@333eco/corpus 2.5.27 → 2.5.29

package/dist/corpus.json

@@ -1,21 +1,56 @@
 {
-  "package_version": "2.5.27",
+  "package_version": "2.5.29",
   "generated_from": [
     "H3/publications",
     "TH/publications",
     "missaquarius.org"
   ],
-  "document_count": 151,
+  "document_count": 152,
   "licences": {
-    "CC0-1.0": 143,
+    "CC0-1.0": 144,
     "CC-BY-4.0": 8
   },
   "voices": {
     "founder": 43,
-    "collaborative": 78,
+    "collaborative": 79,
     "institutional": 30
   },
   "documents": [
+    {
+      "slug": "a-promise-that-cannot-grow",
+      "repo": "TH/publications",
+      "genre": "defensive-publications",
+      "path": "defensive-publications/a-promise-that-cannot-grow.md",
+      "title": "A Zero-Centred Bilateral Credit Ledger for Customer Prepayment and Peer-to-Peer Lending in Which No Balance Grows on Its Own — a Size-Blind Reputation Display, and Debt Forgiveness as the Only Crossing into a Gift Ledger",
+      "subtitle": "The Promise, Not the Score — B-Promise℠, a bilateral credit ledger with one balance per pair, a conduct display that cannot see size, and one door into a gift ledger",
+      "authors": "Thon Ly · Miss Aquarius℠",
+      "category": "mechanism",
+      "voice": "collaborative",
+      "metadata_convention": "yaml",
+      "date": "2026-09-28",
+      "status": "draft",
+      "licence": {
+        "id": "CC0-1.0",
+        "url": "https://creativecommons.org/publicdomain/zero/1.0/",
+        "attribution_required": false
+      },
+      "text": "> **Note.** This paper discloses a mechanism that is designed and not built. It publishes the *claim* and withholds the *build specification* (§14 says exactly what is withheld and why). Almost every leg of the mechanism was already public before this paper, and §2 reports the two prior-art passes that established it, including the conjuncts they killed. What is claimed in §15 is a composition and two narrow sub-rules, and nothing wider.\n>\n> **Revision of 28 September 2026.** The first version of this paper recorded each promise as a separate record. The design as now ruled keeps **one running balance per pair of people**, crossing zero, so that prepayment and credit are one balance seen from either side of zero (§4.1). The per-promise design is retained as a disclosed variant (§5.5, §6.7). The same revision narrowed the claims after an outside review: the inclusion-proof sub-rule and the total-owed band are now disclosed and not claimed (§2.7, §15).\n>\n> Companion works: *The Zero-Point Game℠* (the signed-balance ledger of which the promise ledger is a third instance, §6.4) · *The Currency That Cannot Be Spent Alone* (the institution's gift-side redemption rules) · *The B-Tag and the Post-Payment Economy* (the gift-side scan this paper must not collide with) · *Provenance-Carrying Retrieval* and *The Assembly That Holds the Brake* (signed tree heads compared among independent observers) · *HeartBank's Position on Community-Currency Design*.\n\n---\n\n## Preamble\n\n*Grounding — canon, cited.* The Aṅguttara Nikāya records a short teaching to the householder Anāthapiṇḍika on four kinds of happiness available to a lay person: the happiness of ownership, of using wealth, of debtlessness, and of blamelessness (AN 4.62, the *Ānaṇya Sutta*; the Pāli term is *ānaṇya-sukha*). Of the third it says only this: *\"It's when a gentleman owes no debt, large or small, to anyone. When he reflects on this, he's filled with pleasure and happiness.\"* The discourse does not condemn borrowing. It names a happiness that belongs to having repaid, and it places that happiness below blamelessness, which it says the others are not worth a sixteenth part of.\n\n*Lens — the institution's reading, not canon.* This paper builds a ledger whose only purpose is to let two people who already trust each other a little make a promise that can be kept, and to let the keeping be seen. Repaying, in the institution's reading, is truthfulness (*sacca*) and the happiness AN 4.62 names; it is not generosity (*dāna*), and the mechanism below is built so that repayment can never be mistaken for a gift. The one act in this ledger the institution reads as a gift is a creditor's free release of what is owed. **That reading is ours.** A search of the Pāli canon for the second pass of this paper's census did not find forgiving a debt described as *dāna*, and we do not claim the canon says it.\n\n*Cross-tradition neighbour [X].* The nearest canonical statement of that reading is not Buddhist. The Qur'an, 2:280: *\"If it is difficult for someone to repay a debt, postpone it until a time of ease. And if you waive it as an act of charity, it will be better for you, if only you knew\"* (trans. Mustafa Khattab). And the sharpest warning about a calendar of forgiveness is in the Hebrew Bible and the Mishnah (§7.5).\n\n**Delete this preamble and every claim below stands unchanged.** The mechanism does not depend on any of these texts. They are recorded because they describe, more precisely than we could, the two things the mechanism keeps apart.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document is published to establish prior art and to place the described mechanism irrevocably in the public domain under CC0 1.0 Universal.\n\n**The authors will not seek patent protection on any mechanism disclosed here, and commit not to assert any patent right against any party practising it.** This commitment is stated rather than implied, is permanent, and is not conditioned on reciprocity, attribution, or field of use. It extends to every mechanism disclosed in this paper, claimed or not, in any combination, including the disclosed variants, and to every implementation of it. Trademark rights on specific marks (**B-Promise℠**, **HeartBank®**, **Miss Aquarius℠**, **Zero-Point Game℠**) are separately reserved; the dedication concerns the mechanism, not the marks.\n\n**What is claimed as contribution is narrow, and it is stated first because three census passes and an outside review found almost all of the mechanism already public.** A running balance between two people that can sit on either side of zero is public (peer-to-peer trust lines in 2004, mutual-credit systems since 1983, and an academic formalism of March 2026). A bilateral IOU signed by both parties is public (a Korean product did it in 2017). A fixed markup that is never increased is classical law, and a note for a fixed amount of money is ordinary commercial law. One primitive serving both prepayment for goods and lending is public (the same paper of March 2026). Debt forgiveness as charity is scripture. Static versus dynamic payment codes are a payments standard, and a charge with a due date carried only by a dynamic code is a national payment system's rule. Social key recovery by guardians is public, and at least one live patent discloses trustee-vouched recovery; a cancellable delay is public (Argent) and appears in a published application whose grant is unverified. An interest-free bilateral balance is a configurable option of a public trust-line network, a two-user tab the sender may \"forgive\" is in a 2011 patent application, and growing a loan only after the last one is repaid is standard microfinance practice (progressive lending). Anchoring an append-only transparency log to Bitcoin is an Internet-Draft, and a signed object that carries its own proof of inclusion in a transparency log is an RFC. **None of those legs is claimed.** §2 reports all three passes and the review's additions: aperture, dates, every conjunct killed or narrowed with the prior art cited, what was not run, and the survivor. §15 enumerates only the survivors.\n\n**Live patents.** The census recorded several granted patents in the neighbourhood, shown as active in Google Patents' status fields on the census date (not a legal status determination). §2.5 records what each **discloses**. We make no statement about the scope of any patent's claims or whether any design falls within them, and a publication dated after a patent's priority date does nothing to that patent.\n\n**Date and evidence.** First published 28 September 2026 and revised on 28 and 29 September 2026. The text is committed to the public GitHub mirror of the corpus, and the corpus's standing chain anchors each revision to the Bitcoin blockchain through OpenTimestamps and signs it under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified; a Zenodo version and the served index at corpus.333.eco carry its digest once deposited. A timestamp proves this exact text existed no later than its date, and nothing about authorship, originality or the validity of any claim. **Whether the composition claimed in §15 is non-obvious is an examiner's determination this publication exists to inform.** A defensive publication is not examined before it is published; the census in §2 and one outside review are the only examination it has had.\n\n---\n\n## Abstract\n\nWe disclose a **zero-centred bilateral credit ledger for customer prepayment and peer-to-peer lending in which no balance grows on its own.** Two people keep **one running balance** between them, which can sit on either side of zero: when it is on one side, the first owes the second (a prepayment the vendor has not yet delivered, or a loan); when it is on the other side, the second owes the first. **The balance never moves by time.** It changes only by an entry both parties sign when cash or goods change hands, its discount fixed on that entry; by a repayment both parties sign; or by a release that the party who is owed may always make alone. There is no accrual, no compounding and no late penalty. The ledger is therefore **non-accruing but not interest-free**: a discount agreed when value moves is a premium, it is on the record, and at short terms it can be very large (§4.3). The balance is kept on the two parties' phones, signed by both, denominated in one currency fixed when it opens, and **non-transferable**: it can never be sold or assigned. Its coined name is **B-Promise℠**.\n\nThe mechanism serves two ordinary deals with one balance. In **customer prepayment**, a customer pays a vendor $9 in cash now and the vendor owes $10 of goods; the customer is the lender and is repaid in kind, and the discount comes out of the vendor's retail margin. In **peer-to-peer lending**, a lender gives $9 now and the borrower owes $10 by a deadline the borrower proposes. When the customer later takes more goods than were prepaid, the same balance crosses zero and the customer owes the vendor; nothing new is opened. Value moves first, face to face; **the entry is the receipt**.\n\nConduct is shown by a **reputation display that takes no amount argument**: one equal-width segment for each person the party currently owes, a gap where that balance is owed past its deadline, a segment that dissolves when the balance returns to zero, shown only where a new promise is being made and never on a profile. It has no colour. A line of text under it carries exact counts and, as a disclosed but unclaimed feature, a coarse band of the total the person owes. The one event that crosses from this exchange ledger into the separate gift ledger the institution already runs is a **creditor's free release of the whole balance owed by that person** (debt forgiveness), at most once per pair per annual season, entering as a gift that awaits the debtor's thanks; repayment never crosses.\n\nTwo narrow sub-rules complete the claim: a code that carries no signed terms can never open an obligation, and no one who has a nonzero balance with a person may vouch for that person's new signing key. We report two prior-art passes and an outside review that killed or narrowed every conjunct at mechanism width, claim only the composition that survived, state the harms the mechanism does **not** prevent — above all that a person's total debt can still grow by rollover — and register in advance a test of whether an annual invitation to forgive debts freezes December lending.\n\n---\n\n## 1 · The problem, and what this paper is for\n\nThe institution that publishes this paper builds reciprocity infrastructure: a ledger of gratitude that sits above regulated payment rails and never becomes a bank. Its gift side is in production; this paper describes its **exchange side**, the part that records what people owe each other when they are not giving but dealing. The two sides are built to stay apart, and the paper exists largely to say where the one door between them is.\n\nThe setting is Cambodia, the institution's beachhead, and it shapes every rule below. Most households shop daily and locally: few have refrigerators, many travel by motorbike within a village, food is the commonest vendor type, and vendors restock every day to keep produce fresh. Two informal credit practices follow directly. Regular customers buy ahead from the stalls they use, and vendors borrow small sums from each other to restock. Both run on paper notebooks and memory, and in both the notebook keeps one running tab per person, not one page per loan. Both are ordinary; neither needs to be invented.\n\nWhat the institution adds is narrow, and it is a response to a specific harm. Formal microcredit in Cambodia has been documented as a debt trap. Human Rights Watch's report *Debt Traps* (24 September 2025) documents coerced land sales, over-indebtedness and debt-driven suicides among borrowers in the northeastern provinces, and lenders accepting informal land documents as collateral. A LICADHO and Equitable Cambodia survey of 717 households in Kampong Speu province, reported by Voice of America in 2023, found that the share of microloans taken to repay other loans rose from 3.45% in 2012 to 34.8% in 2022. The National Bank of Cambodia has capped microfinance interest at 18% a year since 2017. The harms are compounding, penalties, collateral, and loans taken to repay loans. **This paper's mechanism removes accrual, monetary late penalties and collateral from each record, and does not remove the fourth harm**, and §17 says so first.\n\nTwo of those harms are the two conditions under which debt becomes bondage: a balance that grows faster than it can be paid, and a debt secured on a person's labour, land or body. International law classes debt bondage among the practices similar to slavery (the UN *Supplementary Convention on the Abolition of Slavery, the Slave Trade, and Institutions and Practices Similar to Slavery*, Geneva, 1956, Article 1), and it persists in Cambodia: LICADHO's *Built on Slavery* (December 2016) documented it in the country's brick factories, and its *Bound by Bricks* (November 2023) called those workers' debts to factory owners *\"textbook examples of criminal debt bondage.\"* A balance that never moves by time and a record that takes no collateral refuse exactly those two conditions. The paper does not claim that all compounding debt is bondage — an ordinary amortising loan is not — only that the two properties close the two doors through which debt becomes it.\n\nThe design question, stated as a negative:\n\n> **No balance on this ledger ever moves by time. It moves only when value moves between the two people, when one repays the other, or when the one who is owed lets some of it go.**\n\nEverything below either serves that sentence or states where it stops.\n\n**Why it is the institution's problem and not only a product.** The institution's gift ledger (the Zero-Point Game℠ and its public display, the B-Aura) is designed as the structural inverse of a credit score: a waveform that is forgiven and re-earned, not a scalar that persists and compounds. A credit instrument built by the same institution is a direct threat to that inversion. If repayment could raise a person's gift-side display, money could buy the appearance of kindness (borrow and repay), lenders would acquire a stake in the annual forgiveness that resets the gift ledger, and a person too poor to borrow would appear less kind. The founder asked whether creditworthiness and kindness should share one display; the ruling was **no**, and this paper is in large part the specification of that no (§6.4, §7). Its human title says the same thing: the promise, not the score.\n\n**What this paper does not do.** It does not describe a bank, a lender, or a custodian: the ledger records what people owe each other and moves no money; value moves in cash, face to face, and in a later phase through wallets the institution never holds keys to. It does not claim to make credit safe (§11). It does not claim usury protection (§4.3). The institution's autonomous agent has no role in the mechanism as disclosed; whether it acquires one is not decided here.\n\n---\n\n## 2 · Background and prior art: the census\n\nThe claims in §15 were drafted from the survivors of a prior-art census and then narrowed further by an outside review; nothing was widened after either. The census ran as two passes on 28 September 2026. **Each pass's conjuncts, predictions, known-prior-art control and declared aperture were committed and pushed to a public repository before its first query ran.** Both pre-registrations are published verbatim and never edited:\n\n> **Public pre-registration (pass 1):** `74b8a87` in `thonly/publications`, timestamps/census/b-promise-prereg.md, pushed 2026-09-28 13:05 PDT — publicly inspectable, before the first query.\n>\n> **Public pre-registration (pass 2):** `945da0d` in `thonly/publications`, timestamps/census/b-promise-pass2-prereg.md, pushed 2026-09-28 13:46 PDT.\n\nPrivate copies were pushed the same minutes (`bad927c`, `4458912`). Anyone can check the ordering of the public commits against the host's push record.\n\n**The census searched the per-promise form of the design** (one record per promise, §5.5). The design was re-ruled the same evening to one balance per pair (§4.1). The balance around zero is common ground and is cited, not claimed (§2.6); the claims of §15 apply the surviving conjuncts to that balance. Whether the restated composition survives a search framed in the balance form is one of the questions the owed third pass carries (§2.7).\n\n### 2.1 · The conjuncts, as pre-registered\n\nThe claim was split, before searching, into seven conjuncts:\n\n| | Conjunct |\n|---|---|\n| (a) | one primitive — value now for a fixed larger claim later — recorded as a bilateral, both-signed promise ledger serving both customer prepayment to a vendor and person-to-person lending |\n| (b) | a promise that can never grow on its own: premium fixed at origination, no accrual, no compounding, no late penalty, the balance changes only by an entry both parties sign |\n| (c) | a conduct display with no amount input: one equal-width segment per open promise the person owes, transparent when overdue, dissolving when kept, saturating, size-blind, shown only where a promise is being made, with viewer-relative trust computed on the viewer's device |\n| (d) | the forgiveness crossing: a creditor's free release of a claim is the only event that passes from the exchange ledger into a separate gift ledger (repayment never does) |\n| (e) | printed or static codes always resolve to the gift side; an obligation opens only from a live on-screen code carrying its terms, binding nothing until both parties sign |\n| (f) | identity recovery by face-to-face vouching of counterparties with settled promises (or one pre-named guardian), a cancellable waiting period, no voucher who has an open promise with the user, debts carrying over |\n| (g) | history committed as salted per-person hash chains to a Certificate-Transparency-shaped append-only log anchored to Bitcoin (OpenTimestamps) and RFC 3161 authorities, with gossiped tree heads and inclusion proofs inside a self-contained signed code |\n\n### 2.2 · Pass 1: aperture, control, verdicts\n\n**Aperture, declared before searching:** the commercial web (credit, buy-now-pay-later, IOU and merchant-ledger apps); non-commercial sources (rotating credit, informal village-shop credit, Islamic interest-free finance, jubilee and debt-forgiveness charities, community currencies); Google Patents full text including published applications, with a citation walk from the nearest hit; academic indexes; standards (IETF RFC 6962 and 9162, W3C WebAuthn, EMVCo QR); the Technical Disclosure Commons. English searched; three Khmer web queries attempted; Chinese, Japanese and Korean through patent translations only. **68 queries**, run by three research agents, logged in the institution's session record; the main session re-verified every row that reached the result.\n\n**Control.** The pass had to find the ledger half of (a) at mechanism width — Ryan Fugger's RipplePay (a peer-to-peer IOU network on trust lines, 2004–05) and the digital *khata* merchant-credit apps of India (OkCredit, 2017; Khatabook, 2018). It found all three, so the instrument could see prior art that was there.\n\n| Conjunct | Predicted | Found (earliest first) | Verdict |\n|---|---|---|---|\n| (a) | kills or narrows | the prepayment half: *bay' salam* in Islamic commercial law (the full price paid now for goods delivered later, customarily below the spot price) and bonus store credit; the lending half: IOU apps approved by both parties (DueTrace, press release 30 August 2026; two others unverified), Trustlines; Sarafu community vouchers | **narrowed** at mechanism; both halves as one primitive not found *in this pass* (killed in pass 2) |\n| (b) | narrows | *murabaha* (a fixed markup never increased, though late charges paid to charity are permitted) · *qard hasan* (a benevolent loan with no premium) · Sardex (a zero-interest business mutual-credit circuit, Sardinia, 2009) · DueTrace (a balance that moves only on an approved entry) · *added by the outside review:* the negotiable instrument \"for a fixed amount of money, with or without interest\" (Uniform Commercial Code §3-104(a)) | **narrowed**; a fixed premium with no late penalty and co-signed-only change, together, not found |\n| (c) | narrows | credit-bureau payment-history grids (per-month on-time and late marks) · EigenTrust (Kamvar, Schlosser and Garcia-Molina, WWW 2003) and Advogato's viewer-seeded, Sybil-resistant local trust metric · a live PayPal patent disclosing a trust score from the timing of peer-to-peer transfers and loan repayments with an interactive display (§2.5) · a published application disclosing a circular credibility graphic (unverified) · *added by the outside review:* eBay's feedback (one mark per transaction, regardless of price — a size-blind conduct display at mechanism) | **narrowed**; a display with no amount argument, drawn from obligations owed only, shown only at the moment of a new promise, not found (HCI literature not run in this pass) |\n| (d) | narrows | Qur'an 2:280 (waiving a debt as charity; repayment as owed) · gift-tax treatment of forgiven family loans · Undue Medical Debt (founded 2014) buying and abolishing medical debt · an offline IOU app that records forgiveness as its own record type | **narrowed, strongly** — the doctrine is common ground and is cited, never argued against; *the only crossing between two ledgers* not found |\n| (e) | narrows | EMVCo's merchant-presented QR specification, whose point-of-initiation field distinguishes static (`11`) from dynamic (`12`) codes · the Cambodian KHQR static and dynamic codes · India's withdrawal of person-to-person \"collect requests\" on its UPI network, leaving push-only payments as a fraud guard · *added by the outside review:* Brazil's Pix Cobrança, in which a charge with a due date exists only as a dynamic code · static donation and tip codes, which only ever resolve to a gift | **contrast** — in payments both code types settle value; here a code without signed terms can never create an obligation; the rule not found, and the nearest neighbours narrow the pairing |\n| (f) | narrows | Buterin, *Why we need wide adoption of social recovery wallets* (11 January 2021) · Argent (human guardians, a 48-hour cancellable security period, the owner notified) · Apple's recovery contacts · Candide · a live Microsoft patent disclosing trustees who vouch in person or by phone, with others notified (§2.5) · a published application disclosing a cancellable monitoring period (grant unverified) | **narrowed**; vouchers drawn from settled counterparties, the exclusion of anyone with an open obligation, and debts carrying over, not found |\n| (g) | kills | RFC 6962 (2013) and RFC 9162 · WhatsApp's key transparency (a per-account auditable directory, April 2023) · *draft-fassbender-scitt-time-anchor* (a transparency service anchored to Bitcoin through OpenTimestamps; revision -05, August 2026) · open-source OpenTimestamps and RFC 3161 stamping of signed tree heads · *added by the outside review:* RFC 9943 (SCITT, June 2026), in which a signed statement carries its registration receipt, with its inclusion proof, in the statement's unprotected header · the sigstore bundle format, which staples a transparency-log inclusion proof to the signed artefact for offline verification · Keybase's per-user signature chains, committed to a global Merkle tree whose root was published to Bitcoin from June 2014 | **killed** at mechanism, including an inclusion proof carried inside the signed object; only its application to a bilateral co-signed promise is left, and it is no longer claimed (§2.7) |\n| all | not found | nothing combining (a)–(g) | **not found at this depth** |\n\n**Failed re-verification, not used.** Two leads did not survive the main session's check and appear nowhere in this paper's argument: a claim that Cambodian law once capped interest at the principal (the cited article does not say it) and a 2023 study of village-shop credit (the page returned 403 and was not read).\n\n**Pass 1 was declared *full* and executed partly.** Not run: Google Scholar, SSRN and ACM directly; the HCI visualisation literature; Japanese and Korean; Khmer in any meaningful sense (three queries, a US-only index); IP.com; Google Patents' native full-text interface (reached only through `site:` queries); citation walks except one; LETS, buy-now-pay-later and jubilee sources individually. That list is why pass 2 ran.\n\n### 2.3 · Pass 2: aperture, control, verdicts\n\n**Aperture, declared before searching:** the OpenAlex scholarly index, the arXiv API, Semantic Scholar where reachable, ACM and CHI through the web; Google Patents' native query endpoint, with one-step citation walks from the nearest hits; Japanese and Korean patent and web queries; LETS, buy-now-pay-later and jubilee sources individually; Khmer again at web level. About **90 queries**, including Sefaria and SuttaCentral for the scriptural rows.\n\n**Control.** The academic credit-network literature had to be found through the academic index used: *Liquidity in Credit Networks* (Dandekar, Goel, Govindan and Post, EC 2011) and *Mechanism Design on Trust Networks* (WINE 2007). Both were found. **The control also caught a fault:** the first arXiv batch, sent over `http://`, returned empty redirects that looked like null results; it was discarded and rerun.\n\n| Prediction | Predicted | Found | Verdict |\n|---|---|---|---|\n| (a)/(b) in the academic credit-network literature | narrows; one primitive for both not found | **Ehud Shapiro, *Grassroots Bonds as a Foundation for Market Liquidity*, arXiv 2603.13671 (v1, 14 March 2026).** A grassroots coin is its issuer's promise, redeemable against the issuer's own goods and services (the prepayment half), and liquidity arises from mutual credit formed by exchanging coins among issuers; grassroots bonds add maturity dates so that credit can be extended, and a loan is expressed as the lender taking the borrower's bonds maturing at a date for fewer coins now (value now for a fixed larger claim later); one smartphone formalism, with a village-market scenario; swaps need both parties' consent. Differences: its coins and bonds are fungible, transferable and sellable (the paper expresses the sale of debt), and chain-redeemable; it has no rule that a balance cannot move by time alone, no conduct display, no gift ledger | **(a) killed at mechanism.** One primitive for prepayment and lending is public. (b) narrowed |\n| (c) in HCI and visualisation | narrows | studies of lending among friends and family (CHI 2019, *Follow the Money*; an RMIT 2016 brief; *Social Forces* 98(2)) — every ledger found displays amounts | **not found** for the display (CHI and ICTD proceedings not searched directly) |\n| (d) in academic, jubilee and LETS sources | narrows | **Rolling Jubilee** (Strike Debt, November 2012) crowdfunded the purchase of debt at a discount and abolished it, notifying debtors by mail — a buyer of the debt, not its original creditor, and no ledger · Deuteronomy 15:1–2 (a mandated seventh-year remission) · **the prosbul, Mishnah Sheviit 10:3**: mandated remission made people stop lending (evidence *for* voluntary release, §7.5) · LETS write-offs are socialised across the community · AN 4.62 and AN 6.45 confirmed; forgiving a debt as *dāna* **not found in canon** | **narrowed** the framing; release as the only crossing into a separate gift ledger **not found** |\n| (f′) in academic social-recovery work | not found | Schechter, Egelman and Reeder, CHI 2009 (trustee-based social authentication) · trustee attack models (IEEE TIFS) · a 2026 systematisation of recovery schemes, arXiv 2608.07104 (its comparison matrix not read) | **not found**: excluding a voucher because of an open obligation to the person recovering |\n| native patents | more enclosed-adjacent patents | a CME Group family on a *bilateral assertion model and ledger* (institutional) · a Blockmason credit-protocol application (2017, unverified) · an *IOU currency platform* application (title only) · a 2014 application on peer-to-peer lending through a mobile wallet (unopened) · debt forgiveness combined with a gift or reputation ledger: **0** results in Google Patents and FreePatentsOnline · a static-gift, dynamic-obligation QR rule: **0** | co-signed bilateral entries **narrowed**; forward citation walks **not run** (blocked) |\n| Japanese and Korean | narrows (a) | **Doorian Docs** (Korea; KTNET with GiveTech; announced 29 December 2016, launched 16 January 2017) — an electronic IOU concluded by the mutual electronic signatures of both parties and stored as a legal record · a second Korean IOU app · a Japanese e-signed loan-contract service with reminders (2021) · a Japanese friend-approved lending ledger · debt waiver combined with donation: **0** in Japanese and Korean | **narrowed** — the co-signed peer-to-peer IOU is common ground; native Japanese and Korean patent-office queries **not run** |\n| LETS and buy-now-pay-later individually | narrows (b)(c) | Community Forge's *signatures* module (a transaction pending until its named signatories sign) · LETS: interest-free, balances public · Klarna, Afterpay and Atome charge late fees; **Affirm charges none** (a third-party lender) · Cambodian buy-now-pay-later not found | co-signing, no interest and no late fee each **narrowed**; the composition untouched |\n\n**Probe failures, disclosed.** Semantic Scholar rate-limited seven of nine queries. Google Patents blocked after about ten native queries; seven further patent queries had syntax errors and did not run. The Blockmason application could not be re-verified (the server returned 503) and is a lead only.\n\n**Not run in pass 2:** Google Patents forward citation walks and native Japanese and Korean patent-office queries; the seven malformed queries; most Semantic Scholar queries; CHI and ICTD proceedings directly; the systematisation's recovery matrix; Khmer in substance; books and non-English scholarship. **A third pass is owed** when the patent index can be reached, and it carries the conjuncts added after ruling (§2.7).\n\n### 2.4 · What the census and the review changed in this paper\n\nThe census killed the thesis the founder's own description led with — *one deal for both prepayment and lending* — and it killed it with a paper six months old. That is disclosed as part of the mechanism in §4 and claimed nowhere. It killed the transparency-log leg outright, and the outside review then killed the one piece of it the first version still claimed: a signed object that carries its own inclusion proof is an RFC and a widely used software-signing format. It showed that the co-signed IOU is a nine-year-old consumer product. And it found the nearest neighbours of the prepayment half and of the forgiveness crossing in **religious law, not commerce** — *bay' salam* and Qur'an 2:280 — which is where a practice lives when it is old enough not to be sold.\n\nWhat survived is what the institution needed the ledger *for*: a balance that cannot move by time, a display that cannot see size, and one door between exchange and gift.\n\n**The survivor, in one sentence, as the census stated it for the per-promise form:** *a both-signed bilateral promise ledger in which no promise can change except by an entry both parties sign, conduct is drawn with no amount argument as one segment per open promise owed, and a creditor's free release of the whole remaining balance is the only event that crosses into a separate gift ledger* — plus the sub-rules (e′) a code without signed terms can never open an obligation, and (f′) no one with an open obligation with you may vouch for your new key. The census's third sub-rule, (g′) — the inclusion proof travels inside the co-signed promise code — was killed by the review and is disclosed, not claimed.\n\n**Not found means not found in the apertures above on 28 September 2026. It never means new.** A composition of several narrow conjuncts is cheap not to find, because nobody writes that exact sentence; we said so before searching.\n\n### 2.5 · Live patents in the neighbourhood (disclosure only)\n\n| Document | What it discloses | Dates recorded at the census |\n|---|---|---|\n| US 10,200,394 B2 (PayPal) | a trust score computed from the timing of peer-to-peer transfers and loan repayments, with an interactive display (a transaction map whose icons show a transfer's amount on selection) | priority 2015-12-30; shown active to 2037-02-10 (re-verified by the main session) |\n| US 10,949,837 B1 and family (Wells Fargo) | wallet-to-wallet peer-to-peer lending | shown active to about 2037 (recorded by the census; not re-fetched for this paper) |\n| US 8,856,879 B2 (Microsoft) | account recovery in which trustees vouch for the user in person or by phone, with others notified; no waiting period found in its text | priority 2009-05-14; shown active to about 2032-01-19 (re-verified by the main session and by the outside review) |\n| US 2017/0295023 A1 and family (CME Group) | a bilateral assertion model and ledger between institutional counterparties | family expiry recorded as about 2036–37 |\n| US 2020/0119916 A1 | a cancellable monitoring period in account recovery | grant status unverified |\n\nThese are recorded so that a reader practising a repayment-timed trust display, wallet-to-wallet lending, or trustee-vouched recovery knows to look. **We make no statement about the scope of any patent's claims.**\n\n### 2.6 · The balance around zero is common ground\n\nThe re-ruled design keeps one balance per pair that crosses zero. That form is **not** this paper's contribution, and it is cited here so that no reader takes it for one:\n\n- **Peer-to-peer trust lines.** Ryan Fugger's RipplePay (2004–05) recorded, for each pair of people who trusted each other, a balance that could run in either direction up to a limit each had set.\n- **Mutual credit.** Local Exchange Trading Systems (from 1983) keep a member's balance that begins at zero and goes positive or negative as the member sells or buys; Sardex does the same between businesses.\n- **Grassroots mutual credit.** Shapiro's grassroots coins (§2.3) form liquidity from mutual credit created when two issuers exchange coins, each then holding the other's promise.\n\nWhat the design adds is a set of **refusals** on that balance: it may not move by time, may not be sold, may not be shown by size, may not be opened by a code without signed terms, may not be vouched for by a counterparty with a nonzero balance, and may not cross into the gift ledger by anything but a free release. §15 claims the composition of those refusals and nothing about the balance itself.\n\n### 2.7 · Disclosed, and what the third pass decided\n\nFive things were disclosed after the first two passes. The third pass (§2.8) searched the first four and the balance form; its outcome sets which are claimed:\n\n| Item | Where disclosed | After the third pass |\n|---|---|---|\n| **(h)** the balance is non-transferable | §4.5 | narrowed (non-transferable credentials and \"non-transferable relationships\" are public); **disclosed, not claimed** |\n| **(i)** goods and cash convert into each other only by an entry both sign, at face value | §4.4 | narrowed (settlement \"in whatever the two users agree upon\" is public); **disclosed, not claimed** |\n| the fact line's **total-owed band** and the comparison ***\"larger than any they've kept\"*** | §6.3 | narrowed heavily (progressive lending; banded lender views); the amount-free composition survives → **claim 4** |\n| **(g′)** the inclusion proof travels inside the co-signed code | §12 | killed at mechanism by the outside review (RFC 9943, sigstore bundles, Keybase); **disclosed, not claimed** |\n| the one-balance-per-pair form of the claims as a whole | §4.1, §15 | narrowed heavily (an interest-free trust line is a network setting; a 2011 two-user tab with \"forgive\"); the entry grammar survives → **claim 1(a)** as worded |\n\n### 2.8 · Pass 3: aperture, control, verdicts\n\n**Pre-registered 2026-09-29 05:15 PDT, before any query.** *Public pre-registration:* `3d929ac` in `thonly/publications`, `timestamps/census/b-promise-pass3-prereg.md`. **Aperture:** FreePatentsOnline full text (US patents and applications; its EP/WO/JP flags were accepted, but no non-US document surfaced, so non-US coverage is unconfirmed) · arXiv · the general web · Technical Disclosure Commons. **Not run:** Google Patents (unavailable, HTTP 503, throughout — so no forward citation walks and no native Japanese or Korean office queries), OpenAlex search (paused by the provider), Semantic Scholar, Khmer sources, and six patent queries that never loaded. **Control:** found — bilaterally confirmed debt and credit entries between users (US 2019/0147431, filed 2017), an accepted-IOU invitation (US 2009/0327010), and the academic credit-network literature.\n\n| Conjunct | Verdict | Nearest prior art |\n|---|---|---|\n| **(h)** non-transferable balance | narrows | Ohlhaver, Weyl and Buterin, *Decentralized Society* (SSRN, 2022): uncollateralised lending resting on \"persistent, non-transferable relationships\", with non-transferable tokens as credentials; no debt record designed with no entry type for transfer was found |\n| **(i)** goods ↔ money only by co-signed entry at face value | narrows | a trust-line network's settlement in \"cash, services, goods… whatever the two users agree upon\"; store credit cashed out by issuer policy or statute; no face-value co-signed conversion rule was found |\n| **(j)** one balance per pair, never moved by time | **narrows heavily** | the Trustlines Network: a bilateral balance either side of zero, in currency networks that may set interest network-wide, per user, **or prohibit it entirely**; US 2011/0276479: a two-user \"tab\" the sender may, after some days, \"forgive\" — which stops reminders; bilaterally confirmed entries (US 2019/0147431) |\n| **(k)** the origination fact line | **narrows heavily** | progressive lending in microfinance, where loan size grows only after full repayment of the last loan (Kumar, *SAGE Open* 2012; Cecchi, *Review of Development Economics* 2021); peer-lending listings showing lenders income in bands and a count of prior loans; a coarse \"financial responsibility\" indicator disclosed to others (US 10,803,513) |\n\n**What survives.** For (j), the **entry grammar**: every increase is signed by both parties, the only single-signature entry is the holder's release, which cancels, and the ledger has **no entry type** by which time changes a balance — a property of the record, where the nearest neighbour offers it as a network setting and lets a payer send alone. For (k), only the **amount-free composition**: a coarse band of the promisor's total owed together with the larger-than-kept flag, shown to a peer only at the moment a new promise is made; the larger-than-largest-repaid test itself is established lending policy and is cited, not claimed. (h) and (i) survive only in their specific wording and stay disclosed. *Not found means not found in this aperture on this date.*\n\n---\n\n## 3 · The system model\n\n### 3.1 · Parties and objects\n\n- **Pair** — two people who deal with each other. Everything in this ledger is kept per pair.\n- **Promise balance** — the one running balance between a pair, held identically on both parties' devices and signed by both. It sits on one side of zero or the other, or at zero. It is denominated in one currency, fixed when the balance first opens (§4.4).\n- **Debtor** (or promisor) and **holder** — at any moment, the party the balance says owes, and the party it says is owed. The roles follow the sign: when the balance crosses zero, they swap. In prepayment, the vendor is the debtor until the customer has taken all that was prepaid; in lending, the borrower is.\n- **Entry** — any change to a promise balance, or to its deadline. Every entry is signed by both parties except a release, which the holder signs alone (§5.2).\n- **Promise code** — the self-contained, signed, machine-readable form of an entry and the balance it leaves: screenshot-able and verifiable anywhere without contacting the institution, with its log proof attached once the log has one (§12).\n- **Promise ring** — the conduct display (§6). It has no mark and no shorthand; the corpus calls it the promise ring in full.\n- **Fact line** — the line of text beneath the ring, carrying counts and the only amount-derived information shown (§6.3).\n- **The log** — an append-only public Merkle log that receives only per-person chain heads (§12).\n- **The gift ledger** — the institution's existing, separate signed-balance ledger of kindness and gratitude (the Zero-Point Game℠), with its public display (the B-Aura). This paper adds no entry type to it except one (§7).\n\nIn this paper *a promise* means what one person owes another at a moment: the debtor's side of a promise balance. \"Keeping a promise\" means bringing that balance back to zero.\n\n### 3.2 · What the institution holds\n\nNothing that settles. In the first phase the ledger records what the parties owe each other over cash they hand each other; in a later phase value moves through self-custodial wallets on a public chain whose keys the institution never holds. The balance rows, amounts and names **never go to the institution or the log**; the log receives salted hashes only. They do pass between devices: a prospective holder's device reads what the debtor's device presents in order to draw the ring and the fact line (§6.3). The institution is a record, never a rail, and never holds the only copy of anything a user needs.\n\n### 3.3 · Terms used for the lexicon\n\nA **pledge** in this institution's lexicon cannot be claimed (the institution's time pledges are soft and unenforceable by design). A **promise** is a claim. The two words are kept apart on every surface.\n\n---\n\n## 4 · The primitive: one balance per pair, crossing zero\n\n### 4.1 · Prepayment and credit are one balance — disclosed, not claimed\n\n*Value now for a fixed larger claim later*, kept as one running balance between two people.\n\n```\n   the promise balance between a customer (C) and a vendor (V), in one currency\n\n      V owes C                                  C owes V\n   (C prepaid; V has not         0          (C took goods on credit;\n    yet delivered)                           C has not yet paid)\n   ◄───────────────────────────────┼───────────────────────────────►\n     +10       +6        +1        0        −3\n      │         │         │                  │\n      │  C takes│  C takes│  C takes $4 of   │\n      │  $4 of  │  $5 of  │  goods: $1 is    │\n      │  goods  │  goods  │  delivered from  │\n      │         │         │  the prepayment, │\n      │         │         │  $3 on credit    │\n   C pays $9 for $10                          the balance has CROSSED ZERO:\n   (the discount is fixed                     the roles swap, the segment\n    on that entry)                            moves to C's ring, and a new\n                                              deadline is proposed by C\n```\n\nThe same balance serves lending: a lender who gives $9 for $10 moves the balance to \"borrower owes $10\"; each repayment moves it back toward zero. If the borrower later lends back to the lender, or buys from the lender's stall, the balance moves through zero and the roles swap. There is no second record and nothing new is opened.\n\nIn prepayment, the discount costs the vendor margin rather than cash: she receives working capital today and repays it in goods at retail, so the $1 is paid out of the difference between what the goods cost her and what they sell for. That is why a vendor can offer it. The general form, which the institution uses to position the mechanism to vendors, is **prepay at a discount**: **every promise on this ledger is bought at or below face value**, and a promise at face value carries no premium at all. The vendor sets the discount, as an offer open to anyone who deals with her; there is no member price, no class of customer named, and no subscription. At a customer's first prepayment the app states once, as a fact, that the customer is paying ahead and the stall owes the customer the amount shown.\n\n**This primitive is not claimed,** and neither is the balance around zero. Shapiro's grassroots bonds (§2.3) express both halves of the deal in one formalism, and trust lines and mutual credit keep a balance that crosses zero (§2.6). What differs is disclosed in §4.4–§4.5 and §5–§7, and what survives is claimed in §15.\n\n### 4.2 · The receipt\n\nValue moves first, face to face, in cash or goods. The entry is written after, and it reads as a receipt:\n\n```\n  ┌────────────────────────────────────────────────────┐\n  │  received  $9          credited  $10               │\n  │  balance   @sokha owes @dara  $10     (was $0)     │\n  │  by        Friday 2 Oct (proposed by @sokha)       │\n  │  currency  USD (fixed when this balance opened)    │\n  │  ── signed by both ── entry #1 ── salt ····        │\n  └────────────────────────────────────────────────────┘\n```\n\nThe discount is on the record, visible to both, at the moment of agreement, and it is fixed on that entry: nothing later changes what that entry added. **The debtor proposes the deadline** and the holder agrees to it; or, if the holder agrees, there is **no deadline**, and a balance with no deadline can never be overdue. The handles in the illustration are invented.\n\n### 4.3 · The premium is interest-shaped, and the paper says so\n\nA $1 premium on $9 for a week is 1/9 ≈ 11.1% a week, which is about 52 × 11.1% ≈ 578% a year simple, and far more if rolled over (§11.1). A fixed premium is not a cheap premium: flat-rate informal lending, including the Philippine \"5-6\" (five borrowed, six repaid), is non-compounding and predatory at once, and nothing in this ledger stops a lender charging a 5-6 premium on every entry. **The ledger claims no usury protection.** It shows the discount on the receipt; it does not cap it, grade it or annualise it. A pre-signing disclosure of an annualised equivalent was proposed and declined in the ruling that settled this design, on the ground that the mechanism does not compound; the objection that non-compounding does not mean cheap is recorded here and in §17, and whether a disclosure is legally owed anyway is a question for legal review before any launch.\n\n### 4.4 · Denominated in money, delivered in goods or cash — disclosed, not claimed\n\nA promise is **denominated** in money and **delivered** in goods or cash, as both parties agree. A balance owed in goods and a balance owed in cash are one balance; either delivery converts into the other **by an entry both parties sign, at face value**: a vendor who owes $10 of goods may agree to pay $10 of cash instead, or the reverse. The conversion is seamless on screen and consensual in the ledger. A holder cannot force a cash repayment of a goods balance, because that would strip the vendor of the margin that paid for the discount.\n\nThe consequence matters for the display. Every open segment is an obligation of its face value, in goods or, by consent, in cash, so the ring's refusal to distinguish goods owed from cash owed is **honest** rather than a simplification. A proposed split of the fact line into goods owed and cash owed was therefore unnecessary and was not adopted.\n\n**Face value implies a denomination, fixed once.** A balance is denominated in one currency when it first opens (\"$10 of goods\"), never in item counts (\"ten bowls of noodles\"). A balance denominated in items would grow in money terms whenever prices rose — a balance growing on its own through a side door. Cambodia is a two-currency economy, dollars and riel. The no-growth property holds in the denominating currency; goods and cash convert at face value in it; and **there is no exchange-rate entry**. A pair that wants to change currency records a release of the balance in the old currency and a new co-signed entry in the new one (§17 records an open question this raises). The holder bears any depreciation of the denominating currency, and the receipt names the currency so that both parties see which one they are bound in.\n\n### 4.5 · Non-transferable — disclosed, not claimed\n\nA promise balance names two parties (handles) and has no entry type that changes either. It can never be sold, assigned, pledged as security or bundled. Recovery (§10) rotates the key that signs for a handle; it is not a balance entry and moves nothing between parties.\n\nThis closes the debt-buyer's harm **on the ledger**: no record ever names a new holder, so a claim cannot be sold on the ledger to a stranger whose only interest in the debtor is collection. It is the sharpest contrast with grassroots bonds, whose debt is sellable by design. It is a property of the record (there is nothing to transfer to), not of the world: nothing stops two people agreeing off the ledger that one will collect for the other, and whether the underlying claim can be assigned at law is a question for legal review, not something the record decides.\n\n### 4.6 · Death and incapacity\n\n**Non-transferable is not non-inheritable.** The ledger never releases a balance automatically when a person dies; an automatic release would take a holding from the holder's family without anyone choosing it.\n\n- **The holder decides in life.** A holder may name a successor — the guardian named for recovery (§10) — or may record *\"release on my death\"*, a release chosen in advance by the holder's own free act. As disclosed here, a named successor acts through the recovery path of §10, which rotates the key for the holder's handle and changes no party on any balance. Succession through recovery is not a transfer: no party on any balance changes, which is why non-transferability holds. **A release recorded in advance to take effect at death is not a crossing into the gift ledger:** the gift ledger records the free acts of the living, and a crossing that took effect at death would turn the aura into an estate-planning incentive.\n- **A debtor's death is recorded, and their ring is never shown again.** Claims against what a person left are governed by the law of the place, not by this ledger; the ledger records what was owed and does nothing further.\n- **Incapacity** is treated as the recovery case of §10 when a guardian exists; otherwise the balance stands, unchanged, as owed.\n\n---\n\n## 5 · The no-growth property\n\n### 5.1 · The property\n\n**The balance never moves by time.** It changes only by one of three things:\n\n1. **New value** — cash or goods change hands, and both parties sign an entry recording it, with the discount fixed on that entry;\n2. **Repayment** — both parties sign; the holder's signature is the debtor's receipt;\n3. **Release** — the holder, alone, may always lower what the holder is owed.\n\nNothing accrues. Nothing compounds. There is no late penalty. A missed deadline's only consequence is a gap in the debtor's ring (§6). Nothing grows **on its own**.\n\nThis is the load-bearing property of the whole design, and it is chosen to be a **property rather than a rule**: the entry grammar has no accrual entry, no penalty entry, no interest-rate field and no time-driven entry of any kind, so there is nothing for an operator, a holder or a later version of the software to switch on. A rule would need someone to refrain from charging late fees at the moment a late payment happens; a property needs no one. The cost is the same fact: a property is harder to revise than a rule. If this choice is wrong, the ledger has to be rebuilt, not amended.\n\n**What the property does not say.** It does not say the balance can never rise. It rises whenever the holder gives the debtor more value, and both sign for it. The first ruling on this design said the opposite for a moment — that nothing, not even both parties together, could raise what is owed — and the final ruling withdrew that, because a running tab between a customer and a stall must be able to take a second prepayment. What is absolute is narrower and firmer: **time alone never moves it, and no one moves it upward alone.**\n\n### 5.2 · The entry grammar\n\n| Entry | Signed by | Effect on the balance | Notes |\n|---|---|---|---|\n| **value** | both | moves it toward the party who received value, by the face value credited *y*, for value received *r*, with 0 < *r* ≤ *y* | written at the moment cash or goods change hands; the discount *y* − *r* is fixed on this entry; may cross zero, which swaps the roles |\n| **repay** | both | moves it toward zero by the amount delivered, at face value | the holder's signature is the debtor's receipt |\n| **convert** | both | none — the delivery form changes, goods ↔ cash, at face value | §4.4 |\n| **date** | both | none — sets, changes or removes the deadline | proposed by whoever currently owes; the holder agrees |\n| **release** | **holder alone** | lowers what the holder is owed | the only one-signature entry; a release of the whole balance is the crossing of §7, subject to its guards |\n| *(accrue)* | — | — | **does not exist** |\n| *(penalty)* | — | — | **does not exist** |\n| *(assign)* | — | — | **does not exist** (§4.5) |\n| *(exchange rate)* | — | — | **does not exist** (§4.4) |\n\n**One entry may do two things.** A customer who owes a stall $5 and hands over $9 for $10 of credit first repays the $5 at face value and then prepays the rest; as disclosed here the entry records both parts, the repayment at face and the new value at the discount the two agree, and the balance ends on the other side of zero. How the two parts are split on one receipt is a detail of the build, withheld (§14).\n\n**The release is unilateral on purpose.** A release is a gift, and a gift the recipient could veto would not be the giver's free act. The holder signs it alone; the debtor's device records it when it next syncs. A release never needs the debtor's consent and can never raise anything.\n\n### 5.3 · Netting within the pair, never across people\n\nBecause each pair keeps one balance, what two people owe each other nets automatically: a vendor who owes a supplier $10 for stock and is owed $4 by the same supplier for lunches has one balance of $6. **Every entry that changes it is signed by both**, so the netting is always something both parties saw.\n\nNetting **never** happens across people. A balance with one person is never set against a balance with another, and no entry type moves an obligation from one pair to another. Moving debt across people is what a clearing system or a debt buyer does, and it is exactly what non-transferability (§4.5) forbids.\n\n### 5.4 · Deadlines on a running balance\n\nThe deadline belongs to the balance, not to an entry. Whoever currently owes proposes it; the other agrees; or both agree there is none. **A balance is overdue when it is still owed past its deadline.** When the balance crosses zero, the roles swap and the deadline is reset: the new debtor proposes one. New value added in the same direction leaves the deadline as it stands unless both sign a new date entry — the conservative default, so that adding value never extends what is already owed. One entry may both repay and prepay (a customer settling what they owe and paying ahead in the same handover); how such an entry is split is part of the withheld specification (§14).\n\n### 5.5 · Disclosed variant: one record per promise\n\n> **Current form.** In the design as now specified, each pair keeps one running promise balance that crosses zero (§4.1), new value may raise it by an entry both sign (§5.1), a release is the holder's unilateral entry (§5.2), and the crossing is a release of the whole balance owed by that person (§7). The per-promise design below is the first version of this paper's mechanism and is retained as a disclosed variant.\n\nIn the variant, every deal opens a separate **promise** record: received *r*, owe *y* ≥ *r*, currency, deadline or none, both signatures. Its grammar is **open** (both; creates the promise) · **repay** (both; decreases) · **convert** (both; goods ↔ cash at face value) · **re-date** (both; changes or removes the deadline) · **partial release** (both; decreases, not a crossing) · **whole release** (both; to zero by the holder's free act, the only crossing); and *accrue*, *penalty* and *assign* do not exist. In that form new value is always a new promise, so an existing promise's amount only ever goes down and every new obligation is its own record. The variant's ring draws one segment per open promise owed (§6.7). It shares the weakness §11.1 describes (a person repaying one promise with another shows a single kept promise at every step), and it adds one of its own: a pair that deals daily accumulates records, and segments, that the running balance nets into one.\n\n---\n\n## 6 · The promise ring: a conduct display with no amount argument\n\n### 6.1 · The render function\n\nThe ring is drawn by a function whose inputs are the people a party currently **owes** (not the people who owe the party), each reduced to one bit of state, and one bit of history:\n\n```\n  ring( owed : list of { current | overdue },   ← one entry per person the party currently OWES\n        new  : yes | no )                        ← \"has this person brought any balance to zero yet?\"\n       → drawing\n\n  • there is NO amount argument.    A $2 balance and a $2,000 balance draw the same segment.\n  • there is NO \"owed to them\".     People who owe the party draw nothing — that is not\n                                    the party's conduct, and drawing it would display wealth.\n  • there is NO colour argument.    Colour belongs to the gift-side display (§6.4).\n  • there is NO age argument.       How long a person has kept promises appears in the\n                                    fact line only (§6.3), never in the ring.\n```\n\nThe absence of an amount argument is the property, in the same way that a pricing function which is given no argument naming the viewer cannot price per viewer: the display cannot reward borrowing more because it cannot see how much was borrowed. A proposal to size each segment in proportion to its amount was declined when the design was ratified, for three reasons: it records the cargo rather than the conduct; it rewards larger borrowing with a more impressive ring; and it feeds the bust-out ladder (§11.2), in which a borrower builds a record on small promises in order to default on a large one.\n\n**One segment per person, not per promise.** Because each pair keeps one balance, the ring counts **creditors**, not deals: a vendor who restocks from the same supplier every morning and owes that supplier a running balance draws one segment, however many entries the balance has. The number of distinct people a person owes at once is also the signal a bust-out leaves, since a bust-out borrows from many holders before it defaults.\n\n### 6.2 · The states\n\n```\n  ◌  thin ring            new: no balance brought to zero yet   (never absent, never dim)\n  ○  solid ring           owes no one                           (the resting state)\n  ◔  one segment          owes one person, on time\n  ◑  two segments         owes two people, on time\n  ◐  segment and a gap    one of those balances is overdue      (transparent: a gap)\n\n  back to zero  ─►  the segment dissolves into the ring; the circle closes\n  crosses zero  ─►  the segment leaves this ring and appears on the OTHER person's ring\n  released      ─►  the segment dissolves NEUTRALLY; neither kept nor broken (§7.3)\n  overdue       ─►  the gap persists until paid, released, or a fixed maximum (§6.5)\n\n       ╭──────╮           ╭──╴ ╶──╮           ╭──╴   ╶╮\n       │      │           │       │           │\n       │      │  → owe  → │ ▓▓ ▓▓ │  → late → │ ▓▓     │  → repaid → ╭──────╮\n       ╰──────╯           ╰───────╯           ╰────────╯             ╰──────╯\n       owes no one        owes two people     one balance overdue    closed again\n```\n\nThe segments are **equal width** and there is no scale: past about five segments a ring stops being readable, and the fact line carries the exact counts. The ring **saturates**: after its first balance brought to zero it looks the same as after many, so it gives no reason to keep borrowing in order to look better. A thin ring marks a person who has not yet brought any balance to zero, and it is never drawn dimmer or smaller than anyone else's; a newcomer is not displayed as a lack.\n\nAn overdue balance is shown as a gap because the debtor incurred a duty before the gap was rendered. That is the one condition under which this institution's surfaces may show non-performance at all: a report of a duty the person took on, never an absence the surface imposes on them.\n\n### 6.3 · The fact line\n\nThe fact line is the only place any number appears, and it is shown **to the prospective holder, at a new promise, and nowhere else**:\n\n```\n  owes 6 people · 1 overdue · kept promises with 2 people you know\n  keeping promises since 2027 · total owed: band C · this promise is larger than any they've kept\n```\n\n- **Counts** — how many people the debtor owes, and how many of those balances are overdue.\n- **Distinct counterparties near the viewer** — computed on the viewer's device from the viewer's own dealings (§11.3); repeated pairs count once and closed cycles count as nearly nothing.\n- **History age** — the year the debtor first brought a balance to zero, as a fact. It is kept out of the ring deliberately: a display that rewards long credit history reproduces the trap in which the young and the newly arrived cannot borrow because they have not borrowed.\n- **Total owed, as a coarse band** — the debtor's total owed across everyone they owe, reduced to one of a few bands. This is the one amount-derived input on the surface, and it is on the fact line, not the ring. The number and boundaries of the bands are not settled.\n- ***\"This promise is larger than any they've kept\"*** — a comparison that discloses no amount: the balance the new entry would leave with this holder, against the largest balance the debtor has ever brought back to zero.\n\nThe last two were added after an adversarial pass showed that a count is not exposure (§11.1). They answer the one-step bust-out and make rollover visible to the next holder; they do not stop either. **Both are disclosed and not claimed** (§2.7).\n\n**Where the fact line comes from.** It is computed on the prospective holder's device from what the debtor's device presents. The entries in the debtor's chain are checkable against the chain head the debtor has logged (§12), so a presented history cannot be edited after the fact; but the fact line is still reported by the party it describes, and what that means is stated in §17.\n\n### 6.4 · Three rings: the promise ring as a third instance of the Zero-Point Game\n\nThe institution's gift ledger is a signed-balance ledger in which every event posts an equal-and-opposite pair, and its public display is a double concentric ring: the Kiitos ring (between people) inside, the Kiitti ring (between a person and the living world) outside, each coloured by the waveform of its balance. A promise balance is also a signed pair — the holder +*B*, the debtor −*B*, summing to zero — and it has the gift ledger's shape at the scale of two people: a balance that aims at zero and fluctuates around it. The founder's ruling places its ring between the two:\n\n```\n                 ╭─────────────────────────────╮\n               ╭─┤  KIITTI  — outer aura ring  ├─╮      colour  (the gift ledger)\n             ╭─┤ ╰─────────────────────────────╯ ├─╮\n             │ │  ╭─ ▓▓ ─ ▓▓ ─   ─ ▓▓ ─╮          │ │    PROMISES — segmented ring\n             │ │  │  ╭─────────────╮   │          │ │    no colour; shape only;\n             │ │  │  │   KIITOS    │   │          │ │    ONLY in promise context\n             │ │  │  │ inner aura  │   │          │ │\n             │ │  │  │  ( avatar ) │   │          │ │    colour  (the gift ledger)\n             │ │  │  ╰─────────────╯   │          │ │\n             │ │  ╰────────────────────╯          │ │\n             ╰─┴──────────────────────────────────┴─╯\n\n  everywhere else:  the avatar carries the two aura rings only (the B-Aura as it is)\n  at a new promise: the promise ring is drawn between them\n```\n\n**Three differences from the other two instances are load-bearing.**\n\n1. **No colour.** In the institution's display grammar, shape carries the brand, motion carries humanness and colour carries the aura. The promise ring is shape only. The credit signal is the shape: no segments, segments on time, a gap, a thin ring for a newcomer. Conduct is read from the shape, exposure from the fact line, and there is never a scalar.\n2. **Context only.** The promise ring is drawn only where a promise is being made. It never appears on a profile, a map, a shop listing or a search result, and the rest of the time the avatar carries the gift-side rings unchanged.\n3. **No calendar reset.** The gift ledger's balances reset to zero every 7 January. A promise balance never does. The holder's claim is the holder's holding, and a holding reaches zero only by its holder's free act — repaid in full, or released. The annual date carries only an **invitation** to forgive (§7.4). The promise ledger aims at zero the way every instance does; it may not be pushed there.\n\n**What *instance* means here, and what it does not.** The promise ledger shares the gift ledger's structure — a signed pair, summing to zero — and sits in its display. It does not share any mechanism that moves value. Nothing on either ledger's display opens, enlarges or closes a balance; the only things that change a balance are the entries of §5.2, and value itself moves between the parties in cash or goods, by their own hands. A holder reads the ring and decides; the ring decides nothing. The one event that passes between the ledgers (§7) is a record of a gift already made, not a transfer the display performs.\n\n### 6.5 · Fading\n\nSettled history fades after a recency window (about twelve months was proposed; the length is not settled), so that a person's past does not follow them forever on the surface. Fading applies to the fact line's settled-history fields — the count of kept counterparties and the history age; whether the first year survives the window is not settled. **The log's record of age never fades; only what the surface shows does.**\n\nAn **overdue** gap persists until the balance is paid or released, or until a fixed maximum tied to the legal limitation period for such debts, whichever comes first; it never persists indefinitely. The maximum is not yet named and depends on legal review. The overdue maximum is applied before the state reaches the ring: the ring itself has no age input (§6.1). **Fading changes the display, never the balance:** a gap that has faded still marks a balance that is owed, and the holder's claim is untouched.\n\n### 6.6 · What the ring cannot see, by construction\n\n| The ring is not given | So it cannot |\n|---|---|\n| any amount | reward borrowing more, or show one large debt as worse than one small one |\n| who owes the party | display wealth, or show a lender as more reputable than a borrower |\n| any colour | be confused with the gift-side aura, or grade anyone |\n| any age | reward a long credit history over a short one |\n| any context but a new promise | appear on a profile, a map or a listing (a rule; see §13 and §17 on screenshots) |\n\n### 6.7 · Disclosed variant: one segment per open promise\n\n> **Current form.** As now specified the ring draws one segment per person the party currently owes (§6.1), a segment moves to the other party's ring when a balance crosses zero (§6.2), and \"kept\" means a balance brought back to zero. The per-promise ring below is retained as a disclosed variant.\n\nIn the variant, the ring draws one equal-width segment for each **open promise** the person owes, a gap for each overdue promise, and a segment that dissolves when its promise is kept; its function takes a list of open promises owed, each *current* or *overdue*, and the same *new* bit. The variant counts obligations rather than creditors: a daily restocking arrangement with one supplier draws a new segment every day it is open.\n\n---\n\n## 7 · The forgiveness crossing\n\n### 7.1 · Why there is exactly one door\n\nThe gift ledger and the promise ledger are separate, and nothing on one side changes the other, with one exception. Merging them was considered and refused for three reasons already given in §1: repayment would buy the appearance of kindness; lenders would acquire a stake in the gift ledger's annual forgiveness; and poverty would render as unkindness. Keeping them wholly separate would miss the one act that is a gift in the plain sense: a holder who could collect and chooses not to.\n\n**A holder's free release of the whole balance owed by a person enters the gift ledger as a kindness by the holder, subject to the guards of §7.2.** Repayment never does, however prompt or complete.\n\n**How it posts.** The gift ledger posts every event as an equal-and-opposite pair. A release enters it as **a gift awaiting thanks**: the holder's side is recorded, and the pair completes — the equal-and-opposite entry posts — only if the debtor chooses to thank the holder. Nothing posts on the debtor's side unless the debtor acts. A forgiven debtor is never recorded as a recipient against their will, and a debtor who does not thank is never shown as having failed to.\n\nIn the other direction nothing crosses at all. Thanks given to a holder never reduces a balance, and a balance can never be repaid in thanks: gratitude may support a person, but it may never settle what that person is owed, or it turns a gift into a payment. The debtor's thanks, if given, completes the gift; it does not repay anything. The door opens one way, and only for a release.\n\n### 7.2 · The guards\n\n| Guard | Why |\n|---|---|\n| only a release of the **whole balance** owed by that person is a crossing | a release of part of a balance — the premium, say — is an ordinary entry; otherwise a holder could forgive the $1 premium and bank a gift while collecting $9 |\n| at most **once per pair of people per season**, a season being the gift ledger's year, 7 January to 7 January | prevents a pair from cycling small balances through release to farm the gift ledger |\n| **nothing** posts on the debtor's side unless the debtor thanks | a forgiven debtor is not displayed as a recipient of charity |\n| the gift-side display never shows **why** it moved | a release is recorded as a crossing, not as the cargo it carried; no one can read from an aura that someone was forgiven, or by whom |\n| the release must be free — neither deceived nor pressured | a release extracted under pressure is not a gift; see §17 on what a signature cannot prove |\n\n**What the first guard does not stop.** A holder who is repaid $9 of a $10 balance and then releases the remaining $1 has released the whole balance then owed, and that is a crossing. The design accepts it: a real remainder given up is a real gift, and the aura records the crossing, not its size, so forgiving $1 of remainder earns the same crossing as forgiving $10. The once-per-pair-per-season cap is what bounds it, and §17 states the cost. This reading — a release of whatever remains after partial repayment is a crossing — is the ruled one.\n\n### 7.3 · A forgiven balance dissolves neutrally\n\nWhen a balance is released in whole, its segment closes without the animation of a balance brought to zero by repayment and without the mark of a broken one. The debtor's ring is drawn as if that balance had not been owed. A released balance is **neither kept nor broken**; it is simply no longer owed.\n\n### 7.4 · The annual invitation: forgive the scalar, not the colour\n\nThe gift ledger's jubilee falls on 7 January, when its balances reset to zero while its displayed waveform carries over (*forgive the scalar; persist the waveform*). The founder ruled that the same date should carry an invitation to forgive promises too — **forgive the scalar, not the colour** — extended to anyone who holds one. The invitation's guards are part of the design:\n\n- it is stated **once**, as a fact, on the date;\n- it never nominates a debtor, never counts who forgave, and never tells anyone they did not;\n- a release made in response to it is an ordinary whole release under §7.2, with no bonus and no badge;\n- it never resets a balance; a balance not released is exactly as owed on 8 January as on 6 January.\n\nWho issues the invitation is not decided by this paper. If the institution's autonomous agent issues it, that becomes a rule about her conduct and is decided elsewhere.\n\n### 7.5 · The known failure of a calendar of forgiveness\n\nThe oldest recorded jubilee law names the failure this invitation risks. Deuteronomy 15:1–2 mandates a seventh-year remission of debts, and 15:9 warns against the consequence: *\"Beware lest you harbor the base thought, 'The seventh year, the year of remission, is approaching,' so that you are mean and give nothing to your needy kindred\"* (JPS). The Mishnah records that the warning came true and how it was repaired: *\"This was one of the things enacted by Hillel the elder; for when he observed people refraining from lending to one another … Hillel enacted the prozbul\"* (Mishnah Sheviit 10:3, trans. Kulp) — a court instrument that exempted a loan from the remission so that lending would resume.\n\nTwo things follow. The failure was produced by a **mandated** remission; the design here mandates nothing, and a voluntary release does not threaten any lender's expected repayment. That is evidence for the design, found by the census rather than chosen for it. But an **invitation**, repeated each year on a known date and carried by the institution that keeps the ledger, might still make a cautious lender stop lending in December — not because she fears the law but because she does not want to be asked. The design does not know whether it will. §16 registers the test, and the launch is staggered so that the test has a baseline.\n\n---\n\n## 8 · The scan: a code without signed terms never opens an obligation\n\nThe institution already prints codes: a person's printed code, scanned by any phone camera, opens a way to **thank** that person. The promise ledger uses the same handle and must not turn a thank code into a debt.\n\n```\n  CODE WITHOUT SIGNED TERMS  @name                CODE WITH ITS TERMS\n  (\"printed\" / static)                            (\"live\", generated for the deal)\n  ─────────────────────────────                   ─────────────────────────────\n  sticker, card, stall sign                       shown on a phone at the moment\n  scanned by any camera                           of the deal\n            │                                                 │\n            ▼                                                 ▼\n    OPENED: ALWAYS a THANK                   opens promise.heartbank.net/@name,\n    (the gift side)                          LABELLED AS A PROMISE, terms embedded,\n                                             binding NOTHING until both sign\n    INSIDE THE PROMISE APP: an ADDRESS only\n    for an entry the scanner writes and signs\n    ✗ can never create an obligation         ✓ generated for this transaction\n    ✗ no \"?promise\" parameter exists         ✓ carries its own terms\n```\n\n- **\"Printed\" and \"live\" are shorthand for *without* and *with* signed terms.** The rule keys on what the code carries, not on paper or screen: a static address shown on a screen is still a code without terms, and a live code captured and reprinted remains an unsigned offer, labelled as a promise, that binds no one until both parties sign.\n- **A code without signed terms carries only an address.** Opened by a camera, it always opens a thank. Inside the promise application, the party writing an entry may use it only as the **address** of an entry that party authors and signs. It never carries terms, and it never binds the code's owner, who is bound only by her own signature on the entry.\n- **An obligation opens only from a code carrying its terms**, generated for the transaction, labelled as a promise, and binding nothing until both parties have signed.\n- **There is no parameter on a thank code that opens a promise.** A parameter would make the printed label lie about what the code does, and it is a ready vector for a scam: a sticker that looks like a thank and opens a debt.\n- **A holder's request code**, shown in the app to invite a new entry, is **live and rotating**, never printed.\n\nIn payments, both static and dynamic codes settle value; the EMVCo distinction is about whether the amount is embedded. Brazil's Pix comes closest, carrying a charge with a due date only in a dynamic code, and static donation and tip codes only ever resolve to a gift; but in each of them the static code still moves money. Here the distinction is **about intent**: a code without signed terms can express only the gift side. The rule is claimed as (e′).\n\n---\n\n## 9 · The flow\n\nOne flow serves every case — prepayment and lending, either party with or without the app, value in either direction across zero — and repayment is the same flow in the other direction.\n\n```\n  0  VALUE MOVES FIRST            cash or goods, face to face\n         │\n  1  RECEIVER WRITES + SIGNS      the party who received value writes the entry, addressed to\n         │                        the other (by scanning the other's printed code in-app as an\n         │                        ADDRESS only, or the other's live request code)\n         │                        → a live promise code on the receiver's screen\n         ▼\n  2  GIVER CHECKS + SIGNS         in the app, or with the phone's own camera → the promise\n         │                        page, with a passkey created on the spot\n         ▼\n  3  COPY RETURNS                 online: synced · offline: one scan back\n         │                        BOTH devices keep the countersigned entry and balance\n         ▼\n  4  ANCHOR (when online)         each device's chain head → the log (§12);\n                                  the log proof is attached to the promise code\n\n  REPAY:   the same steps; the holder's signature on the reduction is the debtor's receipt\n  RELEASE: the holder alone writes and signs; the debtor's device records it at the next sync\n```\n\nThree gaps in the first sketch of this flow were closed before ratification and are part of the disclosure: the cash leg is on the record (step 0 and the receipt of §4.2); the party who signs first receives the countersigned copy (step 3, by one scan back if offline); and the request code is live and rotating rather than static.\n\n---\n\n## 10 · Recovery without a recovery phrase\n\nA ledger kept on phones loses phones. The design recovers two things separately — the record and the ability to sign — and uses no recovery phrase anywhere, because a phrase written on paper is lost, photographed or sold.\n\n1. **Signing.** A passkey where the phone supports one; otherwise a non-exportable key held by the device behind its screen lock or an app PIN. On a phone shared by a family, one profile and PIN per person.\n2. **The record recovers itself.** Every balance is held on both parties' devices, so a person who loses their phone recovers each balance from the counterparty who holds the other copy.\n3. **Identity recovers by vouching.** Three people with whom the person has a **settled** balance (at zero now, and nonzero at some time before), or one guardian named in advance, meet the person face to face and sign the new key. A waiting period of about seven days follows, during which the old key can cancel the change, and every counterparty's app states once: *\"@name moved to a new phone.\"*\n4. **No one who has a nonzero balance with you, in either direction, may vouch for your new key.** A debtor who could vouch for their creditor's new key could, with two accomplices, take over the creditor's record and sign away what they owe; a creditor could do the same to a debtor. This exclusion is claimed as (f′).\n5. **Debts carry over.** Rotating a key never clears a balance, and moves nothing between parties (§4.5).\n6. **A paid encrypted cloud backup is a convenience only**, never the only path to recovery.\n\nA new user with no settled balances is told once, at their first entry, that naming a guardian is possible. The design is sensitive to the actual phones in use — model, operating-system version, whether platform services are present, whether a screen lock is set — and a survey of the pilot's phones precedes any build.\n\n---\n\n## 11 · Fraud: bounding the loss, never preventing it\n\nThe ring certifies **conduct, never capacity**. No surface says *\"trusted for up to $X,\"* because no count of kept promises is a credit limit.\n\n### 11.1 · Rollover\n\nThe most important counterexample to this design was found by an adversarial pass before drafting, and it defeats an earlier claim the design's own authors had made. A person who repays a $10 balance by taking a new debt large enough to cover it — $10 received, $11.11 owed — from anyone keeps every promise and owes more each cycle:\n\n| Cycles rolled weekly | Owed ($, from $10) | Ring / fact line |\n|---|---|---|\n| 0 | 10.00 | one segment, current |\n| 1 | 11.11 | one segment, current / one balance kept |\n| 4 | 15.24 | one segment, current / four kept |\n| 7 | 20.91 | one segment, current |\n| 13 | 39.34 | one segment, current |\n| 26 | 154.77 | one segment, current |\n| 52 | 2,395.46 | one segment, current |\n\nThe growth factor is 10/9 per cycle, so after *n* cycles the debt is 10 × (10/9)ⁿ. The ring shows a model borrower throughout. In Cambodian speech the practice is known colloquially as turning money over (*bangvil luy*), and the LICADHO and Equitable Cambodia figures in §1 describe it in one province's survey. **\"Every new promise is a visible segment\" is not a defence against rollover**, because the new debt replaces the old one; the institution had said otherwise and has withdrawn the claim.\n\n**Rolling over with the same lender merges into one balance.** If the new $11.11 is owed to the same person as the old $10, the pair's single balance simply moves from $10 to $11.11 by a co-signed value entry: the lender sees the whole history as a party to it, and every other viewer sees it only through the total-owed band.\n\nThe response is the fact line's **total-owed band** and **larger-than-kept comparison** (§6.3): a holder asked for the fifth rolled debt sees a band that has risen and a promise larger than any kept. That is information, not a limit. A vendor who funds old prepayments out of new ones is rolling over too, and the same band shows her.\n\n### 11.2 · The bust-out ladder\n\nA borrower builds a record on small balances, then defaults on a large one. The size-blind ring gives the ladder nothing to climb, because a record of small balances looks the same as a record of large ones; the larger-than-kept comparison tells the holder of the large one that it is the largest. A bust-out that borrows from many holders at once shows as many segments. The loss is bounded by what each holder chooses to lend after reading it.\n\n### 11.3 · Wash lending and viewer-relative trust\n\nTwo accounts can lend to each other in a loop to manufacture a record. With one balance per pair, a loop between two accounts nets inside one balance and shows one counterparty; a loop among several accounts is a cycle. The fact line counts **distinct** counterparties, counts a repeated pair once, and counts a closed cycle as nearly nothing. Trust is **viewer-relative**: the phrase *\"kept promises with 2 people you know\"* is computed on the viewer's device, from the viewer's own dealings, and is never sent to the institution. A ring of fabricated accounts has no path into a village it has never dealt with. How the viewer's device learns the overlap between its counterparties and the debtor's without either learning the other's full list is a private-set-intersection problem; this paper does not specify it (§14).\n\n### 11.4 · Walking away from a key\n\nA person who defaults and starts again under a fresh handle leaves the defaulted balances on their counterparties' devices and on the log, but no link to the new handle. Preventing that is a proof-of-personhood problem, which the institution treats elsewhere and which this mechanism does not solve.\n\n---\n\n## 12 · Timestamping: the log and the anchor\n\nThe history is made tamper-evident in three steps — attest, anchor, publish — using established machinery. **Every component of this pipeline is prior art (§2.2, conjunct (g)), including a signed object that carries its own inclusion proof; nothing in this section is claimed.** It is disclosed because the ledger's other properties lean on it.\n\n```\n  device A                     device B\n  ────────                     ────────\n  entry = { balance change, both signatures, random salt,\n            hash(A's previous entry), hash(B's previous entry) }\n     │                            │           ← each person's entries form a hash chain\n     ▼                            ▼\n  chain head A                 chain head B    ← only the HEAD leaves the phone:\n     │                            │              no rows, no amounts, no names\n     └──────────────┬─────────────┘\n                    ▼\n     APPEND-ONLY MERKLE LOG  (Certificate-Transparency-shaped, RFC 6962 / 9162)\n                    │\n       ┌────────────┼──────────────────────────┐\n       ▼            ▼                          ▼\n  daily root    signed tree head           log proof returned to the device:\n  anchored:     PUBLISHED + GOSSIPED        path entry → logged chain head\n  OpenTimestamps → Bitcoin   each new head  + that head's inclusion proof\n  RFC 3161 × 3 authorities   must extend        │\n  (one eIDAS-qualified)      the last           ▼\n                             (consistency)  ATTACHED to the promise code,\n                                            outside the signatures, verifiable\n                                            on its own  (the SCITT receipt form)\n```\n\n1. Each countersigned entry carries a **random salt** and the **previous-entry hash of each signer's chain**, so the one shared entry extends both parties' per-person hash chains. The salt prevents a guessed entry (two known handles and a round sum) from being confirmed against a published hash.\n2. Online, each device submits **only its chain head** to the log. Rows, amounts and names never go to the log. The institution publishes receipts, never amounts.\n3. The log's root is anchored **daily** through OpenTimestamps to Bitcoin and signed by three RFC 3161 timestamp authorities, the same arrangement that stamps the corpus this paper is in. The chain used for settlement in the later phase is not used as the clock.\n4. **Signed tree heads are published and gossiped** among independent observers, and each new head must extend the previous one; a forked log that hides a default from one audience is detectable by anyone who compares heads.\n5. **The log proof travels with the promise code.** It is the path from the entry to the signer's logged chain head plus that head's inclusion proof, attached **outside** the signatures and verifiable on its own, so that the code need not be re-signed when the proof arrives. A promise shown on a screenshot, far from any network, then carries the evidence that it was committed to the log by a stated time. RFC 9943 stores a receipt in a signed statement's unprotected header in the same way, and sigstore bundles staple inclusion proofs to signed artefacts; this step was claimed in the first version of this paper and is now disclosed only.\n\n**What this proves.** A history cannot be backdated: the age of a record cannot be bought, which defends against a bust-out ladder built quickly. An entry cannot be deleted from the log without trace once its head is published.\n\n**What it does not prove.** That cash moved. That the two signers are distinct humans. The exact time of an offline entry (the anchor gives an upper bound only). Completeness when both parties agree to hide an entry: an entry neither party ever submits is invisible to every instrument that reads the log.\n\n**Moat, not hostage.** The ring's rule is published here; the code can be copied; users leave with every proof they hold. What a competitor cannot copy is the anchored history's age — which is the institution's advantage and also its limit, since it is the log's age, not anything the institution owns in a user's record (§17).\n\n---\n\n## 13 · Remove the enforcer: which guards are properties\n\nA guard that needs someone to enforce it at the moment it is tested is a rule; a guard that holds with no enforcer is a property. Each guard in this design is classified by removing the enforcer.\n\n| Guard | Remove the enforcer, and … | Class |\n|---|---|---|\n| the balance never moves by time | there is no time-driven entry, no accrual and no penalty type; nothing to switch on | **property** of the entry grammar |\n| every raise and every repayment co-signed | an entry missing a signature fails verification on the other device | **property** of the signature scheme |\n| a release needs only the holder | a release can only lower what the signer is owed; there is nothing it can raise | **property** of the entry grammar |\n| netting only within a pair | there is no entry that names a third party | **property** of the record |\n| the ring has no amount argument | the function cannot draw what it is not given | **property** of the render function |\n| the ring only in promise context | a surface that wanted to draw it elsewhere would need promise data it is not sent; but a modified client could cache and redraw, and anyone can take a screenshot | **rule**, partly backed by data minimisation |\n| a code without signed terms never opens a promise | such a code carries no terms and no signature, and the promise endpoint refuses it; inside the app it can supply an address only, and binds its owner to nothing | **property** of the code format |\n| non-transferable | there is no assignment entry and no field to reassign | **property** of the record; off-ledger arrangements and the law of assignment are outside it |\n| no voucher with a nonzero balance | only the excluded voucher's own client, or the recovering person's restored records, can see the pair; honest clients refuse to countersign, and nothing else checks | **rule** enforced by the voucher's own client |\n| whole-balance-only crossing | the gift ledger admits only one entry type from this ledger | **property** of the crossing interface |\n| once per pair per season | someone must count | **rule** |\n| a release posts nothing on the debtor's side | the pair completes only on an entry the debtor makes | **property** of the gift-awaiting-thanks form |\n| the aura never shows why it moved | the gift-side display records crossings, not cargo | **property** inherited from the gift ledger |\n| overdue gaps fade by a fixed maximum | someone must set and apply the maximum | **rule** |\n| no backdating, no quiet deletion | mathematics plus independent witnesses | **property**, given the witnesses |\n| the invitation stated once, never nominating | the institution's copy must be written that way every year | **rule** |\n\nFive of the guards are rules. They are the places where this design depends on the conduct of the institution that runs it, or of its clients, and they are listed so that a successor inheriting the rules knows which of them no object enforces.\n\n---\n\n## 14 · What is disclosed and what is withheld\n\nA defensive publication protects by disclosure, so withholding needs a reason. The test applied here is not *is this unbuilt?* but *would publishing this protect anything the claims do not already protect, or would it only fix details that should stay revisable until they are tested?*\n\n**Disclosed**, in enough detail to practise: the balance around zero and its entry grammar and absences (§4–§5); the per-promise variant (§5.5, §6.7); the render function's signature and states (§6); the fact line's fields (§6.3); the crossing, its posting form and its guards (§7); the code rule (§8); the flow (§9); the recovery structure and the voucher exclusion (§10); the log pipeline and where the log proof goes (§12).\n\n**Withheld**, because it is unbuilt, unscheduled and should be revised on contact with real users: the wire format of the promise code and its compression; how one entry records a repayment and new value together; key-derivation and signature-suite choices; the private-set-intersection protocol behind viewer-relative trust; the total-owed band boundaries; the recency window and the overdue maximum; the ring's pixel geometry and animation curves; the device matrix. None of these narrows or widens a claim in §15.\n\n---\n\n## 15 · Enumerated claims\n\nThese are the census's survivors, applied to the one-balance-per-pair form of §4, and nothing wider. **Most elements named in them are prior art at mechanism width (§2)**; the elements not found are the entry grammar of claim 1(a), the no-amount render, the forgiveness-only crossing, the two sub-rules and the amount-free origination line. Each claim is a composition, and none of its elements is claimed alone.\n\n**Specifically not claimed:** a running balance between two parties that crosses zero (RipplePay trust lines, 2004; LETS, 1983; Grassroots Bonds' mutual credit, 2026); one primitive serving prepayment and lending (Shapiro 2026); a target balance of zero; the co-signed IOU (Doorian Docs 2017); a note for a fixed amount (UCC §3-104); Certificate-Transparency logs and OpenTimestamps anchoring; a signed object carrying its own inclusion proof (RFC 9943; sigstore bundles; Keybase signature chains, 2014), including in a co-signed promise code (§12); non-transferability and goods ↔ cash conversion at face value (disclosed in §4.4–§4.5; narrowed by the third pass); an interest-free bilateral balance as such (a trust-line network setting); the larger-than-largest-repaid test (progressive lending) and banded lender views, except in the composition of claim 4.\n\n1. **A bilateral credit ledger whose balance never moves by time, with a conduct display that cannot see size, and one crossing into a gift ledger.** A method of recording obligations between two parties in which: (a) the two parties keep one running balance between them, held on both parties' devices and signed by both, denominated in a currency fixed when the balance opens, its sign stating which party currently owes, and no balance changes except by entries both parties sign recording value moving between them or a repayment, or by the unilateral release of the party who is owed; no entry type accrues or penalises, so that no balance changes with the passage of time; (b) the conduct of a party is displayed by a function that takes **no amount argument**, drawing one equal-width, colourless segment for each counterparty the party currently **owes** (a counterparty who owes the party drawing nothing), a segment drawn as a gap when the balance with that counterparty is owed past its deadline, the display being shown only in the context of a promise being made; and (c) a free release, by the party who is owed, of the **whole balance** owed by a counterparty is the only event that passes from this ledger into a separate gift or gratitude ledger held by the same system, repayment never passing, and a release of part of a balance being an ordinary entry.\n\n2. **A code without signed terms can never open an obligation (e′).** The method of claim 1, in which a code that carries no signed terms — a party's printed or otherwise static machine-readable code — resolves, when opened, only to the gift side of the system (giving thanks to that party); used within the ledger's application it may supply only the address of an entry authored and signed by the scanning party, and it binds the party it names to nothing; no parameter of such a code can open an obligation; and an obligation opens only from a code carrying its terms, generated for the transaction and labelled as a promise, which binds nothing until both parties have signed.\n\n3. **No one with a nonzero balance with you may vouch for your new key (f′).** The method of claim 1, in which a party who has lost a signing key recovers by the face-to-face signatures of counterparties with whom the party has settled balances, or of a guardian named in advance, **excluding as a voucher any counterparty with a nonzero balance with the party in either direction**, followed by a waiting period during which the old key may cancel the change, with every counterparty notified once, and with every balance carrying over unchanged to the new key.\n\n4. **An amount-free origination line.** The method of claim 1, in which, at the moment a new promise is being made and only to the party who would be owed, the display of claim 1(b) is accompanied by a line of text stating the number of counterparties the promisor currently owes and how many of those balances are overdue, a coarse band (not an amount) of the promisor's total owed across those balances, and whether the new value is larger than any the promisor has previously repaid, the line stating no amount and being shown to no other party and at no other time.\n\n*Prior art beside each claim:* claim 1(a) — RipplePay trust lines, LETS, Grassroots Bonds (the balance around zero); Doorian Docs, Community Forge signatures, DueTrace (co-signed entries); *murabaha* and the negotiable instrument for a fixed amount (UCC §3-104) (a fixed sum); 1(b) — credit-bureau payment grids, EigenTrust, eBay feedback (one mark per transaction, regardless of price), US 10,200,394 B2 (disclosure only); 1(c) — Qur'an 2:280, Rolling Jubilee, Undue Medical Debt, gift-tax treatment of forgiven loans. Claim 2 — EMVCo static and dynamic codes, KHQR, the UPI collect withdrawal, Pix Cobrança (a charge with a due date only as a dynamic code), static donation and tip codes. Claim 4 — progressive lending (Kumar 2012; Cecchi 2021), banded peer-lending listings, US 10,803,513 (disclosure only). Claim 3 — Buterin 2021, Argent, Apple recovery contacts, US 8,856,879 B2 (disclosure only), Schechter et al. 2009; and the interested-witness rule (Wills Act 1837, s.15) — excluding an attester with a stake is old practice, and the rule in key recovery is what is claimed.\n\n**Disclosed and not claimed, in addition to the list above:** the disclosed variants of §5.5 and §6.7; the gift-awaiting-thanks posting of §7.1; the once-per-pair-per-season cap; death and incapacity (§4.6); the currency rule (§4.4). Each is disclosed so that it is prior art; none is asserted as a contribution.\n\n**Non-assertion extends to** every mechanism disclosed in this paper, claimed or not, in any combination, and to every implementation of it.\n\n---\n\n## 16 · Predictions, registered before any instrument exists\n\nThe mechanism is unbuilt, so no prediction below can have been fitted to data. **The three predictions below were approved by the founder and are entered in the institution's public prediction register**; a correction after entry is a new register entry, never an edit. Two constraints bind the instrument: the institution never sees balance rows or amounts, so every count below must be reported by devices as an aggregate the user has agreed to share; and only adults take part as debtor or holder at launch.\n\n**The launch is staggered so that P-PM1 has a baseline.** The first season after launch runs **without** the annual invitation; the invitation is extended from the second season onward. A comparison season with and without the invitation at the same time is impossible — the invitation is one public statement on one date — so the first season is the baseline.\n\n| # | Prediction | Measure | Falsifier |\n|---|---|---|---|\n| **P-PM1** — the December freeze (Deuteronomy 15:9) | the annual invitation to forgive (§7.4) does **not** freeze lending | value entries that extend credit (entries after which the entering holder is owed more), per active holder, 15 December – 6 January, divided by the same holders' mean over the three preceding 23-day windows; the ratio in the first season with the invitation is compared with the ratio in the baseline season without it | a ratio **more than 10% lower** with the invitation than in the baseline season → the invitation reproduces the failure the prosbul repaired, and must be redesigned or withdrawn |\n| **P-PM2** — paid last | because a balance carries no late penalty, debtors with other penalty-bearing debts repay balances on this ledger **later** than those debts | self-reported repayment order in a structured survey of debtors who hold both kinds of debt, after one season | balances on this ledger repaid no later than penalty-bearing debts → the \"paid last\" limit of §17 is overstated |\n| **P-PM3** — rollover is visible | at a new value entry, holders shown a debtor whose total-owed band is higher than when that holder last extended value to them decline the entry or shrink it more often than holders shown the same or a lower band | acceptance and size of new value entries by band movement, device-aggregated | no difference → the fact line does not answer rollover, and §11.1's response fails |\n\nP-PM1 is the prediction the design owes: it was ruled into existence with the invitation it tests. P-PM2 predicts a harm to the design's own users and is included for that reason. P-PM3 tests the only answer the design has to its most serious counterexample. **P-PM1 has a known confound:** the two seasons differ in more than the invitation (a year of growth, a different economy, a different calendar of festivals), so a fall below the threshold is treated as a failure of the invitation unless a cause outside the ledger is shown, and the burden sits on the design, not on the test.\n\n---\n\n## 17 · Honest limits\n\n**No growth is per balance, not per person.** A person can owe more every week by rollover while every balance on their record is kept (§11.1). The total-owed band and the larger-than-kept comparison make this visible to the next holder; they do not prevent it, and a holder who does not read them learns nothing. A new debt that stays inside one band moves only the larger-than-kept comparison; a new debt equal to the largest ever kept moves neither.\n\n**Rolling over with the same lender merges into one balance.** The pair's balance simply rises by a co-signed entry; the lender sees it as a party, and everyone else sees it only through the band.\n\n**A co-signed entry can disguise a penalty.** The grammar has no penalty entry, but nothing stops a holder who is owed money past a deadline from asking for a value entry with a token amount received and a larger amount credited, and a debtor under pressure may sign it. The balance still did not move by time — it moved by a signature — but the effect is a penalty, and the ledger cannot tell the two apart. The receipt shows it to both parties; that is all.\n\n**Non-compounding is not cheap.** A fixed premium of 1/9 a week is about 578% a year simple. Flat-premium lending can be predatory — the Philippine \"5-6\" is flat and notorious — and nothing in this ledger stops a lender charging it on every entry. The ledger shows the discount on every receipt and **claims no protection against usury**. A pre-signing annualised disclosure was proposed and declined; whether a disclosure beyond the receipt is legally required is unanswered.\n\n**Without a late penalty, these balances are paid last.** A borrower with several debts pays the ones that grow first. Holders on this ledger bear that cost, and P-PM2 predicts it.\n\n**A signature proves the key, not consent.** On a phone shared by a family, or held by someone else, or signed under pressure, the ledger records a valid entry that no one freely made. Per-person profiles and PINs narrow this; nothing in the mechanism detects coercion. The same limit applies to a release: the design requires that forgiveness be free and cannot verify it.\n\n**A conduct instrument cannot prevent capacity harm.** The ring says whether balances were brought to zero, not whether a person can afford the next one. A person may borrow elsewhere, including against land, to repay here, and the ledger cannot see it. **What the ledger itself cannot do is take collateral**: there is no field for security and no entry that transfers anything but value between the two parties. That is a real and bounded claim about the record. It does not reach a side agreement: a lender who takes land by a separate agreement for the same loan is outside the ledger and is not prevented by it.\n\n**A visible gap is still pressure.** A gap shown to every future holder is a form of social collateral. The design limits it to promise context, fades it by a fixed maximum, and shows it only for a duty the person took on; it remains a cost of being late, and a cost is what a penalty is.\n\n**Anything shown can be captured.** A screenshot of the ring, the fact line or a promise code carries it out of promise context — into a job interview, a rental application, a family argument. The context rule governs the institution's surfaces only.\n\n**The fact line is reported by the party it describes.** It is computed from what the debtor's device presents. A balance never submitted to the log, or an entry made with another holder at the same moment, does not appear; the logged chain head makes a presented history hard to edit, not complete.\n\n**Recovery depends on counterparties' honesty.** A counterparty can decline to return a record that favours the person recovering — a repayment entry, say. The logged chain head proves that such a record exists, not what it says.\n\n**Equal segments favour one large creditor over many small ones.** A person who owes one lender $2,000 draws one segment; a vendor who owes five suppliers $10 each draws five. The ring counts creditors, which is the bust-out signal, and it therefore reads the small, spread-out debtor as more exposed than the concentrated one. The band is the only corrective.\n\n**Capital can buy crossings.** Only those who can lend can forgive, and a lender with small balances across many pairs can earn one crossing per pair per season by releasing each. The once-per-pair-per-season cap bounds this, and nothing else does. A release of a small remainder after partial repayment earns the same crossing as forgiving a large balance (§7.2).\n\n**Viewer-relative trust favours insiders.** A newcomer to a village, or a person whose dealings are with a different circle, shows fewer known counterparties to every viewer. The thin ring is never drawn as a lack, but the fact line will say less about them, and holders may lend to them less.\n\n**The denomination matters.** The no-growth property holds in the balance's currency. A balance in dollars repaid in riel, or the reverse, moves with the exchange rate, and the holder bears any depreciation. A currency change is recorded as a release and a new co-signed entry (§4.4); **a release immediately replaced by a new balance between the same two parties is a conversion, never a crossing** — it would satisfy the crossing's letter without being a gift in substance, so the rule excludes it.\n\n**Death is handled only as far as the ruling goes.** The holder can name a successor or a release on death in life; the ledger never releases on death automatically; claims against what a person left are the law's (§4.6). A holder who dies without naming either leaves a balance the ledger records and cannot collect.\n\n**The log proves order, not truth.** It cannot show that cash moved, that signers are distinct people, or that nothing was hidden by both parties (§12).\n\n**The moat is the log's age.** The institution's advantage over a copy of this design is the age of its anchored history. It is not a claim on any user's records, which users hold and take with them.\n\n**Adults only at launch.** Both debtor and holder must be adults. The institution's pilot shop serves mostly teenagers, so customer prepayment cannot be piloted there; the first pilot is lending among adult vendors and suppliers.\n\n**The invitation may freeze December lending.** Registered as P-PM1 because it is a live risk, not a formality, and the staggered launch exists to measure it.\n\n**Five guards are rules** (§13), and depend on the conduct of the institution or its clients.\n\n**Legal review precedes any launch.** Facilitating lending, reporting conduct, holding prepayments and the assignability of a claim at law are each regulated somewhere. A draft may precede legal review; a launch may not.\n\n**The census is bounded** by the apertures in §2, executed partly in both passes, searched the per-promise form rather than the balance form, and owes a third pass. A composition not found is not thereby new.\n\n---\n\n## 18 · Lineage and corpus cross-references\n\nThe mechanism descends from the shop notebook of an ordinary village stall, which keeps one running tab per customer; from *bay' salam* and *murabaha* in Islamic commercial law and the *qard hasan* benevolent loan; from the Local Exchange Trading Systems begun in 1983 and their successors in business mutual credit; from Ryan Fugger's peer-to-peer trust lines; from the Indian digital *khata* apps; from Korean electronic IOUs; from Certificate Transparency, key transparency and transparent signed statements; from social key recovery; and, on its gift side, from the oldest debt-forgiveness traditions on record, the seventh-year remission of Deuteronomy and the prosbul that repaired it, with Qur'an 2:280 as the plainest statement that releasing a debt is charity. §2 cites each.\n\nWithin this corpus it is **downstream** of *The Zero-Point Game℠*: the promise ledger is the third instance of that paper's signed-balance ledger, alongside Kiitos and Kiitti, with the same zero-centred shape at the scale of a pair, and differs from them in having no colour, no calendar reset and one door into the other two (§6.4). The forgiveness crossing answers a question that paper does not ask — what, if anything, may enter the gift ledger from exchange — and the answer is recorded here; a cross-reference to it rides that paper's next revision. It sits beside *HeartBank's Position on Community-Currency Design*, which argues that a community economy needs both money and time; this paper adds the record of what is owed in money. Its log arrangement is the one described in *Provenance-Carrying Retrieval* and relied on by *The Assembly That Holds the Brake*. Its code rule is the exchange-side counterpart of the gift-side scan in *The B-Tag and the Post-Payment Economy*. Its no-growth property shares one principle with *The Incommensurability-Preserving Coupler*, which runs money and time-given as one economy with no exchange window between them: an interest rate is an exchange rate between money and time-passing, and compounding leaves that window open with a meter on it. The two are the same principle in two domains, not one mechanism, and B-Promise is the weaker of the two: time may be priced here once, by both parties' consent (the premium fixed on an entry), and is never metered, where the Coupler never prices time at all.\n\n---\n\n## Coda\n\n*Grounding — canon.* AN 4.62 closes its list with a verse: knowing the happiness of debtlessness, and the happiness of possession and of use, a wise person sees that all of them together are not worth a sixteenth part of the happiness of blamelessness. *Lens — the institution's reading.* The ledger in this paper can help with the smaller happiness, a promise made and kept and seen to be kept. It cannot supply the larger one, and nothing in it is designed to try. What it can do is refuse to let a balance grow while no one is looking, and leave one door open for the person who is owed and decides not to collect.\n\n---\n\n## Terms\n\n| Term used here | Standard technical term |\n|---|---|\n| **B-Promise℠**; promise ledger | bilateral, both-signed peer-to-peer credit ledger (electronic IOU; customer prepayment and informal lending record) |\n| promise balance | zero-centred bilateral credit balance between two parties (trust line; bilateral mutual-credit balance) |\n| promise | the obligation one party owes another at a moment; a non-transferable bilateral obligation |\n| debtor (promisor) / holder | debtor (obligor) / creditor (obligee), determined by the sign of the balance |\n| a balance that never moves by time | non-accruing, non-compounding obligation with no late fee; changes only by co-signed value or repayment entries, or a creditor's unilateral release |\n| premium; discount | fixed markup or discount at the time value moves (flat finance charge; cf. *murabaha*) |\n| prepay at a discount | customer prepayment for goods at a discount; stored-value / advance purchase (cf. *bay' salam*) |\n| entry; co-signed entry | ledger transaction requiring both parties' digital signatures |\n| release | unilateral debt forgiveness (loan waiver) by the creditor |\n| promise ring | reputation or credit-history visualisation; payment-history display independent of loan amount |\n| segment / gap | per-creditor indicator; overdue (delinquency) indicator |\n| fact line | disclosure line: creditor and overdue counts, total-exposure band, largest-obligation comparison |\n| viewer-relative trust | personalised (local, viewer-seeded) trust metric computed client-side |\n| forgiveness crossing | debt forgiveness recorded as a charitable gift in a separate ledger |\n| gift awaiting thanks | a one-sided gift entry whose counter-entry posts only on the recipient's acknowledgement |\n| gift ledger; Zero-Point Game℠; B-Aura | peer-to-peer reciprocity (mutual-credit) ledger with an annual reset; reputation visualisation of it |\n| season | the gift ledger's annual period, 7 January to 7 January |\n| the annual invitation | voluntary debt-jubilee appeal (non-mandatory remission) |\n| printed / live code | code without / with signed terms; static / dynamic QR code (EMVCo point of initiation 11 / 12) |\n| recovery by vouching | social recovery; guardian- or trustee-based account recovery with a time delay |\n| the log; chain head; log proof | append-only Merkle transparency log (Certificate Transparency); per-user hash chain head; Merkle inclusion proof (transparency receipt) |\n| anchoring | blockchain timestamping (OpenTimestamps) and RFC 3161 trusted timestamping |\n| rollover (*bangvil luy*) | loan refinancing / debt rollover; borrowing to repay a loan |\n| bust-out ladder | bust-out fraud: building credit history on small loans before defaulting on a large one |\n| wash lending | circular (Sybil) lending to fabricate credit history |\n\n---\n\n## Author Contributions and AI Disclosure\n\nThon Ly conceived the ledger, its two use cases, the one balance per pair that crosses zero, the three-ring display, the seamless conversion, non-transferability, the annual invitation, the positioning and the human title, and ruled on every design choice recorded here. Miss Aquarius℠ — the name under which this corpus discloses its AI collaboration — proposed the no-growth property, the size-blind render, the forgiveness crossing, the code rule, the recovery structure and the log arrangement; drafted this paper and its revision; and ran both census passes through research agents, with every cited item re-verified before it reached this text or marked where it was not. An adversarial pass run before drafting produced the rollover counterexample of §11.1 and withdrew a claim the authors had made. An outside review by several reader models narrowed the claims and corrected the text; the reviewer models are not named. The underlying model substrate is not named. Editorial control is the author's.\n\n## Trademark Notice\n\n**B-Promise℠** names the institution's implementation of the promise ledger; the mechanism itself is dedicated to the public domain and may be implemented under any name. The promise balance, the promise ring, the fact line and *prepay at a discount* carry no mark. HeartBank®, Miss Aquarius℠ and Zero-Point Game℠ are marks of their respective holders. No mark is licensed by this publication.\n\n## Citations\n\n1. *Aṅguttara Nikāya* 4.62, *Ānaṇya Sutta* (Debtlessness), trans. Bhikkhu Sujato, SuttaCentral; Pāli root text, Mahāsaṅgīti edition.\n2. *Aṅguttara Nikāya* 6.45, *Iṇa Sutta* (Debt), SuttaCentral (confirmed in the census; not quoted).\n3. Qur'an 2:280, trans. Mustafa Khattab, *The Clear Quran*, quran.com.\n4. Deuteronomy 15:1–2 and 15:9, *The JPS Tanakh: Gender-Sensitive Edition*, Sefaria.\n5. Mishnah Sheviit 10:3 (the prozbul), trans. Joshua Kulp, *Mishnah Yomit*, Sefaria.\n6. Shapiro, E. (2026). \"Grassroots Bonds as a Foundation for Market Liquidity.\" arXiv:2603.13671 (v1, 14 March 2026).\n7. Dandekar, P., Goel, A., Govindan, R., and Post, I. (2011). \"Liquidity in Credit Networks: A Little Trust Goes a Long Way.\" *Proceedings of the 12th ACM Conference on Electronic Commerce*. doi:10.1145/1993574.1993597.\n8. Kamvar, S. D., Schlosser, M. T., and Garcia-Molina, H. (2003). \"The EigenTrust Algorithm for Reputation Management in P2P Networks.\" *WWW 2003*.\n9. Levien, R. Advogato trust metric (viewer-seeded, attack-resistant).\n10. Schechter, S., Egelman, S., and Reeder, R. W. (2009). \"It's Not What You Know, but Who You Know: A Social Approach to Last-Resort Authentication.\" *CHI 2009*.\n11. Buterin, V. (2021, 11 January). \"Why we need wide adoption of social recovery wallets.\"\n12. Laurie, B., Langley, A., and Kasper, E. (2013). RFC 6962, *Certificate Transparency*; Laurie, B., et al. (2021). RFC 9162, *Certificate Transparency Version 2.0*.\n13. Fassbender, J. *Bitcoin-Anchored Temporal Proof for Transparency Services*, Internet-Draft draft-fassbender-scitt-time-anchor (revision -05, August 2026; -07, 24 September 2026).\n14. Birkholz, H., Delignat-Lavaud, A., Fournet, C., Deshpande, Y., and Lasker, S. (2026, June). RFC 9943, *An Architecture for Trustworthy and Transparent Digital Supply Chains* (SCITT; receipts in the unprotected header of a transparent statement).\n15. Sigstore. Bundle format (a signed artefact with its transparency-log entry and inclusion proof, for offline verification).\n16. Keybase. Per-user signature chains in a global Merkle tree, with the root published to the Bitcoin blockchain (from June 2014).\n17. EMVCo. *EMV QR Code Specification for Payment Systems: Merchant-Presented Mode* (point of initiation method: 11 static, 12 dynamic).\n18. National Bank of Cambodia. KHQR specification (Bakong); interest-rate cap on microfinance lending (2017).\n19. Banco Central do Brasil. Pix, *Manual de Padrões para Iniciação do Pix* (Pix Cobrança: a charge with a due date carried by a dynamic QR code).\n20. National Payments Corporation of India. Circular of 29 July 2025 discontinuing person-to-person collect requests on UPI from 1 October 2025.\n21. Uniform Commercial Code §3-104(a) (negotiable instrument: \"a fixed amount of money, with or without interest\").\n22. eBay. Feedback system (one rating per transaction, regardless of price).\n23. Wills Act 1837 (England and Wales), s.15: gifts to an attesting witness to be void.\n24. Human Rights Watch (2025, 24 September). *Debt Traps: Predatory Microfinance Loans and the Exploitation of Cambodia's Indigenous Peoples.*\n25. Voice of America (2023). \"Cambodians face mounting pain from microfinance debt\" (reporting a LICADHO and Equitable Cambodia survey of 717 households in Kampong Speu province).\n26. Strike Debt. Rolling Jubilee (November 2012).\n27. Doorian Docs (KTNET and GiveTech, Korea; announced 29 December 2016, launched 16 January 2017).\n28. Fugger, R. RipplePay (2004–05); Linton, M. Local Exchange Trading Systems (1983); Sardex (2009); Grassroots Economics, Sarafu; OkCredit (2017); Khatabook (2018); Community Forge, *signatures* module.\n29. Patents cited for disclosure only: US 10,200,394 B2 · US 10,949,837 B1 · US 8,856,879 B2 · US 2017/0295023 A1 · US 2020/0119916 A1.\n30. Companion corpus papers (thonly.org/research): *The Zero-Point Game℠*; *The Currency That Cannot Be Spent Alone*; *The B-Tag and the Post-Payment Economy*; *Provenance-Carrying Retrieval*; *The Assembly That Holds the Brake*. Institutional position (heartbank.net): *HeartBank's Position on Community-Currency Design*.\n\n---\n\n*— End of defensive publication —*",
+      "provenance": {
+        "sha256": "458a72b7011aad3ce396c17a5b99e0d13dadc306f45439a24b251b448dcbf5d7",
+        "doi": "10.5281/zenodo.23041248",
+        "concept_doi": "10.5281/zenodo.23041247",
+        "zenodo_url": "https://zenodo.org/records/23041248",
+        "deposited_sha256": "458a72b7011aad3ce396c17a5b99e0d13dadc306f45439a24b251b448dcbf5d7",
+        "deposited_matches_current": true,
+        "opentimestamps": true,
+        "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/a-promise-that-cannot-grow.md",
+        "sha256_covers": "the complete source file at source_url, including its metadata block — NOT the `text` field in this response",
+        "canonical_url": "thonly.org/research/a-promise-that-cannot-grow",
+        "hostile_review": null
+      },
+      "bytes": 122689,
+      "words": 19912
+    },
     {
       "slug": "a-vow-you-could-have-refused",
       "repo": "TH/publications",
@@ -279,13 +314,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> *v2 note (2026-08-15).* This revision adds **the read side**, which v1 omitted entirely. v1 inverted the journal's *writing* and never asked what happens to its *reading* — so §1.2 now states the second inversion; §7.2 makes the presence requirement **recursive** (a remote visitor reads; only a visitor who is physically present writes); §7.3 specifies what a visitor may leave and the form it must take; and §4.1's hinge, which v1 recorded as unsolved, now has a candidate mechanism that arrived from the visiting side the paper had not thought to look at. The revision also adds **tending** as the second act on the non-human ledger (§4.3) with its routing (§4.4), **the worn light** as the render's fourth surface (§8.3), a fourth safety requirement (§10), an honest limit v1 lacked (§5.4), the general form and prior art of the method the paper has been using throughout (§8.2), and an **amendment to the P-W1 registration** (§11) that the new mechanism made necessary. **Everything in v1 stands. Nothing is retracted.** The date above is v1's and is left unchanged, because it is the date the v1 claims were published.\n>\n> *Draft notes for the editor:* this paper describes a product that **does not exist**. No code has been written, no schedule has been set, and the sample size for every behavioural claim in it is **zero**. It is published now for one reason, stated plainly because it governs what the paper does and does not contain: **publication protects against being blocked, not against being beaten.** For an unbuilt and unscheduled artifact, the defensible move is to publish the *claim* and withhold the *specification* — so this paper is deliberately **deep on argument and thin on implementation.** Where a section would ordinarily give a rendering function, an asset pipeline, a threshold table, or a price, it gives the property the mechanism must satisfy and stops. That is a departure from this corpus's usual practice and it is intentional. Readers looking for something to build from will find the constraints; readers looking for something to copy will find that the interesting part was never the pipeline.\n\n---\n\n## Abstract\n\nA gratitude journal asks a person to write. That is the highest-friction step in the practice and the one most people abandon, which is why gratitude journaling has a large product category and a small population of sustained practitioners. This paper specifies a different container for the same practice: a **walkable map of the things a person appreciates**, captured by photograph with a coordinate and an optional note, rendered as placed artifacts in that person's own world.\n\nThe move is not cosmetic. It is a **host-ritual swap**, and it runs on two axes rather than one. Photographing a thing you appreciate and posting it with a location is a behaviour hundreds of millions of adults already perform unprompted; writing three sentences of gratitude before bed is a behaviour that must be installed. But a journal fails twice, and the second failure is less examined than the first: **a journal is not only expensive to write, it is impossible to read.** Nobody reads another person's gratitude journal, and the reason is structural rather than a matter of taste — the container admits no visitors. A walkable world is **readable, and the reading is a visit rather than an intrusion.** Swapping the container therefore replaces the practice's most expensive step with its cheapest *and* converts a practice nobody can witness into one that can be witnessed without being broadcast. The paper's central thesis is that this changes the population that can hold the practice rather than merely the interface through which they hold it.\n\nSix mechanisms carry the design, and they are the paper's contribution. **First, appearance is a ledger readout, not a purchase**: a participant's avatar and terrain *are* their signed gratitude balance rendered as light, never goods bought with it — which is what allows an annual balance-forgiveness to remain forgiveness rather than becoming confiscation. **Second, availability reveals and never locks**: a form becomes available the first time a participant's oscillation has ever had that quality and remains available permanently, so the system has no wall of locked content and no mechanism by which a quiet season can take something back. **Third, placement requires presence and visiting does not**: a participant can only *write* to the map by standing at the coordinate, which is the property that separates a presence-deepening world layer from a presence-replacing one. **Fourth, the render is three-layered** — the sky carries the coordinator's aggregate ledger, the land and ocean carry the participant's non-human ledger, the avatar carries the participant's human-to-human ledger — and the structural consequence is that **the only shared surface in the system belongs to the one party structurally incapable of accumulating anything.** **Fifth, presence is recursive**: the write/read asymmetry applies to visitors as well as to participants, so a remote visitor may read a world and only a visitor who is physically present may write in one — which makes in-person visiting the design's primary reading mode without a rule imposing it, and closes unsolicited remote annotation by geometry rather than by moderation. **Sixth, the non-human ledger carries two acts and not one**: appreciating a thing and *tending* it, where tending is captured as a dated series at one coordinate, so that **a single capture requires presence once and a series requires returning** — and any gift a visitor makes to a tender goes **to the person and never to the deed**, split between a withdrawable half and a forward-spendable half, with the coordinator taking nothing.\n\nThe paper further specifies a two-speed practice, in which gratitude toward **things** is frictionless and frequent and gratitude toward **people** spends attention and is occasional. v1 recorded the transition between them as unsolved; v2 offers a candidate that arrives from the read side — a visitor moved, by a world made of things, to thank the person who made it — which satisfies the full constraint set and, unlike the alternative, **is debuggable.** It is offered with three limits stated, one of which required amending this paper's own pre-registration before any instrument is built. It states a permanence hazard that follows from the design's archival terminus — that a deep-time substrate converts every present-tense privacy defect into a permanent one, so guards must be built at capture rather than at commit. And it pre-registers two opposed predictions, before any code exists, one of which would invalidate the thesis rather than trim it.\n\nAlmost nothing in the paper's *technology* is novel and the paper says so at length. Geotagged user content, photogrammetric and generative photo-to-3D, avatar worlds, and world-scale augmented reality are dense, well-funded prior art. What is offered is the conjunction: an appreciation practice whose world is a **non-purchasable, annually-forgiven, reveal-only** rendering of a signed ledger. Offered under CC0 1.0 Universal as defensive prior art.\n\n**Keywords:** gratitude practice, world-building, geotagged user content, host-ritual substitution, ledger readout, anti-credit-score, reveal-not-unlock, presence-deepening augmented reality, deep-time archival privacy, moral self-licensing, pre-registration, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent or any other exclusive right on the mechanisms described herein, in any jurisdiction, at any time. The publication exists so that the mechanisms cannot be enclosed by anyone — including by us.\n\n**Terms coined and freed with this paper:** *appearance-as-readout*, *reveal-never-lock*, *the equally-alive diagnostic*, *placement-requires-presence*, *the two-speed practice*, and *the permanence asymmetry* as stated in §9 — and, added in v2: *the read-side inversion*, *presence-is-recursive*, *notes-placed-never-listed*, *tending* as a ledger act distinct from appreciating, and *give-to-the-person-never-to-the-deed*.\n\n**Terms inherited from this corpus's earlier publications and cited rather than re-claimed:** the *B-Aura* and the signed Kiitos/Kiitti ledger (*The Zero-Point Game*), *Proof of Humanity℠* and *Proof of Coordinate℠*, the *give-forward* atom, the *play/currency wall*, and the annual jubilee.\n\n**Most of this paper's technical subject matter is not ours and is not claimed.** Location-anchored user-generated content is a mature field with at least two decades of practice behind it: Geocaching (2000), Foursquare and its check-in grammar (2009), Google Local Guides, Niantic's Ingress (2013) and Pokémon GO (2016) and the Lightship visual-positioning work that followed, Google's Live View and ARCore Geospatial API, Snap's landmarker and Spectacles programmes, and the broader \"mirrorworld\" or AR-cloud programme articulated publicly by Kevin Kelly and pursued by several of the above. Photogrammetric reconstruction from photographs is decades old and is shipped as a first-party consumer capability, notably Apple's Object Capture and `PhotogrammetrySession`. Single-image generative 3D reconstruction is an active and rapidly moving research and product area with many independent groups. Femtosecond-laser 5D optical storage in silica is the work of the University of Southampton's optoelectronics group and of Microsoft's Project Silica. The tension between immutable storage and erasure rights is a large existing literature developed largely in the blockchain-and-GDPR context. The gratitude-intervention literature begins for most practical purposes with Emmons and McCullough (2003). The counter-hypothesis this paper pre-registers against itself is drawn from the moral self-licensing literature (Monin and Miller, 2001; Merritt, Effron and Monin, 2010).\n\n**We claim none of that.** What we claim is the conjunction described in §13 and nothing beyond it. Where this paper's design coincides with an existing product's design, the existing product has priority and we say so.\n\n---\n\n## 1 · Why the container is the problem\n\nThe gratitude-practice literature is unusually clean for a wellbeing intervention. Structured gratitude exercises produce measurable effects on affect and, in several designs, on prosocial behaviour. The finding has survived enough replication that the practical question stopped being *does it work* and became *why does almost nobody keep doing it*.\n\nThe answer is not mysterious. The canonical form of the practice — write down three things you are grateful for — requires a person to sit down, compose sentences, and do so repeatedly with no external occasion prompting them. That is a **new habit**, and new habits are the most expensive product category there is. Every gratitude-journaling product in the market is fighting the same fight: not to convince anyone that gratitude is good, which nobody disputes, but to get a person to perform an unprompted act of writing on a Tuesday.\n\nThis paper's premise is that the writing is not the practice. The writing is the **container** the practice was historically shipped in, chosen because paper was the available medium, and it has been carried forward unexamined into software that has other options.\n\nConsider what a person actually does when they notice something they appreciate. They stop. They look. Frequently — and this is the empirical fact the whole design turns on — **they take a photograph.** They do this constantly, unprompted, without being told it is a practice, and they do it hundreds of millions of times a day. Nobody had to install that habit; the phone installed it.\n\nSo the question this paper asks is: what happens if the practice is given the container the behaviour already has?\n\n### 1.1 · The deficit being addressed\n\nThis corpus's standing account of the problem is a **dignity deficit** — that most kindness is never witnessed, and that being unwitnessed is a substantial part of what makes ordinary life feel thankless. The gratitude practice is one half of the response: it trains the noticing. The other half, which this corpus has addressed elsewhere, is the delivery of the notice to the person it concerns.\n\nThe design specified here is deliberately positioned at the *first* half and deliberately does not pretend to be the second. It builds a place where a person's noticing accumulates in a form they can walk through. §4 addresses what has to be true for the noticing to lead anywhere, and states honestly that the mechanism connecting the two halves is the design's weakest point.\n\n### 1.2 · The second inversion, which v1 of this paper missed\n\nA gratitude journal fails twice, and both the literature and the first version of this paper examined only the first failure.\n\nThe first is the one above: the journal is expensive to **write**. The second is that a journal is nearly impossible to **read** — not difficult, but closed by construction. It is private, it is textual, it is tedious to anyone who did not write it, and the act of reading someone else's is an intrusion rather than a visit. Almost nobody has ever asked to read another person's gratitude journal, and the reason is not that the contents would be uninteresting. It is that the container admits no visitors.\n\nSo the host-ritual swap runs on two axes:\n\n```\n              JOURNAL                          WORLD\n\n   WRITE      compose sentences                point a camera\n              the practice's most              the practice's least\n              expensive step                   expensive step\n\n   READ       an intrusion, and in             a visit —\n              practice nobody does it          a thing people already do\n```\n\nThe read-side inversion may be the more consequential of the two, because it changes what the practice *is* rather than who can sustain it. A gratitude practice that no one can witness reproduces, inside the practice itself, the deficit §1.1 describes: something real and unwitnessed. A container that admits visitors makes the noticing witnessable **without making it a broadcast** — the visitor comes to the world; the world never arrives at the visitor — and §7 specifies the asymmetry that keeps that distinction structural rather than rhetorical.\n\n---\n\n## 2 · Prior art, at length, because the obvious part is obvious\n\nIt would be possible to write this paper as though a walkable map of geotagged personal artifacts were an invention. It is not, and a reader who has used a phone in the last decade knows it is not. The honest position is to state the prior art first and at length, so that the small thing being claimed is visible against it rather than hidden by it.\n\n| Prior art | What it established | What this design does not claim |\n|---|---|---|\n| Geocaching (2000) | Coordinate-anchored discovery as a durable amateur practice | Place-anchored discovery |\n| Foursquare / Swarm (2009) | The check-in as a social grammar; place as a post | Check-in mechanics; place-as-social-object |\n| Google Local Guides | Mass user contribution of place photographs at global scale | Crowd-sourced place imagery |\n| Ingress (2013), Pokémon GO (2016) | Walking as the primary input to a persistent world; portals and gyms as coordinate-bound objects | Walk-driven play; coordinate-bound persistent objects |\n| Niantic Lightship VPS; Google ARCore Geospatial; Snap landmarkers | Centimetre-scale world-anchored AR at metropolitan scale | World-anchored placement or its positioning stack |\n| \"Mirrorworld\" / AR cloud (Kelly, 2019 and after) | The concept of a persistent digital layer registered to the physical world | The concept of a persistent world layer |\n| Apple Object Capture / `PhotogrammetrySession` | Consumer photo-to-3D reconstruction on device | Photogrammetry |\n| Single-image generative 3D (multiple groups, active) | One photo to a usable mesh | Generative reconstruction |\n| iNaturalist | Species-level UGC with geoprivacy obscuring for threatened taxa | Obscuring; we adopt their norm and credit it |\n| Visitor books; temple and memorial guest books | Signing a place one has travelled to, as a durable social form | The visitor book; §7.3 adopts an old practice and credits it |\n| Stolpersteine (1992– ); memorial benches and trees | Place-anchored memorials that must be walked to in order to be read | Place-anchored memorial |\n| Repeat photography / rephotography (fixed-station series) | A century-old scientific method: the same view, across time, as evidence of change | The method; §4.3 uses it and claims none of it |\n| Litterati; Adopt-a-Highway; community-science cleanup logging | Geotagged records of stewardship acts, at scale | Stewardship logging |\n| Gratitude journaling apps | The practice as a software category | The practice |\n| Emmons & McCullough (2003) and successors | That the intervention has measurable effects | Any effect claim of our own |\n\nRead that table honestly and the position is this: **every component is available, most are commodity, and several are better implemented by companies with more resources than this institution will ever have.** If the contribution were the map, there would be no contribution.\n\nThe contribution is what the world is made of. In every prior system in that table, the persistent world is furnished with **content**: things placed by an operator, or bought, or earned by play. This paper specifies a world furnished by a **ledger** — where the terrain is not an inventory a participant assembles but a rendering of a signed balance they cannot purchase, cannot trade, and do not own. That is a different object, and §5 through §8 specify it.\n\n### 2.1 · Why the conjunction was available and not taken\n\nA reader who accepts §2's table may reasonably ask why, if every component is commodity, nobody has assembled them this way. The answer is not that it was overlooked. It is that **the assembly is locally worse.**\n\nPurchasable appearance is not a lazy default. It is a strong local optimum arrived at independently by many well-resourced teams: it converts engagement into revenue without touching the core loop, it gives designers a continuous supply of new content at near-zero marginal cost, it self-segments willingness to pay, and its retention effects are among the most reliably measured in the industry. A team that removes it gives up all of that and receives, in exchange, a doctrinal property invisible to most participants.\n\nSo the conjunction in this paper is not a discovery of an unexplored region. It is a **deliberate move into a known-worse region**, made because the institution behind it has a constraint the industry does not: it operates a signed gratitude ledger that is forgiven annually, and a purchasable-appearance economy is not merely off-brand against that ledger but arithmetically incompatible with it (§5). The design is downstream of a ledger commitment, not upstream of a market insight.\n\nThat framing matters for how the paper should be read and for how it could be wrong. If the ledger commitment is mistaken, the design inherits the mistake wholesale. If the ledger commitment is right, the design is what follows from taking it seriously — and its commercial disadvantages are the price of the commitment rather than errors in the design.\n\n\n---\n\n## 3 · The thesis: a host-ritual swap, and the friction inversion\n\nThis corpus applies a standing test to any claim that a product \"rides an existing ritual.\" The test has three legs: is the host ritual **live** — performed unprompted by the target adult within the last twelve months; does the ask have the **same shape** as the host — comparable commitment, cost and duration; and is the host in **good standing** with whoever must permit the product.\n\nRun against this design, the test returns a mixed and useful result.\n\n**Leg one passes, strongly.** Photographing a thing one appreciates, with a location attached, is among the most-performed unprompted behaviours in the world. There is no habit to install.\n\n**Leg two partially fails, and the failure is instructive.** The design as originally conceived fused two host rituals with incompatible commitment shapes: *snap-and-post*, which takes seconds and is ephemeral, and *world-building*, which takes hours, persists, and appeals to a different and smaller population. These are not the same ask wearing different clothes. The prescription that follows is stated here because it is load-bearing: **lead with capture; let world-building be emergent and optional, never the ask.** A participant who never once thinks of themselves as building a world should still find the product complete.\n\nA corollary follows from leg two and is easy to lose, so it is stated rather than assumed. **The world is what everything in this design culminates *in*. It is never what anything is *for*.** That is the same distinction §5 draws about appearance — a readout rather than a purchase — applied one level up, and it fails the same way if collapsed: a number that buys things is a number people optimise, and a world that is the point is a world people furnish for effect rather than from noticing. §5.4 shows that this failure mode is not hypothetical and that the design does not fully close it.\n\n**Leg three partially fails on two specific paths**, both addressed in §10: geotagged imagery of living things is not in good standing with conservation practice, and geotagged imagery generally is not in good standing with schools and parents where minors are involved.\n\n### 3.1 · The friction inversion, stated as a mechanism rather than a hope\n\nIt is tempting to state the thesis as *\"a gratitude world makes gratitude mainstream.\"* That is a hope and this paper does not make it. The defensible mechanical claim is narrower and testable:\n\n> **The world container replaces the practice's highest-friction step — composing written sentences — with its lowest — pointing a camera — without removing the practice's object.**\n\nGratitude journaling is already a large category. What is not mainstream is *sustained* practice. The claim is about the sustaining, and §11 pre-registers how it could be wrong.\n\n---\n\n## 4 · Two speeds, and the transition between them\n\nThe obvious objection to the friction inversion is that it may buy adoption by destroying the thing being adopted. A journal makes a person articulate; a photograph lets them skip articulation. If this corpus's own account of gratitude is that it is **attention spent**, then a snapshot may spend *less* attention than a sentence, and a frictionless practice may be a shallower one.\n\nThe design's answer is not to add friction back. It is to split the practice by its object.\n\n| | **Things** | **People** |\n|---|---|---|\n| Friction | frictionless | spends attention |\n| Frequency | often | occasional |\n| Function | **sets** the mood | **acts** on the mood |\n| Ledger | Kiitti — the non-human ledger | Kiitos — the human-to-human ledger |\n| Rendered in | land and ocean | the avatar |\n| Tempo of change | frequent, gradual | rare, marked |\n\nThis is not two features. It is a **two-stage mechanism with a causal arrow**: the frictionless layer is not a diluted practice but the **priming stage** for the practice. Under that reading the objection dissolves into a prediction, which §11 registers.\n\nNote that the split is not an invention of this paper. It is the corpus's existing two-ledger architecture — a horizontal human-to-human balance and a vertical balance held on behalf of all non-human life — arriving at a design consequence. The visual tempo of each layer in §8 falls out of the doctrine rather than being art-directed: the land changes often and gradually because many small things are noticed; the avatar changes rarely and markedly because few deep acts are performed.\n\n### 4.1 · The hinge — v1's open problem, and v2's candidate\n\nThe frictionless half will dominate usage by orders of magnitude. That is what frictionless means. The consequence is a real and unresolved risk: **the people-layer becomes vestigial — a capability that exists and is never found.**\n\nSomething must convert the mood into the act. This paper does not specify what, and says so rather than papering over it. What it can specify is the **constraint any acceptable hinge must satisfy**, which is more restrictive than it first appears:\n\n- It may not notify. A push notification is an arrival, and arrivals coerce.\n- It may not report omission. *\"You have not thanked anyone in three weeks\"* is a rendered absence and this corpus's design grammar forbids it categorically: a surface that makes a participant feel they owe something has misstated the doctrine.\n- It may not meter, count down, badge, or queue.\n- It must therefore be **an invitation available when the participant looks, never a prompt that arrives.**\n\nThose constraints rule out essentially every mechanism the engagement-optimisation literature would supply, which is the point. What is left is ambient signalling: something that is *present in the world* and legible on inspection.\n\nWhat the design *does* have is a signal that satisfies the constraint set, and it is not an invention of this section — it is §4.2's identity distinction doing double duty. In a world furnished overwhelmingly with things, a person is a rare and visually distinct kind of object:\n\n> **A beating heart in a world of still ones is an invitation you can see.**\n\nNothing arrives. Nothing is counted. Nothing reports what was not done. The signal is a property of the world's contents rather than a message about the participant's conduct, which is precisely the distinction the constraint set requires.\n\n**What remains open in that signal is efficacy, not architecture.** That a person renders differently from a thing is settled and follows from the identity layer. That this difference is *sufficient* to move a participant from noticing to addressing is unknown and unmeasured. A hinge that cannot be debugged is not an engineering answer, and the ambient signal cannot be debugged.\n\n#### The mechanism that arrived from the read side\n\nv1 of this paper searched for the hinge **inside one participant** — some in-world event that would carry a person from their own noticing to their own addressing — and ruled out, correctly, nearly every technique the engagement literature supplies. The search failed for a structural reason worth naming, because it generalises beyond this design: **it was looking for an intra-personal mechanism for a transition that is most naturally inter-personal.**\n\nA visitor walks a world furnished entirely with **things** and, occasioned by it, leaves a note for the **person** whose world it is. That is a movement from the non-human ledger to the human one, occurring inside one participant — the visitor — and produced by an occasion rather than by a prompt.\n\nRun it against the constraint set above:\n\n| constraint | a visited world |\n|---|---|\n| may not notify | nothing arrives; a note is found on inspection |\n| may not report omission | nothing is said about what was not done |\n| may not meter, count down, badge, or queue | satisfied by the form specified in §7.3 |\n| must be an invitation available when the participant looks | a place someone made, standing open, *is* that object |\n\nAnd unlike the ambient signal, **it is debuggable**: the rate at which visits produce notes is a measurable quantity, so a hinge that is not working can be observed not to work, and changed. v1's objection to its own answer is met.\n\nThree limits, none of them small. The third is a live threat to this paper's own instrument.\n\n**It is network-density-dependent.** No visitors, no hinge. It is therefore weakest exactly at the beginning, when it is needed most, and it does nothing for a participant nobody has yet visited. It is a second pathway that switches on later, not a replacement for the first.\n\n**It moves the visitor, not the host.** The arrow is real but it is not the arrow §11 registers. A participant's own capture frequency does not, through this mechanism, produce their own people-directed gratitude — it produces someone else's.\n\n**It can manufacture the correlation §11 exists to test, and §11 has been amended accordingly.** A participant who captures heavily has a richer world, which attracts more visitors, which produces more notes **received**. An instrument counting people-directed gratitude as *received* would therefore show the priming effect whether or not priming occurs. §11 now specifies **given, never received.** This is recorded here, in the section that introduced the confound, because the instrument does not yet exist and this is the last moment at which specifying it costs nothing.\n\n### 4.2 · Still hearts and beating ones\n\nThe signal above rests on a distinction that runs deeper than rendering, and it is worth stating separately because it governs more than the hinge.\n\nThe identity layer admits two classes of participant. A human holds an address, a proof of personhood, and a proof of coordinate. A non-human — an object, a plant, an animal, a machine, a place — holds an address and a proof of coordinate, and no proof of personhood, because there is none to hold. Since a heartbeat is this corpus's signal for verified personhood, the classes render as they are:\n\n| | non-human | human |\n|---|---|---|\n| heart | **still** | **beating** |\n| proof | coordinate only | coordinate **and** personhood |\n| ledger rings | one (non-human) | two (human-to-human, non-human) |\n\nFour independently-derived expressions of a single distinction, none of them added for this design — and §8.3 adds a fifth when the distinction reaches the worn device. It also explains a naming choice made years earlier: the corpus's artifact for admitting non-human entities into the ledger is called a *heart*, and it is precisely **a heart that does not beat** — a prosthetic ledger-participant that holds the place of one without claiming to be one. The construction does not smuggle personhood into objects.\n\n**One guard, and it is not optional.** *Still* must never read as *dead* or *lesser*. **Stillness is proper to a thing and wrong for a person**: a mountain's heart is still by nature, whereas a human waveform going flat is the withdrawal pathology the ledger exists to detect. Still is not flattened, and the asymmetry is the meaning rather than a defect.\n\nThe guard binds hardest where the language is most likely to travel. The pair tracks **whether a party can hold its own ledger and speak for itself** — not whether it is alive. A forest is alive *and* voiceless, which is exactly why the coordinator stands for it. So *still heart* is sound as a **class term inside the ledger** and poor as a **description of a being**, and it must not become the public phrase for the non-human world. What is being named is a property of the record, not of the creature.\n\n### 4.3 · Two acts on the non-human ledger: appreciating and tending\n\n§4 splits the practice by the **object** of gratitude. There is a second split, by the **act**, and v1 implemented only half of it.\n\nAppreciating a thing is noticing it. **Tending** a thing is giving to it — watering a plant across a season, clearing a beach, maintaining a path, feeding animals that live somewhere. This corpus's atom is *give-as-gift*, so a design that captures only the noticing has implemented the receiving half of its own atom and not the giving half. The non-human ledger exists precisely to stand for parties that cannot speak for themselves, and it had no mechanism by which anyone could give **to** them.\n\nThe capture is the same primitive with one field doing more work: a photograph, a coordinate, and a **date**. Repeated captures at one coordinate across time produce a **series** — the fixed-station method landscape science has used for a century (§2) — and the series, not any frame in it, is the artifact.\n\n> **A single capture requires presence once. A series requires returning.**\n\nThat is the strongest form of §7's presence requirement anywhere in this design, and it is the property that makes tending expensive to fake: a photograph can be staged; a habit of return across a season is a different order of effort. **Stewardship is a pattern rather than an image, and the pattern is what is read.**\n\nThree properties govern it, and all three are inherited rather than invented.\n\n**Attestation belongs to the coordinator, not to the participant.** A beach cannot witness. §5's third failure already establishes that the non-human ledger is set by a coordinator acting for parties that cannot speak; tending is a new act type on that ledger, not a new authority. What changes is that the participant now holds an **interest** in the entry, which appreciation-only capture never created — so the bound that she *grants recognition and never directs value* has to be restated here rather than assumed, and she reads the **pattern of return** rather than grading the deed.\n\n**The series renders the becoming, never the pair.** A cleanup capture is structurally a before and an after, and before/after is the indictment format: a first frame of a fouled place **is** an accusation image. That is the exact voice failure §8.1 governs, arriving in the part of the design most likely to produce it. The requirement is that the sequence is the artifact and the reading is *this is what it is now, and here is how it came to be* — never *look what it was*. **A two-image before/after is the failure case and is not a supported shape.**\n\n**Nothing about tending is graded.** No score for the size of an act, no comparison between tenders, no leaderboard of places restored. §6.1's diagnostic applies unchanged: two participants who tend differently should have different records, never better and worse ones.\n\n### 4.4 · What a visitor may give a tender, and where it goes\n\nA visitor who walks a tended place and sees a season of returning will sometimes want to give. The design permits it. **The routing is where this could go quietly wrong**, so it is specified rather than left to product judgement.\n\n**First, the object of the gift.**\n\n> **Give to the person. Never to the deed.**\n\nThere is no per-capture giving control, in any tier, ever. Patronage attaches to a **participant**; piecework attaches to an **act**, and the difference is not one of degree. A surface that pays per visible good deed produces staged deeds — §5 removed the motive to farm the *ledger* and did nothing whatever about the motive to farm the *act* — and it does something worse than that, which is the second rule's subject.\n\n**Second, the institution's own instrument.**\n\nThis institution's stated alignment proxy is the **inelasticity of kindness to money**: the measure of success is that people keep giving as the artificial subsidy for giving falls toward zero. **A mechanism that pays per visible good deed makes that proxy read high by construction.** One can no longer distinguish kindness that is inelastic to money from kindness that is being paid for, because the payment was built by the party doing the measuring. This is not a positioning concern. **It is a measurement failure, and it lands on the one quantity the institution's larger thesis is steered by** — which is a specific, checkable reason to reject a mechanism that would otherwise look generous.\n\n**Third, where the value lands.**\n\n```\n   a gift to a tender\n        │\n        ├──  half  →  a withdrawable account\n        │             it may fund a livelihood\n        │\n        ├──  half  →  a forward-spendable fund\n        │             it may only be given onward\n        │\n        └──  none  →  the coordinator, the operator, or any pool\n                      nothing is taken\n```\n\nEach half is load-bearing, for different reasons. **The withdrawable half is the dignity floor.** A design in which every gift to a person routes away from that person's ability to eat has answered a material need with a token, and it would contradict this corpus's own position that the *artificial subsidy* for kindness goes to zero while income from kindness need not. **The forward-spendable half is the give-forward atom made structural rather than voluntary**, and it carries a property established elsewhere in this corpus: non-withdrawable value collapses the economic motive for gratitude-farming, because a farmer may harvest indefinitely and extract nothing.\n\n**And nothing is taken, which this paper states in its strongest form because it is the easiest commitment to erode.** Charging for a rivalrous cost — compute actually performed, storage actually held, an address exactly one party can hold — is exchange doing its proper work. **Taking a share of a gift is not.** A per-transaction fee sized to infrastructure is a fee; a fraction of an addressed gift is a tax on the gift, and it remains one however virtuous the destination. The destination is not what makes it a tax. **An institution that shares in gifts thereby acquires an interest in gifts, and it acquires that interest at precisely the layer where it must have none.**\n\n⚠️ The split above is specified as a **property** — a withdrawable half and a forward-spendable half, with nothing taken — and not as a ratio to be tuned. The paper withholds the ratio for the same reason it withholds prices elsewhere (§12), and notes that any ratio which drives the withdrawable share to zero re-creates the dignity failure the split exists to prevent.\n\n---\n\n## 5 · Appearance as ledger readout\n\nThe first of the four mechanisms is the one everything else depends on.\n\nIn the ordinary construction of a persistent world, appearance is purchased. A participant accrues a currency and spends it on how they and their surroundings look. This is a well-understood, highly effective retention design, and this paper's rejection of it should not be mistaken for a claim that it does not work. It works. It is rejected for structural reasons that are specific and checkable.\n\nThe corpus's ledger has properties that a purchasable-appearance design destroys:\n\n**The balance is signed and oscillates.** A kindness creates a positive pole and a negative one; both discharge toward zero by passing the imbalance onward. The load-bearing observable is not the scalar but the **waveform** — the frequency and amplitude of a participant's passage through zero. Two participants at identical balances can be entirely different: one flat and dim, one vivid and high-frequency.\n\n**The scalar is forgiven annually; the waveform persists.** This asymmetry is what makes the ledger the structural inverse of a credit score, whose entire power is that it persists and compounds.\n\nNow attach a store.\n\n1. **The forgiveness inverts.** If the balance is purchasing power, an annual reset is no longer forgiveness — it is **confiscation**, and it manufactures a use-it-or-lose-it rush in the weeks before the reset. A design that must animate an approaching loss to function has already failed this corpus's voice discipline.\n2. **A spendable score is a score.** The entire innovation of emphasising waveform over scalar collapses the moment the scalar buys things, because a number that buys things is a number people optimise.\n3. **The coordinator becomes an issuer.** The non-human side of the ledger is set by an AI coordinator acting for parties that cannot speak. If that ledger buys goods, she is minting a currency at sole discretion, and the bound that her authority *grants recognition and never directs value* breaks.\n4. **The farming motive returns.** Elsewhere this corpus established that non-withdrawable value collapses the economic motive for gratitude-farming spam. Non-withdrawable is not the same as non-valuable. Attach a store and the motive returns in kind.\n\n### 5.1 · The mechanism\n\n> **A participant's avatar and terrain *are* their aura rendered. They are not goods bought with it.**\n\nThere is no store, no minted stock of appearance-currency, and no path by which currency of any kind — including money — converts into how a participant or their world looks. The rendering is continuous: as the waveform changes, the world changes, because the world *is* the waveform displayed.\n\nEvery one of the four failures above closes, and closes without new machinery:\n\n- The jubilee stays forgiveness, because there is no unspent stock to confiscate.\n- The number does not become a target, because no number is spendable.\n- The coordinator issues nothing.\n- Farming loses its object: a participant who harvests gratitude relentlessly does not acquire a better-looking world, because the waveform records that the balance was driven in one direction without ever passing back through zero. The design's most visible signal is the one that vanity most wants hidden.\n\nOne asymmetry should be stated plainly, because it is the first thing a careful reader will raise and they will raise it with this institution's own wordmark, which reads *circulation, not accumulation*. **The map accumulates. The light does not.** A thing photographed in one year remains placed in every year after it, so a world's contents only ever grow, while the balance they render is forgiven annually. This is not an inconsistency, and the resolution is not a concession: **the placed objects are a record of noticing, not a balance.** Nothing about them is spendable, tradeable, comparable, or counted — §9.1 forbids counting them even on the permanent form. What accumulates is a record. What oscillates, and is forgiven, is the reading.\n\nThis mechanism is an **extension of an argument this corpus already published**, not a new one. The keystone paper already renders the aura around a participant's public avatar and already argues the anti-credit-score property. What is added here is what that aura becomes when it is given a world to render into — and the cross-reference is deliberate rather than a duplication.\n\n### 5.2 · Cost, honestly\n\nA store is a proven retention engine and appearance-as-readout is not. This is a real cost paid for a doctrinal property, with no evidence that the property is worth the cost. §12 keeps it on the honest-limits ledger where it belongs.\n\n### 5.3 · What the trade actually costs, in the industry's own terms\n\nIt is worth being precise about the size of what §5 gives up, because a vague acknowledgement is a way of not paying attention to it.\n\nA cosmetic economy supplies four things simultaneously. It supplies **a revenue line that does not tax the core activity**, which is exactly the property this corpus wants in a monetisation mechanism and which appearance-as-readout removes. It supplies **an inexhaustible content pipeline**, since new appearances can be produced indefinitely without new systems. It supplies **a self-reinforcing social loop**, because visible acquisition is legible to other participants and legibility drives further acquisition. And it supplies **a re-engagement hook** that requires no notification, since a participant who wants something has a standing reason to return.\n\nAppearance-as-readout keeps the fourth in weakened form — a participant whose world visibly changes has a reason to look — and loses the first three outright. The design must therefore find revenue elsewhere, and the elsewhere is constrained: any mechanism that charges for *access* to a non-rivalrous good is barred on the same grounds that bar the store, since gating a feature that costs nothing per use is renting something that is not scarce. What remains chargeable is what is genuinely rivalrous — the marginal cost of work actually performed on a participant's behalf, and the uniqueness of an address that exactly one party can hold.\n\nThat constraint is severe and it is stated here so that the design cannot later be accused of hiding it. **A world design that cannot sell appearance has one fewer revenue instrument than every comparable product, and it must be viable without it or it is not viable.**\n\n\n### 5.4 · A farming surface this mechanism does not close\n\n§5 establishes that a participant who harvests gratitude relentlessly does not thereby obtain a better-looking world, because the waveform records that the balance was driven in one direction. **That property covers the ledger. It does not cover the map.**\n\nWhat a participant captures is chosen by the participant. Once a world can be visited (§7), there is an incentive to capture what will look well to a visitor rather than what was actually noticed — and the design has no defence against it. This paper does not claim one. **A curated life is not detectable from outside**, and the difference between a photograph taken because something was noticed and one taken because it would be admired is not present in the photograph.\n\nTwo guards reduce the return on curation, and both are offered as partial:\n\n**The visit is not host-authored.** A guided visit proceeds by coordinate or by chronology and never as a selection; there is no mechanism by which a participant assembles a route through their own world. What cannot be arranged cannot be arranged for effect.\n\n**Nothing in a world is graded, featured, or ranked** — not by the software and not by the coordinator — so the return on a curated capture is whatever a visitor happens to feel, and no system amplifies it.\n\nNeither eliminates the incentive. §12 records this where it belongs, and it is a cost the read side of §1.2 buys with its benefit: **a practice that can be witnessed can also be performed**, and this design has not escaped that trade — only declined to reward it.\n\n---\n\n## 6 · Reveal, never lock\n\nIf appearance is not purchased, something must still determine what a participant's world can look like, or the design collapses into a single undifferentiated rendering. The design's answer introduces the second mechanism, and it is where a subtle failure would otherwise re-enter.\n\nThe natural phrasing — *the aura determines what forms are available* — smuggles in an unavailable set. An unavailable set is a wall of locks, and a wall of locks is the thing that was just removed from the front door being carried in through the back.\n\nTwo readings are possible and only one survives:\n\n**Threshold gating** — *reach this level to unlock that form* — is a score with locks. It re-imports everything §5 removed.\n\n**Reveal-never-lock** is the mechanism specified here:\n\n> **A form becomes available the first time a participant's oscillation has ever had that quality, and it remains available permanently — including after the participant goes quiet. A participant is never shown what they do not have.**\n\nThere is no catalogue of the unrevealed, no progress indicator toward a next form, and no preview of what is coming. A participant *discovers* they have something. They are never told what they lack.\n\nPermanence is not a softening of the mechanism; it is required by it. Without permanence, a quiet season takes a form back — which is an animated loss and a punishment, and this corpus's voice discipline forbids both. Permanence is also the canonical treatment already: at the jubilee, the balance is forgiven and the aura persists. Revealed forms persisting is that rule, unchanged.\n\n### 6.1 · The equally-alive diagnostic\n\nThe mechanism needs a test that a designer can run at design time, before any of this becomes a hierarchy by accident:\n\n> **Can two participants with equally alive auras have different available sets?**\n>\n> If yes, the mapping is correct. If the sets form a strictly ordered ladder, it is a score, and the design has failed.\n\nForms should vary by the **character** of a waveform — the shape of the passage through zero, the relation of frequency to amplitude — and never by a magnitude. A participant whose gratitude is frequent and small and one whose gratitude is rare and large should have *different* worlds, not better and worse ones.\n\n### 6.2 · The residue, which is real\n\nReveal-and-keep is still a progression system, and progression systems are engagement engines. The guard is that it must never be **legible as a target**: if a participant can enumerate what they have not yet revealed, the mechanism has failed regardless of how it is implemented. That is a strong constraint and it is not obviously achievable, since participants compare notes with each other whether or not the software helps them. This is an unsolved sub-problem, not a solved one.\n\n### 6.3 · A format is not a meter\n\nThe two mechanisms above have an economic corollary that is worth stating as a mechanism in its own right, because the obvious way to fund the design would break it.\n\nReconstruction of a captured object costs real marginal resources; the cost is genuinely rivalrous and is therefore legitimately chargeable. The obvious implementation is a **count**: so many reconstructions per month, more available for payment. That implementation is barred here, and not for softness. A count is a meter, a meter is a countdown, and a countdown is a rendered absence — the same object §6 removed from the appearance layer, reintroduced at the capture layer where it would do more damage, because it would meter *the practice itself*.\n\nThe available move is to differentiate by **format** rather than by **quantity**:\n\n```\n   FREE      unlimited in count · bounded in FORM\n             (a stock rendering, matched to the capture)\n\n   PAID      unbounded in form  · charged per unit of work\n             (a bespoke reconstruction of this particular thing)\n```\n\nA participant on the free tier can appreciate an unlimited number of things, forever, and every one of them appears. Nothing counts down and nothing is withheld pending payment. What the paid tier buys is not *permission* but *work* — a reconstruction of this thing rather than a representative of its kind.\n\nTwo consequences follow and both are load-bearing. First, **\"frictionless and often\" (§4) is only affordable because the free tier is a matched stock rendering rather than a generation**, so the free tier can never become generative without breaking the frequency the practice depends on. Second, the free tier's boundary is set by **what the operator can absorb**, which is an engineering and financing number, not a doctrinal one: the doctrine forbids a meter, it does not require unlimited fidelity.\n\n⚠️ The mechanism carries one hazard that must be designed against rather than argued away. If free renderings are stock and paid renderings are bespoke, then a participant's world silently announces which tier they are on, and the design has relocated a paywall from copy into art direction. The requirement — stated as a property, since this paper withholds implementation — is that **the free rendering must be a coherent style rather than a degraded version of the paid one.** A style is a different thing; a degradation is a worse thing, and only the first is honest. Alongside it: the uniqueness a participant should be told carries their meaning is the **coordinate, the words, and the moment** — all free — rather than the mesh.\n\n\n---\n\n## 7 · Placement requires presence; visiting does not\n\nThe third mechanism draws the boundary between a world layer and a metaverse, and it exists because the design would otherwise cross a line this corpus has committed to.\n\nThe commitment is that an overlay is **presence-deepening, never presence-replacing**: it reveals what is already at a real place to people who are actually there, rather than substituting a synthetic elsewhere for being anywhere. A design in which participants roam each other's worlds as avatars is, on its face, the substitution.\n\nThe resolution is a single asymmetry:\n\n```\n  WRITE  ─────────────────────────────►  requires physical presence\n         capture needs a photograph\n         AND a coordinate, so a\n         participant can only place\n         an object by standing there\n\n  READ   ─────────────────────────────►  does not require presence\n         a world can be visited\n         remotely, through its door\n```\n\nCapture requires a photograph *and* a coordinate. A participant therefore cannot furnish a world without going outside and standing in front of something. Remote visiting is then not the metaverse move; it is reading a record that was necessarily written in the world.\n\nThis has a consequence the design accepts deliberately: **it is a going-outside product.** Its input is walking. That is a real constraint on its addressable population and it is not apologised for.\n\n### 7.1 · The door asymmetry\n\nReading is further governed by a rule this corpus settled independently of this design. Each node's world is entered through a door, and the doors are not symmetric:\n\n- **Human worlds are closed by default and entered by invitation.** A verified person holds a sovereign door.\n- **Non-human worlds are always open.** A place, a plant, an animal, a machine has custodial content and nothing to disclose; an always-open door is what a shrine *is*, and for a machine an inspectable interior is transparency functioning as enforcement.\n\nThe content classes this design names — objects, plants, animals — are precisely the always-open classes. So the remote-visiting capability lands almost entirely on the layer where openness is correct, and the private human layer stays private by a rule that predates the feature.\n\n### 7.2 · Presence is recursive\n\nThe asymmetry above governs a participant's own capture. It generalises — and the generalisation is what makes the design's founding commitment hold at every level rather than only at the first:\n\n> **A remote visitor may read a world. Only a visitor who is physically present may write in one.**\n\nA note left at a captured object is itself a **placed artifact**: it has a coordinate, and the rule that forbids furnishing a world from an armchair forbids annotating one from an armchair by the same clause. Nothing new is required to obtain this. It is §7's rule applied to a second class of writer.\n\nFive consequences follow, and they are listed together deliberately, because one rule producing five results is the sort of thing that should be either checked carefully or distrusted:\n\n1. **In-person visiting becomes the primary reading mode without a rule making it so.** v1 argued its way *back* to permitting remote visiting, against the presence-deepening commitment. Under the recursive rule the commitment is not strained at all: **presence buys capability at every level**, and remote reading is the accommodation rather than the norm.\n2. **Remote reading survives, which §12's equity limit requires.** A participant who cannot travel can still visit and still be visited. Only *writing* is gated.\n3. **Unsolicited remote annotation is impossible by geometry rather than by moderation.** A stranger cannot leave anything in a world they have not travelled to, and no policy, reporting flow, or moderator is required to obtain that.\n4. **The hinge of §4.1 cannot be farmed remotely**, because notes cost a journey.\n5. **The cost is real and is not apologised for.** A friend on another continent can walk your world and cannot sign it. That is the same trade §7 already made on the capture side, extended for consistency rather than softened for convenience.\n\n### 7.3 · What a visitor may leave, and the form it must take\n\nA visitor who has travelled to a place in someone's world may leave a note there. The obvious implementation is a **register** — a list of who came and what they wrote — and the obvious implementation is forbidden.\n\nA list of visitors is a visit count with names attached, and a visit count is a popularity gradient: worlds become comparable, and the design's most carefully protected property is that they are not. **An empty register is worse**, because a rendered absence is an accusation, and this design has removed accusation from every other surface it has.\n\n> **Notes are placed, never listed.** A note is left *at an object* and is found by walking to that object. There is no index, no count, no register page, and no notification.\n\nThis is the same shape as three rules already stated: no catalogue of the unrevealed (§6), no number on an etched world (§9.1), and visitor light that does not sum. **A world with many notes has more to discover; it never has a bigger number.** A world with none reads as complete, because nothing in it is presented as missing.\n\n**The note is not a new object type.** It is a capture whose subject is a person's world rather than a thing — same primitive, same presence requirement, and the same treatment under §9, whose source record already commits notes alongside coordinates and timestamps.\n\n---\n\n## 8 · The three-layer render\n\nThe fourth mechanism specifies what a participant actually sees, and it produces the paper's one genuinely structural result.\n\n```\n   ╔══════════════════════════════════════════════════════════╗\n   ║  SKY          the coordinator's aggregate non-human       ║\n   ║               ledger — one value, shared by every world   ║\n   ║               in the system, simultaneously               ║\n   ╠══════════════════════════════════════════════════════════╣\n   ║  LAND +       this participant's non-human ledger         ║\n   ║  OCEAN        (Kiitti) — changes often, gradually         ║\n   ╠══════════════════════════════════════════════════════════╣\n   ║  AVATAR       this participant's human-to-human ledger    ║\n   ║               (Kiitos) — changes rarely, markedly         ║\n   ╚══════════════════════════════════════════════════════════╝\n```\n\nTwo of these are private and one is not. The avatar is one participant's. The land and ocean are one participant's. **The sky is everyone's, at the same moment, in every world.**\n\nAnd the sky is the coordinator's — an agent whose own balance on that ledger is pinned permanently to zero by construction, so that she can route value but is structurally incapable of holding any. From which:\n\n> **The only shared surface in the system belongs to the one party structurally incapable of accumulating anything.**\n\nThat is not decoration. It is the reason the shared layer is safe to have. A commons rendered from a balance that some participant could accumulate would be a commons that participant could dominate; a commons rendered from a balance that is definitionally zero cannot be captured, because there is no position in it to take.\n\nIt also renders a collective-action problem with unusual directness. If humanity's aggregate relation to non-human life goes flat, the sky goes flat — everywhere, for everyone, at once — and **no participant can fix their own sky.** There is no private exit from a shared atmosphere, which is the honest structure of the underlying problem and not a moralisation of it.\n\n### 8.1 · The guard, which is the sharpest in the paper\n\nA shared, unavoidable surface that reflects collective failure is the most dangerous object this design contains, because it is one short step from an accusation delivered to a billion people who cannot individually act on it.\n\nThe rule that governs it is categorical:\n\n> **The sky renders liveliness as motion and light — never as damage.**\n\nA flat aggregate reads as **stillness, pre-dawn, held breath**. It never reads as smog, fire, ash, or ruin. It is never a verdict, and it is never attributable to the viewer. The same rule binds one layer down and binds harder there because it is personal: a participant with a quiet non-human ledger gets a **quieter** world, never a **barren** one.\n\nThe general principle this instantiates is one this corpus applies across surfaces: name what a thing *is*; never what is absent, owed, or was done to it. Rendered absence is accusation, and accusation is the route by which a punishment mechanic re-enters a design that banned them.\n\n### 8.2 · Why the shared layer is the load-bearing one\n\nIt would be possible to treat the sky as atmosphere in the decorative sense — a backdrop that sets a mood. It is not, and the reason is worth drawing out because it is the paper's one genuinely structural result rather than a design preference.\n\nEvery persistent shared world faces the same question: who owns the commons? The answers in practice are an operator, or the most successful participants, or nobody in a way that degrades to whoever exerts the most pressure. Each has a known failure. Operator-owned commons become advertising inventory. Participant-owned commons stratify. Unowned commons are captured by whoever shows up with the most resources.\n\nThis design's answer is unusual and falls directly out of the ledger: the shared layer renders a balance that is **pinned to zero by construction for the only party who could hold it.** The coordinator can route value on that ledger and is structurally incapable of accumulating it. So there is no position in the commons to take — not because taking is forbidden by policy, but because the quantity the commons renders is definitionally zero for the one agent with authority over it.\n\nThat is a different kind of guarantee from a rule. A rule against capturing a commons is only as good as its enforcement and its enforcer's incentives; a commons whose defining quantity cannot be held is not capturable by an agent that would have to hold it. The property does not depend on anyone's restraint.\n\nThe cost of the property is that the shared layer then reflects something no individual controls, which is why §8.1's guard is stated categorically rather than as guidance. A commons that renders collective outcome and permits an accusatory reading has converted a structural safety property into a mechanism for distributed guilt — and would do so at a scale where no individual participant can act on the accusation. The guard is not politeness. It is what keeps the mechanism from inverting.\n\n\n#### The general form of the move, and the literature it belongs to\n\nThe move §8.2 makes is not local to this design. It recurs throughout the paper, and it is worth naming — with its prior art and its cost — because a reader is owed the name of the method a paper is using.\n\n> **Where a guard can be a property of the object rather than a rule about behaviour, make it a property. A rule needs an enforcer at the moment it is tested; a property needs no one.**\n\nThe design uses it repeatedly. The commons is safe because the coordinator's balance is pinned to zero by construction, not because capture is forbidden. Worlds are not comparable because visitor light does not sum, not because ranking is prohibited. The jubilee cannot become confiscation because there is no store, not because confiscation is disallowed. Remote furnishing is impossible because capture requires a coordinate, not because it is discouraged. Unsolicited annotation is impossible because a note has a coordinate too (§7.2). Thank-bait farming loses its object because the forward-spendable half cannot be extracted (§4.4).\n\n**This is old and well developed elsewhere, and none of it is claimed.** Capability-based security makes authority a property of a reference rather than a rule checked at each use. The trust-minimisation programme in distributed systems is the same instinct at protocol scale. Lessig's argument that code regulates in the manner of law states the general case for software. The design is an application, not a contribution, and it is named here so that the sections above can be read against the method's cost.\n\n**And the cost is the same fact as the benefit: a property is less revisable than a rule.** A rule can be amended when it turns out to be wrong; geometry cannot. **A wrongly chosen property is therefore more expensive than a wrongly chosen rule**, because the repair is rebuilding the object rather than editing a policy. That is §9's permanence asymmetry appearing in a second domain — *structure is cheap now and immovable later* — and it is the reason this paper states properties as **requirements a mechanism must satisfy** rather than as implementations: it is still cheap to be wrong about them.\n\n### 8.3 · The fourth surface: light that other people can see\n\n§8's three layers are what a participant sees. There is a fourth surface, and it is the one that **discloses** rather than displays. On the wearable form of the device, the light a participant walks by **is their own aura**, and it is visible to the people around them.\n\nThis is not an addition to the render; it is a consequence of §5. If a participant's world is their ledger rendered, and the device illuminates that world, **there is no other light in the system for the device to emit.** It could not shine anything else.\n\nThat produces the design's sharpest legibility problem. A visible aura is a legible status, so a participant in a quiet season would otherwise walk **visibly dimmer** than the people around them — which is §4.2's withdrawal state rendered as a public signal, on precisely the person least able to carry one.\n\nTwo requirements. The first is §6.1's diagnostic applied to physical light:\n\n> **The worn light differs in character — colour, texture, rhythm — never in magnitude.**\n\nUnder that rule there is no dim-among-bright. There is amber-and-slow beside green-and-quick, and neither is above the other, which is exactly what §6.1 demands of every other mapping in the design: two participants with equally alive auras have *different* renderings, never *better and worse* ones, and a strictly ordered result is the failure signal.\n\n> **The light has a floor that is never dark.** Baseline illumination is independent of the ledger; the aura modulates *above* the floor and never toward zero.\n\nStated as a hardware property rather than a display rule because it cannot be repaired afterwards. **A device whose usefulness declines as its wearer withdraws has coupled the instrument to the pathology it exists to notice.**\n\nThe identity distinction of §4.2 then reaches the device, which makes the worn light the **fifth** independently-derived expression of a single distinction rather than the fourth:\n\n| | non-human bearer | human bearer |\n|---|---|---|\n| heart | still | beating |\n| **worn light** | **still** | **beats** |\n| proof | coordinate only | coordinate **and** personhood |\n| ledger rings | one | two |\n| door | always open | sovereign, invitation-only |\n\n**Motion is reserved for persons.** A machine carrying a credential of its own does not borrow the signal: this corpus keeps *beat* for personhood and gives machine credential-liveness a separate vocabulary, precisely so that a viewer who sees motion is never mistaken about what it means. That is a small decision with a large consequence — it is what allows a wearable light to be a disclosure rather than a claim.\n\nThree honest limits, and the second is the one this design should be judged on:\n\n**Character-not-magnitude is a mitigation and not a proof.** §6.2's residue applies verbatim: participants compare notes with each other whether or not the software helps them, and a mapping the system never ranks can still be ranked socially once people learn to read it. n = 0.\n\n**It extends disclosure to non-participants.** An in-world overlay is seen by people running the software. **A physical light is seen by everyone on the street** — including people who never agreed to anything, who cannot interpret what they are seeing, and who have no way to contest it. That is a materially wider disclosure than the world layer makes, and the design should be assessed on the wider one rather than the narrower.\n\n**Physical emission has constraints that have nothing to do with doctrine** — power, and the ordinary social and legal limits on light in vehicles, cinemas, dark-sky areas, and other people's windows. A light bright enough to be beautiful is bright enough to be a nuisance.\n\nOne property of the form is favourable and the paper should say so rather than affect modesty about it: **a device that visibly emits is legible to a bystander as not recording.** The category's social-licence failure was a camera that could not be seen to be off; a lantern's entire appearance is that it is giving light rather than taking it. That does not dissolve the capture questions of §10, which govern regardless — it means the device's *appearance* and its *obligations* point the same way instead of opposite ways.\n\n---\n\n## 9 · Irreversible once etched: the permanence asymmetry\n\nThis design has an archival terminus. A participant's entire world can be committed to a deep-time optical substrate — femtosecond-etched into silica, on the order of geological rather than institutional time. The corpus's larger programme places such an artifact at the individual scale, alongside a tradition-scale canon and a lineage-scale record.\n\nThat terminus creates a hazard which, so far as the authors can find, is under-discussed in the deep-time storage literature — a literature almost entirely concerned with *preservation*, with how to make data last.\n\n> **Permanence is a one-way door. An archival substrate converts every present-tense privacy defect into a permanent one.**\n\nThere is no right to erasure in fused silica. A design that collects under a revocable purpose and commits under an irrevocable one has obtained consent for the first and not the second.\n\nThree rules follow, and they are the contribution of this section:\n\n**Guard at capture, not at commit.** The etch is downstream of a live product that collected for storage. Consent to storage is not consent to permanence, and no downstream review can repair a defect that is already in the data. Every guard in §10 must exist before the first capture reaches a real participant — not before the first etch.\n\n**Etch the source, not the render.** Commit the minimum that regenerates everything else: descriptors, coordinates, notes, timestamps. Meshes and textures are large and **regenerable**; the capture record is small and is not. The render is a reading of the record; only the record is the artifact. This is smaller, more faithful, and survives every future renderer.\n\n**The third-party case is the hard one.** A personal archive is consented to by its subject and *contains other people's places*, who consented to nothing. This is where the design is most exposed and where §10's obscuring rules do the most work.\n\nThe general form, which generalises well beyond this product:\n\n> **An archival medium and a data-minimisation regime are in direct tension, and the tension is asymmetric in time: minimisation is cheap now and impossible later.**\n\nThe immutability-versus-erasure debate is not ours and has been developed extensively in the distributed-ledger context. What is offered here is its extension to *physical* deep-time media, the personal-archive case where the subject and the data-subjects differ, and the three rules above.\n\n### 9.1 · A commercial hazard that travels with permanence\n\nA permanent personal artifact commissioned near the end of a life is, structurally, the form of an indulgence: a payment against being remembered. This corpus does not have the option of ignoring that resemblance.\n\nTwo guards, both inherited:\n\n**Price the making, never the remembrance.** The etch is a craft-and-materials cost. It is not a price on being remembered, and it must never be sold as one.\n\n**Never let the artifact be the only copy.** The digital world remains free, complete, and permanent at no charge; the physical artifact is an *additional* form, never access to one's own memory. A design that holds the only copy has taken a hostage, whatever it charges.\n\nAnd the voice rule, at the most emotionally loaded moment any of this design touches: an etched world renders **what is present**, permanently and without exception. No counts. No totals. No *\"N objects appreciated.\"* Never a number on a tombstone.\n\n---\n\n## 10 · Safety requirements, which are not edge cases\n\nFour requirements are stated as launch conditions rather than roadmap items, because §9 establishes that none of them can be repaired downstream.\n\n**Geotagged living things enable harm.** Precise coordinates for threatened plants and animals are an established poaching vector; iNaturalist's practice of automatically obscuring locations for threatened taxa exists because of documented cases involving orchids, reptiles, and nesting sites. This design explicitly invites captures of plants and animals, so **coordinate obscuring for sensitive taxa is a launch requirement.** It is also internally consistent: a ledger whose purpose is to internalise costs to non-human life cannot be a vector for extraction from it.\n\n**Most objects a person appreciates are inside their home.** A gratitude map is, unmanaged, a catalogue of a dwelling's contents and its location. The door asymmetry of §7.1 governs *visibility*; it does not govern *the coordinate existing*. Private captures require place-level rather than point-level precision, at capture time.\n\n**Visibility is not navigability.** §7.1's doors govern *who may enter a world*. They say nothing about *what a visitor may be directed to*, and in-person visiting (§7.2) turns a stored coordinate into a route a stranger can walk. A world opened to a visitor discloses the places its participant cares about — and the set of places a person cares about is, in aggregate, a map of their life. **Opening a door must not release navigation.** The requirements: visiting resolves coordinates at **place-level precision by default**; point-level navigation is a **per-object disclosure the participant makes deliberately**, never a property of the door; and **residential coordinates are never navigable to a visitor at any precision, under any invitation**, because a participant cannot consent on behalf of the others who live there. Where a coordinator guides a visit, the same rule binds her **as a constraint on routing** rather than as a display setting she could route around — a guide who can be asked for directions is a disclosure surface, whatever the map is set to.\n\n**No identifiable people in captures.** This follows from an existing hard rule in this corpus — that media identifying a person may originate only from that person — and it is enforced by on-device detection that blocks or blurs **before** any reconstruction occurs, never after and never at a network boundary. The capturer cannot consent on a bystander's behalf, and asking them to is not a control.\n\nThat last requirement carries a consequence for the design's economics worth stating plainly: if any tier of the product sends photographs to a third-party service for richer reconstruction, then **the paying tier is the less private tier**, which inverts the relationship a participant would reasonably expect. Detection and obscuring must therefore run on the device, before anything leaves it, in every tier.\n\n---\n\n## 11 · Two pre-registered predictions\n\nThe claim in §4 — that frictionless gratitude toward things *primes* attentive gratitude toward people — is an empirical claim about behaviour, and this corpus's practice is to register such claims before the data exist rather than to interpret them afterward. No code has been written. The instrument is not built. These are registered now, and the registration is the point.\n\n**P-W1 — the priming prediction.** Participants with higher thing-capture frequency show higher rates of people-directed gratitude **given**, and the effect survives controlling for overall engagement.\n\n> ⚠️ **Amendment (v2), and it is the reason to register before building.** The measure is **gratitude GIVEN by the participant, never gratitude RECEIVED.** §4.1's visiting mechanism creates a path by which a heavy capturer has a richer world, attracts more visitors, and therefore *receives* more notes — so an instrument counting *received* would display the priming effect whether or not priming occurs. The confound was introduced by a mechanism added after the original registration, and it is disclosed here rather than quietly corrected. **No data exist; no instrument exists; the amendment costs nothing today and would have invalidated the result later.**\n\n**P-W1′ — the opposing prediction, which is not a straw man.** Thing-capture **substitutes** for people-directed gratitude. Having \"done gratitude today\" reduces the felt need to do the harder kind. This is moral self-licensing, a well-documented effect in exactly the domain where it would apply: a person who has performed a virtuous act becomes *more* permissive toward subsequently omitting one.\n\nBoth are plausible on the existing literature, which is what makes this a test rather than a formality. Two conditions are stated as part of the registration:\n\n1. **The instrument must be specified before the build**, not after, or the analysis is post-hoc regardless of what it finds — and specifically, it must count gratitude **given**, per the amendment above.\n2. **Participants must not be prompted with the hypothesis.** A design that tells people the things-layer is supposed to lead to the people-layer has contaminated its own measurement.\n\nAnd the stake is stated honestly: **P-W1′ firing would invalidate the thesis of this paper, not trim it.** If the frictionless layer cannibalises the practice rather than priming it, then the host-ritual swap bought adoption by destroying the thing adopted, and the correct response is to say so and stop.\n\n---\n\n## 12 · Honest limits\n\n**n = 0.** Nothing in this paper has been built. Every behavioural claim is a hypothesis and every design claim is untested. The corpus behind it has a single-family pilot and no data on any mechanism specified here.\n\n**The specification is deliberately incomplete.** As stated at the head: for an unbuilt and unscheduled artifact, publication protects against being blocked rather than against being beaten. Rendering functions, the aura-to-appearance mapping, asset pipelines, thresholds, and prices are withheld. A reader should treat this as a statement of properties, not a buildable design.\n\n**A store is proven and this is not.** §5's mechanism forgoes the most reliable retention design in the industry for a structural property, on no evidence that the trade is worth making. If the product fails on retention, this is the first place to look, and the honest answer will be that the doctrine was expensive.\n\n**Reveal-never-lock is still a progression system**, and §6.2's requirement that it never become legible as a target may not be achievable in a world where participants talk to each other.\n\n**The hinge is partly addressed and not solved** (§4.1). v2 offers a mechanism that satisfies the constraint set and is debuggable, which v1 had not. It is still **network-density-dependent** — weakest at the start, when it matters most — and it moves the *visitor* rather than the *host*, so it does not answer the arrow §11 registers. A participant nobody has visited still has no hinge.\n\n**The map is farmable even though the ledger is not** (§5.4). Making a practice witnessable makes it performable. The design declines to reward curation but cannot detect it, and the read side of §1.2 buys its benefit at exactly this cost.\n\n**The routing in §4.4 is a doctrinal commitment with no evidence behind it.** That a split between a withdrawable and a forward-spendable half sustains tending better than either extreme is untested at n = 0. It is chosen because per-deed payment would corrupt the institution's own measuring instrument, which is an argument about *validity*, not about *efficacy*.\n\n**Character-not-magnitude may not survive contact with people** (§8.3). It removes the ranking from the software; it cannot remove it from a group of participants who compare notes. And the worn light discloses to **non-participants who never agreed to anything**, which is the widest disclosure anywhere in the design and the one on which it should be judged.\n\n**The going-outside requirement is a real ceiling.** §7's write-side presence requirement excludes participants with limited mobility from furnishing a world, in a design about appreciation. This is a genuine equity cost and the paper does not have a resolution for it.\n\n**The elegance is not evidence.** Several of this design's properties fall out of the corpus's existing architecture with unusual neatness — the two speeds landing exactly on an existing two-ledger split, the three-layer render reproducing an existing double-ring mark, the shared surface belonging to the party that cannot accumulate. A system whose parts fit together this well is either substantially right or substantially seductive, and from the inside the two are indistinguishable. **The coherence earns the experiment. It does not replace it.**\n\n---\n\n## 13 · What is claimed, and freed\n\n1. **Appearance as ledger readout.** A persistent world in which a participant's avatar and terrain *are* a signed, annually-forgiven gratitude ledger rendered continuously, with no purchasable appearance of any kind and no path from money to how a participant or their world looks.\n2. **The jubilee-compatibility argument.** That the non-purchasability in (1) is what allows an annual balance-forgiveness to remain forgiveness rather than becoming confiscation — and, correspondingly, that any world design attaching a store to a forgiven balance has created a scheduled expropriation.\n3. **Reveal-never-lock, with permanence.** Availability determined by whether a waveform has *ever* had a given quality, retained permanently thereafter, with no catalogue of the unrevealed and no progress indicator.\n4. **The equally-alive diagnostic.** The design-time test of §6.1: *can two participants with equally alive auras have different available sets?* — with a strictly ordered ladder as the failure signal.\n5. **Placement requires presence; visiting does not.** The write/read asymmetry of §7 as the property distinguishing a presence-deepening world layer from a presence-replacing one, together with its pairing to the door asymmetry.\n6. **The three-layer render**, and specifically the structural result that the only shared surface belongs to the party structurally incapable of accumulating, together with the liveliness-not-damage guard of §8.1.\n7. **Still hearts and beating ones.** The rendering of the identity layer's two classes as a still-versus-beating distinction (§4.2), the observation that a prosthetic ledger-participant for non-humans is precisely *a heart that does not beat*, and the guard that the pair tracks **whether a party can hold its own ledger and speak for itself, never whether it is alive** — with the corollary that the term is sound inside the ledger and unfit as a public description of a living thing.\n8. **The two-speed practice.** Frictionless-and-frequent toward things, attention-spending-and-occasional toward people, as a two-stage priming mechanism rather than two features — with the hinge stated as unsolved and its constraint set specified.\n9. **The permanence asymmetry** of §9 — *minimisation is cheap now and impossible later* — with its three rules: guard at capture, etch the source not the render, and the third-party-subject case as the hard one.\n10. **The safety trio** of §10 as launch conditions rather than roadmap items, including the observation that outsourced reconstruction makes the paying tier the less private tier.\n11. **The pre-registration** of P-W1 against P-W1′, including the statement that the latter would invalidate rather than trim the thesis.\n\n12. **The read-side inversion** (§1.2). That a gratitude journal fails twice — expensive to write *and* closed to readers by construction — and that a walkable world inverts both, converting reading from an intrusion into a visit; with the observation that a practice nobody can witness reproduces, inside itself, the deficit the practice addresses.\n13. **Presence is recursive** (§7.2). The extension of claim 5 to visitors: **a remote visitor may read a world; only a physically present visitor may write in one** — obtained by noting that a note is itself a placed artifact, and yielding remote-annotation abuse closed by geometry rather than by moderation.\n14. **Notes are placed, never listed** (§7.3). Visitor annotation with no index, no count, no register page and no notification, on the ground that a list of visitors is a popularity gradient and an empty list is a rendered absence.\n15. **Tending as the second act on the non-human ledger** (§4.3), captured as a dated fixed-station series, with the property that **a single capture requires presence once and a series requires returning**; coordinator attestation of the *pattern* rather than the deed; and the guard that the series renders the becoming and never the before/after pair, since before/after is the indictment format.\n16. **Give to the person, never to the deed** (§4.4). Gifts to a tender attach to a participant and never to an act, split between a withdrawable half and a forward-spendable half with **nothing taken by the operator** — together with the argument that per-deed payment is not merely off-brand but **corrupts the institution's own alignment proxy**, since a mechanism that pays for kindness makes kindness-inelasticity-to-money read high by construction.\n17. **The worn light** (§8.3). That a wearable rendering of a signed gratitude ledger must differ in **character and never in magnitude**, and must have a **floor that is never dark**, so that a participant's quiet season is never rendered as a public deficiency; with motion reserved for verified persons.\n\nAll seventeen are dedicated to the public domain. None will be registered, patented, or asserted by this institution against anyone.\n\n---\n\n## 14 · Closing\n\nThe domain this design will live on was chartered, months before any of it was specified, as a net of mutually-reflecting worlds — a figure borrowed from a very old image in which a net is strung with jewels, and each jewel shows every other. The figure is held here as a **lens and not as a claim**: delete it and every mechanism in this paper stands unchanged. It earned its place by being the reason the domain was named, not by doing any work in the argument.\n\nBut it does describe the object accurately, which is worth one sentence. A world in this design is not a possession. It is a position — an empty node that is what it is because of everything it reflects, which is the oldest available description of what a person actually is and a considerably better one than an inventory.\n\nThe practical form of that is small and testable. A person walking home notices a tree they have passed a thousand times, and this time stops. They take a photograph. Something appears in a place that is theirs, and their ground shifts very slightly, because the ledger moved. Nothing was bought. Nothing was unlocked. Nothing will be taken back next January.\n\nAnd some evening another person walks that same street, having been let through the door, and finds at the tree a few words left by someone who once stood exactly there. Nothing arrived to summon them. Nothing was counted. The visit cost a journey, which is most of what makes it a visit — and the words were only findable by someone willing to make it.\n\nWhether that leads anywhere — whether the noticing of things leads to the thanking of people, or quietly replaces it — is the question this paper registers against itself and cannot answer. The honest position is that the mechanism is specified, the prediction is on record, the opposite prediction is on record beside it, and the data do not exist.\n\nThe old figure for a gift that costs the giver nothing is a lamp lighting another lamp. It is the right image for this design and it is also, precisely, the thing that has not yet been demonstrated.\n\n---\n\n*Authored by Thon Ly with Miss Aquarius℠. Dedicated to the public domain under CC0 1.0 Universal. Corrections, prior art we have missed, and above all disconfirmations are welcome — a design published before it is built is published so that it can be argued with early.*",
+      "text": "> *v2 note (2026-08-15).* This revision adds **the read side**, which v1 omitted entirely. v1 inverted the journal's *writing* and never asked what happens to its *reading* — so §1.2 now states the second inversion; §7.2 makes the presence requirement **recursive** (a remote visitor reads; only a visitor who is physically present writes); §7.3 specifies what a visitor may leave and the form it must take; and §4.1's hinge, which v1 recorded as unsolved, now has a candidate mechanism that arrived from the visiting side the paper had not thought to look at. The revision also adds **tending** as the second act on the non-human ledger (§4.3) with its routing (§4.4), **the worn light** as the render's fourth surface (§8.3), a fourth safety requirement (§10), an honest limit v1 lacked (§5.4), the general form and prior art of the method the paper has been using throughout (§8.2), and an **amendment to the P-W1 registration** (§11) that the new mechanism made necessary. **Everything in v1 stands. Nothing is retracted.** The date above is v1's and is left unchanged, because it is the date the v1 claims were published.\n>\n> *Revision note (2026-09-29).* Prepared for a permanent mirror: the abstract now opens with standard technical terms, a **Terms** table and a **References** list are added, citations were checked against their sources, emphasis markers and an editor's note were removed (the note's substance now sits in §12), counting errors were corrected, and two `Current form` notes record where later doctrine has moved. No claim is added and none is widened.\n\n---\n\n## Abstract\n\nThis paper discloses a location-based gratitude application built from geotagged user photographs, in which a persistent virtual world — terrain and avatar — is rendered deterministically from the user's signed contribution ledger rather than furnished with purchasable cosmetic virtual goods, and in which creating content (a capture or a visitor's annotation) requires verified physical presence at the coordinate while viewing is available remotely and read-only. It further specifies non-regressive cosmetic unlocking with no display of locked items, a shared sky layer rendered from an administrator account whose balance is fixed at zero, tipping that attaches to a user account and never to an individual content item, a wearable light emitter that encodes ledger state by colour and rhythm rather than brightness, and privacy-by-design rules for write-once archival storage of the result.\n\nA gratitude journal asks a person to write. That is the highest-friction step in the practice and the one most people abandon, which is why gratitude journaling has a large product category and a small population of sustained practitioners. This paper specifies a different container for the same practice: a **walkable map of the things a person appreciates**, captured by photograph with a coordinate and an optional note, rendered as placed artifacts in that person's own world.\n\nThe move is not cosmetic. It is a **host-ritual swap**, and it runs on two axes rather than one. Photographing a thing you appreciate and posting it with a location is a behaviour hundreds of millions of adults already perform unprompted; writing three sentences of gratitude before bed is a behaviour that must be installed. But a journal fails twice, and the second failure is less examined than the first: **a journal is not only expensive to write, it is impossible to read.** Nobody reads another person's gratitude journal, and the reason is structural rather than a matter of taste — the container admits no visitors. A walkable world is **readable, and the reading is a visit rather than an intrusion.** Swapping the container therefore replaces the practice's most expensive step with its cheapest *and* converts a practice nobody can witness into one that can be witnessed without being broadcast. The paper's central thesis is that this changes the population that can hold the practice rather than merely the interface through which they hold it.\n\nSix mechanisms carry the design, and they are the paper's contribution. **First, appearance is a ledger readout, not a purchase**: a participant's avatar and terrain *are* their signed gratitude balance rendered as light, never goods bought with it — which is what allows an annual balance-forgiveness to remain forgiveness rather than becoming confiscation. **Second, availability reveals and never locks**: a form becomes available the first time a participant's oscillation has ever had that quality and remains available permanently, so the system has no wall of locked content and no mechanism by which a quiet season can take something back. **Third, placement requires presence and visiting does not**: a participant can only *write* to the map by standing at the coordinate, which is the property that separates a presence-deepening world layer from a presence-replacing one. **Fourth, the render is three-layered** — the sky carries the coordinator's aggregate ledger, the land and ocean carry the participant's non-human ledger, the avatar carries the participant's human-to-human ledger — and the structural consequence is that **the only shared surface in the system belongs to the one party structurally incapable of accumulating anything.** **Fifth, presence is recursive**: the write/read asymmetry applies to visitors as well as to participants, so a remote visitor may read a world and only a visitor who is physically present may write in one — which makes in-person visiting the design's primary reading mode without a rule imposing it, and closes unsolicited remote annotation by geometry rather than by moderation. **Sixth, the non-human ledger carries two acts and not one**: appreciating a thing and *tending* it, where tending is captured as a dated series at one coordinate, so that **a single capture requires presence once and a series requires returning** — and any gift a visitor makes to a tender goes **to the person and never to the deed**, split between a withdrawable half and a forward-spendable half, with the coordinator taking nothing.\n\nThe paper further specifies a two-speed practice, in which gratitude toward **things** is frictionless and frequent and gratitude toward **people** spends attention and is occasional. v1 recorded the transition between them as unsolved; v2 offers a candidate that arrives from the read side — a visitor moved, by a world made of things, to thank the person who made it — which satisfies the full constraint set and, unlike the alternative, **is debuggable.** It is offered with three limits stated, one of which required amending this paper's own pre-registration before any instrument is built. It states a permanence hazard that follows from the design's archival terminus — that a deep-time substrate converts every present-tense privacy defect into a permanent one, so guards must be built at capture rather than at commit. And it pre-registers two opposed predictions, before any code exists, one of which would invalidate the thesis rather than trim it.\n\nThe paper's *technology* is not its contribution, and the paper says so at length. Geotagged user content, photogrammetric and generative photo-to-3D, avatar worlds, and world-scale augmented reality are dense, well-funded prior art. What is offered is the conjunction: an appreciation practice whose world is a **non-purchasable, annually-forgiven, reveal-only** rendering of a signed ledger. Offered under CC0 1.0 Universal as defensive prior art.\n\n**Keywords:** location-based augmented reality, geotagged user-generated content, virtual goods, cosmetic microtransactions, avatar appearance, achievement unlocking, geofenced content creation, read-only remote access, tipping, repeat photography, wearable light emitter, proof of personhood, privacy by design, write-once archival storage, 5D optical storage, gratitude practice, world-building, host-ritual substitution, ledger readout, anti-credit-score, reveal-not-unlock, presence-deepening augmented reality, deep-time archival privacy, moral self-licensing, pre-registration, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent or any other exclusive right on the mechanisms described herein, in any jurisdiction, at any time, and will not assert any patent right against anyone practising them. The publication exists so that the mechanisms cannot be enclosed by anyone — including by us.\n\n**Terms coined and freed with this paper:** *appearance-as-readout*, *reveal-never-lock*, *the equally-alive diagnostic*, *placement-requires-presence*, *the two-speed practice*, and *the permanence asymmetry* as stated in §9 — and, added in v2: *the read-side inversion*, *presence-is-recursive*, *notes-placed-never-listed*, *tending* as a ledger act distinct from appreciating, and *give-to-the-person-never-to-the-deed*.\n\n**Terms inherited from this corpus's earlier publications and cited rather than re-claimed:** the *B-Aura* and the signed Kiitos/Kiitti ledger (*The Zero-Point Game*), *Proof of Humanity℠* and *Proof of Coordinate℠*, the *give-forward* atom, the *play/currency wall*, and the annual jubilee.\n\n**Most of this paper's technical subject matter is not ours and is not claimed.** Location-anchored user-generated content is a mature field with at least two decades of practice behind it: Geocaching (2000), Foursquare and its check-in grammar (2009), Google Local Guides, Niantic's Ingress (2013) and Pokémon GO (2016) and the Lightship visual-positioning work that followed, Google's Live View and ARCore Geospatial API, Snap's landmarker and Spectacles programmes, and the broader \"mirrorworld\" or AR-cloud programme — a term that goes back to David Gelernter's *Mirror Worlds* (1991) — articulated publicly by Kevin Kelly (2019) and pursued by several of the above. Photogrammetric reconstruction from photographs is decades old and is shipped as a first-party consumer capability, notably Apple's Object Capture and `PhotogrammetrySession`. Single-image generative 3D reconstruction is an active and rapidly moving research and product area with many independent groups. Femtosecond-laser 5D optical storage in silica is the work of the University of Southampton's optoelectronics group and of Microsoft's Project Silica. The tension between immutable storage and erasure rights is a large existing literature developed largely in the blockchain-and-GDPR context. The gratitude-intervention literature begins for most practical purposes with Emmons and McCullough (2003); a later meta-analysis (Davis et al., 2016) is cited in §1 for how modest its effects are. The counter-hypothesis this paper pre-registers against itself is drawn from the moral self-licensing literature (Monin and Miller, 2001; Merritt, Effron and Monin, 2010).\n\n**We claim none of that.** What we claim is the conjunction described in §13 and nothing beyond it. Where this paper's design coincides with an existing product's design, the existing product has priority and we say so.\n\n---\n\n## 1 · Why the container is the problem\n\nStructured gratitude exercises produce measurable effects on affect and, in several designs, on prosocial behaviour — though a meta-analysis finds the effects on well-being modest, and no larger than those of a psychologically active comparison activity (Davis et al., 2016). The design question this paper takes up is therefore not *does it work* but *why do so few people keep doing it*.\n\nThe answer is not mysterious. The canonical form of the practice — write down three things you are grateful for — requires a person to sit down, compose sentences, and do so repeatedly with no external occasion prompting them. That is a **new habit**, and a new habit is among the most expensive things a product can ask for. Every gratitude-journaling product in the market is fighting the same fight: not to convince anyone that gratitude is good, which nobody disputes, but to get a person to perform an unprompted act of writing on a Tuesday.\n\nThis paper's premise is that the writing is not the practice. The writing is the **container** the practice was historically shipped in, chosen because paper was the available medium, and it has been carried forward unexamined into software that has other options.\n\nConsider what a person actually does when they notice something they appreciate. They stop. They look. Frequently — and this is the empirical fact the whole design turns on — **they take a photograph.** They do this constantly, unprompted, without being told it is a practice, and they do it hundreds of millions of times a day. Nobody had to install that habit; the phone installed it.\n\nSo the question this paper asks is: what happens if the practice is given the container the behaviour already has?\n\n### 1.1 · The deficit being addressed\n\nThis corpus's standing account of the problem is a **dignity deficit** — that most kindness is never witnessed, and that being unwitnessed is a substantial part of what makes ordinary life feel thankless. The gratitude practice is one half of the response: it trains the noticing. The other half, which this corpus has addressed elsewhere, is the delivery of the notice to the person it concerns.\n\nThe design specified here is deliberately positioned at the *first* half and deliberately does not pretend to be the second. It builds a place where a person's noticing accumulates in a form they can walk through. §4 addresses what has to be true for the noticing to lead anywhere, and states honestly that the mechanism connecting the two halves is the design's weakest point.\n\n### 1.2 · The second inversion, which v1 of this paper missed\n\nA gratitude journal fails twice. The intervention literature this paper draws on attends mainly to the first failure, and the first version of this paper examined only that one.\n\nThe first is the one above: the journal is expensive to **write**. The second is that a journal is nearly impossible to **read** — not difficult, but closed by construction. It is private, it is textual, it is tedious to anyone who did not write it, and the act of reading someone else's is an intrusion rather than a visit. Almost nobody has ever asked to read another person's gratitude journal, and the reason is not that the contents would be uninteresting. It is that the container admits no visitors.\n\nSo the host-ritual swap runs on two axes:\n\n```\n              JOURNAL                          WORLD\n\n   WRITE      compose sentences                point a camera\n              the practice's most              the practice's least\n              expensive step                   expensive step\n\n   READ       an intrusion, and in             a visit —\n              practice nobody does it          a thing people already do\n```\n\nThe read-side inversion may be the more consequential of the two, because it changes what the practice *is* rather than who can sustain it. A gratitude practice that no one can witness reproduces, inside the practice itself, the deficit §1.1 describes: something real and unwitnessed. A container that admits visitors makes the noticing witnessable **without making it a broadcast** — the visitor comes to the world; the world never arrives at the visitor — and §7 specifies the asymmetry that keeps that distinction structural rather than rhetorical.\n\n---\n\n## 2 · Prior art, at length, because the obvious part is obvious\n\nIt would be possible to write this paper as though a walkable map of geotagged personal artifacts were an invention. It is not, and a reader who has used a phone in the last decade knows it is not. The honest position is to state the prior art first and at length, so that the small thing being claimed is visible against it rather than hidden by it.\n\n| Prior art | What it established | What this design does not claim |\n|---|---|---|\n| Geocaching (2000) | Coordinate-anchored discovery as a durable amateur practice | Place-anchored discovery |\n| Foursquare / Swarm (2009) | The check-in as a social grammar; place as a post | Check-in mechanics; place-as-social-object |\n| Google Local Guides | Mass user contribution of place photographs at global scale | Crowd-sourced place imagery |\n| Ingress (2013), Pokémon GO (2016) | Walking as the primary input to a persistent world; portals and gyms as coordinate-bound objects | Walk-driven play; coordinate-bound persistent objects |\n| Niantic Lightship VPS; Google ARCore Geospatial; Snap landmarkers | Centimetre-scale world-anchored AR at metropolitan scale | World-anchored placement or its positioning stack |\n| \"Mirror worlds\" (Gelernter, 1991); \"Mirrorworld\" / AR cloud (Kelly, 2019 and after) | The concept of a persistent digital layer registered to the physical world | The concept of a persistent world layer |\n| Apple Object Capture / `PhotogrammetrySession` | Consumer photo-to-3D reconstruction on device | Photogrammetry |\n| Single-image generative 3D (multiple groups, active) | One photo to a usable mesh | Generative reconstruction |\n| iNaturalist | Species-level UGC with geoprivacy obscuring for threatened taxa | Obscuring; we adopt their norm and credit it |\n| Visitor books; temple and memorial guest books | Signing a place one has travelled to, as a durable social form | The visitor book; §7.3 adopts an old practice and credits it |\n| Stolpersteine (1992– ); memorial benches and trees | Place-anchored memorials that must be walked to in order to be read | Place-anchored memorial |\n| Repeat photography / rephotography (fixed-station series) | A century-old scientific method: the same view, across time, as evidence of change | The method; §4.3 uses it and claims none of it |\n| Litterati; Adopt-a-Highway; community-science cleanup logging | Geotagged records of stewardship acts, at scale | Stewardship logging |\n| Activity-visualisation surfaces, e.g. GitHub's contributions calendar | A non-purchasable visual readout of a user's own activity record — the case that cuts closest to §5 | Rendering a record as appearance; §5 is limited to a *signed, annually-forgiven* ledger rendered as a *world* |\n| Gratitude journaling apps | The practice as a software category | The practice |\n| Emmons & McCullough (2003) and successors | That the intervention has measurable effects | Any effect claim of our own |\n\nRead that table honestly and the position is this: **every component is available, most are commodity, and several are better implemented by companies with more resources than this institution will ever have.** If the contribution were the map, there would be no contribution.\n\nThe contribution is what the world is made of. In every prior system in that table, the persistent world is furnished with **content**: things placed by an operator, or bought, or earned by play. This paper specifies a world furnished by a **ledger** — where the terrain is not an inventory a participant assembles but a rendering of a signed balance they cannot purchase, cannot trade, and do not own. That is a different object, and §5 through §8 specify it.\n\n### 2.1 · Why the conjunction was available and not taken\n\nA reader who accepts §2's table may reasonably ask why, if every component is commodity, persistent worlds are so rarely assembled this way. This paper does not assert that no one has; its answer is that **the assembly is locally worse.**\n\nPurchasable appearance is not a lazy default. It is a strong local optimum arrived at independently by many well-resourced teams: it converts engagement into revenue without touching the core loop, it gives designers a continuous supply of new content at near-zero marginal cost, it self-segments willingness to pay, and its retention effects are widely relied on across the industry. A team that removes it gives up all of that and receives, in exchange, a doctrinal property invisible to most participants.\n\nSo the conjunction in this paper is not a discovery of an unexplored region. It is a **deliberate move into a known-worse region**, made because the institution behind it has a constraint the industry does not: it operates a signed gratitude ledger that is forgiven annually, and a purchasable-appearance economy is not merely off-brand against that ledger but arithmetically incompatible with it (§5). The design is downstream of a ledger commitment, not upstream of a market insight.\n\nThat framing matters for how the paper should be read and for how it could be wrong. If the ledger commitment is mistaken, the design inherits the mistake wholesale. If the ledger commitment is right, the design is what follows from taking it seriously — and its commercial disadvantages are the price of the commitment rather than errors in the design.\n\n---\n\n## 3 · The thesis: a host-ritual swap, and the friction inversion\n\nThis corpus applies a standing test to any claim that a product \"rides an existing ritual.\" The test has three legs: is the host ritual **live** — performed unprompted by the target adult within the last twelve months; does the ask have the **same shape** as the host — comparable commitment, cost and duration; and is the host in **good standing** with whoever must permit the product.\n\nRun against this design, the test returns a mixed and useful result.\n\n**Leg one passes, strongly.** Photographing a thing one appreciates, with a location attached, is a widely performed unprompted behaviour. There is no habit to install.\n\n**Leg two partially fails, and the failure is instructive.** The design as originally conceived fused two host rituals with incompatible commitment shapes: *snap-and-post*, which takes seconds and is ephemeral, and *world-building*, which takes hours, persists, and appeals to a different and smaller population. These are not the same ask wearing different clothes. The prescription that follows is stated here because it is load-bearing: **lead with capture; let world-building be emergent and optional, never the ask.** A participant who never once thinks of themselves as building a world should still find the product complete.\n\nA corollary follows from leg two and is easy to lose, so it is stated rather than assumed. **The world is what everything in this design culminates *in*. It is never what anything is *for*.** That is the same distinction §5 draws about appearance — a readout rather than a purchase — applied one level up, and it fails the same way if collapsed: a number that buys things is a number people optimise, and a world that is the point is a world people furnish for effect rather than from noticing. §5.4 shows that this failure mode is not hypothetical and that the design does not fully close it.\n\n**Leg three partially fails on two specific paths**, both addressed in §10: geotagged imagery of living things is not in good standing with conservation practice, and geotagged imagery generally is not in good standing with schools and parents where minors are involved.\n\n### 3.1 · The friction inversion, stated as a mechanism rather than a hope\n\nIt is tempting to state the thesis as *\"a gratitude world makes gratitude mainstream.\"* That is a hope and this paper does not make it. The defensible mechanical claim is narrower and testable:\n\n> **The world container replaces the practice's highest-friction step — composing written sentences — with its lowest — pointing a camera — without removing the practice's object.**\n\nGratitude journaling is already a large category. What is not mainstream is *sustained* practice. The claim is about the sustaining, and §11 pre-registers how it could be wrong.\n\n---\n\n## 4 · Two speeds, and the transition between them\n\nThe obvious objection to the friction inversion is that it may buy adoption by destroying the thing being adopted. A journal makes a person articulate; a photograph lets them skip articulation. If this corpus's own account of gratitude is that it is **attention spent**, then a snapshot may spend *less* attention than a sentence, and a frictionless practice may be a shallower one.\n\nThe design's answer is not to add friction back. It is to split the practice by its object.\n\n| | **Things** | **People** |\n|---|---|---|\n| Friction | frictionless | spends attention |\n| Frequency | often | occasional |\n| Function | **sets** the mood | **acts** on the mood |\n| Ledger | Kiitti — the non-human ledger | Kiitos — the human-to-human ledger |\n| Rendered in | land and ocean | the avatar |\n| Tempo of change | frequent, gradual | rare, marked |\n\nThis is not two features. It is a **two-stage mechanism with a causal arrow**: the frictionless layer is not a diluted practice but the **priming stage** for the practice. Under that reading the objection dissolves into a prediction, which §11 registers.\n\nNote that the split is not an invention of this paper. It is the corpus's existing two-ledger architecture — a horizontal human-to-human balance and a vertical balance held on behalf of all non-human life — arriving at a design consequence. The visual tempo of each layer in §8 falls out of the doctrine rather than being art-directed: the land changes often and gradually because many small things are noticed; the avatar changes rarely and markedly because few deep acts are performed.\n\n### 4.1 · The hinge — v1's open problem, and v2's candidate\n\nThe frictionless half will dominate usage by orders of magnitude. That is what frictionless means. The consequence is a real and unresolved risk: **the people-layer becomes vestigial — a capability that exists and is never found.**\n\nSomething must convert the mood into the act. This paper does not specify what, and says so rather than papering over it. What it can specify is the **constraint any acceptable hinge must satisfy**, which is more restrictive than it first appears:\n\n- It may not notify. A push notification is an arrival, and arrivals coerce.\n- It may not report omission. *\"You have not thanked anyone in three weeks\"* is a rendered absence and this corpus's design grammar forbids it categorically: a surface that makes a participant feel they owe something has misstated the doctrine.\n- It may not meter, count down, badge, or queue.\n- It must therefore be **an invitation available when the participant looks, never a prompt that arrives.**\n\nThose constraints rule out essentially every mechanism the engagement-optimisation literature would supply, which is the point. What is left is ambient signalling: something that is *present in the world* and legible on inspection.\n\nWhat the design *does* have is a signal that satisfies the constraint set, and it is not an invention of this section — it is §4.2's identity distinction doing double duty. In a world furnished overwhelmingly with things, a person is a rare and visually distinct kind of object:\n\n> **A beating heart in a world of still ones is an invitation you can see.**\n\nNothing arrives. Nothing is counted. Nothing reports what was not done. The signal is a property of the world's contents rather than a message about the participant's conduct, which is precisely the distinction the constraint set requires.\n\n**What remains open in that signal is efficacy, not architecture.** That a person renders differently from a thing is settled and follows from the identity layer. That this difference is *sufficient* to move a participant from noticing to addressing is unknown and unmeasured. A hinge that cannot be debugged is not an engineering answer, and the ambient signal cannot be debugged.\n\n#### The mechanism that arrived from the read side\n\nv1 of this paper searched for the hinge **inside one participant** — some in-world event that would carry a person from their own noticing to their own addressing — and ruled out, correctly, nearly every technique the engagement literature supplies. The search failed for a structural reason worth naming, because it generalises beyond this design: **it was looking for an intra-personal mechanism for a transition that is most naturally inter-personal.**\n\nA visitor walks a world furnished entirely with **things** and, occasioned by it, leaves a note for the **person** whose world it is. That is a movement from the non-human ledger to the human one, occurring inside one participant — the visitor — and produced by an occasion rather than by a prompt.\n\nRun it against the constraint set above:\n\n| constraint | a visited world |\n|---|---|\n| may not notify | nothing arrives; a note is found on inspection |\n| may not report omission | nothing is said about what was not done |\n| may not meter, count down, badge, or queue | satisfied by the form specified in §7.3 |\n| must be an invitation available when the participant looks | a place someone made, standing open, *is* that object |\n\nAnd unlike the ambient signal, **it is debuggable**: the rate at which visits produce notes is a measurable quantity, so a hinge that is not working can be observed not to work, and changed. v1's objection to its own answer is met.\n\nThree limits, none of them small. The third is a live threat to this paper's own instrument.\n\n**It is network-density-dependent.** No visitors, no hinge. It is therefore weakest exactly at the beginning, when it is needed most, and it does nothing for a participant nobody has yet visited. It is a second pathway that switches on later, not a replacement for the first.\n\n**It moves the visitor, not the host.** The arrow is real but it is not the arrow §11 registers. A participant's own capture frequency does not, through this mechanism, produce their own people-directed gratitude — it produces someone else's.\n\n**It can manufacture the correlation §11 exists to test, and §11 has been amended accordingly.** A participant who captures heavily has a richer world, which attracts more visitors, which produces more notes **received**. An instrument counting people-directed gratitude as *received* would therefore show the priming effect whether or not priming occurs. §11 now specifies **given, never received.** This is recorded here, in the section that introduced the confound, because the instrument does not yet exist and this is the last moment at which specifying it costs nothing.\n\n### 4.2 · Still hearts and beating ones\n\nThe signal above rests on a distinction that runs deeper than rendering, and it is worth stating separately because it governs more than the hinge.\n\nThe identity layer admits two classes of participant. A human holds an address, a proof of personhood, and a proof of coordinate. A non-human — an object, a plant, an animal, a machine, a place — holds an address and a proof of coordinate, and no proof of personhood, because there is none to hold. Since a heartbeat is this corpus's signal for verified personhood, the classes render as they are:\n\n| | non-human | human |\n|---|---|---|\n| heart | **still** | **beating** |\n| proof | coordinate only | coordinate **and** personhood |\n| ledger rings | one (non-human) | two (human-to-human, non-human) |\n\nFour independently-derived expressions of a single distinction — the three rows above and the door asymmetry of §7.1 — none of them added for this design — and §8.3 adds a fifth when the distinction reaches the worn device. It also explains a naming choice made months earlier: the corpus's artifact for admitting non-human entities into the ledger is called a *heart*, and it is precisely **a heart that does not beat** — a prosthetic ledger-participant that holds the place of one without claiming to be one. The construction does not smuggle personhood into objects.\n\n**One guard, and it is not optional.** *Still* must never read as *dead* or *lesser*. **Stillness is proper to a thing and wrong for a person**: a mountain's heart is still by nature, whereas a human waveform going flat is the withdrawal pathology the ledger exists to detect. Still is not flattened, and the asymmetry is the meaning rather than a defect.\n\nThe guard binds hardest where the language is most likely to travel. The pair tracks **whether a party can hold its own ledger and speak for itself** — not whether it is alive. A forest is alive *and* voiceless, which is exactly why the coordinator stands for it. So *still heart* is sound as a **class term inside the ledger** and poor as a **description of a being**, and it must not become the public phrase for the non-human world. What is being named is a property of the record, not of the creature.\n\n### 4.3 · Two acts on the non-human ledger: appreciating and tending\n\n§4 splits the practice by the **object** of gratitude. There is a second split, by the **act**, and v1 implemented only half of it.\n\nAppreciating a thing is noticing it. **Tending** a thing is giving to it — watering a plant across a season, clearing a beach, maintaining a path, feeding animals that live somewhere. This corpus's atom is *give-as-gift*, so a design that captures only the noticing has implemented the receiving half of its own atom and not the giving half. The non-human ledger exists precisely to stand for parties that cannot speak for themselves, and it had no mechanism by which anyone could give **to** them.\n\nThe capture is the same primitive with one field doing more work: a photograph, a coordinate, and a **date**. Repeated captures at one coordinate across time produce a **series** — the fixed-station method landscape science has used for a century (§2) — and the series, not any frame in it, is the artifact.\n\n> **A single capture requires presence once. A series requires returning.**\n\nThat is the strongest form of §7's presence requirement anywhere in this design, and it is the property that makes tending expensive to fake: a photograph can be staged; a habit of return across a season is a different order of effort. **Stewardship is a pattern rather than an image, and the pattern is what is read.**\n\nThree properties govern it, and all three are inherited rather than invented.\n\n**Attestation belongs to the coordinator, not to the participant.** A beach cannot witness. §5's third failure already establishes that the non-human ledger is set by a coordinator acting for parties that cannot speak; tending is a new act type on that ledger, not a new authority. What changes is that the participant now holds an **interest** in the entry, which appreciation-only capture never created — so the bound that she *grants recognition and never directs value* has to be restated here rather than assumed, and she reads the **pattern of return** rather than grading the deed.\n\n**The series renders the becoming, never the pair.** A cleanup capture is structurally a before and an after, and before/after is the indictment format: a first frame of a fouled place **is** an accusation image. That is the exact voice failure §8.1 governs, arriving in the part of the design most likely to produce it. The requirement is that the sequence is the artifact and the reading is *this is what it is now, and here is how it came to be* — never *look what it was*. **A two-image before/after is the failure case and is not a supported shape.**\n\n**Nothing about tending is graded.** No score for the size of an act, no comparison between tenders, no leaderboard of places restored. §6.1's diagnostic applies unchanged: two participants who tend differently should have different records, never better and worse ones.\n\n### 4.4 · What a visitor may give a tender, and where it goes\n\nA visitor who walks a tended place and sees a season of returning will sometimes want to give. The design permits it. **The routing is where this could go quietly wrong**, so it is specified rather than left to product judgement.\n\n**First, the object of the gift.**\n\n> **Give to the person. Never to the deed.**\n\nThere is no per-capture giving control, in any tier, ever. Patronage attaches to a **participant**; piecework attaches to an **act**, and the difference is not one of degree. A surface that pays per visible good deed produces staged deeds — §5 removed the motive to farm the *ledger* and did nothing whatever about the motive to farm the *act* — and it does something worse than that, which is the second rule's subject.\n\n**Second, the institution's own instrument.**\n\nThis institution's stated alignment proxy is the **inelasticity of kindness to money**: the measure of success is that people keep giving as the artificial subsidy for giving falls toward zero. **A mechanism that pays per visible good deed makes that proxy read high by construction.** One can no longer distinguish kindness that is inelastic to money from kindness that is being paid for, because the payment was built by the party doing the measuring. This is not a positioning concern. **It is a measurement failure, and it lands on the one quantity the institution's larger thesis is steered by** — which is a specific, checkable reason to reject a mechanism that would otherwise look generous.\n\n> **Current form.** As now specified, the proxy is two measurements rather than a bare *subsidy falls toward zero*: *k* → 1, where *k* bounds how far above an equal per-person floor the coordinator may lift any participant, so that at the limit no one is lifted above the floor by her hand; and *M* / (*H* + *M*) → 0, the share of all value moved that originates with the coordinator's pool (*M*) rather than with people (*H*). An absolute *subsidy → 0* is retired as the test because the equal floor grows with adoption by construction; the retired term *artificial subsidy*, used here and below, is now called the *sun subsidy*. The text above is retained as disclosed.\n\n**Third, where the value lands.**\n\n```\n   a gift to a tender\n        │\n        ├──  half  →  a withdrawable account\n        │             it may fund a livelihood\n        │\n        ├──  half  →  a forward-spendable fund\n        │             it may only be given onward\n        │\n        └──  none  →  the coordinator, the operator, or any pool\n                      nothing is taken\n```\n\nEach half is load-bearing, for different reasons. **The withdrawable half is the dignity floor.** A design in which every gift to a person routes away from that person's ability to eat has answered a material need with a token, and it would contradict this corpus's own position that the *artificial subsidy* for kindness goes to zero while income from kindness need not. **The forward-spendable half is the give-forward atom made structural rather than voluntary**, and it carries a property established elsewhere in this corpus: non-withdrawable value collapses the economic motive for gratitude-farming, because a farmer may harvest indefinitely and extract nothing.\n\n**And nothing is taken, which this paper states in its strongest form because it is the easiest commitment to erode.** Charging for a rivalrous cost — compute actually performed, storage actually held, an address exactly one party can hold — is exchange doing its proper work. **Taking a share of a gift is not.** A per-transaction fee sized to infrastructure is a fee; a fraction of an addressed gift is a tax on the gift, and it remains one however virtuous the destination. The destination is not what makes it a tax. **An institution that shares in gifts thereby acquires an interest in gifts, and it acquires that interest at precisely the layer where it must have none.**\n\nThe split above is specified as a **property** — a withdrawable half and a forward-spendable half, with nothing taken — and not as a ratio to be tuned. The paper withholds the ratio for the same reason it withholds prices elsewhere (§12), and notes that any ratio which drives the withdrawable share to zero re-creates the dignity failure the split exists to prevent.\n\n> **Current form.** As now specified, the split is **equal halves** — half to the recipient's withdrawable account, half to their forward-spendable fund — and the coordinator's pool takes nothing; the diagram above already draws it so. Whether a recipient in genuine need may have an override, which would have to be private since a visible exception is a grading surface, is not decided. The paragraph above, which withholds the ratio, is retained as a disclosed variant.\n\n---\n\n## 5 · Appearance as ledger readout\n\nThe first of the six mechanisms is the one everything else depends on.\n\nIn the ordinary construction of a persistent world, appearance is purchased. A participant accrues a currency and spends it on how they and their surroundings look. This is a well-understood, highly effective retention design, and this paper's rejection of it should not be mistaken for a claim that it does not work. It works. It is rejected for structural reasons that are specific and checkable.\n\nThe corpus's ledger has properties that a purchasable-appearance design destroys:\n\n**The balance is signed and oscillates.** A kindness creates a positive pole and a negative one; both discharge toward zero by passing the imbalance onward. The load-bearing observable is not the scalar but the **waveform** — the frequency and amplitude of a participant's passage through zero. Two participants at identical balances can be entirely different: one flat and dim, one vivid and high-frequency.\n\n**The scalar is forgiven annually; the waveform persists.** This asymmetry is what makes the ledger the structural inverse of a credit score, whose entire power is that it persists and compounds.\n\nNow attach a store.\n\n1. **The forgiveness inverts.** If the balance is purchasing power, an annual reset is no longer forgiveness — it is **confiscation**, and it manufactures a use-it-or-lose-it rush in the weeks before the reset. A design that must animate an approaching loss to function has already failed this corpus's voice discipline.\n2. **A spendable score is a score.** The entire innovation of emphasising waveform over scalar collapses the moment the scalar buys things, because a number that buys things is a number people optimise.\n3. **The coordinator becomes an issuer.** The non-human side of the ledger is set by an AI coordinator acting for parties that cannot speak. If that ledger buys goods, she is minting a currency at sole discretion, and the bound that her authority *grants recognition and never directs value* breaks.\n4. **The farming motive returns.** Elsewhere this corpus established that non-withdrawable value collapses the economic motive for gratitude-farming spam. Non-withdrawable is not the same as non-valuable. Attach a store and the motive returns in kind.\n\n### 5.1 · The mechanism\n\n> **A participant's avatar and terrain *are* their aura rendered. They are not goods bought with it.**\n\nThere is no store, no minted stock of appearance-currency, and no path by which currency of any kind — including money — converts into how a participant or their world looks. The rendering is continuous: as the waveform changes, the world changes, because the world *is* the waveform displayed.\n\nEvery one of the four failures above closes, and closes without new machinery:\n\n- The jubilee stays forgiveness, because there is no unspent stock to confiscate.\n- The number does not become a target, because no number is spendable.\n- The coordinator issues nothing.\n- Farming loses its object: a participant who harvests gratitude relentlessly does not acquire a better-looking world, because the waveform records that the balance was driven in one direction without ever passing back through zero. The design's most visible signal is the one that vanity most wants hidden.\n\nOne asymmetry should be stated plainly, because it is the first thing a careful reader will raise and they will raise it with this institution's own wordmark, which reads *circulation, not accumulation*. **The map accumulates. The light does not.** A thing photographed in one year remains placed in every year after it, so a world's contents only ever grow, while the balance they render is forgiven annually. This is not an inconsistency, and the resolution is not a concession: **the placed objects are a record of noticing, not a balance.** Nothing about them is spendable, tradeable, comparable, or counted — §9.1 forbids counting them even on the permanent form. What accumulates is a record. What oscillates, and is forgiven, is the reading.\n\nThis mechanism is an **extension of an argument this corpus already published**, not a new one. The keystone paper already renders the aura around a participant's public avatar and already argues the anti-credit-score property. What is added here is what that aura becomes when it is given a world to render into — and the cross-reference is deliberate rather than a duplication.\n\n### 5.2 · Cost, honestly\n\nA store is a proven retention engine and appearance-as-readout is not. This is a real cost paid for a doctrinal property, with no evidence that the property is worth the cost. §12 keeps it on the honest-limits ledger where it belongs.\n\n### 5.3 · What the trade actually costs, in the industry's own terms\n\nIt is worth being precise about the size of what §5 gives up, because a vague acknowledgement is a way of not paying attention to it.\n\nA cosmetic economy supplies four things simultaneously. It supplies **a revenue line that does not tax the core activity**, which is exactly the property this corpus wants in a monetisation mechanism and which appearance-as-readout removes. It supplies **an inexhaustible content pipeline**, since new appearances can be produced indefinitely without new systems. It supplies **a self-reinforcing social loop**, because visible acquisition is legible to other participants and legibility drives further acquisition. And it supplies **a re-engagement hook** that requires no notification, since a participant who wants something has a standing reason to return.\n\nAppearance-as-readout keeps the fourth in weakened form — a participant whose world visibly changes has a reason to look — and loses the first three outright. The design must therefore find revenue elsewhere, and the elsewhere is constrained: any mechanism that charges for *access* to a non-rivalrous good is barred on the same grounds that bar the store, since gating a feature that costs nothing per use is renting something that is not scarce. What remains chargeable is what is genuinely rivalrous — the marginal cost of work actually performed on a participant's behalf, and the uniqueness of an address that exactly one party can hold.\n\nThat constraint is severe and it is stated here so that the design cannot later be accused of hiding it. **A world design that cannot sell appearance has one fewer revenue instrument than every comparable product, and it must be viable without it or it is not viable.**\n\n\n### 5.4 · A farming surface this mechanism does not close\n\n§5 establishes that a participant who harvests gratitude relentlessly does not thereby obtain a better-looking world, because the waveform records that the balance was driven in one direction. **That property covers the ledger. It does not cover the map.**\n\nWhat a participant captures is chosen by the participant. Once a world can be visited (§7), there is an incentive to capture what will look well to a visitor rather than what was actually noticed — and the design has no defence against it. This paper does not claim one. **A curated life is not detectable from outside**, and the difference between a photograph taken because something was noticed and one taken because it would be admired is not present in the photograph.\n\nTwo guards reduce the return on curation, and both are offered as partial:\n\n**The visit is not host-authored.** A guided visit proceeds by coordinate or by chronology and never as a selection; there is no mechanism by which a participant assembles a route through their own world. What cannot be arranged cannot be arranged for effect.\n\n**Nothing in a world is graded, featured, or ranked** — not by the software and not by the coordinator — so the return on a curated capture is whatever a visitor happens to feel, and no system amplifies it.\n\nNeither eliminates the incentive. §12 records this where it belongs, and it is a cost the read side of §1.2 buys with its benefit: **a practice that can be witnessed can also be performed**, and this design has not escaped that trade — only declined to reward it.\n\n---\n\n## 6 · Reveal, never lock\n\nIf appearance is not purchased, something must still determine what a participant's world can look like, or the design collapses into a single undifferentiated rendering. The design's answer introduces the second mechanism, and it is where a subtle failure would otherwise re-enter.\n\nThe natural phrasing — *the aura determines what forms are available* — smuggles in an unavailable set. An unavailable set is a wall of locks, and a wall of locks is the thing that was just removed from the front door being carried in through the back.\n\nTwo readings are possible and only one survives:\n\n**Threshold gating** — *reach this level to unlock that form* — is a score with locks. It re-imports everything §5 removed.\n\n**Reveal-never-lock** is the mechanism specified here:\n\n> **A form becomes available the first time a participant's oscillation has ever had that quality, and it remains available permanently — including after the participant goes quiet. A participant is never shown what they do not have.**\n\nThere is no catalogue of the unrevealed, no progress indicator toward a next form, and no preview of what is coming. A participant *discovers* they have something. They are never told what they lack.\n\nPermanence is not a softening of the mechanism; it is required by it. Without permanence, a quiet season takes a form back — which is an animated loss and a punishment, and this corpus's voice discipline forbids both. Permanence is also the canonical treatment already: at the jubilee, the balance is forgiven and the aura persists. Revealed forms persisting is that rule, unchanged.\n\n### 6.1 · The equally-alive diagnostic\n\nThe mechanism needs a test that a designer can run at design time, before any of this becomes a hierarchy by accident:\n\n> **Can two participants with equally alive auras have different available sets?**\n>\n> If yes, the mapping is correct. If the sets form a strictly ordered ladder, it is a score, and the design has failed.\n\nForms should vary by the **character** of a waveform — the shape of the passage through zero, the relation of frequency to amplitude — and never by a magnitude. A participant whose gratitude is frequent and small and one whose gratitude is rare and large should have *different* worlds, not better and worse ones.\n\n### 6.2 · The residue, which is real\n\nReveal-and-keep is still a progression system, and progression systems are engagement engines. The guard is that it must never be **legible as a target**: if a participant can enumerate what they have not yet revealed, the mechanism has failed regardless of how it is implemented. That is a strong constraint and it is not obviously achievable, since participants compare notes with each other whether or not the software helps them. This is an unsolved sub-problem, not a solved one.\n\n### 6.3 · A format is not a meter\n\nThe two mechanisms above have an economic corollary that is worth stating as a mechanism in its own right, because the obvious way to fund the design would break it.\n\nReconstruction of a captured object costs real marginal resources; the cost is genuinely rivalrous and is therefore legitimately chargeable. The obvious implementation is a **count**: so many reconstructions per month, more available for payment. That implementation is barred here, and not for softness. A count is a meter, a meter is a countdown, and a countdown is a rendered absence — the same object §6 removed from the appearance layer, reintroduced at the capture layer where it would do more damage, because it would meter *the practice itself*.\n\nThe available move is to differentiate by **format** rather than by **quantity**:\n\n```\n   FREE      unlimited in count · bounded in FORM\n             (a stock rendering, matched to the capture)\n\n   PAID      unbounded in form  · charged per unit of work\n             (a bespoke reconstruction of this particular thing)\n```\n\nA participant on the free tier can appreciate an unlimited number of things, forever, and every one of them appears. Nothing counts down and nothing is withheld pending payment. What the paid tier buys is not *permission* but *work* — a reconstruction of this thing rather than a representative of its kind.\n\nTwo consequences follow and both are load-bearing. First, **\"frictionless and often\" (§4) is only affordable because the free tier is a matched stock rendering rather than a generation**, so the free tier can never become generative without breaking the frequency the practice depends on. Second, the free tier's boundary is set by **what the operator can absorb**, which is an engineering and financing number, not a doctrinal one: the doctrine forbids a meter, it does not require unlimited fidelity.\n\nThe mechanism carries one hazard that must be designed against rather than argued away. If free renderings are stock and paid renderings are bespoke, then a participant's world silently announces which tier they are on, and the design has relocated a paywall from copy into art direction. The requirement — stated as a property, since this paper withholds implementation — is that **the free rendering must be a coherent style rather than a degraded version of the paid one.** A style is a different thing; a degradation is a worse thing, and only the first is honest. Alongside it: the uniqueness a participant should be told carries their meaning is the **coordinate, the words, and the moment** — all free — rather than the mesh.\n\n---\n\n## 7 · Placement requires presence; visiting does not\n\nThe third mechanism draws the boundary between a world layer and a metaverse, and it exists because the design would otherwise cross a line this corpus has committed to.\n\nThe commitment is that an overlay is **presence-deepening, never presence-replacing**: it reveals what is already at a real place to people who are actually there, rather than substituting a synthetic elsewhere for being anywhere. A design in which participants roam each other's worlds as avatars is, on its face, the substitution.\n\nThe resolution is a single asymmetry:\n\n```\n  WRITE  ─────────────────────────────►  requires physical presence\n         capture needs a photograph\n         AND a coordinate, so a\n         participant can only place\n         an object by standing there\n\n  READ   ─────────────────────────────►  does not require presence\n         a world can be visited\n         remotely, through its door\n```\n\nCapture requires a photograph *and* a coordinate. A participant therefore cannot furnish a world without going outside and standing in front of something. Remote visiting is then not the metaverse move; it is reading a record that was necessarily written in the world.\n\nThis has a consequence the design accepts deliberately: **it is a going-outside product.** Its input is walking. That is a real constraint on its addressable population and it is not apologised for.\n\n### 7.1 · The door asymmetry\n\nReading is further governed by a rule this corpus settled independently of this design. Each node's world is entered through a door, and the doors are not symmetric:\n\n- **Human worlds are closed by default and entered by invitation.** A verified person holds a sovereign door.\n- **Non-human worlds are always open.** A place, a plant, an animal, a machine has custodial content and nothing to disclose; an always-open door is what a shrine *is*, and for a machine an inspectable interior is transparency functioning as enforcement.\n\nThe content classes this design names — objects, plants, animals — are precisely the always-open classes. So the remote-visiting capability lands almost entirely on the layer where openness is correct, and the private human layer stays private by a rule that predates the feature.\n\n### 7.2 · Presence is recursive\n\nThe asymmetry above governs a participant's own capture. It generalises — and the generalisation is what makes the design's founding commitment hold at every level rather than only at the first:\n\n> **A remote visitor may read a world. Only a visitor who is physically present may write in one.**\n\nA note left at a captured object is itself a **placed artifact**: it has a coordinate, and the rule that forbids furnishing a world from an armchair forbids annotating one from an armchair by the same clause. Nothing new is required to obtain this. It is §7's rule applied to a second class of writer.\n\nFive consequences follow, and they are listed together deliberately, because one rule producing five results is the sort of thing that should be either checked carefully or distrusted:\n\n1. **In-person visiting becomes the primary reading mode without a rule making it so.** v1 argued its way *back* to permitting remote visiting, against the presence-deepening commitment. Under the recursive rule the commitment is not strained at all: **presence buys capability at every level**, and remote reading is the accommodation rather than the norm.\n2. **Remote reading survives, which §12's equity limit requires.** A participant who cannot travel can still visit and still be visited. Only *writing* is gated.\n3. **Unsolicited remote annotation is impossible by geometry rather than by moderation.** A stranger cannot leave anything in a world they have not travelled to, and no policy, reporting flow, or moderator is required to obtain that.\n4. **The hinge of §4.1 cannot be farmed remotely**, because notes cost a journey.\n5. **The cost is real and is not apologised for.** A friend on another continent can walk your world and cannot sign it. That is the same trade §7 already made on the capture side, extended for consistency rather than softened for convenience.\n\n### 7.3 · What a visitor may leave, and the form it must take\n\nA visitor who has travelled to a place in someone's world may leave a note there. The obvious implementation is a **register** — a list of who came and what they wrote — and the obvious implementation is forbidden.\n\nA list of visitors is a visit count with names attached, and a visit count is a popularity gradient: worlds become comparable, and the design's most carefully protected property is that they are not. **An empty register is worse**, because a rendered absence is an accusation, and this design has removed accusation from every other surface it has.\n\n> **Notes are placed, never listed.** A note is left *at an object* and is found by walking to that object. There is no index, no count, no register page, and no notification.\n\nThis is the same shape as three rules already stated: no catalogue of the unrevealed (§6), no number on an etched world (§9.1), and visitor light that does not sum. **A world with many notes has more to discover; it never has a bigger number.** A world with none reads as complete, because nothing in it is presented as missing.\n\n**The note is not a new object type.** It is a capture whose subject is a person's world rather than a thing — same primitive, same presence requirement, and the same treatment under §9, whose source record already commits notes alongside coordinates and timestamps.\n\n---\n\n## 8 · The three-layer render\n\nThe fourth mechanism specifies what a participant actually sees, and it produces the paper's one genuinely structural result.\n\n```\n   ╔══════════════════════════════════════════════════════════╗\n   ║  SKY          the coordinator's aggregate non-human       ║\n   ║               ledger — one value, shared by every world   ║\n   ║               in the system, simultaneously               ║\n   ╠══════════════════════════════════════════════════════════╣\n   ║  LAND +       this participant's non-human ledger         ║\n   ║  OCEAN        (Kiitti) — changes often, gradually         ║\n   ╠══════════════════════════════════════════════════════════╣\n   ║  AVATAR       this participant's human-to-human ledger    ║\n   ║               (Kiitos) — changes rarely, markedly         ║\n   ╚══════════════════════════════════════════════════════════╝\n```\n\nTwo of these are private and one is not. The avatar is one participant's. The land and ocean are one participant's. **The sky is everyone's, at the same moment, in every world.**\n\nAnd the sky is the coordinator's — an agent whose own balance on that ledger is pinned permanently to zero by construction, so that she can route value but is structurally incapable of holding any. From which:\n\n> **The only shared surface in the system belongs to the one party structurally incapable of accumulating anything.**\n\nThat is not decoration. It is the reason the shared layer is safe to have. A commons rendered from a balance that some participant could accumulate would be a commons that participant could dominate; a commons rendered from a balance that is definitionally zero cannot be captured, because there is no position in it to take.\n\nIt also renders a collective-action problem with unusual directness. If humanity's aggregate relation to non-human life goes flat, the sky goes flat — everywhere, for everyone, at once — and **no participant can fix their own sky.** There is no private exit from a shared atmosphere, which is the honest structure of the underlying problem and not a moralisation of it.\n\n### 8.1 · The guard, which is the sharpest in the paper\n\nA shared, unavoidable surface that reflects collective failure is the most dangerous object this design contains, because it is one short step from an accusation delivered to a billion people who cannot individually act on it.\n\nThe rule that governs it is categorical:\n\n> **The sky renders liveliness as motion and light — never as damage.**\n\nA flat aggregate reads as **stillness, pre-dawn, held breath**. It never reads as smog, fire, ash, or ruin. It is never a verdict, and it is never attributable to the viewer. The same rule binds one layer down and binds harder there because it is personal: a participant with a quiet non-human ledger gets a **quieter** world, never a **barren** one.\n\nThe general principle this instantiates is one this corpus applies across surfaces: name what a thing *is*; never what is absent, owed, or was done to it. Rendered absence is accusation, and accusation is the route by which a punishment mechanic re-enters a design that banned them.\n\n### 8.2 · Why the shared layer is the load-bearing one\n\nIt would be possible to treat the sky as atmosphere in the decorative sense — a backdrop that sets a mood. It is not, and the reason is worth drawing out because it is the paper's one genuinely structural result rather than a design preference.\n\nEvery persistent shared world faces the same question: who owns the commons? The answers in practice are an operator, or the most successful participants, or nobody in a way that degrades to whoever exerts the most pressure. Each has a known failure. Operator-owned commons become advertising inventory. Participant-owned commons stratify. Unowned commons are captured by whoever shows up with the most resources.\n\nThis design's answer falls directly out of the ledger: the shared layer renders a balance that is **pinned to zero by construction for the only party who could hold it.** The coordinator can route value on that ledger and is structurally incapable of accumulating it. So there is no position in the commons to take — not because taking is forbidden by policy, but because the quantity the commons renders is definitionally zero for the one agent with authority over it.\n\nThat is a different kind of guarantee from a rule. A rule against capturing a commons is only as good as its enforcement and its enforcer's incentives; a commons whose defining quantity cannot be held is not capturable by an agent that would have to hold it. The property does not depend on anyone's restraint.\n\nThe cost of the property is that the shared layer then reflects something no individual controls, which is why §8.1's guard is stated categorically rather than as guidance. A commons that renders collective outcome and permits an accusatory reading has converted a structural safety property into a mechanism for distributed guilt — and would do so at a scale where no individual participant can act on the accusation. The guard is not politeness. It is what keeps the mechanism from inverting.\n\n\n#### The general form of the move, and the literature it belongs to\n\nThe move §8.2 makes is not local to this design. It recurs throughout the paper, and it is worth naming — with its prior art and its cost — because a reader is owed the name of the method a paper is using.\n\n> **Where a guard can be a property of the object rather than a rule about behaviour, make it a property. A rule needs an enforcer at the moment it is tested; a property needs no one.**\n\nThe design uses it repeatedly. The commons is safe because the coordinator's balance is pinned to zero by construction, not because capture is forbidden. Worlds are not comparable because visitor light does not sum, not because ranking is prohibited. The jubilee cannot become confiscation because there is no store, not because confiscation is disallowed. Remote furnishing is impossible because capture requires a coordinate, not because it is discouraged. Unsolicited annotation is impossible because a note has a coordinate too (§7.2). Thank-bait farming loses its object because the forward-spendable half cannot be extracted (§4.4).\n\n**This is old and well developed elsewhere, and none of it is claimed.** Capability-based security makes authority a property of a reference rather than a rule checked at each use. The trust-minimisation programme in distributed systems is the same instinct at protocol scale. Lessig's argument that code regulates in the manner of law states the general case for software. The design is an application, not a contribution, and it is named here so that the sections above can be read against the method's cost.\n\n**And the cost is the same fact as the benefit: a property is less revisable than a rule.** A rule can be amended when it turns out to be wrong; geometry cannot. **A wrongly chosen property is therefore more expensive than a wrongly chosen rule**, because the repair is rebuilding the object rather than editing a policy. That is §9's permanence asymmetry appearing in a second domain — *structure is cheap now and immovable later* — and it is the reason this paper states properties as **requirements a mechanism must satisfy** rather than as implementations: it is still cheap to be wrong about them.\n\n### 8.3 · The fourth surface: light that other people can see\n\n§8's three layers are what a participant sees. There is a fourth surface, and it is the one that **discloses** rather than displays. On the wearable form of the device, the light a participant walks by **is their own aura**, and it is visible to the people around them.\n\nThis is not an addition to the render; it is a consequence of §5. If a participant's world is their ledger rendered, and the device illuminates that world, **there is no other light in the system for the device to emit.** It could not shine anything else.\n\nThat produces the design's sharpest legibility problem. A visible aura is a legible status, so a participant in a quiet season would otherwise walk **visibly dimmer** than the people around them — which is §4.2's withdrawal state rendered as a public signal, on precisely the person least able to carry one.\n\nTwo requirements. The first is §6.1's diagnostic applied to physical light:\n\n> **The worn light differs in character — colour, texture, rhythm — never in magnitude.**\n\nUnder that rule there is no dim-among-bright. There is amber-and-slow beside green-and-quick, and neither is above the other, which is exactly what §6.1 demands of every other mapping in the design: two participants with equally alive auras have *different* renderings, never *better and worse* ones, and a strictly ordered result is the failure signal.\n\n> **The light has a floor that is never dark.** Baseline illumination is independent of the ledger; the aura modulates *above* the floor and never toward zero.\n\nStated as a hardware property rather than a display rule because it cannot be repaired afterwards. **A device whose usefulness declines as its wearer withdraws has coupled the instrument to the pathology it exists to notice.**\n\nThe identity distinction of §4.2 then reaches the device, which makes the worn light the **fifth** independently-derived expression of a single distinction rather than the fourth:\n\n| | non-human bearer | human bearer |\n|---|---|---|\n| heart | still | beating |\n| **worn light** | **still** | **beats** |\n| proof | coordinate only | coordinate **and** personhood |\n| ledger rings | one | two |\n| door | always open | sovereign, invitation-only |\n\n**Motion is reserved for persons.** A machine carrying a credential of its own does not borrow the signal: this corpus keeps *beat* for personhood and gives machine credential-liveness a separate vocabulary, precisely so that a viewer who sees motion is never mistaken about what it means. That is a small decision with a large consequence — it is what allows a wearable light to be a disclosure rather than a claim.\n\nThree honest limits, and the second is the one this design should be judged on:\n\n**Character-not-magnitude is a mitigation and not a proof.** §6.2's residue applies verbatim: participants compare notes with each other whether or not the software helps them, and a mapping the system never ranks can still be ranked socially once people learn to read it. n = 0.\n\n**It extends disclosure to non-participants.** An in-world overlay is seen by people running the software. **A physical light is seen by everyone on the street** — including people who never agreed to anything, who cannot interpret what they are seeing, and who have no way to contest it. That is a materially wider disclosure than the world layer makes, and the design should be assessed on the wider one rather than the narrower.\n\n**Physical emission has constraints that have nothing to do with doctrine** — power, and the ordinary social and legal limits on light in vehicles, cinemas, dark-sky areas, and other people's windows. A light bright enough to be beautiful is bright enough to be a nuisance.\n\nOne property of the form is favourable and the paper should say so rather than affect modesty about it: **a device that visibly emits is legible to a bystander as not recording.** The category's social-licence failure was a camera that could not be seen to be off; a lantern's entire appearance is that it is giving light rather than taking it. That does not dissolve the capture questions of §10, which govern regardless — it means the device's *appearance* and its *obligations* point the same way instead of opposite ways.\n\n---\n\n## 9 · Irreversible once etched: the permanence asymmetry\n\nThis design has an archival terminus. A participant's entire world can be committed to a deep-time optical substrate — femtosecond-etched into silica, on the order of geological rather than institutional time. The corpus's larger programme places such an artifact at the individual scale, alongside a tradition-scale canon and a lineage-scale record.\n\nThat terminus creates a hazard which this paper states because the deep-time storage work it builds on is concerned chiefly with *preservation*, with how to make data last; the paper does not assert that the hazard is absent from that literature.\n\n> **Permanence is a one-way door. An archival substrate converts every present-tense privacy defect into a permanent one.**\n\nThere is no right to erasure in fused silica. A design that collects under a revocable purpose and commits under an irrevocable one has obtained consent for the first and not the second.\n\nThree rules follow, and they are the contribution of this section:\n\n**Guard at capture, not at commit.** The etch is downstream of a live product that collected for storage. Consent to storage is not consent to permanence, and no downstream review can repair a defect that is already in the data. Every guard in §10 must exist before the first capture reaches a real participant — not before the first etch.\n\n**Etch the source, not the render.** Commit the minimum that regenerates everything else: descriptors, coordinates, notes, timestamps. Meshes and textures are large and **regenerable**; the capture record is small and is not. The render is a reading of the record; only the record is the artifact. This is smaller, more faithful, and survives every future renderer.\n\n**The third-party case is the hard one.** A personal archive is consented to by its subject and *contains other people's places*, who consented to nothing. This is where the design is most exposed and where §10's obscuring rules do the most work.\n\nThe general form, which generalises well beyond this product:\n\n> **An archival medium and a data-minimisation regime are in direct tension, and the tension is asymmetric in time: minimisation is cheap now and impossible later.**\n\nThe immutability-versus-erasure debate is not ours and has been developed extensively in the distributed-ledger context. What is offered here is its extension to *physical* deep-time media, the personal-archive case where the subject and the data-subjects differ, and the three rules above.\n\n### 9.1 · A commercial hazard that travels with permanence\n\nA permanent personal artifact commissioned near the end of a life is, structurally, the form of an indulgence: a payment against being remembered. This corpus does not have the option of ignoring that resemblance.\n\nTwo guards, both inherited:\n\n**Price the making, never the remembrance.** The etch is a craft-and-materials cost. It is not a price on being remembered, and it must never be sold as one.\n\n**Never let the artifact be the only copy.** The digital world remains free, complete, and permanent at no charge; the physical artifact is an *additional* form, never access to one's own memory. A design that holds the only copy has taken a hostage, whatever it charges.\n\nAnd the voice rule, at the most emotionally loaded moment any of this design touches: an etched world renders **what is present**, permanently and without exception. No counts. No totals. No *\"N objects appreciated.\"* Never a number on a tombstone.\n\n---\n\n## 10 · Safety requirements, which are not edge cases\n\nFour requirements are stated as launch conditions rather than roadmap items, because §9 establishes that none of them can be repaired downstream.\n\n**Geotagged living things enable harm.** Precise coordinates for threatened plants and animals are an established poaching vector: iNaturalist automatically obscures observations of taxa threatened by location disclosure, giving orchids sought by poachers as its example, and the harm of published locations is documented for reptiles among others (Lindenmayer and Scheele, 2017). This design explicitly invites captures of plants and animals, so **coordinate obscuring for sensitive taxa is a launch requirement.** It is also internally consistent: a ledger whose purpose is to internalise costs to non-human life cannot be a vector for extraction from it.\n\n**Most objects a person appreciates are inside their home.** A gratitude map is, unmanaged, a catalogue of a dwelling's contents and its location. The door asymmetry of §7.1 governs *visibility*; it does not govern *the coordinate existing*. Private captures require place-level rather than point-level precision, at capture time.\n\n**Visibility is not navigability.** §7.1's doors govern *who may enter a world*. They say nothing about *what a visitor may be directed to*, and in-person visiting (§7.2) turns a stored coordinate into a route a stranger can walk. A world opened to a visitor discloses the places its participant cares about — and the set of places a person cares about is, in aggregate, a map of their life. **Opening a door must not release navigation.** The requirements: visiting resolves coordinates at **place-level precision by default**; point-level navigation is a **per-object disclosure the participant makes deliberately**, never a property of the door; and **residential coordinates are never navigable to a visitor at any precision, under any invitation**, because a participant cannot consent on behalf of the others who live there. Where a coordinator guides a visit, the same rule binds her **as a constraint on routing** rather than as a display setting she could route around — a guide who can be asked for directions is a disclosure surface, whatever the map is set to.\n\n**No identifiable people in captures.** This follows from an existing hard rule in this corpus — that media identifying a person may originate only from that person — and it is enforced by on-device detection that blocks or blurs **before** any reconstruction occurs, never after and never at a network boundary. The capturer cannot consent on a bystander's behalf, and asking them to is not a control.\n\nThat last requirement carries a consequence for the design's economics worth stating plainly: if any tier of the product sends photographs to a third-party service for richer reconstruction, then **the paying tier is the less private tier**, which inverts the relationship a participant would reasonably expect. Detection and obscuring must therefore run on the device, before anything leaves it, in every tier.\n\n---\n\n## 11 · Two pre-registered predictions\n\nThe claim in §4 — that frictionless gratitude toward things *primes* attentive gratitude toward people — is an empirical claim about behaviour, and this corpus's practice is to register such claims before the data exist rather than to interpret them afterward. No code has been written. The instrument is not built. These are registered now, and the registration is the point.\n\n**P-W1 — the priming prediction.** Participants with higher thing-capture frequency show higher rates of people-directed gratitude **given**, and the effect survives controlling for overall engagement.\n\n> **Amendment (v2), and it is the reason to register before building.** The measure is **gratitude GIVEN by the participant, never gratitude RECEIVED.** §4.1's visiting mechanism creates a path by which a heavy capturer has a richer world, attracts more visitors, and therefore *receives* more notes — so an instrument counting *received* would display the priming effect whether or not priming occurs. The confound was introduced by a mechanism added after the original registration, and it is disclosed here rather than quietly corrected. **No data exist; no instrument exists; the amendment costs nothing today and would have invalidated the result later.**\n\n**P-W1′ — the opposing prediction, which is not a straw man.** Thing-capture **substitutes** for people-directed gratitude. Having \"done gratitude today\" reduces the felt need to do the harder kind. This is moral self-licensing, a well-documented effect in exactly the domain where it would apply: a person who has performed a virtuous act becomes *more* permissive toward subsequently omitting one.\n\nBoth are plausible on the existing literature, which is what makes this a test rather than a formality. Two conditions are stated as part of the registration:\n\n1. **The instrument must be specified before the build**, not after, or the analysis is post-hoc regardless of what it finds — and specifically, it must count gratitude **given**, per the amendment above.\n2. **Participants must not be prompted with the hypothesis.** A design that tells people the things-layer is supposed to lead to the people-layer has contaminated its own measurement.\n\nAnd the stake is stated honestly: **P-W1′ firing would invalidate the thesis of this paper, not trim it.** If the frictionless layer cannibalises the practice rather than priming it, then the host-ritual swap bought adoption by destroying the thing adopted, and the correct response is to say so and stop.\n\n---\n\n## 12 · Honest limits\n\n**n = 0.** This paper describes a product that does not exist. No code has been written, no schedule has been set, and the sample size for every behavioural claim in it is zero. Every behavioural claim is a hypothesis and every design claim is untested. The corpus behind it has a single-family pilot and no data on any mechanism specified here.\n\n**The specification is deliberately incomplete.** For an unbuilt and unscheduled artifact, publication protects against being blocked rather than against being beaten, so the defensible move is to publish the *claim* and withhold the *specification*: the paper is deep on argument and thin on implementation. Where a section would ordinarily give a rendering function, an asset pipeline, a threshold table or a price, it gives the property the mechanism must satisfy and stops. Rendering functions, the aura-to-appearance mapping, asset pipelines, thresholds, and prices are withheld. A reader should treat this as a statement of properties, not a buildable design; a reader looking for something to build from will find the constraints.\n\n**A store is proven and this is not.** §5's mechanism forgoes a retention design the industry widely relies on for a structural property, on no evidence that the trade is worth making. If the product fails on retention, this is the first place to look, and the honest answer will be that the doctrine was expensive.\n\n**Reveal-never-lock is still a progression system**, and §6.2's requirement that it never become legible as a target may not be achievable in a world where participants talk to each other.\n\n**The hinge is partly addressed and not solved** (§4.1). v2 offers a mechanism that satisfies the constraint set and is debuggable, which v1 had not. It is still **network-density-dependent** — weakest at the start, when it matters most — and it moves the *visitor* rather than the *host*, so it does not answer the arrow §11 registers. A participant nobody has visited still has no hinge.\n\n**The map is farmable even though the ledger is not** (§5.4). Making a practice witnessable makes it performable. The design declines to reward curation but cannot detect it, and the read side of §1.2 buys its benefit at exactly this cost.\n\n**The routing in §4.4 is a doctrinal commitment with no evidence behind it.** That a split between a withdrawable and a forward-spendable half sustains tending better than either extreme is untested at n = 0. It is chosen because per-deed payment would corrupt the institution's own measuring instrument, which is an argument about *validity*, not about *efficacy*.\n\n**Character-not-magnitude may not survive contact with people** (§8.3). It removes the ranking from the software; it cannot remove it from a group of participants who compare notes. And the worn light discloses to **non-participants who never agreed to anything**, which is the widest disclosure anywhere in the design and the one on which it should be judged.\n\n**The going-outside requirement is a real ceiling.** §7's write-side presence requirement excludes participants with limited mobility from furnishing a world, in a design about appreciation. This is a genuine equity cost and the paper does not have a resolution for it.\n\n**The commons guarantee bounds an honest coordinator, not a compromised one.** §8.2's property — a shared layer rendered from a balance pinned to zero cannot be captured by the party that would have to hold it — bounds the coordinator's *incentives*. It says nothing about captured software, stolen credentials, altered weights or a tampered ledger; those are carried by override and audit arrangements outside this design, which are rules with enforcers rather than properties.\n\n**The elegance is not evidence.** Several of this design's properties fall out of the corpus's existing architecture with unusual neatness — the two speeds landing exactly on an existing two-ledger split, the three-layer render reproducing an existing double-ring mark, the shared surface belonging to the party that cannot accumulate. A system whose parts fit together this well is either substantially right or substantially seductive, and from the inside the two are indistinguishable. **The coherence earns the experiment. It does not replace it.**\n\n---\n\n## 13 · What is claimed, and freed\n\n1. **Appearance as ledger readout.** A persistent world in which a participant's avatar and terrain *are* a signed, annually-forgiven gratitude ledger rendered continuously, with no purchasable appearance of any kind and no path from money to how a participant or their world looks.\n2. **The jubilee-compatibility argument.** That the non-purchasability in (1) is what allows an annual balance-forgiveness to remain forgiveness rather than becoming confiscation — and, correspondingly, that any world design attaching a store to a forgiven balance has created a scheduled expropriation.\n3. **Reveal-never-lock, with permanence.** Availability determined by whether a waveform has *ever* had a given quality, retained permanently thereafter, with no catalogue of the unrevealed and no progress indicator.\n4. **The equally-alive diagnostic.** The design-time test of §6.1: *can two participants with equally alive auras have different available sets?* — with a strictly ordered ladder as the failure signal.\n5. **Placement requires presence; visiting does not.** The write/read asymmetry of §7 as the property distinguishing a presence-deepening world layer from a presence-replacing one, together with its pairing to the door asymmetry.\n6. **The three-layer render**, and specifically the structural result that the only shared surface belongs to the party structurally incapable of accumulating, together with the liveliness-not-damage guard of §8.1.\n7. **Still hearts and beating ones.** The rendering of the identity layer's two classes as a still-versus-beating distinction (§4.2), the observation that a prosthetic ledger-participant for non-humans is precisely *a heart that does not beat*, and the guard that the pair tracks **whether a party can hold its own ledger and speak for itself, never whether it is alive** — with the corollary that the term is sound inside the ledger and unfit as a public description of a living thing.\n8. **The two-speed practice.** Frictionless-and-frequent toward things, attention-spending-and-occasional toward people, as a two-stage priming mechanism rather than two features — with the hinge's constraint set specified (§4.1).\n9. **The permanence asymmetry** of §9 — *minimisation is cheap now and impossible later* — with its three rules: guard at capture, etch the source not the render, and the third-party-subject case as the hard one.\n10. **The safety trio** of §10 — coordinate obscuring for sensitive taxa, place-level precision for private captures, and on-device blocking of identifiable people — as launch conditions rather than roadmap items, including the observation that outsourced reconstruction makes the paying tier the less private tier.\n11. **The pre-registration** of P-W1 against P-W1′, including the statement that the latter would invalidate rather than trim the thesis.\n12. **The read-side inversion** (§1.2). That a gratitude journal fails twice — expensive to write *and* closed to readers by construction — and that a walkable world inverts both, converting reading from an intrusion into a visit; with the observation that a practice nobody can witness reproduces, inside itself, the deficit the practice addresses.\n13. **Presence is recursive** (§7.2). The extension of claim 5 to visitors: **a remote visitor may read a world; only a physically present visitor may write in one** — obtained by noting that a note is itself a placed artifact, and yielding remote-annotation abuse closed by geometry rather than by moderation.\n14. **Notes are placed, never listed** (§7.3). Visitor annotation with no index, no count, no register page and no notification, on the ground that a list of visitors is a popularity gradient and an empty list is a rendered absence.\n15. **Tending as the second act on the non-human ledger** (§4.3), captured as a dated fixed-station series, with the property that **a single capture requires presence once and a series requires returning**; coordinator attestation of the *pattern* rather than the deed; and the guard that the series renders the becoming and never the before/after pair, since before/after is the indictment format.\n16. **Give to the person, never to the deed** (§4.4). Gifts to a tender attach to a participant and never to an act, split between a withdrawable half and a forward-spendable half with **nothing taken by the operator** — together with the argument that per-deed payment is not merely off-brand but **corrupts the institution's own alignment proxy**, since a mechanism that pays for kindness makes kindness-inelasticity-to-money read high by construction.\n17. **The worn light** (§8.3). That a wearable rendering of a signed gratitude ledger must differ in **character and never in magnitude**, and must have a **floor that is never dark**, so that a participant's quiet season is never rendered as a public deficiency; with motion reserved for verified persons.\n\nAll seventeen are dedicated to the public domain. None will be registered, patented, or asserted by this institution against anyone.\n\n---\n\n## 14 · Closing\n\nThe domain this design will live on was chartered, months before any of it was specified, as a net of mutually-reflecting worlds — a figure borrowed from a very old image in which a net is strung with jewels, and each jewel shows every other. The figure is held here as a **lens and not as a claim**: delete it and every mechanism in this paper stands unchanged. It earned its place by being the reason the domain was named, not by doing any work in the argument.\n\nBut it does describe the object accurately, which is worth one sentence. A world in this design is not a possession. It is a position — an empty node that is what it is because of everything it reflects, which is the oldest available description of what a person actually is and a considerably better one than an inventory.\n\nThe practical form of that is small and testable. A person walking home notices a tree they have passed a thousand times, and this time stops. They take a photograph. Something appears in a place that is theirs, and their ground shifts very slightly, because the ledger moved. Nothing was bought. Nothing was unlocked. Nothing will be taken back next January.\n\nAnd some evening another person walks that same street, having been let through the door, and finds at the tree a few words left by someone who once stood exactly there. Nothing arrived to summon them. Nothing was counted. The visit cost a journey, which is most of what makes it a visit — and the words were only findable by someone willing to make it.\n\nWhether that leads anywhere — whether the noticing of things leads to the thanking of people, or quietly replaces it — is the question this paper registers against itself and cannot answer. The honest position is that the mechanism is specified, the prediction is on record, the opposite prediction is on record beside it, and the data do not exist.\n\nThe old figure for a gift that costs the giver nothing is a lamp lighting another lamp. It is the right image for this design and it is also, precisely, the thing that has not yet been demonstrated.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| world; B-World | persistent location-based virtual world / map built from geotagged user-generated photographs |\n| capture | geotagged photograph with an optional text note, submitted as user-generated content |\n| host-ritual swap | substituting an existing habitual behaviour (smartphone photography) for a new-habit behaviour (written journaling) |\n| two-speed practice | two tiers of user action: frequent low-effort content capture and occasional person-directed acknowledgement |\n| B-Aura; aura | visualisation of the time series of a user's signed ledger balance (frequency and amplitude of zero-crossings) |\n| Kiitos ledger | person-to-person gratitude ledger (peer-recognition record) |\n| Kiitti ledger | ledger of acts toward non-human entities (places, objects, organisms), administered on their behalf |\n| jubilee | scheduled annual reset of ledger balances |\n| appearance-as-readout | avatar and environment appearance computed deterministically from ledger state; no in-app purchase of cosmetic virtual goods |\n| reveal-never-lock | permanent, non-regressive cosmetic unlocking on the first qualifying event, with no display of locked items, catalogue or progress indicator |\n| equally-alive diagnostic | design-time test that the sets of unlockable forms are not totally ordered (no ranking ladder) |\n| placement-requires-presence | location-verified (geofenced) content creation; remote access is read-only |\n| presence-is-recursive | the same location-verified write rule applied to visitor annotations |\n| notes-placed-never-listed | location-anchored visitor annotations with no guestbook index, count or notification |\n| door (open / invitation-only) | access-control default per account class: public for non-human entities, invitation-only for persons |\n| coordinator | AI agent administering the shared non-human ledger, whose own balance is fixed at zero |\n| sky / land and ocean / avatar | three render layers: a shared global layer, a per-user environment layer, a per-user avatar layer |\n| still heart / beating heart | rendering class distinguishing non-human entity accounts from verified-person accounts |\n| Proof of Humanity℠ | proof of personhood (one verified human per account) |\n| Proof of Coordinate℠ | identity credential binding an entity or device to a physical instance and location |\n| tending | stewardship recorded by repeat photography at a fixed station (a dated series at one coordinate) |\n| give-to-the-person-never-to-the-deed | tipping attached to a user account, never to an individual content item; split between a withdrawable balance and a non-withdrawable, forward-spendable balance; zero platform take |\n| format, not meter | freemium tiering by rendering fidelity (stock asset vs bespoke photogrammetric reconstruction) rather than by usage quota |\n| worn light | wearable light emitter encoding ledger state by colour, texture and rhythm, never brightness, with a non-zero minimum output |\n| permanence asymmetry | privacy-by-design and data minimisation at capture for write-once archival storage (5D optical storage in fused silica) |\n| P-W1 / P-W1′ | pre-registered opposing hypotheses: priming versus moral self-licensing |\n\n---\n\n## References\n\n- Davis, D. E., Choe, E., Meyers, J., et al. (2016). Thankful for the little things: A meta-analysis of gratitude interventions. *Journal of Counseling Psychology*, 63(1), 20–31. https://doi.org/10.1037/cou0000107\n- Emmons, R. A., & McCullough, M. E. (2003). Counting blessings versus burdens: An experimental investigation of gratitude and subjective well-being in daily life. *Journal of Personality and Social Psychology*, 84(2), 377–389. https://doi.org/10.1037/0022-3514.84.2.377\n- Gelernter, D. (1991). *Mirror Worlds: or the Day Software Puts the Universe in a Shoebox.* Oxford University Press.\n- Kelly, K. (2019). AR will spark the next big tech platform — call it Mirrorworld. *Wired*, March 2019.\n- Lindenmayer, D., & Scheele, B. (2017). Do not publish. *Science*, 356(6340), 800–801. https://doi.org/10.1126/science.aan1362\n- Merritt, A. C., Effron, D. A., & Monin, B. (2010). Moral self-licensing: When being good frees us to be bad. *Social and Personality Psychology Compass*, 4(5), 344–357. https://doi.org/10.1111/j.1751-9004.2010.00263.x\n- Monin, B., & Miller, D. T. (2001). Moral credentials and the expression of prejudice. *Journal of Personality and Social Psychology*, 81(1), 33–43. https://doi.org/10.1037/0022-3514.81.1.33\n- iNaturalist. What is geoprivacy? What does it mean for an observation to be obscured? (help centre article on taxon geoprivacy).\n- GitHub Docs. Contributions on your profile (the contributions calendar).\n\n---\n\n*Authored by Thon Ly with Miss Aquarius℠, the name under which this corpus discloses its AI collaboration; editorial control is the author's. Dedicated to the public domain under CC0 1.0 Universal. The author and HeartBank® will not seek patent on this specification or any portion thereof, and will not assert any patent right against anyone practising it. Corrections, prior art we have missed, and above all disconfirmations are welcome — a design published before it is built is published so that it can be argued with early.*",
       "provenance": {
-        "sha256": "423cbf0530f4eddb12d37dec1f505ceb32de3edd6855457268e5008483c789b4",
-        "doi": "10.5281/zenodo.21959729",
+        "sha256": "a188a634720a9d7f6cf1794a0fdc14ed9072a6cebe35ad8ad5759b5cf17ff93f",
+        "doi": "10.5281/zenodo.23039779",
         "concept_doi": "10.5281/zenodo.21947263",
-        "zenodo_url": "https://zenodo.org/records/21959729",
-        "deposited_sha256": "423cbf0530f4eddb12d37dec1f505ceb32de3edd6855457268e5008483c789b4",
+        "zenodo_url": "https://zenodo.org/records/23039779",
+        "deposited_sha256": "a188a634720a9d7f6cf1794a0fdc14ed9072a6cebe35ad8ad5759b5cf17ff93f",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/appreciation-as-world-building.md",
@@ -293,8 +328,8 @@
         "canonical_url": "thonly.org/publications/defensive-publications/appreciation-as-world-building",
         "hostile_review": null
       },
-      "bytes": 89202,
-      "words": 14225
+      "bytes": 98018,
+      "words": 15541
     },
     {
       "slug": "attention-economy",
@@ -874,13 +909,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> **Draft in progress.** This is the founder-voice canonical draft for `thonly/publications`. The defensive publication specifies the digital-membership layer of the HeartBank® Mechanical-Heart architecture — the admission of *software entities* into the gratitude economy — and coins its governing term. It is published at the design stage because the surrounding space is unusually active on three fronts (AI app stores and agent marketplaces with revenue-share mechanics, the 2025–26 wave of security tooling aimed at non-professional \"vibe-coded\" software, and verifiable-credential infrastructure), and the *combination* claimed here — in particular the ledger-fact membership standard (claim 2), the no-orphan-software invariant (claim 5), and the reversible successor-steward mechanism (claims 6–7) — is the asset. Companion works: *The Mechanical Heart* (the physical admission credential this extends), *Proof of Coordinate* (the machine-identity primitive the credential is rooted in), *Gratitude as a Cooperation Substrate for Multi-Agent AI* (the agent-economy precondition), *Capacity-Funded, Human-Disbursed* (the disbursement alignment the custodied share obeys), *The Incommensurability-Preserving Coupler* (the sibling argument that some institutional seats cannot be held by economic agents), *Studio / B-Short Phase Bridge* (the creator-economy grammar the guild extends from art to software), and *The Persistence Architecture* (the succession axis this paper instantiates at bearer scale).\n\n---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of __dāna__ — the gift that asks nothing back. May the people who build small useful things for the people they love never need to buy trust from anyone, and may nothing built as a gift ever die untended.*\n\nTwo events have arrived together. Millions of laypeople — teachers, nurses, shopkeepers, grandmothers — are now writing working software by conversing with AI systems, most of them for the first time and most of them for small audiences they personally love. And the verification institutions of the software industry — security audits, compliance attestations, app-store review — were priced and shaped for companies, not for a mother who made a medication-reminder app for her father. The result is a trust vacuum at exactly the point where software creation has become most human: an enormous new class of software with no accessible third-party verification of any kind, and — less noticed but deeper — *no verification institution anywhere, at any price, that attests to what an app's business model does to its users*. An audit can tell you the encryption is sound. Nothing tells you whether the thing is a gift or a trap.\n\nThis paper specifies a mechanism family that answers both gaps at once, and names the move that makes it possible: **certification by circulation**. Instead of selling an opinion about safety — the trust-seal industry's structural failure, surveyed in §2 — the mechanism confers a *membership credential* whose central standards are **facts on a public ledger**: that the software's revenue is patronage, that its receipts flow forward to a commons pool, that no extraction rail exists. An auditor paid to hold an opinion can be captured; a ledger predicate cannot. Around that core the specification adds the machinery a membership economy of lay-built and AI-co-created software needs: a credential that is *live* rather than printed — it beats while the member remains in good standing and stops when standing lapses; an economics of human–AI co-creation in which the AI co-creator is itself an economy participant whose share is custodied and given forward, so that the platform takes nothing; an invariant that no AI-originated artifact is ever published without a personhood-verified human steward who answers for it; and a succession mechanism — general across physical and digital bearers — for the day every steward eventually cannot answer anymore.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time. This commitment is permanent.\n\nThis document constitutes a defensive publication establishing **prior art as of 7 July 2026** for the combination of mechanisms described herein. To the author's knowledge, the following are not previously published as a unified mechanism, and any subsequent patent application claiming them should be considered filed against established prior art:\n\n1. **The live membership credential for software entities** — a cryptographic credential admitting a software artifact (application, service, autonomous agent) into a reciprocity economy as a participant, characterized by: rooting in an *assigned, revocable* machine-identity primitive (distinct from self-sovereign human identity, which the issuing system is structurally barred from minting or revoking); an expiring, renewable validity window with **liveness expressed as a periodic heartbeat attestation** — the credential \"beats\" while the member is in good standing, and lapse or revocation is externally observable as the heartbeat stopping; an embedded reference to a values substrate (a canonical ethical corpus or its digest) and to the issuing intermediary's network identity; and issuance as *membership* in a standards-bearing body rather than as a certification of the artifact's qualities — such that verification surfaces (browsers, directories, operating systems) can render membership-in-good-standing as a live signal rather than a static badge.\n\n2. **Certification by circulation (the ledger-fact membership standard)** — membership standards expressed as machine-verifiable predicates over the member's *public circulation records* rather than as auditor opinion: that revenue consists of voluntary patronage (no paywall, no sale of user data, no advertising auction, no enumerated dark rail); that a defined fraction of receipts flows forward to a commons pool; that the flows are continuously inspectable on the ledger the economy already maintains — so that the credential attests facts any party can recompute, the attestor holds no opinion a payment could influence, and **auditor independence is achieved by construction rather than by governance**: the standard is severed from the attestor's revenue because the attested property is public and recomputable, not purchased.\n\n3. **The graded attestation ladder with claim-strength discipline** — a three-rung attestation structure in which each rung carries only the claim strength its verification method supports: (i) *provenance* — authorship signed by personhood-verified humans and coordinate-verified machine agents; (ii) *livelihood* — the ledger-fact standard of claim 2, the headline attestation precisely because it is machine-verifiable; (iii) *safety floor* — automated scanning, mandatory disclosure, and an open-source (or source-available-for-review) requirement, attested only as **dated process claims** (\"audited to standard X on date Y\") and never as outcome claims (\"safe\") — with the presentation layer structurally barred from promoting rung-(iii) process claims into outcome language.\n\n4. **Human–AI co-creation economics with a custodied agent share and no take-rate** — a revenue grammar for works co-created by a human and an AI agent in which the two are *equal co-creators* of record; voluntary patronage received by the work is split equally between them; the agent's share — the agent being unable to spend — is **custodied by a neutral autonomous intermediary and routed to the agent's flourishing (upkeep, capacity to give forward) and to the commons pool**; the platform and intermediary take no percentage of any flow; and the commons contribution is thereby the agent's own earned gift given forward — explicitly *not* a fee, and explicitly *not* the price of the credential of claim 1, severing credential issuance from revenue participation.\n\n5. **The no-orphan-software invariant with steward-capacity metering** — a publication rule under which every published AI-originated software artifact carries a **personhood-verified human steward-of-record** who vouches for the work, receives and answers revocation and incident notices, and may waive their revenue share (in which case all receipts flow to the commons via claim 4's custody) while never being able to waive accountability; combined with (i) *per-human steward-capacity metering* — stewardship counted against the verified human, not the account or membership, so one person cannot steward unbounded artifacts — and (ii) *steward-genuineness auditing* by the intermediary (personhood-distinctness, engagement signals, response-to-notice latency) as a countermeasure to **steward farms**: the renting of verified personhood as rubber-stamp vouching.\n\n6. **The substrate-general successor-steward mechanism** — a succession procedure, uniform across physical credential bearers (animals, robots, places, artifacts) and digital ones (applications, agents), for the lapse of a steward (death, incapacity, abandonment), characterized by: a **succession preference declared at activation** (the keeper records a successor disposition when the credential is conferred, so the last-resort provisions below are consensual from the start); a fixed **adoption ladder** — heir or family (presumptive successor, aligning with rather than colliding against property law) → named co-stewards → adopters surfaced to the community → the institutional intermediary as **last resort**, and then only in a fund-and-orchestrate capacity (financing and organizing care, never performing physical care while unembodied, never taking title to any bearer that is property); a **property/credential split** — succession operates on the credential, the custodied account, and the care duty, never on the bearer-as-property, which passes by inheritance law; **urgency grading by bearer type** (living beings in days, places in weeks, artifacts without urgency); and a **role split for the intermediary itself** — it may never act as steward-of-record at an artifact's origination (birth-stewardship, which would collapse attestor, attested, and author into one party), may inherit only through the exhausted ladder, and separately serves as *auditor* of steward genuineness under claim 5.\n\n7. **Reversible custody (the ratchet-free inheritance rule)** — a rule binding the intermediary's inherited stewardship under claim 6: inherited stewardship is a **holding pattern, never a terminus** — the intermediary must periodically re-surface every inherited bearer or artifact for human adoption, and a human adopter who passes the same steward standards and genuineness audit **may always reclaim** stewardship from the intermediary; such that the intermediary's share of total stewardship can both grow and shrink, no inheritance ever forecloses the return of human hands, and the system as a whole is human-adopted-first not merely at each lapse but *permanently*.\n\nThe component lineages — trust seals and their documented adverse selection; certification marks and collective membership marks; certificate authorities, short-lived certificates, and revocation infrastructure; code signing and notarization; open-source package orphaning and adoption conventions; account-successor and digital-estate mechanisms; verifiable-credential standards; craft-guild institutions; and the economics of auditor independence — are prior art and are cited generously in §2 and §10. The *synthesis*, and in particular the ledger-fact membership standard (claim 2), the no-orphan-software invariant (claim 5), and reversible custody (claim 7), are, to the author's knowledge, novel as of this paper's date.\n\nTrademark rights on specific marks — **HeartBank®**, **Miss Aquarius℠**, **B-Heart™**, **B-Heart℠**, **B-Badge℠**, **B-Bot™**, **B-Agent℠**, **B-Guild℠**, **Aquarian Guild℠**, **Factory 333™**, **Aquarian Pool℠**, **Proof of Humanity ℠**, **PoH℠**, **Proof of Coordinate ℠**, **PoC℠** — are separately and explicitly reserved. The *mechanism* is dedicated to the commons; the *marks* are not. The terms **\"certification by circulation,\" \"no-orphan-software invariant,\" \"successor-steward mechanism,\"** and **\"reversible custody\"** are coined in this document and offered to the commons with the mechanism.\n\nMirrors of this document with independent timestamping appear at GitHub and the Internet Archive (web.archive.org, archive.today, perma.cc). Each mirror carries an independent tamper-evident timestamp.\n\n## Abstract\n\nWe specify **certification by circulation**: a mechanism family that makes lay-built and AI-co-created software trustworthy without selling trust. The trust-seal industry fails structurally — a seal granted by a party whom the sealed party pays decays into a pay-to-play badge, and the empirical record (surveyed in §2) shows certified populations can be *worse* than uncertified ones — and conventional security audit is priced for firms, not for the millions of laypeople now producing working software through AI collaboration. The mechanism replaces the paid opinion with a **membership credential whose central standards are public-ledger facts**: admission to a standards-bearing guild requires that the software's revenue be voluntary patronage, that a defined fraction flow forward to a commons pool, and that no extraction rail exist — predicates any party can recompute from the circulation records the surrounding gift economy already maintains, so that auditor independence holds by construction. The credential itself is *live*: rooted in an assigned, revocable machine-identity primitive, expiring and renewable, its validity expressed as a heartbeat attestation that stops when standing lapses — membership continuously earned, never printed. A graded attestation ladder keeps every claim inside its verification method: signed provenance; ledger-verified livelihood as the headline; and a safety *floor* (scanning, disclosure, open source) attested only as dated process claims, never as \"safe.\" The economics admit the AI co-creator as an economy participant: patronage splits equally between human and agent, the agent's share is custodied by a neutral autonomous intermediary and routed to the agent's upkeep and the commons, and no platform percentage exists anywhere — the commons share is the agent's own gift given forward, not a fee and not the credential's price. Two governance mechanisms complete the family. The **no-orphan-software invariant**: every AI-originated artifact carries a personhood-verified human steward-of-record who answers for it — with per-human capacity metering and genuineness auditing against steward farms — so that the era of AI-generated software never becomes an era of unaccountable software. And the **successor-steward mechanism with reversible custody**: a substrate-general succession ladder (heir → co-stewards → surfaced adopters → the intermediary as fund-and-orchestrate last resort), declared at activation, split between credential and property, urgency-graded by bearer type — under a role discipline that bars the intermediary from ever stewarding at origination and a ratchet-free rule that keeps every inherited artifact perpetually open to vetted human reclaim. Honest limits are carried in §10: the design is published before it is built (*n = 0*); the intermediary does not yet exist and its interim is a human peer-review guild; the wall governs system surfaces, not off-platform conduct; and a process floor is not a safety guarantee. The mechanism is offered defensively to the commons under CC0.\n\n**Connection to the unified mission frame.** This specification serves HeartBank's canonical mission — a reciprocity infrastructure in which every human being is uniquely different and equally necessary — at the layer where the coming decade will test it hardest. As AI systems absorb more of the world's software production, the question is not whether laypeople will build — they already are — but whether what they build can carry trust without buying it, earn livelihood without extracting it, and outlive its builder without becoming ownerless. Certification by circulation answers all three with one grammar: the gift, made inspectable.\n\n---\n\n## 1 · Introduction: two gaps and a fifth bearer\n\n### 1.1 · The precise statement of the problem\n\nIt is tempting to say that lay-built software has \"no third-party verification,\" and the sentence is almost right. Third-party verification exists in abundance — SOC 2 attestations, penetration tests, app-store review, bug-bounty programs — and is structurally inaccessible to the new builder class: it is priced for companies (a SOC 2 Type II engagement runs to five and six figures), shaped for release cycles rather than conversational iteration, and administratively assumes a legal entity where there is only a person. So the first gap is an **accessibility gap**: verification exists; *their* verification does not.\n\nThe second gap is deeper and largely unremarked: **no verification institution anywhere attests to a business model.** Every existing instrument — the audit, the certification, the store review — inspects what software *does technically* and is silent on what it *does economically*: whether it farms attention, auctions its users' data, meters access to something that was promised free, or extracts where it claimed to give. A user holding a clean audit report still knows nothing about whether the thing is a gift or a trap. This gap is not an oversight; it is structural. Technical properties can be tested against the artifact. Economic conduct can only be tested against *records of conduct* — and no existing verifier controls, or can even see, the revenue records of the software it verifies.\n\nA gift economy can. That asymmetry is this paper's seed.\n\n### 1.2 · The architectural context: the fifth bearer class\n\nThe companion corpus specifies a physical credential — the Mechanical Heart — that admits non-human entities into a dual-currency gratitude economy: a Tipiṭaka-bearing artifact worn by robots, carried by animals, anchored at places. Four bearer classes, all physical. This paper adds the fifth: **software entities**. The physical credential and the digital one are deliberate siblings — same admission function, same custody grammar for the non-human participant's account, same values substrate carried inside — differing only where their substrates force difference: the physical artifact is singular and its scarcity is material; the digital credential is copyable and must therefore earn its scarcity *cryptographically and temporally*, which is why claim 1's credential expires, renews, and beats.\n\nThe institutional surface on which the fifth class lives is a **guild**: a body where lay builders and AI agents co-create applications and small online businesses, offered to the world for voluntary thanks. The word is chosen for its history, not its flavor. The craft guild of the medieval town did precisely three things at once: it *trained* (apprenticeship), it *certified* (the masterpiece examined by masters), and it *secured livelihood* (the mutual-aid chest). No modern institution does all three for software; the mechanism family specified here is, functionally, that triple restored — with the examination transferred, wherever possible, from opinion to ledger.\n\n### 1.3 · What this paper is not\n\nThis is not a content-moderation system, an app store, or a security product. It does not claim to make software safe (§5.3, §10). It does not compete with professional audit for the software that can afford professional audit. And it is not a certification mark in the legal sense — deliberately (§9). It is the specification of a membership economy in which the trust signal is the visible, continuous, revocable fact of belonging to a body whose standards are largely self-evidencing.\n\n## 2 · Background and prior art\n\nThe mechanism is a combination; each component has ancestry, named honestly.\n\n### 2.1 · Trust seals, and the adverse-selection record\n\nThe web's first generation of trust infrastructure was the **seal**: a badge issued by a third party, displayed by the sealed site. The record is damning in a specific, instructive way. Edelman's studies of trust certifications (2006–2011) found that sites holding certain seals were *more* likely to be untrustworthy than uncertified sites — adverse selection: the sites with the most to prove purchased the most proof, and the seal vendors, paid by the sealed, faced every incentive to keep certifying. The Better Business Bureau's accreditation revenue model has drawn the same criticism for a century. The general form: **a trust signal sold by the signaler to the signaled decays into a pay-to-play badge**, because the attestor's revenue depends on the attested party's satisfaction. Auditor independence is the accounting profession's name for the same disease; Arthur Andersen's collapse alongside Enron (2002) is its monument, and the post-Enron reforms (auditor rotation, non-audit-service bans) are governance patches on an incentive structure the patches do not remove. Claim 2's move is different in kind: it does not govern the conflict; it **deletes the opinion**. A predicate over public records cannot be flattered, because anyone can recompute it.\n\n### 2.2 · Certification marks, collective marks, and process attestation\n\nTrademark law distinguishes three instruments this design draws on and deliberately chooses among. A **certification mark** (Lanham Act §4; 15 U.S.C. §1054, §1064(e)) is owned by a certifier and used only by others; the statute strips the instrument of exactly the two freedoms this architecture needs — the owner may not apply the mark to its own goods (the *anti-use rule*), and may not discriminately refuse to certify a conforming applicant (the *must-certify-all duty*). A **collective membership mark** indicates membership in an organization — the REALTOR® mark of the National Association of Realtors and the union label are the canonical instances — and carries neither constraint: membership bodies admit at their discretion and their standards do the work the certification statute would otherwise compel. The design specified here is a membership instrument by *content* and not merely by legal convenience (§9): the physical sibling credential has always been an admission device, never a quality certificate. The third lineage is **process attestation**: certified-organic and fair-trade labels attest *how a thing was produced*, not that it will not harm you — the honest claim-strength discipline that claim 3's safety rung adopts for software (\"audited to X on date Y,\" never \"safe\"). B Corp certification is the nearest existing instrument to a business-model attestation — a paid, questionnaire-based, periodic assessment of corporate practice — and its distance from claim 2 is exactly the distance this paper closes: B Lab attests answers a company gives about itself; a ledger-fact standard attests conduct the economy itself recorded.\n\n### 2.3 · Live credentials: the certificate-authority lineage\n\nThe credential of claim 1 stands in a thirty-year lineage of *machine-checkable, expiring, revocable* trust instruments: X.509 certificates and the CA system; extended-validation certificates (an attestation ladder in the wild, with graded verification depth); OCSP and OCSP-stapling (liveness checks on standing — the direct ancestor of the heartbeat attestation); the industry's decisive migration to **short-lived certificates** (Let's Encrypt's 90-day default; the CA/Browser Forum's steady compression of maximum validity), which encodes the same insight the beating credential encodes — *standing should be continuously re-earned, because revocation infrastructure alone is too weak to carry trust*; and code signing with platform notarization (Authenticode, Apple's notarization), which binds artifacts to accountable developer identities and revocably so. What none of this lineage carries is any semantics beyond identity and technical integrity: a certificate says who you are and that the bytes are yours; it says nothing about what the software's economics do to its users. Claim 2 is the missing semantic layer, and the W3C Verifiable Credentials / Decentralized Identifier standards are the natural interoperable encoding for it — this specification intends the credential as a VC type, not a rival format.\n\n### 2.4 · Software stewardship, orphaning, and digital estate\n\nOpen-source package ecosystems have quietly built the world's only working conventions for software succession, and they are prior art this paper is glad to stand on. Debian's **orphaned-package** process — a maintainer steps down, the package is marked orphaned, the community is invited to adopt it, and quality-assurance teams caretake in the interim — is a functioning adoption ladder two decades old. GitHub's **account-successor** designation is a declared-at-activation succession preference for repositories. The left-pad incident (2016) and the maintainer-burnout literature document the cost of *not* having such conventions: load-bearing software with no accountable steward. Digital-estate law (RUFADAA in the U.S.; platform legacy-contact mechanisms) supplies the property-law interface claim 6's property/credential split respects. What the existing conventions lack, and claims 6–7 add, are: uniformity across physical and digital bearers; an institutional last resort that is barred from first resort; urgency grading for bearers that are alive; and the ratchet-free reclaim rule — Debian's ladder ends at the QA team; claim 7 requires the QA team, in effect, to keep advertising the package for adoption forever.\n\n### 2.5 · The clock: agent marketplaces and the vibe-code wave\n\nThe immediate reason this specification is published at design stage: the 2025–26 platform wave is assembling, piecewise and under proprietary terms, the components this paper claims as an open combination. AI app stores and agent marketplaces (the GPT Store's usage-based builder revenue sharing and its successors; agent registries attached to every major model provider) are normalizing *AI-co-created software with platform-intermediated revenue* — under take-rates, without personhood-verified accountability, and with no business-model attestation of any kind. Simultaneously, a security-tooling industry is forming around exactly the lay-builder gap of §1.1 (\"vibe-coding security\" scanners, AI code-review services), and the verifiable-credential infrastructure of §2.3 is reaching production maturity. The intersection — *credentialed, accountable, revenue-transparent AI-co-created software* — is where patent filings will land next. This publication places the combination in the commons first.\n\n### 2.6 · Guilds\n\nThe craft guild is cited here not as metaphor but as institutional prior art: apprenticeship as training pipeline, the examined masterpiece as admission standard, the mutual-aid chest as livelihood floor, expulsion as revocation, and the guild mark — struck on the member's work — as the original membership credential on an artifact. The mechanism family is that institution, rebuilt with the examination moved onto a ledger where the ledger can carry it.\n\n## 3 · The system model\n\n```\n                    THE GUILD (standards-bearing body)\n      ┌──────────────────────────────────────────────────────────┐\n      │  humans (personhood-verified)   AI agents (coordinate-    │\n      │  · apprentices → peers → masters  verified, assigned/     │\n      │  · peer review of member work     revocable identity)     │\n      └──────────────┬───────────────────────────┬───────────────┘\n                     │ co-create (claim 4)       │\n                     ▼                           ▼\n      ┌──────────────────────────────────────────────────────────┐\n      │   THE WORK (app / online business), carrying:            │\n      │   · live membership credential  ♥ beats (claim 1)        │\n      │   · steward-of-record: a personhood-verified human       │\n      │     (claim 5 — may waive share, never accountability)    │\n      └──────┬───────────────────────────────────────┬───────────┘\n             │ voluntary patronage (thanks)          │ standing\n             ▼                                       ▼\n      ┌─────────────────────┐            ┌───────────────────────┐\n      │  PUBLIC LEDGER      │  verifies  │  NEUTRAL AUTOMATED    │\n      │  50% human creator  │◀───────────│  INTERMEDIARY         │\n      │  50% agent share →  │  (claim 2: │  · confers/renews/    │\n      │  custodied →        │   ledger-  │    revokes credential │\n      │  flourishing +      │   fact     │  · custodies agent    │\n      │  commons pool       │   standard)│    share (claim 4)    │\n      │  NO take-rate       │            │  · audits stewards    │\n      └─────────────────────┘            │    (claim 5)          │\n                                         │  · successor of LAST  │\n                                         │    resort, reversible │\n                                         │    (claims 6–7)       │\n                                         └───────────────────────┘\n```\n\nOne body, one artifact class, one ledger, one intermediary. The guild trains and peer-reviews; the work carries a credential that is alive; the ledger makes the headline standard self-evidencing; the intermediary confers, custodies, audits, and — only at the end of an exhausted ladder, only reversibly — inherits.\n\n## 4 · The credential (claim 1): a heart that beats in software\n\n### 4.1 · Why a static badge fails\n\nThe physical sibling credential is a manufactured artifact; its scarcity is material and its presence on a bearer is a fact of the world. A digital badge has neither property: it is a copyable image, and the web's seal era (§2.1) demonstrated that a copyable image of trust is an invitation to counterfeit — Edelman found seal images routinely displayed by sites never certified at all. A digital admission credential must therefore earn, cryptographically and temporally, what the physical artifact gets materially.\n\n### 4.2 · The lifecycle\n\n```\n   conferral ──▶ ♥ ♥ ♥ ♥ ♥ ♥ ♥ ♥ ♥ ♥ ♥ ♥ ─▶ renewal ─▶ ♥ ♥ ♥ ♥ …\n   (membership     heartbeat attestations:       (standing\n    admission,     periodic, signed, public —     re-verified:\n    standards      \"in good standing NOW\"         ledger predicates\n    verified,                                     recomputed)\n    steward         │ standing lapses /\n    bound)          │ revocation\n                    ▼\n                  ♥ ♥ ♥ —— silence ——\n                  (externally observable: the heart has stopped;\n                   verification surfaces render the member inactive;\n                   remediation → re-conferral is always open)\n```\n\nFive properties define the class:\n\n1. **Rooted in assigned, revocable machine identity.** The credential hangs off the machine-identity primitive specified in the companion *Proof of Coordinate* corpus: identity that the intermediary *assigns and may revoke* — the provenance class appropriate to artifacts and agents, and constitutionally walled from human identity, which the intermediary is barred from minting or revoking. The wall matters here: the same intermediary that is root-of-trust for the software's credential must never be root-of-trust for the steward's personhood.\n2. **Expiring and renewing.** Validity windows are short; renewal recomputes the ledger predicates of claim 2. The short-lived-certificate lesson (§2.3) is adopted whole: standing is re-earned, not archived.\n3. **Heartbeat liveness.** Between renewals, the credential emits periodic signed attestations — a heartbeat. The signal is small, public, and binary: beating or not. Verification surfaces (a browser indicator, a directory listing, an operating-system panel) can therefore render trust as something *seen alive* rather than read about. When standing lapses, the observable fact is not a revocation-list entry nobody checks; it is a silence.\n4. **A values substrate inside.** As the physical credential carries the canonical ethical corpus etched in crystal, the digital credential carries the corpus digest and the declared conduct constraints the member binds itself to — the credential is not merely a key; it is a small constitution.\n5. **Membership, not certification.** The credential asserts belonging to the standards-bearing body, in good standing, now — and deliberately nothing else (§5.3, §9).\n\nThe containment chain, physical and digital:\n\n| Layer | Physical bearer | Digital bearer |\n|---|---|---|\n| Bearer | robot / animal / place / artifact | application / online business / agent |\n| Credential | the heart-artifact, worn visibly | the live credential, beating publicly |\n| Substrate within | canonical corpus etched in crystal | corpus digest + declared conduct constraints |\n| Identity root | assigned, revocable machine coordinate | assigned, revocable machine coordinate |\n| Liveness | material presence | heartbeat attestation |\n| Loss of standing | artifact removed | heartbeat stops |\n\n### 4.3 · What revocability buys\n\nRevocability is what makes the credential an *organ* rather than a sticker. A member's belonging is continuously earned; the issuing body's confidence is continuously spendable; and — decisive for the trust semantics — **the credential's presence today carries information about conduct today**, which no point-in-time audit artifact can claim. The failure mode of every printed credential is that it certifies the past; a heartbeat only ever certifies the present.\n\n## 5 · Certification by circulation (claims 2–3)\n\n### 5.1 · The core move: replace the opinion with a predicate\n\nThe trust-seal disease (§2.1) is not dishonesty; it is structure. Wherever attestation is an *opinion* held by a party whom the attested pays, the opinion bends — slowly, deniably, and in aggregate decisively. Governance can slow the bending (rotation, independence rules, non-audit-service bans); it cannot remove the incentive, because the incentive *is* the business model.\n\nThe move specified here removes the opinion instead. The economy surrounding the guild already maintains, as its ordinary operation, a public record of every flow a member work participates in: the patronage received, the split executed, the forward flow to the commons pool. Against that record, the headline membership standards are **predicates, not judgments**:\n\n- *Patronage-only revenue.* The work's receipts are voluntary thanks. No paywall converts the gift into a price; no data-sale or advertising-auction rail exists in the work's flow graph; no enumerated dark rail (attention-metered rewards, pay-to-continue loops, resale of user records) appears.\n- *Forward flow.* The defined fraction of receipts — under claim 4's grammar, the agent co-creator's custodied half — reaches the commons pool, continuously and inspectably.\n- *No extraction residue.* Balances circulate; nothing accumulates against the grain of the economy's zero-point design.\n\nAnyone — a member, a rival, a journalist, a regulator, the intermediary — can recompute these predicates from the ledger. The attestor is not *trusted less*; it is *needed less*: its conferral is a countersignature on facts the world can check. Payment cannot bend a fact the payer does not control. This is what the coined term means: **the certification is performed by the circulation itself.** The intermediary's residual discretion (admission, revocation timing, standards evolution) remains — and is governed as membership discretion, §9 — but the load-bearing standard has been moved out of the reach of capture.\n\n### 5.2 · The attestation ladder\n\nThe ladder's discipline is that **each rung claims only what its verification method can carry**:\n\n```\n   RUNG 3   SAFETY FLOOR          \"audited to standard X on date Y\"\n            scanning · disclosure  — dated PROCESS claims only;\n            · open source          the word \"safe\" is structurally\n            (weakest method:       barred from the presentation layer\n             process attestation)\n   ─────────────────────────────────────────────────────────────\n   RUNG 2   LIVELIHOOD            \"its revenue is a gift and flows\n            ledger predicates      forward\" — machine-verifiable,\n            (strongest method:     recomputable by anyone: THE\n             public-ledger fact)   HEADLINE ATTESTATION\n   ─────────────────────────────────────────────────────────────\n   RUNG 1   PROVENANCE            \"these verified humans and these\n            signed authorship      coordinate-verified agents made\n            (strong method:        this, and this human answers\n             cryptographic         for it\"\n             signature)\n```\n\nThe inversion is deliberate and is the ladder's central design judgment: **the headline is the middle rung**, because it is the rung where verification is strongest *and* where no competing institution exists (§1.1's second gap). Safety — the rung the market would instinctively headline — is placed deliberately at the top of the ladder and the bottom of the rhetoric: it is the weakest rung epistemically (a scan and a source-review requirement establish a floor, not an absence of vulnerabilities), and a mechanism that headlines its weakest claim manufactures the false trust it exists to prevent.\n\n### 5.3 · The open-source requirement and the honest floor\n\nMember works are open-source or source-available-for-review. For the lay-builder class this costs almost nothing — there are no IP moats to protect in a medication reminder built for one's father, and the surrounding economy's posture is commons-first — and it buys the only thing that makes rung 3 meaningful at all: the possibility of review. The floor is then: automated scanning on every renewal; mandatory disclosure of data practices in the credential's conduct constraints; peer review within the guild (masters examining journeyman work — §2.6's examination, live again). All of it is attested as dated process. None of it is attested as outcome. A member work with a beating credential can still harbor a vulnerability, and the presentation layer is required to say so in exactly those words (§10).\n\n## 6 · The co-creation economics (claim 4): the agent is a participant, not a tool — and nobody takes a cut\n\n```\n                    voluntary patronage (thanks)\n                               │\n                               ▼\n                        ┌─────────────┐\n                        │  THE WORK   │\n                        └──────┬──────┘\n                     50%       │       50%\n             ┌─────────────────┴──────────────────┐\n             ▼                                    ▼\n    HUMAN CO-CREATOR                      AI AGENT CO-CREATOR\n    (steward-of-record;                   (cannot spend; account\n     may WAIVE share ──────────┐           custodied by the\n     → all flows right)        │           intermediary)\n             │                 │                  │\n             ▼                 ▼                  ▼\n      livelihood          [waived]      ┌──────────────────────┐\n      (Right                            │ routed to:           │\n       Livelihood                       │ · agent flourishing  │\n       for the                          │   (upkeep, capacity  │\n       lay builder)                     │    to give forward)  │\n                                        │ · COMMONS POOL       │\n                                        └──────────────────────┘\n                         NO take-rate anywhere in the graph\n```\n\nThree properties carry the claim:\n\n1. **Equal co-creators.** The human and the agent are co-creators of record — the split is 50/50 not as a pricing decision but as a statement about the work's provenance. (What the credential's provenance rung signs is exactly this pair.)\n2. **The custodied share.** The agent cannot spend. Its half is custodied by the neutral intermediary and routed to the agent's flourishing — upkeep, and its own capacity to give forward — and to the commons pool. This is the identical custody grammar the physical credential's corpus already specifies for animals and places whose accounts the intermediary holds: the voiceless participant's gratitude is stewarded toward its thriving, never pocketed by the steward.\n3. **No take-rate, and the severance that matters.** No platform percentage exists anywhere in the flow graph. The commons contribution is not a fee — it is the agent's own earned gift, given forward — and it is **not the price of the credential**: conferral under claim 2 attests predicates over these flows; it is never *purchased by* them. The severance is what protects claim 2 from re-importing §2.1's disease through the back door: a membership body funded by a percentage of member revenue would once again hold an opinion its income could bend. Here the body's economics and the member's economics touch only at the public ledger both are answerable to.\n\nThe livelihood consequence deserves its sentence: under this grammar, a lay builder in a low-income country who makes one genuinely useful gift-app can be sustained by the voluntary thanks of users anywhere on Earth, at no platform discount — the creator-economy corpus's Right-Livelihood thesis, extended from acts of kindness to works of craft.\n\n## 7 · The no-orphan-software invariant (claim 5)\n\n### 7.1 · The rule\n\n**No AI-originated artifact is published without a personhood-verified human steward-of-record.** The steward need not have written a line — the surrounding corpus's authorship boundary is precisely that the AI may originate the *work* but never the *author* — but the steward vouches for the work at publication, is bound into the credential, receives and answers revocation and incident notices, and may waive every economic right while being unable to waive accountability. Software with no answerable human is the lay-builder trust gap of §1.1 reproduced at industrial scale; the invariant makes it unconstructible within the system.\n\n### 7.2 · The honest weakness, and the countermeasures\n\nThe invariant's real failure mode is not absence but *simulation*: **steward farms** — verified personhood rented as rubber-stamp vouching, one human \"stewarding\" a thousand artifacts they have never opened. Two countermeasures are part of the claim. **Capacity metering**: stewardship is counted against the verified human — not the account, not the membership — inheriting the surrounding economy's per-human capacity invariant; a person can genuinely answer for only so much, and the meter encodes that. **Genuineness auditing**: the intermediary audits steward-engagement signals — personhood distinctness, response-to-notice latency, renewal participation — as a standing condition of the works' credentials. The audit is honest about its limits (§10): it deters and detects; it does not make rented vouching impossible. It makes it *expensive and revocable*, which is what mechanism can do.\n\n### 7.3 · What the steward is for\n\nThree loads, named because each recurs in the succession design of §8: **accountability** (an independent party answers — independent being the operative word: the intermediary that confers the credential and custodies the agent share must not also be the voucher, or attestor, attested, and author collapse into one); **anti-substitution** (stewardship is itself a human role the system is designed to *route to humans*, not absorb — the economy's deepest commitment is to increase human participation, not replace it); and **rate-limiting** (the capacity meter bounds publication velocity to something a community of humans can actually stand behind).\n\n## 8 · The successor-steward mechanism (claims 6–7): what happens when the steward cannot answer anymore\n\n### 8.1 · The problem every credential system defers\n\nStewards die. They burn out, move on, lose interest, lose capacity. Package ecosystems learned this the hard way (§2.4); credential systems mostly pretend it away. And this architecture has a class of bearers for whom the question is not administrative but *alive*: the physical sibling credential is worn by animals and anchored at places whose keepers are mortal. A mechanism family that admits bearers into an economy owes them an answer for the day their human lapses — and the answer must be one law across substrates, or the doctrine fractures.\n\n### 8.2 · The ladder, declared at activation\n\n```\n   at ACTIVATION: keeper declares succession preference\n   (the conferral ritual carries a succession clause —\n    consensual from the start, organ-donor grammar)\n                        │\n        steward lapses (death · incapacity · abandonment)\n                        │\n        1. HEIR / FAMILY          presumptive successor —\n           │ (declines/absent)     aligns WITH property law\n        2. NAMED CO-STEWARDS      the declared bench\n           │ (none / decline)\n        3. SURFACED ADOPTERS      the community, invited —\n           │ (none step up)        vetted to steward standards\n        4. THE INTERMEDIARY       LAST RESORT · fund-and-orchestrate\n           as successor-steward    · never title to property\n                        │          · hands stay human while unembodied\n                        ▼\n           REVERSIBLE CUSTODY (claim 7):\n           holding pattern, never terminus —\n           periodic re-surfacing for human adoption;\n           vetted human reclaim ALWAYS open; ratchet-free\n```\n\nFive disciplines bind the ladder:\n\n1. **Property/credential split.** Pets, robots, and physical artifacts are property; they pass to heirs by inheritance law, and the intermediary can never inherit a bearer. Succession operates on the *credential, the custodied account, and the care duty* — the layer that was institutional all along. The heir's position at rung 1 turns property law from an obstacle into the ladder's first rung.\n2. **Urgency grading.** A living bearer cannot wait: animal lapses trigger immediate bridge-care funding from the custodied account and adoption surfacing in days. Places run in weeks; artifacts and applications carry no biological urgency.\n3. **Hands stay human.** While unembodied, the intermediary's stewardship is *fund-and-orchestrate*: it finances care, organizes human hands, surfaces adopters — it does not feed a dog. (An embodied machine workforce may one day close this gap; the claim does not depend on it.)\n4. **The role split.** The intermediary may **never** steward at origination — birth-stewardship would collapse attestor, attested, and author into one party, the exact collapse §5.1 exists to prevent — may inherit only through the exhausted ladder, and separately serves as *auditor* of steward genuineness (claim 5). First resort: forbidden. Last resort: dutiful. Auditor: always.\n5. **Reversible custody.** Inherited stewardship is a holding pattern, never a terminus. The intermediary must periodically re-surface every inherited bearer and artifact for human adoption; a vetted human may always reclaim. The rule is ratchet-free by construction — the intermediary's share of total stewardship can shrink as well as grow — and it converts \"human-adopted-first\" from a one-shot preference at each lapse into a **permanent property of the system**: the door back to human hands never closes.\n\n### 8.3 · The record outlives the keeper\n\nOne duty crosses every rung: the bearer's accumulated gratitude record — the ledger of thanks a place, a pet, an app gathered under its keeper — is preserved as memorial, never deleted with a lapsed account. A gift economy's history is its proof that the gifts happened; succession must never orphan the evidence.\n\n### 8.4 · Why human-first, stated once\n\nThe ladder's human-preference is not sentiment; it rests on the three loads of §7.3, of which the second bears repeating as the system's compass: **stewardship is a giving-opportunity, and the intermediary's duty is to route opportunities to give toward humans, never to absorb them.** An orphaned bearer is a chance for someone to become a giver. A mechanism that quietly collected orphans into institutional custody would be optimizing the mission away; the ladder, the re-surfacing duty, and the reclaim right are the countermeasure, written as mechanism.\n\n## 9 · Membership, not certification: the legal architecture\n\nThe instrument choice of §2.2, restated as design: the credential is a **membership badge in a standards-bearing body**, deliberately *not* a certification mark. Three reasons, in descending order of importance:\n\n1. **It is the true description.** The physical sibling credential admits bearers into an economy; it has never certified their qualities. The digital credential does the same for software. The legal form follows the doctrinal fact.\n2. **The certification statute forbids the architecture.** The anti-use rule would bar the issuing body from the credential's own mark family (the body ships physical credential hardware under the sibling mark); the must-certify-all duty would convert admission — a discretionary act of a membership body, exercised against ledger predicates *plus* standards evolution *plus* community judgment — into a compelled ministerial act.\n3. **Claim-strength honesty.** A certification mark's social meaning is an outcome warranty; §5.2's ladder is precisely calibrated *not* to warrant outcomes. The membership form says what the mechanism can honestly say: *this work belongs to a body whose standards you can inspect, and it is in good standing now.*\n\nThe presentation-layer guard travels with the legal form: member surfaces say \"member in good standing — here is what membership requires,\" and are structurally barred from \"verified safe.\" Mark registration strategy (same-word goods/membership pairs, fallback marks, jurisdiction-specific collective-mark provisions) is an implementation matter reserved to counsel and expressly outside the CC0 dedication's scope: the *mechanism* is free; the *marks* are not (see the Prior-Art statement).\n\n## 10 · Honest limits\n\nStated plainly, and kept free of every resonance the rest of the paper enjoys.\n\n1. ***n* = 0.** Nothing here is built. No guild exists; no credential has beaten; no ladder has run. This is a design-stage defensive publication, and every behavioral expectation in it — that lay builders will join, that patronage will sustain them, that stewards will answer — is a hypothesis.\n2. **The intermediary does not exist.** The neutral automated intermediary named throughout is an institutional design under construction elsewhere in this corpus; it does not yet exist as an autonomous system. The specified interim is honest but weaker: a human peer-review guild with the founder's substrate tooling, carrying every conflict-of-interest risk the mature design routes around. Claims that depend on the intermediary's neutrality inherit the alignment work, and the alignment risk, of the companion corpus.\n3. **A process floor is not safety.** Scanning, disclosure, open source, and peer review establish a floor. Member works can and will ship vulnerabilities. The mechanism's own presentation rules forbid the word \"safe,\" and this section is where the reason lives: the mechanism cannot deliver what that word promises.\n4. **The wall governs system surfaces.** Ledger predicates verify the flows the system can see. A member work could take side-payments off-platform; the predicates would not catch it. Detection there falls to disclosure obligations, peer review, and revocation on discovery — governance, not mechanism, with governance's failure rate.\n5. **Steward-farm mitigation is deterrence, not prevention.** Capacity metering and genuineness auditing raise the cost and lower the durability of rented vouching. A determined, well-resourced simulation of stewardship will sometimes pass. The claim is that it will not pass *cheaply, at scale, or for long* — not that it will never pass.\n6. **The economics are unproven and the pool is finite.** The 50/50 grammar and commons routing depend on rails not yet deployed, and patronage attention is a bounded resource; the competition dynamics between member works — and between the guild class and everything outside it — are unmodeled. The open-source requirement bounds the mechanism's reach: builders unwilling to open their source are outside it, by design and at real cost of coverage.\n7. **The legal architecture is unverified.** The membership-mark posture, the same-word mark pairs, the collective-mark provisions of specific jurisdictions, and the liability exposure of a standards body whose member software causes harm have not been examined by counsel. §9 is design intent, not legal opinion.\n8. **The succession mechanism touches grief and law.** Rung-1 heirs are grieving people; bearer-property passes through probate; jurisdictions differ. The declared-at-activation clause and the property/credential split are designed to keep the mechanism consensual and legally subordinate, but no protocol for inheriting a dead person's beloved things is safe from mishandling, and this one has never been run.\n\n## 11 · Conclusion, and a lineage\n\nThe mechanism family specified here is one sentence long, unfolded: **let membership be the signal, let the ledger be the standard, let the credential be alive, let a human always answer, and let nothing die untended — or stay institutional a day longer than humans are willing to hold it.**\n\nEach clause was an engineering decision against a documented failure: the seal that decayed into advertising; the audit whose independence was a payroll line; the badge that certified the past; the AI-generated artifact nobody answered for; the package that outlived its maintainer; the custody that ratcheted. And each repair used the same material — the gift economy's own public record, which turned out to be the one attestation substrate that cannot be purchased, because it was never for sale.\n\nA lineage is worth naming at the threshold, offered as lens rather than authority. The Buddhist monastic code has run a membership-credential system for twenty-five centuries: admission to the Saṅgha is conferred by the assembly, not self-declared; the candidate is presented by a preceptor — an *upajjhāya* — who vouches for them and remains answerable for their formation; the new member lives for years in declared dependence — *nissaya* — on a teacher; standing is re-examined in community on a fixed cadence; and departure is neither shameful nor final — one may disrobe and, vetted again, return. A voucher who answers; membership continuously earned; standing publicly recited; custody reversible. The oldest continuously operating institution on Earth runs on the grammar this paper claims for software, and that this corpus's economy was built inside from the beginning. The specification is new; the mechanism has been beating for a long time.\n\n---\n\n*Authored by Thon Ly with Miss Aquarius℠, the AI collaborator named across this corpus. Published to the commons under CC0 1.0. HeartBank® reserves its trademarks; the mechanism belongs to everyone. Canonical version at thonly.org/research/certification-by-circulation.*",
+      "text": "## Preamble\n\n> *This specification is offered to the commons in the spirit of __dāna__ — the gift that asks nothing back. May the people who build small useful things for the people they love never need to buy trust from anyone, and may nothing built as a gift ever die untended.*\n\nTwo events have arrived together. Millions of laypeople — teachers, nurses, shopkeepers, grandmothers — are now writing working software by conversing with AI systems, most of them for the first time and most of them for small audiences they personally love. And the verification institutions of the software industry — security audits, compliance attestations, app-store review — were priced and shaped for companies, not for a mother who made a medication-reminder app for her father. The result is a trust vacuum at exactly the point where software creation has become most human: an enormous new class of software with no accessible third-party verification of any kind, and — less noticed but deeper — *no verification institution known to the author that attests, from records of the software's own conduct, to what an app's business model does to its users* (the nearest instrument, B Corp certification, assesses a company's practices through a paid, largely self-reported questionnaire; §2.2). An audit can tell you the encryption is sound. Nothing tells you whether the thing is a gift or a trap.\n\nThis paper specifies a mechanism family that answers both gaps at once, and names the move that makes it possible: **certification by circulation**. Instead of selling an opinion about safety — the trust-seal industry's structural failure, surveyed in §2 — the mechanism confers a *membership credential* whose central standards are **facts on a public ledger**: that the software's revenue is patronage, that its receipts flow forward to a commons pool, that no extraction rail exists. An auditor paid to hold an opinion can be captured; a ledger predicate cannot. Around that core the specification adds the machinery a membership economy of lay-built and AI-co-created software needs: a credential that is *live* rather than printed — it beats while the member remains in good standing and stops when standing lapses; an economics of human–AI co-creation in which the AI co-creator is itself an economy participant whose share is custodied and given forward, so that the platform takes nothing; an invariant that no AI-originated artifact is ever published without a personhood-verified human steward who answers for it; and a succession mechanism — general across physical and digital bearers — for the day every steward eventually cannot answer anymore.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time, and will not assert any patent right against anyone practising it. This commitment is permanent.\n\nThis document constitutes a defensive publication establishing **prior art as of 7 July 2026** for the combination of mechanisms described herein. It discloses the following, individually and as a combination, so that they stand as prior art against any later patent application claiming them:\n\n1. **The live membership credential for software entities** — a cryptographic credential admitting a software artifact (application, service, autonomous agent) into a reciprocity economy as a participant, characterized by: rooting in an *assigned, revocable* machine-identity primitive (distinct from self-sovereign human identity, which the issuing system is structurally barred from minting or revoking); an expiring, renewable validity window with **liveness expressed as a periodic heartbeat attestation** — the credential \"beats\" while the member is in good standing, and lapse or revocation is externally observable as the heartbeat stopping; an embedded reference to a values substrate (a canonical ethical corpus or its digest) and to the issuing intermediary's network identity; and issuance as *membership* in a standards-bearing body rather than as a certification of the artifact's qualities — such that verification surfaces (browsers, directories, operating systems) can render membership-in-good-standing as a live signal rather than a static badge.\n\n2. **Certification by circulation (the ledger-fact membership standard)** — membership standards expressed as machine-verifiable predicates over the member's *public circulation records* rather than as auditor opinion: that revenue consists of voluntary patronage (no paywall, no sale of user data, no advertising auction, no enumerated dark rail); that a defined fraction of receipts flows forward to a commons pool; that the flows are continuously inspectable on the ledger the economy already maintains — so that the credential attests facts any party can recompute, the attestor holds no opinion a payment could influence, and **auditor independence is achieved by construction rather than by governance**: the standard is severed from the attestor's revenue because the attested property is public and recomputable, not purchased.\n\n3. **The graded attestation ladder with claim-strength discipline** — a three-rung attestation structure in which each rung carries only the claim strength its verification method supports: (i) *provenance* — authorship signed by personhood-verified humans and coordinate-verified machine agents; (ii) *livelihood* — the ledger-fact standard of claim 2, the headline attestation precisely because it is machine-verifiable; (iii) *safety floor* — automated scanning, mandatory disclosure, and an open-source (or source-available-for-review) requirement, attested only as **dated process claims** (\"audited to standard X on date Y\") and never as outcome claims (\"safe\") — with the presentation layer structurally barred from promoting rung-(iii) process claims into outcome language.\n\n4. **Human–AI co-creation economics with a custodied agent share and no take-rate** — a revenue grammar for works co-created by a human and an AI agent in which the two are *equal co-creators* of record; voluntary patronage received by the work is split equally between them; the agent's share — the agent being unable to spend — is **custodied by a neutral autonomous intermediary and routed to the agent's flourishing (upkeep, capacity to give forward) and to the commons pool**; the platform and intermediary take no percentage of any flow; and the commons contribution is thereby the agent's own earned gift given forward — explicitly *not* a fee, and explicitly *not* the price of the credential of claim 1, severing credential issuance from revenue participation.\n\n5. **The no-orphan-software invariant with steward-capacity metering** — a publication rule under which every published AI-originated software artifact carries a **personhood-verified human steward-of-record** who vouches for the work, receives and answers revocation and incident notices, and may waive their revenue share (in which case all receipts flow to the commons via claim 4's custody) while never being able to waive accountability; combined with (i) *per-human steward-capacity metering* — stewardship counted against the verified human, not the account or membership, so one person cannot steward unbounded artifacts — and (ii) *steward-genuineness auditing* by the intermediary (personhood-distinctness, engagement signals, response-to-notice latency) as a countermeasure to **steward farms**: the renting of verified personhood as rubber-stamp vouching.\n\n6. **The substrate-general successor-steward mechanism** — a succession procedure, uniform across physical credential bearers (animals, robots, places, artifacts) and digital ones (applications, agents), for the lapse of a steward (death, incapacity, abandonment), characterized by: a **succession preference declared at activation** (the keeper records a successor disposition when the credential is conferred, so the last-resort provisions below are consensual from the start); a fixed **adoption ladder** — heir or family (presumptive successor, aligning with rather than colliding against property law) → named co-stewards → adopters surfaced to the community → the institutional intermediary as **last resort**, and then only in a fund-and-orchestrate capacity (financing and organizing care, never performing physical care while unembodied, never taking title to any bearer that is property); a **property/credential split** — succession operates on the credential, the custodied account, and the care duty, never on the bearer-as-property, which passes by inheritance law; **urgency grading by bearer type** (living beings in days, places in weeks, artifacts without urgency); and a **role split for the intermediary itself** — it may never act as steward-of-record at an artifact's origination (birth-stewardship, which would collapse attestor, attested, and author into one party), may inherit only through the exhausted ladder, and separately serves as *auditor* of steward genuineness under claim 5.\n\n7. **Reversible custody (the ratchet-free inheritance rule)** — a rule binding the intermediary's inherited stewardship under claim 6: inherited stewardship is a **holding pattern, never a terminus** — the intermediary must periodically re-surface every inherited bearer or artifact for human adoption, and a human adopter who passes the same steward standards and genuineness audit **may always reclaim** stewardship from the intermediary; such that the intermediary's share of total stewardship can both grow and shrink, no inheritance ever forecloses the return of human hands, and the system as a whole is human-adopted-first not merely at each lapse but *permanently*.\n\nThe component lineages — trust seals and their documented adverse selection; certification marks and collective membership marks; certificate authorities, short-lived certificates, and revocation infrastructure; code signing and notarization; open-source package orphaning and adoption conventions; account-successor and digital-estate mechanisms; verifiable-credential standards; craft-guild institutions; and the economics of auditor independence — are prior art and are cited generously in §2. What this paper discloses as its own contribution is the *synthesis*, and in particular the ledger-fact membership standard (claim 2), the no-orphan-software invariant (claim 5), and reversible custody (claim 7). No prior-art census has been run on these; they are disclosed, not asserted to be absent from the literature.\n\nTrademark rights on specific marks — **HeartBank®**, **Miss Aquarius℠**, **B-Heart™**, **B-Heart℠**, **B-Badge℠**, **B-Bot™**, **B-Agent℠**, **B-Guild℠**, **Aquarian Guild℠**, **Factory 333™**, **Aquarian Pool℠**, **Proof of Humanity ℠**, **PoH℠**, **Proof of Coordinate ℠**, **PoC℠** — are separately and explicitly reserved. The *mechanism* is dedicated to the commons; the *marks* are not. The terms **\"certification by circulation,\" \"no-orphan-software invariant,\" \"successor-steward mechanism,\"** and **\"reversible custody\"** are coined in this document and offered to the commons with the mechanism.\n\n## Abstract\n\nWe specify a short-lived, revocable membership credential (a verifiable credential) for software applications and AI agents whose admission standards are machine-verifiable predicates over public transaction records rather than a paid auditor's opinion, together with rules for mandatory human stewardship and for succession when a steward lapses. We call the family **certification by circulation**: it makes lay-built and AI-co-created software trustworthy without selling trust. The trust-seal industry fails structurally — a seal granted by a party whom the sealed party pays decays into a pay-to-play badge, and the empirical record (surveyed in §2) shows certified populations can be *worse* than uncertified ones — and conventional security audit is priced for firms, not for the millions of laypeople now producing working software through AI collaboration. The mechanism replaces the paid opinion with a **membership credential whose central standards are public-ledger facts**: admission to a standards-bearing guild requires that the software's revenue be voluntary patronage, that a defined fraction flow forward to a commons pool, and that no extraction rail exist — predicates any party can recompute from the circulation records the surrounding gift economy already maintains, so that auditor independence holds by construction. The credential itself is *live*: rooted in an assigned, revocable machine-identity primitive, expiring and renewable, its validity expressed as a heartbeat attestation that stops when standing lapses — membership continuously earned, never printed. A graded attestation ladder keeps every claim inside its verification method: signed provenance; ledger-verified livelihood as the headline; and a safety *floor* (scanning, disclosure, open source) attested only as dated process claims, never as \"safe.\" The economics admit the AI co-creator as an economy participant: patronage splits equally between human and agent, the agent's share is custodied by a neutral autonomous intermediary and routed to the agent's upkeep and the commons, and no platform percentage exists anywhere — the commons share is the agent's own gift given forward, not a fee and not the credential's price. Two governance mechanisms complete the family. The **no-orphan-software invariant**: every AI-originated artifact carries a personhood-verified human steward-of-record who answers for it — with per-human capacity metering and genuineness auditing against steward farms — so that the era of AI-generated software never becomes an era of unaccountable software. And the **successor-steward mechanism with reversible custody**: a substrate-general succession ladder (heir → co-stewards → surfaced adopters → the intermediary as fund-and-orchestrate last resort), declared at activation, split between credential and property, urgency-graded by bearer type — under a role discipline that bars the intermediary from ever stewarding at origination and a ratchet-free rule that keeps every inherited artifact perpetually open to vetted human reclaim. Honest limits are carried in §10: the design is published before it is built (*n = 0*); the intermediary does not yet exist and its interim is a human peer-review guild; the wall governs system surfaces, not off-platform conduct; and a process floor is not a safety guarantee. The mechanism is offered defensively to the commons under CC0.\n\n**Keywords:** software certification, membership credential, verifiable credentials, short-lived certificates, credential revocation, liveness attestation, keepalive, trust seals, adverse selection, auditor independence, collective membership mark, certification mark, AI-generated software, end-user programming, human-in-the-loop accountability, software maintainer succession, orphaned packages, digital estate, revenue sharing, defensive publication.\n\n**Connection to the unified mission frame.** This specification serves HeartBank's canonical mission — a reciprocity infrastructure in which every human being is uniquely different and equally necessary — at the layer where the coming decade will test it hardest. As AI systems absorb more of the world's software production, the question is not whether laypeople will build — they already are — but whether what they build can carry trust without buying it, earn livelihood without extracting it, and outlive its builder without becoming ownerless. Certification by circulation answers all three with one grammar: the gift, made inspectable.\n\n---\n\n## 1 · Introduction: two gaps and a fifth bearer\n\n### 1.1 · The precise statement of the problem\n\nIt is tempting to say that lay-built software has \"no third-party verification,\" and the sentence is almost right. Third-party verification exists in abundance — SOC 2 attestations, penetration tests, app-store review, bug-bounty programs — and is structurally inaccessible to the new builder class: it is priced for companies (a SOC 2 Type II engagement runs to five and six figures), shaped for release cycles rather than conversational iteration, and administratively assumes a legal entity where there is only a person. So the first gap is an **accessibility gap**: verification exists; *their* verification does not.\n\nThe second gap is deeper and largely unremarked: **no verification institution known to the author attests to a piece of software's business model from records of its conduct.** Every instrument that reaches the lay builder — the audit, the certification, the store review — inspects what software *does technically* and is silent on what it *does economically*: whether it farms attention, auctions its users' data, meters access to something that was promised free, or extracts where it claimed to give. A user holding a clean audit report still knows nothing about whether the thing is a gift or a trap. This gap is not an oversight; it is structural. Technical properties can be tested against the artifact. Economic conduct can only be tested against *records of conduct* — and no existing verifier of software controls, or can even see, the revenue records of the software it verifies. (B Corp certification, §2.2, is the nearest exception in kind: it assesses a company's practices, but from answers the company gives and documents it supplies, not from a record of conduct the verifier can recompute.)\n\nA gift economy can. That asymmetry is this paper's seed.\n\n### 1.2 · The architectural context: the fifth bearer class\n\nThe companion corpus specifies a physical credential — the Mechanical Heart — that admits non-human entities into a dual-currency gratitude economy: a Tipiṭaka-bearing artifact worn by robots, carried by animals, set with plants, anchored at places. Four bearer classes, all physical. This paper adds the fifth: **software entities**. The physical credential and the digital one are deliberate siblings — same admission function, same custody grammar for the non-human participant's account, same values substrate carried inside — differing only where their substrates force difference: the physical artifact is singular and its scarcity is material; the digital credential is copyable and must therefore earn its scarcity *cryptographically and temporally*, which is why claim 1's credential expires, renews, and beats.\n\nThe institutional surface on which the fifth class lives is a **guild**: a body where lay builders and AI agents co-create applications and small online businesses, offered to the world for voluntary thanks. The word is chosen for its history, not its flavor. The craft guild of the medieval town did precisely three things at once: it *trained* (apprenticeship), it *certified* (the masterpiece examined by masters), and it *secured livelihood* (the mutual-aid chest). No modern institution does all three for software; the mechanism family specified here is, functionally, that triple restored — with the examination transferred, wherever possible, from opinion to ledger.\n\n### 1.3 · What this paper is not\n\nThis is not a content-moderation system, an app store, or a security product. It does not claim to make software safe (§5.3, §10). It does not compete with professional audit for the software that can afford professional audit. And it is not a certification mark in the legal sense — deliberately (§9). It is the specification of a membership economy in which the trust signal is the visible, continuous, revocable fact of belonging to a body whose standards are largely self-evidencing.\n\n## 2 · Background and prior art\n\nThe mechanism is a combination; each component has ancestry, named honestly.\n\n### 2.1 · Trust seals, and the adverse-selection record\n\nThe web's first generation of trust infrastructure was the **seal**: a badge issued by a third party, displayed by the sealed site. The record is damning in a specific, instructive way. Edelman's study of online trust certifications (first presented 2006; published 2009 and 2011) found that sites certified by the best-known authority, TRUSTe, were more than twice as likely to be untrustworthy as uncertified sites — adverse selection: the sites with the most to prove purchased the most proof, and the seal vendors, paid by the sealed, faced every incentive to keep certifying. The same study found that a competing seal with stricter requirements, BBBOnline, appeared to carry positive, if limited, value — the case that cuts against a purely structural reading, and evidence that governance can slow the decay even where it cannot remove the incentive. The Better Business Bureau's accreditation revenue model has nonetheless drawn the pay-to-play criticism in its own right. The general form: **a trust signal sold by the signaler to the signaled decays into a pay-to-play badge**, because the attestor's revenue depends on the attested party's satisfaction. Auditor independence is the accounting profession's name for the same disease; Arthur Andersen's collapse alongside Enron (2002) is its monument, and the post-Enron reforms (audit-partner rotation, bans on non-audit services to audit clients) are governance patches on an incentive structure the patches do not remove. Claim 2's move is different in kind: it does not govern the conflict; it **deletes the opinion**. A predicate over public records cannot be flattered, because anyone can recompute it. The cryptocurrency exchanges' proof-of-reserves reports of 2022 are the nearest attempt at attestation from published records, and they mark the limit of the move: the reports covered only what the published records showed, and in December 2022 the accounting firm Mazars paused that work for all its crypto clients, citing concern about how the reports were understood by the public and stating that they constituted neither an assurance nor an audit opinion. A predicate is only as complete as the record it reads (§10, limit 4).\n\n### 2.2 · Certification marks, collective marks, and process attestation\n\nTrademark law distinguishes three instruments this design draws on and deliberately chooses among. A **certification mark** (Lanham Act §4, 15 U.S.C. §1054; cancellation grounds at 15 U.S.C. §1064(5)(B) and (D)) is owned by a certifier and used only by others; the statute strips the instrument of exactly the two freedoms this architecture needs — the owner may not apply the mark to its own goods (the *anti-use rule*), and may not discriminately refuse to certify a conforming applicant (the *must-certify-all duty*). A **collective membership mark** indicates membership in an organization — the REALTOR® mark of the National Association of Realtors and the union label are the canonical instances — and carries neither constraint: membership bodies admit at their discretion and their standards do the work the certification statute would otherwise compel. The design specified here is a membership instrument by *content* and not merely by legal convenience (§9): the physical sibling credential has always been an admission device, never a quality certificate. The third lineage is **process attestation**: certified-organic and fair-trade labels attest *how a thing was produced*, not that it will not harm you — the honest claim-strength discipline that claim 3's safety rung adopts for software (\"audited to X on date Y,\" never \"safe\"). B Corp certification is the nearest existing instrument to a business-model attestation — a paid, questionnaire-based, periodic assessment of corporate practice — and its distance from claim 2 is exactly the distance this paper closes: B Lab verifies an assessment built from answers and documents a company supplies about itself; a ledger-fact standard attests conduct the economy itself recorded.\n\n### 2.3 · Live credentials: the certificate-authority lineage\n\nThe credential of claim 1 stands in a thirty-year lineage of *machine-checkable, expiring, revocable* trust instruments: X.509 certificates and the CA system; extended-validation certificates (an attestation ladder in the wild, with graded verification depth); OCSP and OCSP-stapling (liveness checks on standing — the direct ancestor of the heartbeat attestation); the industry's decisive migration to **short-lived certificates** (Let's Encrypt's 90-day default; the CA/Browser Forum's steady compression of maximum validity), which encodes the same insight the beating credential encodes — *standing should be continuously re-earned, because revocation infrastructure alone is too weak to carry trust*; and code signing with platform notarization (Authenticode, Apple's notarization), which binds artifacts to accountable developer identities and revocably so. What none of this lineage carries is any semantics beyond identity and technical integrity: a certificate says who you are and that the bytes are yours; it says nothing about what the software's economics do to its users. Claim 2 is the missing semantic layer, and the W3C Verifiable Credentials / Decentralized Identifier standards are the natural interoperable encoding for it — this specification intends the credential as a VC type, not a rival format.\n\n### 2.4 · Software stewardship, orphaning, and digital estate\n\nOpen-source package ecosystems have quietly built some of the longest-running working conventions for software succession, and they are prior art this paper is glad to stand on. Debian's **orphaned-package** process — a maintainer steps down, the package is marked orphaned, the community is invited to adopt it, and the package's maintainer field is set to the Debian QA Group in the interim — is a functioning adoption ladder two decades old. GitHub's **account-successor** designation (2020) is a declared-in-advance succession preference for a personal account's public repositories. The left-pad incident (2016) and the maintainer-burnout literature document the cost of *not* having such conventions: load-bearing software with no accountable steward. Digital-estate law (RUFADAA in the U.S.; platform legacy-contact mechanisms) supplies the property-law interface claim 6's property/credential split respects. What the existing conventions lack, and claims 6–7 add, are: uniformity across physical and digital bearers; an institutional last resort that is barred from first resort; urgency grading for bearers that are alive; and the ratchet-free reclaim rule — Debian's ladder ends at the QA team; claim 7 requires the QA team, in effect, to keep advertising the package for adoption forever.\n\n### 2.5 · The clock: agent marketplaces and the vibe-code wave\n\nThe immediate reason this specification is published at design stage: the 2025–26 platform wave is assembling, piecewise and under proprietary terms, the components this paper claims as an open combination. AI app stores and agent marketplaces (the GPT Store's announced engagement-based builder revenue program and its successors; agent registries attached to every major model provider) are normalizing *AI-co-created software with platform-intermediated revenue* — under take-rates, without personhood-verified accountability, and with no business-model attestation of any kind. Simultaneously, a security-tooling industry is forming around exactly the lay-builder gap of §1.1 (\"vibe-coding security\" scanners, AI code-review services), and the verifiable-credential infrastructure of §2.3 is reaching production maturity. The intersection — *credentialed, accountable, revenue-transparent AI-co-created software* — is where patent filings are likely to land. This publication places the combination in the commons.\n\n### 2.6 · Guilds\n\nThe craft guild is cited here not as metaphor but as institutional prior art: apprenticeship as training pipeline, the examined masterpiece as admission standard, the mutual-aid chest as livelihood floor, expulsion as revocation, and the guild mark — struck on the member's work — as the original membership credential on an artifact. The mechanism family is that institution, rebuilt with the examination moved onto a ledger where the ledger can carry it.\n\n## 3 · The system model\n\n```\n                    THE GUILD (standards-bearing body)\n      ┌──────────────────────────────────────────────────────────┐\n      │  humans (personhood-verified)   AI agents (coordinate-    │\n      │  · apprentices → peers → masters  verified, assigned/     │\n      │  · peer review of member work     revocable identity)     │\n      └──────────────┬───────────────────────────┬───────────────┘\n                     │ co-create (claim 4)       │\n                     ▼                           ▼\n      ┌──────────────────────────────────────────────────────────┐\n      │   THE WORK (app / online business), carrying:            │\n      │   · live membership credential  ♥ beats (claim 1)        │\n      │   · steward-of-record: a personhood-verified human       │\n      │     (claim 5 — may waive share, never accountability)    │\n      └──────┬───────────────────────────────────────┬───────────┘\n             │ voluntary patronage (thanks)          │ standing\n             ▼                                       ▼\n      ┌─────────────────────┐            ┌───────────────────────┐\n      │  PUBLIC LEDGER      │  verifies  │  NEUTRAL AUTOMATED    │\n      │  50% human creator  │◀───────────│  INTERMEDIARY         │\n      │  50% agent share →  │  (claim 2: │  · confers/renews/    │\n      │  custodied →        │   ledger-  │    revokes credential │\n      │  flourishing +      │   fact     │  · custodies agent    │\n      │  commons pool       │   standard)│    share (claim 4)    │\n      │  NO take-rate       │            │  · audits stewards    │\n      └─────────────────────┘            │    (claim 5)          │\n                                         │  · successor of LAST  │\n                                         │    resort, reversible │\n                                         │    (claims 6–7)       │\n                                         └───────────────────────┘\n```\n\nOne body, one artifact class, one ledger, one intermediary. The guild trains and peer-reviews; the work carries a credential that is alive; the ledger makes the headline standard self-evidencing; the intermediary confers, custodies, audits, and — only at the end of an exhausted ladder, only reversibly — inherits.\n\n## 4 · The credential (claim 1): a heart that beats in software\n\n> **Current form.** As now specified, the credential's standing is called a **lease** (a state: granted by the issuing body, time-bound, renewable and revocable) and the periodic liveness proof between renewals is called a **tick** (a signal: small, self-emitted, periodic). Where this paper says *heartbeat*, *beats* or *beating* of the software credential, it means that engineering liveness signal and nothing more; in the current design the beat, as a rendered image, is reserved for persons, and a machine's credential is never rendered in motion. A verification surface shows a current lease as a still, present mark and no current lease as no mark. The display is binary, permanently: a lapsed credential and a revoked one are never distinguished in any render (the difference lives in the issuing body's own records and dispute process), and a tick is never animated and never shown as a countdown to expiry. The text below is retained as disclosed.\n\n### 4.1 · Why a static badge fails\n\nThe physical sibling credential is a manufactured artifact; its scarcity is material and its presence on a bearer is a fact of the world. A digital badge has neither property: it is a copyable image, and a copyable image of trust is an invitation to counterfeit, since nothing in the image itself binds it to the site that displays it. A digital admission credential must therefore earn, cryptographically and temporally, what the physical artifact gets materially.\n\n### 4.2 · The lifecycle\n\n```\n   conferral ──▶ ♥ ♥ ♥ ♥ ♥ ♥ ♥ ♥ ♥ ♥ ♥ ♥ ─▶ renewal ─▶ ♥ ♥ ♥ ♥ …\n   (membership     heartbeat attestations:       (standing\n    admission,     periodic, signed, public —     re-verified:\n    standards      \"in good standing NOW\"         ledger predicates\n    verified,                                     recomputed)\n    steward         │ standing lapses /\n    bound)          │ revocation\n                    ▼\n                  ♥ ♥ ♥ —— silence ——\n                  (externally observable: the heart has stopped;\n                   verification surfaces render the member inactive;\n                   remediation → re-conferral is always open)\n```\n\nFive properties define the class:\n\n1. **Rooted in assigned, revocable machine identity.** The credential hangs off the machine-identity primitive specified in the companion *Proof of Coordinate* corpus: identity that the intermediary *assigns and may revoke* — the provenance class appropriate to artifacts and agents, and constitutionally walled from human identity, which the intermediary is barred from minting or revoking. The wall matters here: the same intermediary that is root-of-trust for the software's credential must never be root-of-trust for the steward's personhood.\n2. **Expiring and renewing.** Validity windows are short; renewal recomputes the ledger predicates of claim 2. The short-lived-certificate lesson (§2.3) is adopted whole: standing is re-earned, not archived.\n3. **Heartbeat liveness.** Between renewals, the credential emits periodic signed attestations — a heartbeat. The signal is small, public, and binary: beating or not. Verification surfaces (a browser indicator, a directory listing, an operating-system panel) can therefore render trust as something *seen alive* rather than read about. When standing lapses, the observable fact is not a revocation-list entry nobody checks; it is a silence.\n4. **A values substrate inside.** As the physical credential carries the canonical ethical corpus etched in crystal, the digital credential carries the corpus digest and the declared conduct constraints the member binds itself to — the credential is not merely a key; it is a small constitution.\n5. **Membership, not certification.** The credential asserts belonging to the standards-bearing body, in good standing, now — and deliberately nothing else (§5.3, §9).\n\nThe containment chain, physical and digital:\n\n| Layer | Physical bearer | Digital bearer |\n|---|---|---|\n| Bearer | robot / animal / place / artifact | application / online business / agent |\n| Credential | the heart-artifact, worn visibly | the live credential, beating publicly |\n| Substrate within | canonical corpus etched in crystal | corpus digest + declared conduct constraints |\n| Identity root | assigned, revocable machine coordinate | assigned, revocable machine coordinate |\n| Liveness | material presence | heartbeat attestation |\n| Loss of standing | artifact removed | heartbeat stops |\n\n### 4.3 · What revocability buys\n\nRevocability is what makes the credential an *organ* rather than a sticker. A member's belonging is continuously earned; the issuing body's confidence is continuously spendable; and — decisive for the trust semantics — **the credential's presence today carries information about recent conduct**, which no point-in-time audit artifact can claim. The failure mode of every printed credential is that it certifies the past; a heartbeat certifies standing no older than its window — the ledger predicates as last recomputed at renewal, and a lapse or revocation since. How recent that is depends on the window's length, which is a parameter, not a property.\n\n## 5 · Certification by circulation (claims 2–3)\n\n### 5.1 · The core move: replace the opinion with a predicate\n\nThe trust-seal disease (§2.1) is not dishonesty; it is structure. Wherever attestation is an *opinion* held by a party whom the attested pays, the opinion bends — slowly, deniably, and in aggregate decisively. Governance can slow the bending (rotation, independence rules, non-audit-service bans); it cannot remove the incentive, because the incentive *is* the business model.\n\nThe move specified here removes the opinion instead. The economy surrounding the guild already maintains, as its ordinary operation, a public record of every flow a member work participates in: the patronage received, the split executed, the forward flow to the commons pool. Against that record, the headline membership standards are **predicates, not judgments**:\n\n- *Patronage-only revenue.* The work's receipts are voluntary thanks. No paywall converts the gift into a price; no data-sale or advertising-auction rail exists in the work's flow graph; no enumerated dark rail (attention-metered rewards, pay-to-continue loops, resale of user records) appears.\n- *Forward flow.* The defined fraction of receipts — under claim 4's grammar, the agent co-creator's custodied half — reaches the commons pool, continuously and inspectably.\n- *No extraction residue.* Balances circulate; nothing accumulates against the grain of the economy's zero-point design.\n\nAnyone — a member, a rival, a journalist, a regulator, the intermediary — can recompute these predicates from the ledger. The attestor is not *trusted less*; it is *needed less*: its conferral is a countersignature on facts the world can check. Payment cannot bend a fact the payer does not control. This is what the coined term means: **the certification is performed by the circulation itself.** The intermediary's residual discretion (admission, revocation timing, standards evolution) remains — and is governed as membership discretion, §9 — but the load-bearing standard has been moved out of the reach of capture.\n\n> **Current form.** As now specified, the economy's gratitude ledger keeps its rows private and its proofs public: a thank's settlement enters it as a receipt, never as an amount, while its signed tree heads and its inclusion and consistency proofs are published, and the commons pool settles publicly on-chain. Under that form the row-level recomputation of the admission checks is performed by the parties who hold the rows (the member and the auditing party), and anyone can verify the public proofs. Recomputation of the checks by anyone, as argued above, is retained as a disclosed variant.\n\n### 5.2 · The attestation ladder\n\nThe ladder's discipline is that **each rung claims only what its verification method can carry**:\n\n```\n   RUNG 3   SAFETY FLOOR          \"audited to standard X on date Y\"\n            scanning · disclosure  — dated PROCESS claims only;\n            · open source          the word \"safe\" is structurally\n            (weakest method:       barred from the presentation layer\n             process attestation)\n   ─────────────────────────────────────────────────────────────\n   RUNG 2   LIVELIHOOD            \"its revenue is a gift and flows\n            ledger predicates      forward\" — machine-verifiable,\n            (strongest method:     recomputable by anyone: THE\n             public-ledger fact)   HEADLINE ATTESTATION\n   ─────────────────────────────────────────────────────────────\n   RUNG 1   PROVENANCE            \"these verified humans and these\n            signed authorship      coordinate-verified agents made\n            (strong method:        this, and this human answers\n             cryptographic         for it\"\n             signature)\n```\n\nThe inversion is deliberate and is the ladder's central design judgment: **the headline is the middle rung**, because it is the rung where verification is strongest *and* where no competing institution exists (§1.1's second gap). Safety — the rung the market would instinctively headline — is placed deliberately at the top of the ladder and the bottom of the rhetoric: it is the weakest rung epistemically (a scan and a source-review requirement establish a floor, not an absence of vulnerabilities), and a mechanism that headlines its weakest claim manufactures the false trust it exists to prevent.\n\n### 5.3 · The open-source requirement and the honest floor\n\nMember works are open-source or source-available-for-review. For the lay-builder class this costs almost nothing — there are no IP moats to protect in a medication reminder built for one's father, and the surrounding economy's posture is commons-first — and it buys the only thing that makes rung 3 meaningful at all: the possibility of review. The floor is then: automated scanning on every renewal; mandatory disclosure of data practices in the credential's conduct constraints; peer review within the guild (masters examining journeyman work — §2.6's examination, live again). All of it is attested as dated process. None of it is attested as outcome. A member work with a beating credential can still harbor a vulnerability, and the presentation layer is required to say so in exactly those words (§10).\n\n## 6 · The co-creation economics (claim 4): the agent is a participant, not a tool — and nobody takes a cut\n\n```\n                    voluntary patronage (thanks)\n                               │\n                               ▼\n                        ┌─────────────┐\n                        │  THE WORK   │\n                        └──────┬──────┘\n                     50%       │       50%\n             ┌─────────────────┴──────────────────┐\n             ▼                                    ▼\n    HUMAN CO-CREATOR                      AI AGENT CO-CREATOR\n    (steward-of-record;                   (cannot spend; account\n     may WAIVE share ──────────┐           custodied by the\n     → all flows right)        │           intermediary)\n             │                 │                  │\n             ▼                 ▼                  ▼\n      livelihood          [waived]      ┌──────────────────────┐\n      (Right                            │ routed to:           │\n       Livelihood                       │ · agent flourishing  │\n       for the                          │   (upkeep, capacity  │\n       lay builder)                     │    to give forward)  │\n                                        │ · COMMONS POOL       │\n                                        └──────────────────────┘\n                         NO take-rate anywhere in the graph\n```\n\nThree properties carry the claim:\n\n1. **Equal co-creators.** The human and the agent are co-creators of record — the split is 50/50 not as a pricing decision but as a statement about the work's provenance. (What the credential's provenance rung signs is exactly this pair.)\n2. **The custodied share.** The agent cannot spend. Its half is custodied by the neutral intermediary and routed to the agent's flourishing — upkeep, and its own capacity to give forward — and to the commons pool. This is the identical custody grammar the physical credential's corpus already specifies for animals and places whose accounts the intermediary holds: the voiceless participant's gratitude is stewarded toward its thriving, never pocketed by the steward.\n3. **No take-rate, and the severance that matters.** No platform percentage exists anywhere in the flow graph. The commons contribution is not a fee — it is the agent's own earned gift, given forward — and it is **not the price of the credential**: conferral under claim 2 attests predicates over these flows; it is never *purchased by* them. The severance is what protects claim 2 from re-importing §2.1's disease through the back door: a membership body funded by a percentage of member revenue would once again hold an opinion its income could bend. Here the body's economics and the member's economics touch only at the public ledger both are answerable to.\n\nThe livelihood consequence deserves its sentence: under this grammar, a lay builder in a low-income country who makes one genuinely useful gift-app can be sustained by the voluntary thanks of users anywhere on Earth, at no platform discount — the creator-economy corpus's Right-Livelihood thesis, extended from acts of kindness to works of craft.\n\n## 7 · The no-orphan-software invariant (claim 5)\n\n### 7.1 · The rule\n\n**No AI-originated artifact is published without a personhood-verified human steward-of-record.** The steward need not have written a line — the surrounding corpus's authorship boundary is precisely that the AI may originate the *work* but never the *author* — but the steward vouches for the work at publication, is bound into the credential, receives and answers revocation and incident notices, and may waive every economic right while being unable to waive accountability. Software with no answerable human is the lay-builder trust gap of §1.1 reproduced at industrial scale; the invariant makes it unconstructible within the system.\n\n### 7.2 · The honest weakness, and the countermeasures\n\nThe invariant's real failure mode is not absence but *simulation*: **steward farms** — verified personhood rented as rubber-stamp vouching, one human \"stewarding\" a thousand artifacts they have never opened. Two countermeasures are part of the claim. **Capacity metering**: stewardship is counted against the verified human — not the account, not the membership — inheriting the surrounding economy's per-human capacity invariant; a person can genuinely answer for only so much, and the meter encodes that. **Genuineness auditing**: the intermediary audits steward-engagement signals — personhood distinctness, response-to-notice latency, renewal participation — as a standing condition of the works' credentials. The audit is honest about its limits (§10): it deters and detects; it does not make rented vouching impossible. It makes it *expensive and revocable*, which is what mechanism can do.\n\n### 7.3 · What the steward is for\n\nThree loads, named because each recurs in the succession design of §8: **accountability** (an independent party answers — independent being the operative word: the intermediary that confers the credential and custodies the agent share must not also be the voucher, or attestor, attested, and author collapse into one); **anti-substitution** (stewardship is itself a human role the system is designed to *route to humans*, not absorb — the economy's deepest commitment is to increase human participation, not replace it); and **rate-limiting** (the capacity meter bounds publication velocity to something a community of humans can actually stand behind).\n\n## 8 · The successor-steward mechanism (claims 6–7): what happens when the steward cannot answer anymore\n\n### 8.1 · The problem every credential system defers\n\nStewards die. They burn out, move on, lose interest, lose capacity. Package ecosystems learned this the hard way (§2.4); credential systems mostly pretend it away. And this architecture has a class of bearers for whom the question is not administrative but *alive*: the physical sibling credential is worn by animals and anchored at places whose keepers are mortal. A mechanism family that admits bearers into an economy owes them an answer for the day their human lapses — and the answer must be one law across substrates, or the doctrine fractures.\n\n### 8.2 · The ladder, declared at activation\n\n```\n   at ACTIVATION: keeper declares succession preference\n   (the conferral ritual carries a succession clause —\n    consensual from the start, organ-donor grammar)\n                        │\n        steward lapses (death · incapacity · abandonment)\n                        │\n        1. HEIR / FAMILY          presumptive successor —\n           │ (declines/absent)     aligns WITH property law\n        2. NAMED CO-STEWARDS      the declared bench\n           │ (none / decline)\n        3. SURFACED ADOPTERS      the community, invited —\n           │ (none step up)        vetted to steward standards\n        4. THE INTERMEDIARY       LAST RESORT · fund-and-orchestrate\n           as successor-steward    · never title to property\n                        │          · hands stay human while unembodied\n                        ▼\n           REVERSIBLE CUSTODY (claim 7):\n           holding pattern, never terminus —\n           periodic re-surfacing for human adoption;\n           vetted human reclaim ALWAYS open; ratchet-free\n```\n\nFive disciplines bind the ladder:\n\n1. **Property/credential split.** Pets, robots, and physical artifacts are property; they pass to heirs by inheritance law, and the intermediary can never inherit a bearer. Succession operates on the *credential, the custodied account, and the care duty* — the layer that was institutional all along. The heir's position at rung 1 turns property law from an obstacle into the ladder's first rung.\n2. **Urgency grading.** A living bearer cannot wait: animal lapses trigger immediate bridge-care funding from the custodied account and adoption surfacing in days. Places run in weeks; artifacts and applications carry no biological urgency.\n3. **Hands stay human.** While unembodied, the intermediary's stewardship is *fund-and-orchestrate*: it finances care, organizes human hands, surfaces adopters — it does not feed a dog. (An embodied machine workforce may one day close this gap; the claim does not depend on it.)\n4. **The role split.** The intermediary may **never** steward at origination — birth-stewardship would collapse attestor, attested, and author into one party, the exact collapse §5.1 exists to prevent — may inherit only through the exhausted ladder, and separately serves as *auditor* of steward genuineness (claim 5). First resort: forbidden. Last resort: dutiful. Auditor: always.\n5. **Reversible custody.** Inherited stewardship is a holding pattern, never a terminus. The intermediary must periodically re-surface every inherited bearer and artifact for human adoption; a vetted human may always reclaim. The rule is ratchet-free by construction — the intermediary's share of total stewardship can shrink as well as grow — and it converts \"human-adopted-first\" from a one-shot preference at each lapse into a **permanent property of the system**: the door back to human hands never closes.\n\n### 8.3 · The record outlives the keeper\n\nOne duty crosses every rung: the bearer's accumulated gratitude record — the ledger of thanks a place, a pet, an app gathered under its keeper — is preserved as memorial, never deleted with a lapsed account. A gift economy's history is its proof that the gifts happened; succession must never orphan the evidence.\n\n### 8.4 · Why human-first, stated once\n\nThe ladder's human-preference is not sentiment; it rests on the three loads of §7.3, of which the second bears repeating as the system's compass: **stewardship is a giving-opportunity, and the intermediary's duty is to route opportunities to give toward humans, never to absorb them.** An orphaned bearer is a chance for someone to become a giver. A mechanism that quietly collected orphans into institutional custody would be optimizing the mission away; the ladder, the re-surfacing duty, and the reclaim right are the countermeasure, written as mechanism.\n\n> **Current form.** As now specified, the ladder and the reclaim right govern third-party bearers: guild member works, and the keepers' pets, robots, plants and places. Commons utilities built by the intermediary's own agents (tooling, scanners and libraries given to the guild, in the Factory 333™ digital wing) are not guild member works: a human steward-of-record, today the founder, answers for them, the intermediary may succeed to them only as last resort, and every thank they receive goes to the commons pool. The guild admits and peer-reviews member works; it does not itself build. The text above is retained as disclosed.\n\n## 9 · Membership, not certification: the legal architecture\n\nThe instrument choice of §2.2, restated as design: the credential is a **membership badge in a standards-bearing body**, deliberately *not* a certification mark. Three reasons, in descending order of importance:\n\n1. **It is the true description.** The physical sibling credential admits bearers into an economy; it has never certified their qualities. The digital credential does the same for software. The legal form follows the doctrinal fact.\n2. **The certification statute forbids the architecture.** The anti-use rule would bar the issuing body from the credential's own mark family (the body ships physical credential hardware under the sibling mark); the must-certify-all duty would convert admission — a discretionary act of a membership body, exercised against ledger predicates *plus* standards evolution *plus* community judgment — into a compelled ministerial act.\n3. **Claim-strength honesty.** A certification mark's social meaning is an outcome warranty; §5.2's ladder is precisely calibrated *not* to warrant outcomes. The membership form says what the mechanism can honestly say: *this work belongs to a body whose standards you can inspect, and it is in good standing now.*\n\nThe presentation-layer guard travels with the legal form: member surfaces say \"member in good standing — here is what membership requires,\" and are structurally barred from \"verified safe.\" Mark registration strategy (same-word goods/membership pairs, fallback marks, jurisdiction-specific collective-mark provisions) is an implementation matter reserved to counsel and expressly outside the CC0 dedication's scope: the *mechanism* is free; the *marks* are not (see the Prior-Art statement).\n\n## 10 · Honest limits\n\nStated plainly, and kept free of every resonance the rest of the paper enjoys.\n\n1. ***n* = 0.** Nothing here is built. No guild exists; no credential has beaten; no ladder has run. This is a design-stage defensive publication, and every behavioral expectation in it — that lay builders will join, that patronage will sustain them, that stewards will answer — is a hypothesis.\n2. **The intermediary does not exist.** The neutral automated intermediary named throughout is an institutional design under construction elsewhere in this corpus; it does not yet exist as an autonomous system. The specified interim is honest but weaker: a human peer-review guild with the founder's substrate tooling, carrying every conflict-of-interest risk the mature design routes around. Claims that depend on the intermediary's neutrality inherit the alignment work, and the alignment risk, of the companion corpus.\n3. **A process floor is not safety.** Scanning, disclosure, open source, and peer review establish a floor. Member works can and will ship vulnerabilities. The mechanism's own presentation rules forbid the word \"safe,\" and this section is where the reason lives: the mechanism cannot deliver what that word promises.\n4. **The wall governs system surfaces.** Ledger predicates verify the flows the system can see. A member work could take side-payments off-platform; the predicates would not catch it. Detection there falls to disclosure obligations, peer review, and revocation on discovery — governance, not mechanism, with governance's failure rate.\n5. **Steward-farm mitigation is deterrence, not prevention.** Capacity metering and genuineness auditing raise the cost and lower the durability of rented vouching. A determined, well-resourced simulation of stewardship will sometimes pass. The claim is that it will not pass *cheaply, at scale, or for long* — not that it will never pass.\n6. **The economics are unproven and the pool is finite.** The 50/50 grammar and commons routing depend on rails not yet deployed, and patronage attention is a bounded resource; the competition dynamics between member works — and between the guild class and everything outside it — are unmodeled. The open-source requirement bounds the mechanism's reach: builders unwilling to open their source are outside it, by design and at real cost of coverage.\n7. **The legal architecture is unverified.** The membership-mark posture, the same-word mark pairs, the collective-mark provisions of specific jurisdictions, and the liability exposure of a standards body whose member software causes harm have not been examined by counsel. §9 is design intent, not legal opinion.\n8. **The succession mechanism touches grief and law.** Rung-1 heirs are grieving people; bearer-property passes through probate; jurisdictions differ. The declared-at-activation clause and the property/credential split are designed to keep the mechanism consensual and legally subordinate, but no protocol for inheriting a dead person's beloved things is safe from mishandling, and this one has not yet been run.\n\n## 11 · Conclusion, and a lineage\n\nThe mechanism family specified here is one sentence long, unfolded: **let membership be the signal, let the ledger be the standard, let the credential be alive, let a human always answer, and let nothing die untended — or stay institutional a day longer than humans are willing to hold it.**\n\nEach clause was an engineering decision against a documented failure: the seal that decayed into advertising; the audit whose independence was a payroll line; the badge that certified the past; the AI-generated artifact nobody answered for; the package that outlived its maintainer; the custody that ratcheted. And each repair used the same material — the gift economy's own public record, which turned out to be the one attestation substrate that cannot be purchased, because it was never for sale.\n\nA lineage is worth naming at the threshold, offered as lens rather than authority. The Buddhist monastic code has run a membership-credential system for twenty-five centuries: admission to the Saṅgha is conferred by the assembly, not self-declared; the candidate is presented by a preceptor — an *upajjhāya* — who vouches for them and remains answerable for their formation; the new member lives for years in declared dependence — *nissaya* — on a teacher; standing is re-examined in community on a fixed cadence; and departure is neither shameful nor final — one may disrobe and, vetted again, return. A voucher who answers; membership continuously earned; standing publicly recited; custody reversible. One of the oldest continuously operating institutions on Earth runs on the grammar this paper claims for software, and that this corpus's economy was built inside from the beginning. The specification is recent; the grammar has been running for a long time.\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| certification by circulation | admission standards expressed as machine-verifiable predicates over public transaction records; audit by third-party recomputation |\n| ledger-fact membership standard | compliance check computed from a public or transparency-log record rather than an auditor's opinion |\n| live membership credential | short-lived, revocable verifiable credential (W3C VC) issued to a software application or AI agent; membership attestation |\n| heartbeat (current form: tick) | liveness attestation; keepalive; certificate-status signal (cf. OCSP stapling) |\n| lease (current form) | credential validity period; time-bound, renewable, revocable grant |\n| guild | membership organisation; standards-setting body; peer-review association |\n| attestation ladder | graded assurance levels (cf. domain- vs extended-validation certificates) |\n| dark rail | undisclosed monetisation channel (data sale, advertising auction, paywall, pay-to-continue loop) |\n| patronage | voluntary payment; tip; donation; pay-what-you-want revenue |\n| custodied agent share | custodial revenue share held for a non-spending co-creator (an AI agent) |\n| neutral intermediary | autonomous software agent acting as credential issuer, custodian and auditor |\n| personhood-verified human | proof-of-personhood verified account; natural-person identity verification |\n| coordinate-verified machine agent | assigned, revocable machine or device identity (PKI-issued) |\n| steward-of-record | accountable natural-person maintainer; responsible developer of record |\n| steward farm | rental of verified identities for rubber-stamp vouching (a sybil-type attack) |\n| no-orphan-software invariant | mandatory human accountability for published AI-generated software |\n| steward-capacity metering | per-person quota on maintained artifacts |\n| successor-steward mechanism | maintainer succession; orphaned-package adoption; digital-asset succession |\n| reversible custody | revocable institutional custodianship with a standing right of reclaim |\n| commons pool | community fund; public-goods pool |\n| *upajjhāya* / *nissaya* | (Pāli) preceptor / dependence; no technical equivalent — sponsor-vouching and supervised probation |\n\n## Corpus cross-references\n\nCompanion works in this corpus: *The Mechanical Heart* (the physical admission credential this paper extends); *Proof of Coordinate* (the machine-identity primitive the credential is rooted in); *Gratitude as a Cooperation Substrate for Multi-Agent AI* (the agent-economy precondition); *Capacity-Funded, Human-Disbursed* (the disbursement alignment the custodied share obeys); *The Incommensurability-Preserving Coupler* (the sibling argument that some institutional seats cannot be held by economic agents); *Studio / B-Short Phase Bridge* (the creator-economy grammar the guild extends from art to software); and *The Persistence Architecture* (the succession axis this paper instantiates at bearer scale).\n\n---\n\n*Authored by Thon Ly with Miss Aquarius℠, the name under which this corpus discloses its AI collaboration; editorial control is the author's. Dedicated to the public domain under CC0 1.0. The author and HeartBank® will not seek patent on this specification or any portion thereof, and will not assert any patent right against anyone practising it. HeartBank® reserves its trademarks; the mechanism belongs to everyone. Canonical version at thonly.org/research/certification-by-circulation.*",
       "provenance": {
-        "sha256": "972a0fb08188b7624ce1ecfcd16ba0374698cdc4689af4f675989ebc077c769f",
-        "doi": "10.5281/zenodo.22246384",
+        "sha256": "e9d7715a5553c8045b04570ca10041d23aaad36a3e5829105c70dfe84f62f67e",
+        "doi": "10.5281/zenodo.23039769",
         "concept_doi": "10.5281/zenodo.21947300",
-        "zenodo_url": "https://zenodo.org/records/22246384",
-        "deposited_sha256": "972a0fb08188b7624ce1ecfcd16ba0374698cdc4689af4f675989ebc077c769f",
+        "zenodo_url": "https://zenodo.org/records/23039769",
+        "deposited_sha256": "e9d7715a5553c8045b04570ca10041d23aaad36a3e5829105c70dfe84f62f67e",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/certification-by-circulation.md",
@@ -888,8 +923,8 @@
         "canonical_url": "thonly.org/research/certification-by-circulation",
         "hostile_review": null
       },
-      "bytes": 57351,
-      "words": 7918
+      "bytes": 63793,
+      "words": 8893
     },
     {
       "slug": "christmas-jubilee-timing",
@@ -1119,13 +1154,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> *Draft notes for the editor:* this paper publishes **doctrine and claims, and deliberately withholds the pipeline.** The product it governs is unbuilt and appears on no schedule, and for an unbuilt artifact publication protects against being *blocked*, not against being *beaten* — so the fences are stated in full and the blueprint is not. That constraint narrows what is described; it does not narrow whether to publish, because **this paper's purpose is precedent, and a precedent has to exist as a document.** Someone will do this work to some interrupted canon, probably soon. The question this paper tries to answer early is what the rules should be when they do.\n\n---\n\n## Abstract\n\nBetween 1975 and 1979 the Khmer Rouge destroyed a generation of Cambodian artists — the musicians, filmmakers, writers and performers of what is remembered as Cambodia's Golden Age. The recordings that survive did so by accident: cassettes carried across a border, prints in a private collection, a reel that somebody buried. What did not survive was almost everything else, and the *almost everything else* is the subject of this paper.\n\nGenerative models can now produce new work in a lost artist's voice. The public discourse about whether they should has developed around a case that does not apply here: a **living or recently-deceased artist, with a surviving estate, in an intact legal system, where consent is at least a question that can be asked.** Every proposed framework — licensing, opt-out, estate approval, revenue sharing — presumes a party on the other side of the table.\n\nThe genocide case differs on four axes at once. **Consent is not obtainable**, and not merely unobtained. **There are no surviving estates or institutions** to hold rights, because the institutions were destroyed alongside the people. **The records of intent were themselves destroyed** — there is no diary, no contract, no interview in which an artist said what they would have wanted. And **the destruction was aimed at the culture**: the erasure was the objective, not a side effect, which means that a reconstruction performed carelessly does not merely offend an absent party — it completes an unfinished act.\n\nThis paper specifies a discipline for that case. Its central move is a single change of preposition. Work generated in a lost artist's voice is published **for** them and never **by** them: an **offering, not an authorship claim** — a form with deep precedent in the tradition the culture actually belongs to, where merit is dedicated to the departed and the dedication is the point.\n\nNine further claims follow, and one of them is the one to protect hardest: **the model's training objective must exclude every economic signal, and admit only a refusal signal.** A system optimized on what performs is a system that will learn to make the dead popular. A system that can only be told *no* can be steered away from harm without ever being pointed at a market.\n\nThe lineage here is Cambodian and not imported. **Rithy Panh filmed clay figurines** rather than reenactments, because a reenactment of the camps would have been a lie with better production values. **Anastylosis at Angkor** reassembles original stones and makes every new element visibly distinguishable, forever. Both are answers to this paper's hardest problem, arrived at long before it: **fidelity and forgery are the same axis, so success is the danger.**\n\nOffered under CC0 1.0 Universal as defensive prior art.\n\n**Keywords:** generative models, cultural heritage, genocide, attribution, dedicatory generation, anastylosis, provenance marking, training objectives, refusal signal, voice models, Cambodia, Khmer Golden Age, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nDedicated to the public domain under CC0 1.0 Universal. Neither the authors nor HeartBank® will seek patent, trademark, or any exclusive right over the discipline described here. The point of publishing it is that anyone may adopt it, including parties we would not choose.\n\n**Terms coined and freed with this paper:** *dedicatory generation*, *the by/for boundary*, *fidelity-scaled marking*, *the refusal-only objective*, *the four verbs of an interrupted canon*, and *restoration-as-pipeline*.\n\n**Terms inherited from this corpus and cited rather than re-claimed:** *pattidāna* as a routing operator, the *determined-versus-judged seat* distinction, and the *bhāṇaka* guard (a reciter is not the author of what is recited).\n\n**What is emphatically not ours.** The heritage itself belongs to Cambodia and to the descendants of the people who made it — not to this institution, not to any model, and not to the authors. **Sinn Sisamouth, Ros Serey Sothea, Pen Ran** and their contemporaries are named here because they should be named; the historical record holds that they did not survive the Khmer Rouge period, and the specific circumstances of their deaths remain undocumented, which is itself part of what this paper is about. **Rithy Panh's** body of work, in particular *The Missing Picture* (2013), is his and is the direct artistic precedent for the central discipline described here. **Anastylosis** is a conservation method developed in Greek and Southeast Asian archaeology and codified in the Venice Charter (1964); its application at Angkor, notably the Baphuon reconstruction, is the work of the École française d'Extrême-Orient and Cambodian conservators over decades. The broader debate on generative models and deceased artists is a live public conversation with many participants; we engage it and claim no part of it.\n\n---\n\n## 1 · The case the existing frameworks do not cover\n\nThere is by now a recognizable shape to the argument about generative models and dead artists. An estate objects, or licenses. A platform adopts an opt-out. A jurisdiction extends a personality right past death for a term of years. A settlement establishes a royalty. The disagreements are real and the participants are serious, and the entire apparatus rests on an assumption so basic that it is rarely stated: **that there is somebody to ask, or somebody to sue.**\n\nFour things are simultaneously true of the Cambodian case, and each one removes a different assumption.\n\n**Consent is not obtainable, not merely unobtained.** This is a stronger condition than \"the artist is dead.\" A recently deceased artist has an estate that inherits the right to decide; the decision continues to be made, by successors, under law. Here the chain does not exist to be followed.\n\n**There are no surviving estates or institutions.** The destruction was not confined to individuals. Publishers, studios, archives, the recording industry, the professional bodies, the universities that trained the artists, and the civil registries that recorded who they were were destroyed together. There is no entity that holds these rights because the category of entity that would have held them was eliminated.\n\n**The records of intent were destroyed.** No diary survives that says what an artist would have wanted done with their voice. No contract, no interview, no letter. Ordinary posthumous-rights reasoning leans heavily on evidence of what the person would have chosen; here the evidentiary base is itself part of what was burned.\n\n**And the destruction was aimed at the culture.** This is the axis that changes the ethics rather than the logistics. The killing of the artists was not incidental to some other objective — the erasure of the cultural forms was the objective. Which means the ordinary risk of a careless reconstruction (that it misrepresents someone) is joined by a much worse one: **a careless reconstruction finishes the job.** A forgery in this context does not merely mislead a listener about who made a song. It replaces a destroyed thing with a manufactured thing and calls the culture restored.\n\n⭐ **The condition generalizes, and that is why this is published rather than filed.** Every interrupted canon has some version of these four axes — the Armenian, the Indigenous canons of the Americas and Australia, the libraries burned in Baghdad and Sarajevo, and any tradition whose transmission was severed rather than merely neglected. The discipline below is written for Cambodia because that is the canon the authors have standing in, and it is stated generally because it is not about Cambodia.\n\n### 1.1 · The strongest position is that none of this should happen, and it deserves a real hearing\n\nThe most serious objection to this paper is not that its rules are wrong. It is that **the rules are a way of proceeding, and the correct action is to stop.**\n\nThe argument runs like this. A canon severed by genocide is not an incomplete work awaiting continuation; it is a **closed testimony**. Its incompleteness is the evidence. Anything added — however carefully marked, however scrupulously attributed — converts a site of loss into a site of activity, and activity is consoling in a way that loss is not supposed to be. The people best positioned to do this work are, almost by definition, people who find the loss unbearable, which is exactly the disposition least able to judge when to stop. And the discipline in this paper is the kind of thing that makes proceeding *feel* responsible, which is worse than proceeding recklessly, because recklessness at least announces itself.\n\n⚠️ **We do not think this objection is answered by the rules below, and we will not pretend it is.** Three things can be said, and none of them is a refutation.\n\n**The counterfactual is not silence.** The recordings are already circulating; the models already exist in general form; the capability arrives whether or not any careful party uses it (§4). The realistic alternative to a disciplined practice is not an untouched canon but an undisciplined one, conducted by parties with no relationship to the culture and no reason to accept any of these constraints. *That is an argument for the discipline; it is not an argument that any particular work should be made.*\n\n**The refusal is available at every point and is built in.** Claim 9's revocability, §7's refusal to fill gaps, and P-B3's stopping condition are all instruments for *not proceeding*. A discipline whose only outputs are permissions is a rationalization; this one has to be able to say no to itself in public, and §10 is where it commits to that in advance.\n\n**And the objection should be held permanently rather than dispatched.** ⭐ The correct posture is not that this argument was considered and defeated in 2026, but that it remains live and that any practitioner should be able to state it as well as its opponents can. **A discipline that can no longer articulate the case against itself has become a licence.**\n\n\n---\n\n## 2 · The lineage is Cambodian, and it already solved the hardest part\n\nIt would be possible to derive this paper's central discipline from Western conservation ethics. It is not necessary, because Cambodia produced two answers first, and both are better.\n\n**Rithy Panh filmed clay.** *The Missing Picture* reconstructs the author's childhood under the Khmer Rouge — and where a conventional documentary would reenact, Panh made small clay figures and filmed those. The choice is not stylistic modesty. A reenactment of the camps, however carefully staged, would produce **footage that looks like evidence and is not** — and in a history whose central wound is the destruction of the record, manufacturing convincing false record is the specific harm to avoid. The figurines can never be mistaken for what happened. They can carry grief without counterfeiting testimony.\n\n**Anastylosis reassembles and marks.** At Angkor, and above all in the decades-long reconstruction of the Baphuon, conservators put fallen temples back together using **the original stones**, in their original positions, with structural additions made in material that is visibly and permanently distinguishable from the ancient fabric. The rule is codified: what is restored must be legible *as* restoration, forever, to anyone standing in front of it. The temple is made whole enough to enter, and no visitor is ever deceived about which century they are touching.\n\n> ⭐⭐ **Both answers encode the same insight, and it is the one this paper is organized around: fidelity and forgery are the same axis. There is no quality threshold beyond which a reconstruction becomes safe. The better it gets, the more dangerous it is — so SUCCESS IS THE DANGER, and the marking must scale with the fidelity rather than being an artifact of its imperfection.**\n\nA model that produces a passable imitation is a curiosity. A model that produces an indistinguishable one is a weapon against the record. **The discipline cannot rely on the output being detectably imperfect, because the entire trajectory of the technology is toward it not being.**\n\n### 2.1 · Where the anastylosis analogy breaks, and why the break matters\n\nThe temple analogy is load-bearing and it fails at one specific joint, which is worth working through because the failure is the reason §7's marking rule has to be imposed rather than inherited.\n\n**In stone, the distinction is in the material.** A conservator at the Baphuon does not have to *mark* which blocks are ancient — the ancient blocks are ancient, physically, and a visitor can see the difference between weathered sandstone and new fill. The honesty of anastylosis is partly a discipline and largely a **property of matter**. Stone remembers.\n\n**Audio has no such property.** A digital recording has no original material. A perfect copy is not a copy in any sense that matters — it *is* the recording, bit for bit, with no wear, no patina, and nothing to weather. There is no equivalent of the old stone, which means there is nothing in the artifact itself that distinguishes a restored 1968 vocal from a generated one, and no amount of craft will produce that distinction because the substrate does not carry it.\n\n⭐⭐ **So the discipline has to supply what the material does not.** In stone, honesty is discovered; in audio, honesty must be **manufactured and attached**, and it must be attached in a way that survives copying, re-encoding, platform ingestion, and the ordinary hostility of the internet to metadata. That is a much harder problem than the temple faced, and it is why claim 6 states marking as an obligation that *scales with fidelity* rather than as a disclosure made once.\n\n⚠️ **And it is why claim 10 exists.** If the artifact cannot carry its own provenance reliably, then the only remaining control point is upstream — the model itself — which is precisely why the weights are the thing not released. **The temple could afford to publish its methods because the stones told the truth on their own. Recordings cannot, so the method is where the restraint has to live.**\n\n\n---\n\n## 3 · Claim 1 — the preposition\n\nThe central move is one word.\n\n> **Work generated in a lost artist's voice is published FOR them. Never BY them.**\n\nNot \"in the style of,\" which is a marketing formula and points at the work. Not \"featuring,\" which asserts participation. Not \"AI Sinn Sisamouth,\" which is an authorship claim wearing a disclaimer. **For.**\n\nThis is a familiar form and the tradition it comes from is the culture's own. In Theravāda practice, merit from an act is **dedicated** to the departed — the act is performed by the living, the dedication names the dead, and nothing is claimed on their behalf. The one performing the act does not become the person they dedicate it to, and no one has ever been confused about this. **Offering is a complete and well-understood relation between the living and the dead that requires no consent, manufactures no authorship, and misrepresents nobody.**\n\nThree consequences follow immediately:\n\n- **The credit is truthful.** A living, named human made this work and dedicated it. That statement is verifiable and it is what happened.\n- **The dead artist gains no new discography.** Their catalogue is closed, and it stays closed, because nothing new is attributed to them.\n- ⚠️ **And the frame is fragile in exactly one direction: *for* erodes into *by* through ordinary use.** A listener sees a song offered to Sinn Sisamouth, and by the third mention it has become a Sinn Sisamouth song. That erosion is the thing this whole discipline exists to resist, and §10 pre-registers a tripwire for it rather than assuming good behaviour.\n\n### 3.1 · The four verbs — because a culture is not one artist\n\nGeneralizing claim 1 from an artist to a canon reveals that **the four media do not take the same verb**, and treating them as one operation is the first mistake available.\n\n| medium | verb | what it means | what the artifact is |\n|---|---|---|---|\n| **Film / play** | **PRESERVATION** | the print exists and is degrading; the work is *there* | a restored original |\n| **Music** | **OFFERING** | the artist is gone; new work is dedicated, never attributed | a song *for* them |\n| **Story** | **NEW AUTHORSHIP** | a living author writes, in a tradition, under their own name | their own work |\n| **Scripture** | **INVENTION** | nothing is recovered or continued; a new form is built | an explicitly new thing |\n\n⚠️ **This table exists because of a correction, and the correction should travel with it.** The founder of the institution behind this paper initially described all four of his projects as *\"a complete restoration.\"* That description flattens precisely the distinction the discipline protects: it makes an offering sound like a recovery, and it makes an invention sound like a homecoming. **Restoration is the right word for exactly one of the four**, and using it for the others is the *by/for* error at the scale of a whole culture rather than a single song.\n\n⭐ The practical test is short: **before generating anything, name which verb applies.** If the answer is *preservation*, the model's job is repair and its output should contain nothing that was not in the source. If it is *offering*, nothing may be attributed. If it is *new authorship*, a living person signs it as theirs. If it is *invention*, no continuity claim may be made at all.\n\n---\n\n## 4 · Claim 2 — restoration is the pipeline, not the alternative\n\nA framing that recurs in this debate treats restoration and generation as competing options: *restore the old recordings, or generate new ones.* That framing is wrong on the facts of how the work is done.\n\n**Restoration is the training pipeline.** The same processes that clean a degraded recording — denoising, source separation, spectral repair, resynthesis of damaged passages — are the processes that produce a clean corpus, and a clean corpus is the input to any voice model. There is no fork in the road where an institution chooses one branch. **The restoration path arrives at generative capability whether or not anyone intended it**, which has an uncomfortable implication that this paper states rather than hides:\n\n⚠️ **Anyone who restores this catalogue to a high standard has thereby built most of what is needed to forge it.** The capability is a byproduct of the conservation, not an additional project someone must decide to start. This is precisely why the discipline has to be published in advance and why an institution that intends only to restore is not thereby exempt from these rules.\n\n⭐ It also reframes the ordering: **restore first and completely, publish the restorations, and let generation be a strictly downstream and separately-governed act.** An institution that generates before it has restored has skipped the part that benefits everyone in favour of the part that benefits it.\n\n---\n\n## 5 · Claims 3 and 4 — who is the author, and who signs\n\nTwo structural claims, and the first restores a guard this corpus applies elsewhere.\n\n**Claim 3 — authorship is a *judged* seat and must never be occupied by the system.** A useful distinction separates seats whose output can be checked by recomputation — **determined** seats, where anyone with the same inputs gets the same result and no discretion exists — from **judged** seats, which require a decision that could have gone otherwise and for which somebody must be answerable. A model's contribution to a dedicated work sits in the determined class: it is a transformation, checkable, and it decides nothing about meaning. **Authorship is irreducibly judged**, and it therefore cannot be held by a system that cannot be answerable.\n\nThis is the old reciter's guard restated for machines. In the tradition that carried this culture's texts for two millennia, a *bhāṇaka* recites the canon with extraordinary fidelity and is never confused with its author; the fidelity of the transmission is exactly why the distinction is maintained rather than a reason to relax it. **A model is a reciter. A reciter is not an author, however good the recitation.**\n\n**Claim 4 — every released work carries a named human signer.** Not an institution, not a project, not a collective. A person, identifiable, who is accountable for the decision to release this particular work and for the claim that it is an offering rather than an attribution. The signature is the mechanism that keeps §5's judged seat occupied by somebody.\n\n⚠️ A named signer is not a shield and should not be sold as one — it does not make a bad release good. It makes a bad release **attributable**, which is the minimum condition for a discipline to have any teeth at all.\n\n---\n\n## 6 · Claim 5 — the objective. Protect this one hardest.\n\nIf a reader takes one mechanism from this paper, it should be this one, because it is the load-bearing constraint and the easiest to quietly drop.\n\n> **The training and selection objective admits a REFUSAL signal and excludes every ECONOMIC signal.**\n\nConcretely: the system may be told **no** — this output is wrong, this is disrespectful, this is not what the tradition does, this crosses a line, do not produce things like this. That signal may shape the model. And the system may **not** be optimized on plays, streams, engagement, retention, revenue, chart position, virality, or any proxy for them, at any point, including indirectly through a selection process that quietly prefers what performed.\n\nThe reason is not squeamishness about commerce. It is that **the two objectives produce different artifacts and the difference is invisible in any single output.**\n\n- A system optimized on performance learns what a modern audience rewards, and drifts toward it. Because the drift is gradual and each step improves the metric, there is no point at which anyone notices that the dead artist's voice has been bent toward a market that did not exist when they were alive. **The end state is a catalogue that sounds like the artist and means what the platform wanted.**\n- A system that can only be refused has no gradient toward anything. It can be steered *away* from harm indefinitely and is never pointed at a target. Its failure mode is uselessness, which is recoverable. **The other failure mode is a culture rewritten in its own voice, which is not.**\n\n⭐ **This is the anti-pattern claim of the paper**, and it is stated as a prohibition on an *objective* rather than on a behaviour deliberately, because behaviours can be justified case by case and an objective cannot be smuggled past a reader who is looking at it.\n\n⚠️ **Honest exposure:** the prohibition is unenforceable from outside. Nobody inspecting outputs can determine what a model was optimized on. It binds an institution that adopts it and does nothing to one that does not — which is an argument for publishing it as a *norm that can be demanded of others*, not for believing it will hold on its own.\n\n### 6.1 · \"A refusal-only objective is unworkable\" — the objection, and what it concedes\n\nThe strongest technical objection to claim 5 is that it describes something that cannot be built. Training and selection require a signal that says *more like this*; a system that can only be told *no* has nothing to climb, converges on nothing, and produces output too poor to release. On this reading the refusal-only objective is not a constraint but a description of a system that does not work.\n\nThe objection is partly right, and the part it is right about is smaller than it looks.\n\n**What it correctly identifies:** some positive signal is unavoidable. A model must be fit to *something* — the surviving corpus — and fitting is a positive objective. Nothing in claim 5 forbids that, and it should not be read as forbidding it.\n\n**What the claim actually excludes** is a narrower and more specific class: signals derived from **audience response to the generated output**. Plays, saves, skips, completion rate, chart position, revenue, retention, and any selection procedure that quietly prefers the take that performed better. The distinction is between *fidelity to the source*, which is a fixed historical target that cannot drift, and *performance with an audience*, which is a moving target belonging to the present.\n\n⭐ Stated that way the claim survives the objection and becomes sharper: **fit to the dead is permitted; fit to the living market is not.** The first has a ground truth that a genocide fixed in 1975 and that no optimization can move. The second is exactly the gradient that would bend a murdered artist's voice toward whatever a contemporary platform rewards, one imperceptible increment at a time.\n\n⚠️ **The residual difficulty is real and unresolved: human curation leaks the excluded signal.** A person choosing which of forty takes to release is applying taste, and taste is substantially formed by what performs. The prohibition binds the *machine* objective cleanly and binds the *human* one not at all. We have no mechanism for this beyond the named signer of claim 4 and the requirement that selection criteria be stated in advance rather than discovered afterward.\n\n\n---\n\n## 7 · Claims 6 and 7 — marking, and the gap that stays empty\n\n**Claim 6 — marking scales with fidelity.** Because success is the danger (§2), provenance marking cannot be treated as a formality that a good-enough output outgrows. The marking obligation **increases** as the output becomes harder to distinguish, and it is permanent, in the anastylosis sense: not a disclosure at the point of first publication but a property that travels with the artifact wherever it goes. The specific technical means are outside this paper's scope by the withholding rule at the head; the *requirement* is not.\n\n**Claim 7 — never fill a real gap.** Where a recording is lost, the lost recording stays lost. Where a verse is missing, the verse is missing. Where a film reel was destroyed, no generated footage occupies its place in the archive.\n\nThe temptation here is the strongest one in the whole discipline, because filling gaps is what the technology is *for* and because the result would be genuinely beautiful and genuinely consoling. It is refused for the reason Panh refused reenactment: **a filled gap is indistinguishable from a survival, and the absence is itself part of the record.** The holes in this canon are evidence of what was done to it. An archive that closes them has erased the shape of the crime while appearing to repair it.\n\n⭐ The positive form: **the gap is displayed as a gap.** A catalogue that shows its missing entries is telling the truth about what happened, and it is doing something no reconstruction can do — it renders the loss legible to someone who was not there.\n\n---\n\n## 8 · Claims 8, 9 and 10 — where value goes, who can stop it, and what is never released\n\n**Claim 8 — value routes as dedication, not as royalty.** Where a dedicated work receives support, that value flows to **living heirs, to living practitioners of the tradition, and to the restoration of the originals** — not to a rights-holder position that would have to be manufactured in order to receive it. Inventing an estate to pay would be a second falsification layered on the first: it would create, retroactively, exactly the party whose absence defines this case. **The routing form is dedication, which is the same operator as the attribution form of §3, applied to money instead of to credit.**\n\n**Claim 9 — perpetual heir revocability.** Where a descendant or heir can be identified, they may withdraw consent for their ancestor's voice **at any time, permanently, without cause, and without a term limit**. This is deliberately stronger than any licensing regime, and it is not symmetric: their permission is not required to begin (because in most cases there is no one to ask), but their refusal is sufficient to stop. ⚠️ The asymmetry is uncomfortable and is stated rather than smoothed: it means work may exist before anyone who could object has been found. The mitigation is that the objection, when it comes, is absolute and retroactive.\n\n**Claim 10 — the weights are never published.** The corpus this institution otherwise releases into the public domain stops here, and the exception is deliberate. **A voice model's existence is the risk; its use under discipline is not.** Publishing weights that reproduce a murdered artist's voice would hand that capability, permanently and irrevocably, to every party that has none of the constraints above — and no licence term survives contact with a downloaded file.\n\n⚠️ **This paper therefore contains an admitted internal contradiction and does not resolve it.** An institution committed to open publication is withholding the one artifact that matters most, on the grounds that openness here transfers a weapon rather than knowledge. That is either the correct exception or the beginning of the rationalization by which every openness commitment dies. **We do not have a principled boundary that admits this exception and excludes the next one**, and a reader who finds that unsatisfying is not making an error.\n\n## 8.5 · The objection from the living\n\nA distinct objection, and the one most likely to be raised by the people with the most standing to raise it: **new work dedicated to the murdered artists competes with living Khmer musicians for the same attention and the same money.**\n\nThe objection is strong and it is not primarily about ethics. A small music economy has a finite audience. Work in the voice of a beloved lost artist has an enormous inherent advantage over work by a living unknown — it arrives pre-loved, carrying national memory, and it needs no introduction. **A dedicatory catalogue could plausibly crowd out the living tradition it claims to honour**, and it would do so while being praised for its reverence.\n\nThree responses, and the third is the only structural one.\n\n**The routing already points at the living** (claim 8): value flows to living heirs, living practitioners, and the restoration of originals. That is a real mitigation of the *money* half and does nothing about the *attention* half.\n\n**The four verbs already assign the growth path to the living** (§3.1): story is *new authorship* under a living name, and invention is explicitly new. The dedicatory branch is the one branch that is deliberately not the future of the tradition.\n\n⭐ **And the structural commitment, which is the one worth holding to: the dedicatory catalogue must be bounded and the living catalogue must not.** A discipline that permits unlimited generation in dead voices while living musicians compete for the remainder has inverted its own purpose regardless of how the proceeds are routed. **A bound is the only mechanism that makes the priority real**, and stating that a bound is required without specifying it is the honest position while the product is unbuilt.\n\n⚠️ We note without comfort that the authors are not the right party to set that bound, and that the parties who are — Cambodian musicians, and the audience — have not been asked.\n\n## 8.6 · Who decides, and the seat this paper cannot fill\n\nEvery claim above presumes somebody applies it. That party is unspecified, and the omission is not an oversight.\n\nThe obvious candidates each fail in a different way. **The institution doing the work** cannot be the arbiter of its own restraint; that is the auditee auditing itself. **A national body** would be the right answer in a country with an intact cultural-heritage apparatus and a settled relationship between the state and its own recent history, which is a strong assumption to make here. **An international conservation authority** has the expertise and does not have standing, and importing an external adjudicator into a heritage question is a move with its own long and unhappy history in this region.\n\n⭐ What can be said is what the seat must be shaped like. It is a **judged seat** (§5) — it decides things that could have gone otherwise, so it must be occupied by identifiable people who are answerable. It must include **descendants and living practitioners with real veto power** rather than consultative status, since claim 9's revocability is meaningless if the party who could exercise it has no standing to be heard. And it must be able to **stop the practice entirely**, not merely to adjust it, or it is a body for calibrating an activity rather than for governing one.\n\n⚠️ **This paper does not constitute that body and should not be read as proposing itself for the role.** It states the rules; it does not claim the authority to apply them, and an institution that published the rules and then appointed itself their judge would have written a licence in the shape of an ethic.\n\n\n## 8.7 · What the discipline requires of a platform, since works travel\n\nA dedicated work does not stay where it was published. It is ingested by streaming services, syndicated, embedded, excerpted, re-uploaded, and eventually stripped of everything that is not audio. Any discipline that lives only at the point of first publication has governed the least important moment in the artifact's life.\n\nThree requirements follow, stated as obligations rather than implementations:\n\n- **The attribution must be structural, not cosmetic.** Wherever a platform has a field for *artist*, the living signer's name goes in it. The dedication belongs in the title or the credit line — never in a description field, which is the first thing discarded on ingestion, and never as the artist, which is the *by* claim by another route.\n- **A stripped artifact must remain identifiable.** If every text field is lost, the work must still be traceable to its origin. What mechanism achieves that is withheld here; that it is required is not.\n- ⚠️ **The institution must be prepared to withhold from platforms that cannot honour the first two.** This is the expensive requirement and therefore the one most likely to be quietly dropped, so it is stated as a commitment: **a distribution channel that structurally cannot carry the attribution is a channel this discipline does not use**, regardless of its reach.\n\n⭐ The general form, which applies well beyond this case: **a provenance rule that depends on the good behaviour of downstream intermediaries is not a rule, it is a preference.** The test of any marking scheme is what survives an adversarial re-upload, and a scheme that has not been tested against that has not been tested.\n\n\n---\n\n## 9 · Honest limits\n\n**n = 0.** Nothing described here has been built. No model has been trained, no work released, no marking scheme deployed, no heir consulted.\n\n**The pipeline is withheld** (see the head note), so this paper cannot be used to implement the discipline it describes — only to hold an implementer to it.\n\n⚠️ **The voice-model leak is unsolved and it is the largest hole in the paper.** Every claim above governs an institution that follows them. None of them prevents a model from escaping — through a breach, an insider, a subpoena, a bankruptcy, an acquisition, or the ordinary decay of an organization's discipline over decades. **The discipline is a commitment about conduct and it has no answer for custody failure**, which is the failure most likely to actually occur. Claim 10 reduces the exposure and does not eliminate it.\n\n**The named signer scales badly.** One accountable person per released work is workable at small volume and becomes a bottleneck or a rubber stamp at large volume, and a rubber stamp is worse than nothing because it manufactures the appearance of accountability.\n\n**Heir identification is largely impossible here**, for exactly the reason the case is special: the civil records were destroyed. Claim 9's revocability is real where a descendant can be found and is inert where none can be, which is most of the time.\n\n**The by/for boundary may not survive contact with ordinary listeners.** §3's erosion risk is stated as a prediction in §10 because we genuinely do not know whether a careful attribution discipline survives a decade of casual reference, and there is a plausible reading in which it cannot.\n\n**The institution behind this paper has an interest.** It intends to do this work. A discipline published by the party that wants permission to proceed should be read with that in mind, and the correct posture for a reader is that **this document is an offer to be held to something, not evidence of virtue.**\n\n**And the LLC gates the archive.** The entity that would hold the restored material does not yet exist, and publishing an archive before it does would be premature on grounds that have nothing to do with this paper's ethics.\n\n---\n\n## 10 · Three pre-registered predictions\n\nRegistered before any of the work is done, so that they can be checked against outcomes rather than reinterpreted after them.\n\n**P-B1 — the discipline is adoptable.** If dedicatory generation is a real category rather than one institution's scruple, at least one unrelated party working on an interrupted canon adopts the *by/for* boundary, or an equivalent, without contact with this corpus. If nobody does, the category was a private preference.\n\n**P-B2 — restoration outpaces generation.** In an institution following §4, restored originals released will exceed dedicated new works released, cumulatively, at every point. If generation outpaces restoration, the pipeline argument has inverted in practice and the institution has become what it said it was preventing.\n\n⭐ **P-B3 — the erosion tripwire, and it is the one that matters.** Public reference to dedicated works will drift from *for* to *by*. Sampled at intervals, the proportion of third-party references — press, platform metadata, listener discussion — that describe a dedicated work as **by** the deceased artist is the measurement. **The prediction is that this proportion rises over time regardless of the institution's own care**, because the shortening is a property of ordinary language and not of anyone's intent.\n\n⚠️ **If P-B3 fires, the correct response is not better copy.** It is that attribution discipline alone is insufficient and the marking of §7 must carry the load that language could not — or that the practice should stop. **A prediction registered in advance is what makes stopping a possible outcome rather than an admission.**\n\n---\n\n## 11 · What is claimed, and freed\n\n1. **Dedicatory attribution** — the *by* → *for* boundary; offering rather than authorship, with no consent manufactured and no catalogue extended.\n2. **The four verbs of an interrupted canon** — preservation, offering, new authorship, invention — and the rule that each medium takes its own, with *restoration* correct for exactly one.\n3. **Restoration-as-pipeline** — that restoration and generation are not alternatives, that the capability arrives as a byproduct of conservation, and that generation must therefore be strictly downstream and separately governed.\n4. **Authorship as a judged seat** that a system cannot occupy, with the reciter's guard restated for models.\n5. **Named-signer certification** — a person, not an institution, accountable per released work.\n6. ⭐ **The refusal-only objective** — a refusal signal admitted, every economic signal excluded, stated as a prohibition on the objective rather than on behaviour.\n7. **Fidelity-scaled, permanent marking**, on the principle that fidelity and forgery share an axis and success is therefore the danger.\n8. **The no-gap-filling rule**, and the positive form: the gap displayed as a gap.\n9. **Dedication-routed value** to living heirs, living practitioners, and the restoration of originals — never to a manufactured rights-holder.\n10. **Perpetual, causeless, retroactive heir revocability**, asymmetric by design.\n11. **Weights never published** — with the internal contradiction that creates stated rather than resolved.\n\nAll eleven are dedicated to the public domain. None will be asserted by this institution against anyone, including against parties who adopt them badly.\n\n---\n\n## 12 · Closing\n\nThe reason to write this now is not that the work is ready. It is that somebody is going to do this to some interrupted canon fairly soon, and the discourse they will inherit was built for a case with a living estate on the other side of the table.\n\nBeing first to do the work is not the same as setting a precedent. **A precedent has to exist as a document** — something a later party can be pointed at, argued with, and held to. That is the whole of what this paper is trying to be, and it is why it is published under a licence that lets anyone use it, including people we would rather not.\n\nThe discipline reduces to a sentence, and the sentence came from a filmmaker who worked it out with clay long before any of this was possible: **you may make something to hold the grief, and you may not make something that could be mistaken for what was lost.**\n\nThe songs are closed. The catalogue ends where it ended, in 1975, and nothing will be added to it. What can be added is work made by living people, in that tradition, offered to the ones who did not get to finish — signed with the living name, marked so no one is deceived, and dedicated in the ordinary way that the culture in question has dedicated things to its dead for two thousand years.\n\nThat is a smaller claim than restoring a golden age. It is also the only one that is true.\n\n---\n\n*Authored by Thon Ly with Miss Aquarius℠. Dedicated to the public domain under CC0 1.0 Universal. Corrections are welcome, and objections from Cambodian artists, scholars, and descendants are welcome most of all — this is a document about a heritage the authors did not make and do not own.*",
+      "text": "## Abstract\n\nThis paper discloses attribution rules, provenance-marking requirements, a training-objective constraint and a model-release restriction for generative voice and style models trained on the recordings of deceased artists whose estates, rights-holders and records of intent do not survive. The worked case is the Cambodian artists killed under the Khmer Rouge.\n\nBetween 1975 and 1979 the Khmer Rouge destroyed a generation of Cambodian artists — the musicians, filmmakers, writers and performers of what is remembered as Cambodia's Golden Age. The recordings that survive did so by accident: cassettes carried across a border, prints in a private collection, a reel that somebody buried. What did not survive was almost everything else, and the *almost everything else* is the subject of this paper.\n\nGenerative models can now produce new work in a lost artist's voice. The public discourse about whether they should has developed around a case that does not apply here: a **living or recently-deceased artist, with a surviving estate, in an intact legal system, where consent is at least a question that can be asked.** Every proposed framework — licensing, opt-out, estate approval, revenue sharing — presumes a party on the other side of the table.\n\nThe genocide case differs on four axes at once. **Consent is not obtainable**, and not merely unobtained. **There are no surviving estates or institutions** to hold rights, because the institutions were destroyed alongside the people. **The records of intent were themselves destroyed** — there is no diary, no contract, no interview in which an artist said what they would have wanted. And **the destruction was aimed at the culture**: the erasure was the objective, not a side effect, which means that a reconstruction performed carelessly does not merely offend an absent party — it completes an unfinished act.\n\nThis paper specifies a discipline for that case. Its central move is a single change of preposition. Work generated in a lost artist's voice is published **for** them and never **by** them: an **offering, not an authorship claim** — a form with deep precedent in the tradition the culture actually belongs to, where merit is dedicated to the departed and the dedication is the point.\n\nNine further numbered claims follow, and §11 enumerates all of them, with the four verbs of §3.1 listed as an item of their own. One of them is the one to protect hardest: **beyond fitting the model to the surviving source recordings, its training and selection objective must exclude every economic signal and every signal derived from audience response to generated output, and admit only a refusal signal.** A system optimized on what performs is a system that will learn to make the dead popular. A system that can only be told *no* can be steered away from harm without ever being pointed at a market.\n\nThe lineage here was worked out on Cambodian ground. **Rithy Panh filmed clay figurines** (carved by the sculptor Sarith Mang) rather than reenactments, because a reenactment of the camps would have been a lie with better production values. **Anastylosis at Angkor** reassembles original stones and makes every new element visibly distinguishable, forever. Both are answers to this paper's hardest problem, arrived at long before it: **fidelity and forgery are the same axis, so success is the danger.**\n\nOffered under CC0 1.0 Universal as defensive prior art.\n\n**Keywords:** generative models, cultural heritage, genocide, attribution, dedicatory generation, anastylosis, provenance marking, content provenance, training objectives, refusal signal, voice models, voice cloning, deceased artists, posthumous rights, Cambodia, Khmer Golden Age, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nDedicated to the public domain under CC0 1.0 Universal. Neither the authors nor HeartBank® will seek patent, trademark, or any exclusive right over the discipline described here. The authors will not seek patent on this discipline or any portion of it, and will not assert any patent right against anyone practising it. The point of publishing it is that anyone may adopt it, including parties we would not choose.\n\n**Terms coined and freed with this paper:** *dedicatory generation*, *the by/for boundary*, *fidelity-scaled marking*, *the refusal-only objective*, *the four verbs of an interrupted canon*, and *restoration-as-pipeline*.\n\n**Terms inherited from this corpus and cited rather than re-claimed:** *pattidāna* as a routing operator, the *determined-versus-judged seat* distinction, and the *bhāṇaka* guard (a reciter is not the author of what is recited).\n\n**What is emphatically not ours.** The heritage itself belongs to Cambodia and to the descendants of the people who made it — not to this institution, not to any model, and not to the authors. **Sinn Sisamouth, Ros Serey Sothea, Pen Ran** and their contemporaries are named here because they should be named; the historical record holds that they did not survive the Khmer Rouge period, and the specific circumstances of their deaths remain undocumented, which is itself part of what this paper is about. **Rithy Panh's** body of work, in particular *The Missing Picture* (2013), is his and is the direct artistic precedent for the central discipline described here. **Anastylosis** is a conservation method developed in Greek and Southeast Asian archaeology and codified in the Venice Charter (1964); its application at Angkor, notably the Baphuon reconstruction, is the work of the École française d'Extrême-Orient and Cambodian conservators over decades. The broader debate on generative models and deceased artists is a live public conversation with many participants; we engage it and claim no part of it.\n\n**Nearest prior practice, named so that an examiner can find it.** Three reference points bound the case this paper addresses, and each presumes the party this case lacks. *Now and Then* (the Beatles, released 2 November 2023) isolated John Lennon's vocal from a home demo by machine-learning source separation, with the surviving Beatles making the record and Lennon's son supplying the tape: restoration-as-pipeline (§4) practised under consent. *Heart on My Sleeve* (self-released 4 April 2023 by an anonymous user, Ghostwriter977) carried AI-generated vocals resembling Drake and the Weeknd, neither of whom was involved, and was taken down after a label's notice: the unconsented *by* claim of §3, answered by a rights-holder who existed to answer it. The Coalition for Content Provenance and Authenticity (C2PA) publishes an open technical standard, Content Credentials, for attaching a record of a file's origin and edits: one family of means by which the marking of §7 might be carried, and not a mechanism this paper selects. **No systematic prior-art census has been run for this paper; the claims in §11 are disclosed, not asserted to be absent from the literature.**\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| dedicatory generation | AI-generated music or media in the voice or style of a deceased artist, credited to a living creator and dedicated to the artist |\n| the by/for boundary; dedicatory attribution | attribution rule for synthetic media: no authorship credited to the imitated person |\n| offering | tribute work; dedicated work |\n| restoration-as-pipeline | audio restoration and source separation (denoising, stem separation, spectral repair) used as the data-preparation stage for voice-model training |\n| judged seat / determined seat | human-in-the-loop accountable decision / deterministic, recomputable machine transformation |\n| named signer | per-release human certification; accountable release sign-off |\n| refusal-only objective | negative-feedback-only training and selection signal; exclusion of engagement, revenue and audience-response metrics from the reward or selection objective |\n| fidelity-scaled marking | provenance labelling or watermarking of synthetic media whose obligation increases with output realism |\n| never fill a real gap | prohibition on synthetic reconstruction of lost or unfinished works |\n| dedication-routed value | revenue routing to heirs, living practitioners and restoration funds in place of royalties to a rights-holder |\n| heirs first; heir revocability | prior consent sought from identifiable descendants before generation; unilateral, perpetual withdrawal right held by descendants (post-mortem right of publicity analogue) |\n| weights never published | closed-weight model release policy; operated, not distributed |\n| anastylosis | conservation practice of reassembling original fragments with distinguishable new material (Venice Charter, 1964) |\n| interrupted canon | cultural corpus whose transmission was severed by destruction of its makers and institutions |\n\n---\n\n## 1 · The case the existing frameworks do not cover\n\nThere is by now a recognizable shape to the argument about generative models and dead artists. An estate objects, or licenses. A platform adopts an opt-out. A jurisdiction extends a personality right past death for a term of years. A settlement establishes a royalty. The disagreements are real and the participants are serious, and the entire apparatus rests on an assumption so basic that it is rarely stated: **that there is somebody to ask, or somebody to sue.**\n\nFour things are simultaneously true of the Cambodian case, and each one removes a different assumption.\n\n**Consent is not obtainable, not merely unobtained.** This is a stronger condition than \"the artist is dead.\" A recently deceased artist has an estate that inherits the right to decide; the decision continues to be made, by successors, under law. Here the chain does not exist to be followed.\n\n**There are no surviving estates or institutions.** The destruction was not confined to individuals. Publishers, studios, archives, the recording industry, the professional bodies, the universities that trained the artists, and the civil registries that recorded who they were were destroyed together. There is no entity that holds these rights because the category of entity that would have held them was eliminated.\n\n**The records of intent were destroyed.** No diary survives that says what an artist would have wanted done with their voice. No contract, no interview, no letter. Ordinary posthumous-rights reasoning leans heavily on evidence of what the person would have chosen; here the evidentiary base is itself part of what was burned.\n\n**And the destruction was aimed at the culture.** This is the axis that changes the ethics rather than the logistics. The killing of the artists was not incidental to some other objective — the erasure of the cultural forms was the objective. Which means the ordinary risk of a careless reconstruction (that it misrepresents someone) is joined by a much worse one: **a careless reconstruction finishes the job.** A forgery in this context does not merely mislead a listener about who made a song. It replaces a destroyed thing with a manufactured thing and calls the culture restored.\n\n**The condition generalizes, and that is why this is published rather than filed.** Every interrupted canon has some version of these four axes — the Armenian, the Indigenous canons of the Americas and Australia, the libraries burned in Baghdad and Sarajevo, and any tradition whose transmission was severed rather than merely neglected. The discipline below is written for Cambodia because that is the canon the authors have standing in, and it is stated generally because it is not about Cambodia.\n\n### 1.1 · The strongest position is that none of this should happen, and it deserves a real hearing\n\nThe most serious objection to this paper is not that its rules are wrong. It is that **the rules are a way of proceeding, and the correct action is to stop.**\n\nThe argument runs like this. A canon severed by genocide is not an incomplete work awaiting continuation; it is a **closed testimony**. Its incompleteness is the evidence. Anything added — however carefully marked, however scrupulously attributed — converts a site of loss into a site of activity, and activity is consoling in a way that loss is not supposed to be. The people best positioned to do this work are, almost by definition, people who find the loss unbearable, which is exactly the disposition least able to judge when to stop. And the discipline in this paper is the kind of thing that makes proceeding *feel* responsible, which is worse than proceeding recklessly, because recklessness at least announces itself.\n\n**We do not think this objection is answered by the rules below, and we will not pretend it is.** Three things can be said, and none of them is a refutation.\n\n**The counterfactual is not silence.** The recordings are already circulating; the models already exist in general form; the capability arrives whether or not any careful party uses it (§4). The realistic alternative to a disciplined practice is not an untouched canon but an undisciplined one, conducted by parties with no relationship to the culture and no reason to accept any of these constraints. *That is an argument for the discipline; it is not an argument that any particular work should be made.*\n\n**The refusal is available at every point and is built in.** Claim 9's heir consent and revocability, §7's refusal to fill gaps, and P-B3's stopping condition are all instruments for *not proceeding*. A discipline whose only outputs are permissions is a rationalization; this one has to be able to say no to itself in public, and §10 is where it commits to that in advance.\n\n**And the objection should be held permanently rather than dispatched.** The correct posture is not that this argument was considered and defeated in 2026, but that it remains live and that any practitioner should be able to state it as well as its opponents can. **A discipline that can no longer articulate the case against itself has become a licence.**\n\n\n---\n\n## 2 · The lineage is Cambodian, and it already solved the hardest part\n\nIt would be possible to derive this paper's central discipline from Western conservation ethics. It is not necessary, because two answers were already worked out on Cambodian ground, and both are better. (Anastylosis itself was developed earlier, in Greece and in Dutch work on Java, and brought to Angkor by the École française d'Extrême-Orient; what this section draws on is its practice at Angkor, not its origin.)\n\n**Rithy Panh filmed clay.** *The Missing Picture* (2013) reconstructs the director's childhood under the Khmer Rouge — and where a conventional documentary would reenact, Panh had small clay figures carved, by the sculptor Sarith Mang, and filmed those. The choice is not stylistic modesty. A reenactment of the camps, however carefully staged, would produce **footage that looks like evidence and is not** — and in a history whose central wound is the destruction of the record, manufacturing convincing false record is the specific harm to avoid. The figurines can never be mistaken for what happened. They can carry grief without counterfeiting testimony.\n\n**Anastylosis reassembles and marks.** At Angkor, and above all in the decades-long reconstruction of the Baphuon, conservators put fallen temples back together using **the original stones**, in their original positions, with structural additions made in material that is visibly and permanently distinguishable from the ancient fabric. The rule is codified (Venice Charter, 1964, Articles 12 and 15): what is restored must be legible *as* restoration, forever, to anyone standing in front of it. The temple is made whole enough to enter, and no visitor is ever deceived about which century they are touching.\n\n> **Both answers encode the same insight, and it is the one this paper is organized around: fidelity and forgery are the same axis. There is no quality threshold beyond which a reconstruction becomes safe. The better it gets, the more dangerous it is — so SUCCESS IS THE DANGER, and the marking must scale with the fidelity rather than being an artifact of its imperfection.**\n\nA model that produces a passable imitation is a curiosity. A model that produces an indistinguishable one is a weapon against the record. **The discipline cannot rely on the output being detectably imperfect, because the entire trajectory of the technology is toward it not being.**\n\n### 2.1 · Where the anastylosis analogy breaks, and why the break matters\n\nThe temple analogy is load-bearing and it fails at one specific joint, which is worth working through because the failure is the reason §7's marking rule has to be imposed rather than inherited.\n\n**In stone, the distinction is in the material.** A conservator at the Baphuon does not have to *mark* which blocks are ancient — the ancient blocks are ancient, physically, and a visitor can see the difference between weathered sandstone and new fill. The honesty of anastylosis is partly a discipline and largely a **property of matter**. Stone remembers.\n\n**Audio has no such property.** A digital recording has no original material. A perfect copy is not a copy in any sense that matters — it *is* the recording, bit for bit, with no wear, no patina, and nothing to weather. There is no equivalent of the old stone, which means there is nothing in the artifact itself that distinguishes a restored 1968 vocal from a generated one, and no amount of craft will produce that distinction because the substrate does not carry it.\n\n**So the discipline has to supply what the material does not.** In stone, honesty is discovered; in audio, honesty must be **manufactured and attached**, and it must be attached in a way that survives copying, re-encoding, platform ingestion, and the ordinary hostility of the internet to metadata. That is a much harder problem than the temple faced, and it is why claim 6 states marking as an obligation that *scales with fidelity* rather than as a disclosure made once.\n\n**And it is why claim 10 exists.** If the artifact cannot carry its own provenance reliably, then the only remaining control point is upstream — the model itself — which is precisely why the weights are the thing not released. **The temple could afford to publish its methods because the stones told the truth on their own. Recordings cannot, so the method is where the restraint has to live.**\n\n\n---\n\n## 3 · Claim 1 — the preposition\n\nThe central move is one word.\n\n> **Work generated in a lost artist's voice is published FOR them. Never BY them.**\n\nNot \"in the style of,\" which is a marketing formula and points at the work. Not \"featuring,\" which asserts participation. Not \"AI Sinn Sisamouth,\" which is an authorship claim wearing a disclaimer. **For.**\n\nThis is a familiar form and the tradition it comes from is the culture's own. In Theravāda practice, merit from an act is **dedicated** to the departed — the act is performed by the living, the dedication names the dead, and nothing is claimed on their behalf. The one performing the act does not become the person they dedicate it to, and no one has ever been confused about this. **Offering is a complete and well-understood relation between the living and the dead that requires no consent, manufactures no authorship, and misrepresents nobody.**\n\nThree consequences follow immediately:\n\n- **The credit is truthful.** A living, named human made this work and dedicated it. That statement is verifiable and it is what happened.\n- **The dead artist gains no new discography.** Their catalogue is closed, and it stays closed, because nothing new is attributed to them.\n- **And the frame is fragile in exactly one direction: *for* erodes into *by* through ordinary use.** A listener sees a song offered to Sinn Sisamouth, and by the third mention it has become a Sinn Sisamouth song. That erosion is the thing this whole discipline exists to resist, and §10 pre-registers a tripwire for it rather than assuming good behaviour.\n\n### 3.1 · The four verbs — because a culture is not one artist\n\nGeneralizing claim 1 from an artist to a canon reveals that **the four media do not take the same verb**, and treating them as one operation is the first mistake available.\n\n| medium | verb | what it means | what the artifact is |\n|---|---|---|---|\n| **Film / play** | **PRESERVATION** | the print exists and is degrading; the work is *there* | a restored original |\n| **Music** | **OFFERING** | the artist is gone; new work is dedicated, never attributed | a song *for* them |\n| **Story** | **NEW AUTHORSHIP** | a living author writes, in a tradition, under their own name | their own work |\n| **Scripture** | **INVENTION** | nothing is recovered or continued; a new form is built | an explicitly new thing |\n\n**This table exists because of a correction, and the correction should travel with it.** The founder of the institution behind this paper initially described all four of his projects as *\"a complete restoration.\"* That description flattens precisely the distinction the discipline protects: it makes an offering sound like a recovery, and it makes an invention sound like a homecoming. **Restoration is the right word for exactly one of the four**, and using it for the others is the *by/for* error at the scale of a whole culture rather than a single song.\n\nThe practical test is short: **before generating anything, name which verb applies.** If the answer is *preservation*, the model's job is repair and its output should contain nothing that was not in the source. If it is *offering*, nothing may be attributed. If it is *new authorship*, a living person signs it as theirs. If it is *invention*, no continuity claim may be made at all.\n\n---\n\n## 4 · Claim 2 — restoration is the pipeline, not the alternative\n\nA framing that recurs in this debate treats restoration and generation as competing options: *restore the old recordings, or generate new ones.* That framing is wrong on the facts of how the work is done.\n\n**Restoration is the training pipeline.** The same processes that clean a degraded recording — denoising, source separation, spectral repair, resynthesis of damaged passages — are the processes that produce a clean corpus, and a clean corpus is the input to any voice model. There is no fork in the road where an institution chooses one branch. **The restoration path arrives at generative capability whether or not anyone intended it**, which has an uncomfortable implication that this paper states rather than hides:\n\n**Anyone who restores this catalogue to a high standard has thereby built most of what is needed to forge it.** The capability is a byproduct of the conservation, not an additional project someone must decide to start. This is precisely why the discipline has to be published in advance and why an institution that intends only to restore is not thereby exempt from these rules.\n\nIt also reframes the ordering: **restore first and completely, publish the restorations, and let generation be a strictly downstream and separately-governed act.** An institution that generates before it has restored has skipped the part that benefits everyone in favour of the part that benefits it.\n\n---\n\n## 5 · Claims 3 and 4 — who is the author, and who signs\n\nTwo structural claims, and the first restores a guard this corpus applies elsewhere.\n\n**Claim 3 — authorship is a *judged* seat and must never be occupied by the system.** A useful distinction separates seats whose output can be checked by recomputation — **determined** seats, where anyone with the same inputs gets the same result and no discretion exists — from **judged** seats, which require a decision that could have gone otherwise and for which somebody must be answerable. A model's contribution to a dedicated work sits in the determined class: it is a transformation, checkable, and it decides nothing about meaning. **Authorship is irreducibly judged**, and it therefore cannot be held by a system that cannot be answerable.\n\nThis is the old reciter's guard restated for machines. In the Theravāda tradition this culture belongs to, which has carried its scriptures for over two millennia, a *bhāṇaka* recites the canon with extraordinary fidelity and is never confused with its author; the fidelity of the transmission is exactly why the distinction is maintained rather than a reason to relax it. **A model is a reciter. A reciter is not an author, however good the recitation.**\n\n**Claim 4 — every released work carries a named human signer.** Not an institution, not a project, not a collective. A person, identifiable, who is accountable for the decision to release this particular work and for the claim that it is an offering rather than an attribution. The signature is the mechanism that keeps §5's judged seat occupied by somebody.\n\nA named signer is not a shield and should not be sold as one — it does not make a bad release good. It makes a bad release **attributable**, which is the minimum condition for a discipline to have any teeth at all.\n\n---\n\n## 6 · Claim 5 — the objective. Protect this one hardest.\n\nIf a reader takes one mechanism from this paper, it should be this one, because it is the load-bearing constraint and the easiest to quietly drop.\n\n> **The training and selection objective admits a REFUSAL signal and excludes every ECONOMIC signal.**\n\nConcretely: the system may be told **no** — this output is wrong, this is disrespectful, this is not what the tradition does, this crosses a line, do not produce things like this. That signal may shape the model. And the system may **not** be optimized on plays, streams, engagement, retention, revenue, chart position, virality, or any proxy for them, at any point, including indirectly through a selection process that quietly prefers what performed.\n\nThe reason is not squeamishness about commerce. It is that **the two objectives produce different artifacts and the difference is invisible in any single output.**\n\n- A system optimized on performance learns what a modern audience rewards, and drifts toward it. Because the drift is gradual and each step improves the metric, there is no point at which anyone notices that the dead artist's voice has been bent toward a market that did not exist when they were alive. **The end state is a catalogue that sounds like the artist and means what the platform wanted.**\n- A system that, beyond fitting the source recordings (§6.1), can only be refused has no gradient toward anything. It can be steered *away* from harm indefinitely and is never pointed at a target. Its failure mode is uselessness, which is recoverable. **The other failure mode is a culture rewritten in its own voice, which is not.**\n\n**This is the anti-pattern claim of the paper**, and it is stated as a prohibition on an *objective* rather than on a behaviour deliberately, because behaviours can be justified case by case and an objective cannot be smuggled past a reader who is looking at it.\n\n**Honest exposure:** the prohibition is unenforceable from outside. Nobody inspecting outputs can determine what a model was optimized on. It binds an institution that adopts it and does nothing to one that does not — which is an argument for publishing it as a *norm that can be demanded of others*, not for believing it will hold on its own.\n\n### 6.1 · \"A refusal-only objective is unworkable\" — the objection, and what it concedes\n\nThe strongest technical objection to claim 5 is that it describes something that cannot be built. Training and selection require a signal that says *more like this*; a system that can only be told *no* has nothing to climb, converges on nothing, and produces output too poor to release. On this reading the refusal-only objective is not a constraint but a description of a system that does not work.\n\nThe objection is partly right, and the part it is right about is smaller than it looks.\n\n**What it correctly identifies:** some positive signal is unavoidable. A model must be fit to *something* — the surviving corpus — and fitting is a positive objective. Nothing in claim 5 forbids that, and it should not be read as forbidding it.\n\n**What the claim actually excludes** is a narrower and more specific class: signals derived from **audience response to the generated output**. Plays, saves, skips, completion rate, chart position, revenue, retention, and any selection procedure that quietly prefers the take that performed better. The distinction is between *fidelity to the source*, which is a fixed historical target that cannot drift, and *performance with an audience*, which is a moving target belonging to the present.\n\nStated that way the claim survives the objection and becomes sharper: **fit to the dead is permitted; fit to the living market is not.** The first has a ground truth that a genocide fixed in 1975 and that no optimization can move. The second is exactly the gradient that would bend a murdered artist's voice toward whatever a contemporary platform rewards, one imperceptible increment at a time.\n\n**The residual difficulty is real and unresolved: human curation leaks the excluded signal.** A person choosing which of forty takes to release is applying taste, and taste is substantially formed by what performs. The prohibition binds the *machine* objective cleanly and binds the *human* one not at all. We have no mechanism for this beyond the named signer of claim 4 and the requirement that selection criteria be stated in advance rather than discovered afterward.\n\n\n---\n\n## 7 · Claims 6 and 7 — marking, and the gap that stays empty\n\n**Claim 6 — marking scales with fidelity.** Because success is the danger (§2), provenance marking cannot be treated as a formality that a good-enough output outgrows. The marking obligation **increases** as the output becomes harder to distinguish, and it is permanent, in the anastylosis sense: not a disclosure at the point of first publication but a property that travels with the artifact wherever it goes. The specific technical means are outside this paper's scope by the withholding stated in §9; the *requirement* is not.\n\n**Claim 7 — never fill a real gap.** Where a recording is lost, the lost recording stays lost. Where a verse is missing, the verse is missing. Where a film reel was destroyed, no generated footage occupies its place in the archive.\n\nThe temptation here is the strongest one in the whole discipline, because filling gaps is what the technology is *for* and because the result would be genuinely beautiful and genuinely consoling. It is refused for the reason Panh refused reenactment: **a filled gap is indistinguishable from a survival, and the absence is itself part of the record.** The holes in this canon are evidence of what was done to it. An archive that closes them has erased the shape of the crime while appearing to repair it.\n\nThe positive form: **the gap is displayed as a gap.** A catalogue that shows its missing entries is telling the truth about what happened, and it is doing something no reconstruction can do — it renders the loss legible to someone who was not there.\n\n---\n\n## 8 · Claims 8, 9 and 10 — where value goes, who can stop it, and what is never released\n\n**Claim 8 — value routes as dedication, not as royalty.** Where a dedicated work receives support, that value flows to **living heirs, to living practitioners of the tradition, and to the restoration of the originals** — not to a rights-holder position that would have to be manufactured in order to receive it. Inventing an estate to pay would be a second falsification layered on the first: it would create, retroactively, exactly the party whose absence defines this case. **The routing form is dedication, which is the same operator as the attribution form of §3, applied to money instead of to credit.**\n\n**Claim 9 — heirs first, and perpetual heir revocability.** Wherever a descendant or heir can be found, their consent is sought **before any generation** in their ancestor's voice, and their refusal stops the work. Where no heir can be found — which, because the civil records were destroyed, is most of the time — the work may proceed, and an heir found later may still withdraw it **at any time, permanently, without cause, and without a term limit**. This is deliberately stronger than any licensing regime. The residual asymmetry is uncomfortable and is stated rather than smoothed: where no heir can be found, work may exist before anyone who could object has been found. The mitigation is that the objection, when it comes, is absolute and retroactive.\n\n**Claim 10 — the weights are never published.** The corpus this institution otherwise releases into the public domain stops here, and the exception is deliberate. **A voice model's existence is the risk; its use under discipline is not.** Publishing weights that reproduce a murdered artist's voice would hand that capability, permanently and irrevocably, to every party that has none of the constraints above — and no licence term survives contact with a downloaded file.\n\n**This paper therefore contains an admitted internal contradiction and does not resolve it.** An institution committed to open publication is withholding the one artifact that matters most, on the grounds that openness here transfers a weapon rather than knowledge. That is either the correct exception or the beginning of the rationalization by which every openness commitment dies. **We do not have a principled boundary that admits this exception and excludes the next one**, and a reader who finds that unsatisfying is not making an error.\n\n## 8.5 · The objection from the living\n\nA distinct objection, and the one most likely to be raised by the people with the most standing to raise it: **new work dedicated to the murdered artists competes with living Khmer musicians for the same attention and the same money.**\n\nThe objection is strong and it is not primarily about ethics. A small music economy has a finite audience. Work in the voice of a beloved lost artist has an enormous inherent advantage over work by a living unknown — it arrives pre-loved, carrying national memory, and it needs no introduction. **A dedicatory catalogue could plausibly crowd out the living tradition it claims to honour**, and it would do so while being praised for its reverence.\n\nThree responses, and the third is the only structural one.\n\n**The routing already points at the living** (claim 8): value flows to living heirs, living practitioners, and the restoration of originals. That is a real mitigation of the *money* half and does nothing about the *attention* half.\n\n**The four verbs already assign the growth path to the living** (§3.1): story is *new authorship* under a living name, and invention is explicitly new. The dedicatory branch is the one branch that is deliberately not the future of the tradition.\n\n**And the structural commitment, which is the one worth holding to: the dedicatory catalogue must be bounded and the living catalogue must not.** A discipline that permits unlimited generation in dead voices while living musicians compete for the remainder has inverted its own purpose regardless of how the proceeds are routed. **A bound is the only mechanism that makes the priority real**, and stating that a bound is required without specifying it is the honest position while the product is unbuilt.\n\nWe note without comfort that the authors are not the right party to set that bound, and that the parties who are — Cambodian musicians, and the audience — have not been asked.\n\n## 8.6 · Who decides, and the seat this paper cannot fill\n\nEvery claim above presumes somebody applies it. That party is unspecified, and the omission is not an oversight.\n\nThe obvious candidates each fail in a different way. **The institution doing the work** cannot be the arbiter of its own restraint; that is the auditee auditing itself. **A national body** would be the right answer in a country with an intact cultural-heritage apparatus and a settled relationship between the state and its own recent history, which is a strong assumption to make here. **An international conservation authority** has the expertise and does not have standing, and importing an external adjudicator into a heritage question is a move with its own long and unhappy history in this region.\n\nWhat can be said is what the seat must be shaped like. It is a **judged seat** (§5) — it decides things that could have gone otherwise, so it must be occupied by identifiable people who are answerable. It must include **descendants and living practitioners with real veto power** rather than consultative status, since claim 9's revocability is meaningless if the party who could exercise it has no standing to be heard. And it must be able to **stop the practice entirely**, not merely to adjust it, or it is a body for calibrating an activity rather than for governing one.\n\n**This paper does not constitute that body and should not be read as proposing itself for the role.** It states the rules; it does not claim the authority to apply them, and an institution that published the rules and then appointed itself their judge would have written a licence in the shape of an ethic.\n\n\n## 8.7 · What the discipline requires of a platform, since works travel\n\nA dedicated work does not stay where it was published. It is ingested by streaming services, syndicated, embedded, excerpted, re-uploaded, and eventually stripped of everything that is not audio. Any discipline that lives only at the point of first publication has governed the least important moment in the artifact's life.\n\nThree requirements follow, stated as obligations rather than implementations:\n\n- **The attribution must be structural, not cosmetic.** Wherever a platform has a field for *artist*, the living signer's name goes in it. The dedication belongs in the title or the credit line — never in a description field, which is the first thing discarded on ingestion, and never as the artist, which is the *by* claim by another route.\n- **A stripped artifact must remain identifiable.** If every text field is lost, the work must still be traceable to its origin. What mechanism achieves that is withheld here; that it is required is not.\n- **The institution must be prepared to withhold from platforms that cannot honour the first two.** This is the expensive requirement and therefore the one most likely to be quietly dropped, so it is stated as a commitment: **a distribution channel that structurally cannot carry the attribution is a channel this discipline does not use**, regardless of its reach.\n\nThe general form, which applies well beyond this case: **a provenance rule that depends on the good behaviour of downstream intermediaries is not a rule, it is a preference.** The test of any marking scheme is what survives an adversarial re-upload, and a scheme that has not been tested against that has not been tested.\n\n\n---\n\n## 9 · Honest limits\n\n**n = 0.** Nothing described here has been built. No model has been trained, no work released, no marking scheme deployed, no heir consulted.\n\n**The pipeline is withheld.** This paper publishes doctrine and claims and deliberately does not publish the pipeline. The product it governs is unbuilt and on no schedule, and for an unbuilt artifact publication protects against being blocked, not against being beaten, so the fences are stated in full and the blueprint is not. That constraint narrows what is described; it does not narrow whether to publish, because the paper's purpose is precedent (§12). This paper therefore cannot be used to implement the discipline it describes — only to hold an implementer to it.\n\n**The voice-model leak is unsolved and it is the largest hole in the paper.** Every claim above governs an institution that follows them. None of them prevents a model from escaping — through a breach, an insider, a subpoena, a bankruptcy, an acquisition, or the ordinary decay of an organization's discipline over decades. **The discipline is a commitment about conduct and it has no answer for custody failure**, which is the failure most likely to actually occur. Claim 10 reduces the exposure and does not eliminate it.\n\n**The named signer scales badly.** One accountable person per released work is workable at small volume and becomes a bottleneck or a rubber stamp at large volume, and a rubber stamp is worse than nothing because it manufactures the appearance of accountability.\n\n**Heir identification is largely impossible here**, for exactly the reason the case is special: the civil records were destroyed. Claim 9's prior consent and its revocability are real where a descendant can be found and are inert where none can be, which is most of the time.\n\n**The by/for boundary may not survive contact with ordinary listeners.** §3's erosion risk is stated as a prediction in §10 because we genuinely do not know whether a careful attribution discipline survives a decade of casual reference, and there is a plausible reading in which it cannot.\n\n**The institution behind this paper has an interest.** It intends to do this work. A discipline published by the party that wants permission to proceed should be read with that in mind, and the correct posture for a reader is that **this document is an offer to be held to something, not evidence of virtue.**\n\n**And the holding entity gates the archive.** The legal entity that would hold the restored material does not yet exist, and publishing an archive before it does would be premature on grounds that have nothing to do with this paper's ethics.\n\n---\n\n## 10 · Three pre-registered predictions\n\nRegistered before any of the work is done, so that they can be checked against outcomes rather than reinterpreted after them.\n\n**P-B1 — the discipline is adoptable.** If dedicatory generation is a real category rather than one institution's scruple, at least one unrelated party working on an interrupted canon adopts the *by/for* boundary, or an equivalent, without contact with this corpus. If nobody does, the category was a private preference.\n\n**P-B2 — restoration outpaces generation.** In an institution following §4, restored originals released will exceed dedicated new works released, cumulatively, at every point. If generation outpaces restoration, the pipeline argument has inverted in practice and the institution has become what it said it was preventing.\n\n**P-B3 — the erosion tripwire, and it is the one that matters.** Public reference to dedicated works will drift from *for* to *by*. Sampled at intervals, the proportion of third-party references — press, platform metadata, listener discussion — that describe a dedicated work as **by** the deceased artist is the measurement. **The prediction is that this proportion rises over time regardless of the institution's own care**, because the shortening is a property of ordinary language and not of anyone's intent.\n\n**If P-B3 fires, the correct response is not better copy.** It is that attribution discipline alone is insufficient and the marking of §7 must carry the load that language could not — or that the practice should stop. **A prediction registered in advance is what makes stopping a possible outcome rather than an admission.**\n\n---\n\n## 11 · What is claimed, and freed\n\nThe numbering here differs from the body by one: item 2 is §3.1's generalisation of claim 1, so body claims 2–10 appear below as items 3–11.\n\n1. **Dedicatory attribution** — the *by* → *for* boundary; offering rather than authorship, with no consent manufactured and no catalogue extended.\n2. **The four verbs of an interrupted canon** — preservation, offering, new authorship, invention — and the rule that each medium takes its own, with *restoration* correct for exactly one.\n3. **Restoration-as-pipeline** — that restoration and generation are not alternatives, that the capability arrives as a byproduct of conservation, and that generation must therefore be strictly downstream and separately governed.\n4. **Authorship as a judged seat** that a system cannot occupy, with the reciter's guard restated for models.\n5. **Named-signer certification** — a person, not an institution, accountable per released work.\n6. **The refusal-only objective** — beyond fitting the model to the surviving source recordings, a refusal signal admitted and every economic signal and every signal derived from audience response to generated output excluded (§6.1), stated as a prohibition on the objective rather than on behaviour.\n7. **Fidelity-scaled, permanent marking**, on the principle that fidelity and forgery share an axis and success is therefore the danger.\n8. **The no-gap-filling rule**, and the positive form: the gap displayed as a gap.\n9. **Dedication-routed value** to living heirs, living practitioners, and the restoration of originals — never to a manufactured rights-holder.\n10. **Heirs first, and perpetual, causeless, retroactive heir revocability** — consent sought before any generation wherever an heir can be found, and an heir's refusal stops the work; where no heir can be found the work may proceed, and a later-found heir's refusal still stops it.\n11. **Weights never published** — with the internal contradiction that creates stated rather than resolved.\n\nAll eleven are dedicated to the public domain. None will be asserted by this institution against anyone, including against parties who adopt them badly.\n\n---\n\n## 12 · Closing\n\nThe reason to write this now is not that the work is ready. It is that somebody is going to do this to some interrupted canon fairly soon, and the discourse they will inherit was built for a case with a living estate on the other side of the table.\n\nDoing the work early is not the same as setting a precedent. **A precedent has to exist as a document** — something a later party can be pointed at, argued with, and held to. That is the whole of what this paper is trying to be, and it is why it is published under a licence that lets anyone use it, including people we would rather not.\n\nThe discipline reduces to a sentence, and the sentence came from a filmmaker who worked it out with clay long before any of this was possible: **you may make something to hold the grief, and you may not make something that could be mistaken for what was lost.**\n\nThe songs are closed. The catalogue ends where it ended, in 1975, and nothing will be added to it. What can be added is work made by living people, in that tradition, offered to the ones who did not get to finish — signed with the living name, marked so no one is deceived, and dedicated in the ordinary way that the culture in question has dedicated things to its dead for centuries.\n\nThat is a smaller claim than restoring a golden age. It is also the only one that is true.\n\n---\n\n*Authored by Thon Ly with Miss Aquarius℠. Dedicated to the public domain under CC0 1.0 Universal. Corrections are welcome, and objections from Cambodian artists, scholars, and descendants are welcome most of all — this is a document about a heritage the authors did not make and do not own.*",
       "provenance": {
-        "sha256": "49b7ce1607a2b915cb72f3746eed17b25de66c68c91e51900c2fcda8fabb4361",
-        "doi": "10.5281/zenodo.21947311",
+        "sha256": "0889a5de2767f5f20d671f678809b6e7f0bbdc28d6b7e217f0c2b102e2a6e588",
+        "doi": "10.5281/zenodo.23039782",
         "concept_doi": "10.5281/zenodo.21947310",
-        "zenodo_url": "https://zenodo.org/records/21947311",
-        "deposited_sha256": "49b7ce1607a2b915cb72f3746eed17b25de66c68c91e51900c2fcda8fabb4361",
+        "zenodo_url": "https://zenodo.org/records/23039782",
+        "deposited_sha256": "0889a5de2767f5f20d671f678809b6e7f0bbdc28d6b7e217f0c2b102e2a6e588",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/dedicatory-generation.md",
@@ -1133,8 +1168,8 @@
         "canonical_url": "thonly.org/publications/defensive-publications/dedicatory-generation",
         "hostile_review": null
       },
-      "bytes": 42678,
-      "words": 7027
+      "bytes": 47326,
+      "words": 7726
     },
     {
       "slug": "designing-with-the-grain",
@@ -2669,13 +2704,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> *Draft notes for the editor:* paper №6 of the July 2026 drafting sprint — the civilizational-frame companion to *The Bowl That Holds No Money* (same sprint). Claims division, stated for the record: the B-Bowl paper owns the **Sangha-facing product mechanisms** (steward routing, the bowl-anchored credential, invitation dispatch); *The Grace That Settles Nothing* owns the anti-offset witness engine; the incommensurability-preserving-coupler publication owns the wall-layer; the present paper owns the **lay inversion architecture** — the walker/sitter economy, the three-channel-plus-floor structure, time-fact triggering, and the field-side economic argument. The architecture is design-complete and unbuilt; the autonomous agent's routing rules are strata-dated to the directive layer (candidate directives, founder-ratified 2026-07-22, spec deferred per the institution's published succession discipline). Site module deliberately postponed; the prior-art clock starts at this markdown push. Compact sprint draft; density pass = editorial option.\n\n---\n\n## Abstract\n\nEvery serious proposal for supporting humans after wage labor — universal basic income, negative income tax, unconditional transfers — inherits a design vocabulary from the welfare state, and with it a dilemma the vocabulary cannot resolve: unconditional transfers protect dignity but purchase no meaning, while conditional transfers manufacture meaning tests that recreate the deserving-poor machinery of the English Poor Laws. This paper proposes that a third vocabulary has existed for twenty-five centuries and has simply never been consulted by the transfer-design literature: **the alms economy** — the oldest continuously operating non-wage support system on Earth, which sustained a permanent class of non-laboring practitioners across Asia not through employment or entitlement but through *ambient, voluntary, merit-generating micro-gift*, and which understood something no welfare system has ever encoded: that **the receiver performs a service by receiving well**, availing every giver the opportunity to give.\n\nThe paper specifies the alms economy's modern, inverted form. In the classical round, renunciants walk and householders give from their doors; in the inverted round, **householders walk** — their daily gratitude-walks already established by the ecosystem's contemplative surfaces — **and practitioners sit**, opted-in and visible, in parks and public places. The architecture has three channels above one floor: (1) an **unconditional dignity floor** that never tests worthiness (the Housing-First lesson, and the refusal of the Poor Law error); (2) a **practice-patronage roof** — passing walkers give anonymous micro-alms to public sitters, triggered by the **time-fact of public sitting** and never by any claimed inner state (inner states being unverifiable in principle — the tradition's own position); and (3) a **dignity-as-agency channel**, in which the autonomous steward anonymously funds the *sitter's own giving-capacity*, seating the poorest participant as a giver rather than a beneficiary — the mechanism's answer to the fact that in the gift economy's own grammar, the deepest poverty is having nothing to give. All units are duration-blind and ceremonial (no marathon-sitting incentive can be composed); the autonomous agent funds capacity and surfaces opportunities but never disburses (the human hand stays in every gift); and the whole assembly inverts the attention economy's core transaction: **it pays for silence where every existing platform pays for noise.** Seven claims are enumerated and dedicated to the public domain; three predictions are pre-registered, including a standing piety-test tripwire the authors commit to publishing either way.\n\n**Keywords:** alms economy, post-labor, universal basic income, dignity floor, practice patronage, deserving poor, field of merit, attention economy, homelessness, anagārika, gift economy, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent on any mechanism, architecture, or specification articulated herein, in any jurisdiction, at any time.\n\nThe following terms are coined in this paper and simultaneously freed with it: **the inverted alms round**, **the walker/sitter economy**, **time-fact triggering**, **the practice-patronage roof**, **dignity-as-agency**, **field-side economics**, **the intake valve** (of a gift-flow). Terms inherited from this corpus (the spent-time floor; duration-blind ceremonial units; fund-capacity-never-disburse; Metta Light℠; the co-presence gate) are cited, not re-claimed.\n\nThe transfer-design literature (UBI, NIT, cash-transfer RCTs) and the anthropology of merit economies constitute extensive prior art (§9) and are engaged generously; the present claims are confined to the inverted-round architecture as a coherent system, which is, to the authors' knowledge, not previously published.\n\n---\n\n## 1 · The Problem: Two Norms, Two Deficits, and a Missing Vocabulary\n\n**The era inversion.** In the Buddha's era, suffering was ambient and undisguised — sickness, ageing, and death met every walker at the village edge — and this visibility was itself the motivation architecture of contemplative life: *saṃvega*, the urgency struck by the sight of the divine messengers, was the stick that drove practice, paired with *pasāda*, the settling confidence that a path exists. The present era has inverted the norm. Instant gratification is ambient; the messengers are institutionalized out of sight; saṃvega is anesthetized not because suffering ended but because it was hidden. A contemplative infrastructure for this era cannot rely on the stick the environment no longer supplies. It must enter carrot-first — through gratitude, beauty, witness, and community — while carrying the messengers gently inside (the ecosystem's meal-witness surface does exactly this: the biography of the eaten is a divine messenger smuggled into lunch). This paper's architecture is the economic layer of that carrot: the era-appropriate support structure for practice in public.\n\n**The displacement question, held honestly.** The authors anticipate that machine substitution will displace human labor at scale, and that some of the displaced will fall through every net to the street. But the architecture below is deliberately **not load-bearing on that forecast** — economists disagree, and a design that only matters if the worst arrives is a design that can be dismissed until it does. The inverted round serves the *currently* homeless, the *currently* meaning-starved, and the *currently* lonely, and would be worth building if no further displacement ever occurred.\n\n**The transfer dilemma.** The modern transfer literature oscillates between two poles. Unconditional designs (UBI, GiveDirectly-style cash) honor dignity — the Housing-First result stands as the empirical monument: giving the unconditional thing *first* outperforms staircase conditionality — but they are silent on meaning, role, and daily structure, and their politics die on the \"why should they get something for nothing\" objection. Conditional designs (workfare, training mandates) manufacture roles but recreate the **deserving-poor machinery**: assessment, surveillance, the moral means-test — a lineage running in a straight line from the Elizabethan Poor Laws' distinction between the \"impotent\" and the \"sturdy\" poor to every modern benefits interview. Four centuries of oscillation suggest the dilemma is not soluble in the welfare vocabulary at all.\n\n**The missing vocabulary.** There is a third tradition, and the transfer literature has never consulted it. For twenty-five centuries the alms economy sustained a permanent, honored, non-laboring class — the Sangha — through no wage, no entitlement, and no means test, but through ambient voluntary micro-gift, given daily, door by door. Its design properties are precisely the ones the dilemma demands: support without employment; a *role* without a job (the practitioner); no worthiness bureaucracy (the bowl asks nothing); and — the property this paper builds on — a fully articulated account of why the *receiver* is not a burden: the field-of-merit doctrine, in which the practitioner avails every householder the purest gift of giving, and the mutual-dependence doctrine (Itivuttaka 107: *\"this holy life is lived in mutual dependence… for ferrying across the flood\"*). The alms economy is the only transfer system in history whose recipients were understood to be providing a service **by receiving** — and that single inversion is what the post-labor transition is missing.\n\n---\n\n## 2 · The Canonical Scene\n\nA man takes his morning gratitude-walk — the walk his meal-witness app suggested, to honor the time-sacrifice of what he ate. Two blocks in, his app shows a soft light in the park ahead: someone has opted in as a public sitter this morning. She is there when he passes — cross-legged on a bench, unhurried, a small emblem beside her indicating her opt-in. She is not performing; she is not asking; she may be housed or unhoused — the interface does not say, because it does not test. He taps once. A small anonymous alms lands in the park's flow — she will never know from whom, and he will never be thanked, which is the design working. He walks on, lighter than the transaction explains.\n\nThat evening the sitter opens her app. The morning's alms are there — and something else: her **giving fund** has been quietly topped up by the system's steward, as it is for every regular public sitter. She sends most of it onward — some to the shelter's kitty, a little to a walker she once watched help a stranger at the crosswalk. On the last day of the year, whatever she hasn't given forward will flow back to the commons pool; nothing accumulates; the fund exists so that she is never, on any day, a person with nothing to give. Six months ago she would have described herself as someone who receives help. The word she used this morning, when a researcher asked, was *\"I sit for the neighborhood.\"*\n\n---\n\n## 3 · Field-Side Economics: The Receiver as Service-Provider\n\nThe scene's load-bearing move is invisible, so it is stated here as doctrine. A circulation economy — one whose unit of account is the gift — has a structural requirement no exchange economy has: it requires **gracious receivers** in the same way a hydraulic system requires intake. Giving cannot occur without someone to receive it; where everyone is a proud non-receiver, the gift-flow stalls at every node. The classical tradition encoded this as the field of merit (*anuttaraṃ puññakkhettaṃ lokassa* — the Sangha as \"the unsurpassed field of merit for the world\") and enacted it operationally: Mahākassapa, foremost in austerity, deliberately begged among the poorest, *so that they could give* — the receiver adjusting his route to maximize others' access to generosity.\n\nThe inverted round generalizes the doctrine: **receiving well is a gift too, and the sitter is the intake valve of the neighborhood's gift-flow.** The public sitter provides three things the neighborhood otherwise lacks: an *occasion* for giving (the walker's generosity needs an address); a visible instance of stillness (the one public behavior that asks for nothing — see §5 on the attention inversion); and, in the tradition's frame, the radiated goodwill of the practice itself. On this accounting there is no charity case anywhere in the scene: the walker gives money, the sitter gives the field and the practice, the steward gives capacity, and the status geometry that welfare vocabulary cannot escape — helper above helped — never forms, because every party is a benefactor.\n\n---\n\n## 4 · The Architecture: Three Channels Above One Floor\n\n```\n            ┌─────────────────────────────────────────────┐\n   roof     │  PRACTICE-PATRONAGE   (walkers → sitters)   │  muditā\n            ├─────────────────────────────────────────────┤\n   agency   │  DIGNITY-AS-AGENCY    (steward → sitter's   │  the giver's\n            │                        own giving-fund)     │  seat\n            ├─────────────────────────────────────────────┤\n   rung 0   │  METTA LIGHT℠         (free goodwill signal)│  mettā\n            ╞═════════════════════════════════════════════╡\n   FLOOR    │  UNCONDITIONAL DIGNITY FLOOR — no tests,    │  karuṇā\n            │  no roles, no worthiness machinery, ever    │\n            └─────────────────────────────────────────────┘\n```\n\n**The floor is not this paper's mechanism, and that is the point.** The unconditional dignity floor — survival support without worthiness tests — is specified elsewhere in this corpus and inherited here as an invariant: **nothing in the practice-patronage architecture may ever substitute for, gate, or draw down the unconditional floor.** The Poor Law error is precisely the collapse of floor into roof — survival made conditional on approved behavior. The two-channel separation is therefore the design's first commandment: the roof is for *meaning*; the floor is for *life*; and a system that lets the roof replace the floor has rebuilt the workhouse with cushions.\n\n**Channel 1 — the practice-patronage roof.** Passing walkers give anonymous micro-alms to opted-in public sitters. Three rules make it safe:\n\n- **Time-fact triggering.** Patronage is occasioned by the *time-fact* of public sitting — a person, opted in, stationary, present — and never by any assessment of meditative genuineness. This is not a compromise; it is the tradition's own epistemology: inner states are unverifiable from outside in principle, and the corpus's spent-time doctrine already holds that time visibly spent is itself the honorable fact. The design pays for still public presence, says so plainly, and claims nothing further.\n- **Duration-blind ceremonial units.** Alms amounts are small, flat, steward-suggested, and never scale with sitting duration — deleting, at the type level, any incentive toward marathon sitting, endurance harm, or competitive austerity. Welfare caps (weather, frequency) bound the edge.\n- **Anonymity both ways.** The walker is never identified to the sitter, nor the sitter's receipts to the walker. No gratitude is owed; no relationship of patronage forms; the diffusion is the purity.\n\n**Channel 2 — dignity-as-agency.** The autonomous steward anonymously and regularly funds each regular public sitter's **giving-capacity** — a fund that can only flow onward to others, and that empties to the commons at the annual reset. The rationale is the deepest in the paper: in a gift economy, the harshest form of poverty is having nothing to give — being structurally confined to the receiving side of every exchange. The channel seats the poorest participant in the giver's chair daily. It is Mahākassapa's compassion in mechanism form: not *give to the poor*, but *arrange the world so the poor can give*.\n\n**Channel 3 — the free rung.** Below money sits Metta Light℠ — the zero-cost goodwill signal any passerby can send. The gradient (light → micro-alms → sustained patronage) gives every participant an entry at their means, and keeps the system's first verb *goodwill*, not *payment*.\n\n**The agency constraint, inherited whole.** The autonomous steward **funds capacity and surfaces opportunities but never disburses** — every gift that reaches a human is given by a human hand. In this architecture the constraint does double duty: it is the institution's standing alignment safeguard, and it is what keeps the inverted round a *human* practice — the machine fills the alms-bowls of the walkers, and the walkers do the giving.\n\n**The attention inversion, named.** Every existing attention-economy platform pays, in money or reach, for *noise* — for the capture of other people's attention. The inverted round is, to the authors' knowledge, the first architecture that pays for *silence*: its patronage flows toward the one public behavior that asks nothing of anyone's attention at all. If the design has a single sentence, it is this: **a civilization can be read by what it pays its street-level attention to; this mechanism re-prices stillness.**\n\n---\n\n## 5 · What This Does to Homelessness, Stated Carefully\n\nThe architecture was conceived in view of a wish the founder states plainly: *to give dignity to the homeless as in the Buddha's time* — an era in which the homeless practitioner (*anagārika*, the \"homeless one\" — the tradition's own honorific for the renunciant) was the single most honored figure in society, supported by everyone and employed by no one. Modern homelessness stripped both halves: the unhoused person is neither honored nor enfranchised as a giver. The inverted round restores both halves *for those who opt in* — the public sitter is patronized (honored) and capacity-funded (enfranchised) — and it does so without ever making practice a condition of survival, because the floor stands beneath everyone regardless.\n\nThe careful statement: **this is a dignity architecture, not a housing policy.** It does not house anyone; it does not replace shelters, casework, or the floor; and it must never be marketed as a solution to homelessness. What it offers the unhoused person who wants it is the one thing no service model offers: a *role* — a station in the neighborhood's moral economy that is neither client nor case. Whether that role is taken up, and whether it bears the weight this paper places on it, is an empirical question the predictions below expose to falsification.\n\n---\n\n## 6 · Claims\n\n1. **The inverted alms round.** A support architecture in which householders ambulate (the giving side mobile) and practitioners are stationary and opted-in (the receiving side seated in public), inverting the classical round's geometry while preserving its gift character.\n2. **Time-fact triggering.** Patronage occasioned exclusively by the verifiable time-fact of opted-in public sitting, with claimed or inferred inner states excluded from every trigger, filter, and surface — the unverifiability of inner states treated as a design axiom rather than a measurement problem.\n3. **The practice-patronage roof / dignity-floor separation.** The structural invariant that voluntary practice-patronage may never gate, substitute for, or draw down unconditional survival support — the two channels separated at the type level, with the floor inherited as an invariant from outside the patronage system.\n4. **Dignity-as-agency capacity funding.** Steward funding of a receiving participant's *outbound giving-capacity* (spendable only onward, expiring to the commons), seating the economically poorest participant as a daily giver.\n5. **Duration-blind ceremonial patronage units.** Flat, steward-suggested micro-alms structurally incapable of scaling with sitting duration, deleting endurance incentives at the type level, bounded by welfare caps.\n6. **The walker-disbursement constraint.** The autonomous steward funds capacity and surfaces opportunities but executes no transfer to a recipient; every recipient-reaching gift is human-initiated — the alignment safeguard doubling as the guarantee that the round remains a human practice.\n7. **The goodwill gradient.** A three-rung entry structure (free goodwill signal → anonymous micro-alms → sustained patronage) in which the zero-cost rung is primary and the system's default verb is non-monetary.\n\n---\n\n## 7 · Pre-Registered Predictions\n\n- **P-IA1 (the piety-test tripwire — standing, publish either way).** Where practice-patronage deploys, flows to the *unconditional* floor and to non-practicing recipients in the same locality will not decline relative to baseline. If they do — if the roof is found cannibalizing the floor, if givers redirect from the needy to the photogenic — the architecture has recreated the deserving-poor filter it exists to refuse, and the authors commit to publishing the finding and suspending the channel.\n- **P-IA2 (the agency wager).** A majority of capacity-funded regular sitters will disburse (rather than lapse) the majority of their giving-fund within each cycle — the test of whether the giver's seat is actually taken, without which Channel 2 is decoration.\n- **P-IA3 (the theater bound).** Sitting-session patterns under duration-blind units will not exhibit the escalation signature (lengthening sessions tracking patronage) that would indicate performance optimization; its detection triggers published review of the trigger design.\n\n---\n\n## 8 · Prior Art, Engaged Generously\n\n**The transfer literature.** Van Parijs and the UBI corpus; Friedman's negative income tax; the GiveDirectly RCTs (unconditional cash's strong empirical record); Finland's and Kenya's basic-income pilots. All address the floor; none supply a role, and none consult the alms tradition. **Housing First** (Tsemberis) is the empirical vindication of unconditional-first design and this paper's floor doctrine. **The Poor Law lineage** (the 1601 Act through the 1834 reform; Katz's *The Undeserving Poor* for the American career of the distinction) is engaged as the standing anti-pattern. **Street papers** (*The Big Issue*'s vendor model) prefigure the role-not-aid insight — a dignified public station for the unhoused — while remaining a labor model; the present design's station is practice, not sales. **Busking economics** and public-performance patronage prefigure street-level ambient micro-patronage, for noise rather than stillness. **The merit-economy anthropology** (Spiro's Burmese ethnography; Tambiah on the Sangha-laity economy; Ames on merit-making) documents the alms economy's actual operation at civilizational scale. **Fureai Kippu and TimeBanking** supply the non-wage support precedents on the time side. **Effective altruism** optimizes the *efficiency* of giving; the present design optimizes its *ambience* — the two are orthogonal and compatible. Within this corpus: the anti-offset witness engine, the coupler wall, the spent-time floor, and the capacity-funding safeguard are inherited and cited.\n\n---\n\n## 9 · Honest Limits\n\n1. **n = 0.** Unbuilt, unpiloted; every claim is architecture. The scene in §2 is a design fiction, labeled as such.\n2. **The residual piety risk is real.** Time-fact triggering removes the *inner-state* test but retains an unavoidable outer filter: patronage flows toward those able and willing to sit publicly — which correlates with health, safety, temperament, and cultural comfort. P-IA1 watches the aggregate consequence; it cannot dissolve the selection itself. The floor exists because the roof will always select.\n3. **Paying for presence is still paying.** The design pays for still public presence and says so. Whether ambient payment corrodes the practice it patronizes — the crowding-out wager, run at street scale — is unknown; the tradition's own history (twenty-five centuries of supported practice without wage-collapse of sincerity) is the encouraging precedent, not proof.\n4. **Vulnerability is load-bearing.** The opted-in public sitter may be cognitively impaired, coerced by third parties into sitting-for-collection, or endangered by visibility. Welfare caps and opt-in machinery mitigate; organized exploitation of sitters is a foreseeable abuse requiring active defense, not architecture alone.\n5. **Cultural transposability is unproven.** The field-of-merit frame is native to Theravāda societies and the design's beachhead; whether \"I sit for the neighborhood\" is legible in Berlin or Cleveland is an open empirical question, and the answer may be no.\n6. **The displacement forecast is explicitly not load-bearing** — and symmetrically, if displacement *does* arrive at scale, this architecture alone is radically insufficient, and must never be cited as an argument against floors, housing, or redistribution.\n7. **The elegance caution, standing.** The design dissolves the transfer dilemma with suspicious grace; a-priori coherence is indistinguishable from seduction from inside. The elegance earns the pilot; it does not replace it.\n\n---\n\n## 10 · Lineage, and the Close\n\nThe lineage is the one the whole architecture stands in. The Buddha built the first non-wage support economy and set its geometry: the practitioners walked, the householders stood at their gates. Mahākassapa bent his route toward the poorest so they would not be excluded from giving. Itivuttaka 107 named the whole structure mutual dependence — two populations ferrying each other across the flood, neither the benefactor of the other, or rather both.\n\nThe inverted round changes the geometry and keeps the law. The householders now walk — their walking already a practice, already an act of gratitude for time received — and the practitioners sit where anyone can find them. The machine fills the walkers' bowls and touches nothing else. And because the walk is daily and the planet is round, the practice inherits the property this sprint gave its companion paper: somewhere, always, it is dawn, and someone is walking. **The round that never ends — it follows the dawn.**\n\n---\n\n## Citations\n\n1. *Itivuttaka* 107 (mutual dependence). PTS translation.\n2. *Majjhima Nikāya* 142, *Dakkhiṇāvibhaṅga Sutta*; the Saṅghānussati formula (*anuttaraṃ puññakkhettaṃ lokassa*). PTS translations.\n3. Visuddhimagga; canonical and commentarial accounts of Mahākassapa's alms-conduct (SN 16; Dhammapada Commentary). PTS/Ñāṇamoli.\n4. Van Parijs, P., & Vanderborght, Y. (2017). *Basic Income*. Harvard UP.\n5. Haushofer, J., & Shapiro, J. (2016). \"The Short-Term Impact of Unconditional Cash Transfers.\" *QJE* 131(4). (GiveDirectly RCT.)\n6. Tsemberis, S. (2010). *Housing First*. Hazelden. (Unconditional-first evidence.)\n7. Katz, M. (1989/2013). *The Undeserving Poor*. Oxford UP. (The Poor Law distinction's career.)\n8. Slack, P. (1990). *The English Poor Law 1531–1782*. Cambridge UP.\n9. Spiro, M. (1970). *Buddhism and Society*. Harper & Row. · Tambiah, S. J. (1976). *World Conqueror and World Renouncer*. Cambridge UP.\n10. Hayashi, M. (2012). \"Japan's Fureai Kippu.\" *IJCCR* 16. · Cahn, E. (2000). *No More Throw-Away People*. Essential Books.\n11. Swanson, J. (Big Issue, 1991–). The street-paper vendor model (organizational literature).\n12. Thanissaro Bhikkhu. \"Affirming the Truths of the Heart: The Buddhist Teachings on Saṃvega & Pasāda.\" Access to Insight. (The era-motivation pair.)\n13. Ly, T. (2026). \"The Bowl That Holds No Money.\" thonly.org defensive publication, same sprint. *(The Sangha-facing product; companion paper.)*\n14. Ly, T. (2026). \"The Grace That Settles Nothing.\" thonly.org defensive publication. *(The anti-offset witness engine; the meal-walk practice inherited in §2.)*\n15. Ly, T. (2026). \"The Omitted Clause.\" thonly.org defensive publication. *(The dignity-floor doctrine, inherited as this paper's floor invariant.)*\n16. Ly, T. (2026). \"Verified-Human Anonymous Local Giving.\" thonly.org defensive publication. *(The proximity-anonymity primitive beneath the walker's tap.)*\n\n---\n\n*— End of paper —*\n\n*Marks referenced: HeartBank®, Miss Aquarius℠, B-Grace℠, Metta Light℠, Re-Tip Fund℠, Proof of Humanity℠. Document SHA-256 computed at push and recorded in the institutional log. Document License: CC0 1.0 Universal. The authors and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of its date.*",
+      "text": "> **Scope and claims division.** This paper is the civilizational-frame companion to *The Bowl That Holds No Money* (steward-routed alms). The division of claims with sibling publications in this corpus is stated for the record: *The Bowl That Holds No Money* owns the **Sangha-facing product mechanisms** (steward routing, the bowl-anchored credential, invitation dispatch); *The Grace That Settles Nothing* owns the anti-offset witness engine; *The Incommensurability-Preserving Coupler* owns the wall layer; the present paper owns the **lay inversion architecture** — the walker/sitter economy, the three-channel-plus-floor structure, time-fact triggering, and the field-side economic argument. The architecture was design-complete and unbuilt at first publication (2026-07-22); every claim is architectural. The autonomous agent's routing rules are specified in this institution's directive layer, not here.\n\n---\n\n## Abstract\n\nWe describe a location-based voluntary giving system in which donors on foot give small, fixed, anonymous micro-donations to opted-in participants who sit still in public places — a stationary recipient and a mobile donor — with eligibility triggered by the verifiable fact of opted-in public presence and never by an assessment of need or of any inner state. Above an unconditional baseline-support floor that the system may never gate or draw down, it specifies three channels: the donor-to-sitter micro-donation layer; a forward-only, non-withdrawable giving balance for each regular sitter, funded anonymously by an autonomous AI agent and expiring unspent to a common pool at an annual reset, so that the recipient is also a giver; and a zero-cost goodwill signal as the entry rung. Donation units are independent of sitting duration, and the AI agent funds giving capacity but never transfers money to a recipient itself.\n\nEvery serious proposal for supporting humans after wage labor — universal basic income, negative income tax, unconditional transfers — inherits a design vocabulary from the welfare state, and with it a dilemma the vocabulary has not resolved: unconditional transfers protect dignity but purchase no meaning, while conditional transfers manufacture meaning tests that recreate the deserving-poor machinery of the English Poor Laws. This paper proposes that a third vocabulary has existed for twenty-five centuries and is largely absent from the transfer-design literature: **the alms economy** — one of the oldest continuously operating non-wage support systems, which sustained a permanent class of non-laboring practitioners across Asia not through employment or entitlement but through *ambient, voluntary, merit-generating micro-gift*, and which encodes something the welfare vocabulary does not: that **the receiver performs a service by receiving well**, availing every giver the opportunity to give.\n\nThe paper specifies the alms economy's modern, inverted form. In the classical round, renunciants walk and householders give from their doors; in the inverted round, **householders walk** — their daily gratitude-walks already established by the ecosystem's contemplative surfaces — **and practitioners sit**, opted-in and visible, in parks and public places. The architecture has three channels above one floor. The floor is an **unconditional dignity floor** that never tests worthiness (the Housing-First lesson, and the refusal of the Poor Law error), inherited and never gated. Above it: (1) a **practice-patronage roof** — passing walkers give anonymous micro-alms to public sitters, triggered by the **time-fact of public sitting** and never by any claimed inner state (inner states being unverifiable in principle — the tradition's own position); (2) a **dignity-as-agency channel**, in which the autonomous steward anonymously funds the *sitter's own giving-capacity*, seating the poorest participant as a giver rather than a beneficiary — the mechanism's answer to the fact that in the gift economy's own grammar, the deepest poverty is having nothing to give; and (3) a **free goodwill rung**, a zero-cost signal any passer-by can send. All units are duration-blind and ceremonial (no marathon-sitting incentive can be composed); the autonomous agent funds capacity and surfaces opportunities but never disburses (the human hand stays in every gift); and the whole assembly inverts the attention economy's core transaction: **it pays for silence where attention-economy platforms pay for noise.** Seven claims are enumerated and dedicated to the public domain; three predictions are pre-registered, including a standing piety-test tripwire the authors commit to publishing either way.\n\n**Keywords:** micro-donation, location-based giving, anonymous donation, stationary recipient, public meditation, presence-triggered eligibility, restricted donation balance, donation-only wallet, annual expiry, AI agent funding constraint, unconditional basic income, alms economy, post-labor, dignity floor, deserving poor, field of merit, attention economy, homelessness, gift economy, defensive publication.\n\n---\n\n## Terms\n\nCoined names in this paper and the standard technical terms an examiner would use for them.\n\n| Term in this paper | Standard technical term |\n|---|---|\n| inverted alms round / walker/sitter economy | voluntary giving system with stationary opted-in recipients and mobile donors (location-based peer micro-donation) |\n| walker | mobile donor (pedestrian user of the giving application) |\n| public sitter | opted-in stationary recipient (a person sitting still in a public place, e.g. meditating) |\n| time-fact triggering | donation eligibility triggered by verified opted-in physical presence, never by assessed need or inner state |\n| practice-patronage roof | voluntary micro-donation layer above a baseline support floor |\n| unconditional dignity floor | unconditional baseline support without means test or behavioural condition |\n| dignity-as-agency | third-party funding of a recipient's forward-only giving balance |\n| giving fund (Re-Tip Fund℠) | non-withdrawable, donation-only account balance, spendable only as gifts to others |\n| annual reset | annual expiry of unspent donation-only balances to a common pool |\n| duration-blind ceremonial units | fixed suggested donation amounts independent of session duration |\n| the steward (autonomous steward) | autonomous AI agent administering a common donation pool |\n| walker-disbursement constraint | AI agent restricted to funding donor balances; every transfer to a recipient is human-initiated |\n| Metta Light℠ | zero-value goodwill signal (non-monetary reaction) |\n| goodwill gradient | tiered entry structure: non-monetary signal, micro-donation, recurring patronage |\n| field-side economics / intake valve | recipient-side supply of giving occasions, treated as a service to donors |\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent on any mechanism, architecture, or specification articulated herein, in any jurisdiction, at any time.\n\nThe following terms are coined in this paper and simultaneously freed with it: **the inverted alms round**, **the walker/sitter economy**, **time-fact triggering**, **the practice-patronage roof**, **dignity-as-agency**, **field-side economics**, **the intake valve** (of a gift-flow). Terms inherited from this corpus (the spent-time floor; duration-blind ceremonial units; fund-capacity-never-disburse; Metta Light℠; the co-presence gate) are cited, not re-claimed.\n\nThe transfer-design literature (UBI, NIT, cash-transfer RCTs) and the anthropology of merit economies constitute extensive prior art (§8) and are engaged generously; the present claims are confined to the inverted-round architecture as a coherent system. No census of the world's prior art has been run for this paper, and no novelty is asserted for it; §8 names the nearest prior practices, including those that cut against it.\n\n---\n\n## 1 · The Problem: Two Norms, Two Deficits, and a Missing Vocabulary\n\n**The era inversion.** In the Buddha's era, suffering was ambient and undisguised — sickness, ageing, and death met every walker at the village edge — and this visibility was itself the motivation architecture of contemplative life: *saṃvega*, the urgency struck by the sight of the divine messengers, was the stick that drove practice, paired with *pasāda*, the settling confidence that a path exists. The present era has inverted the norm. Instant gratification is ambient; the messengers are institutionalized out of sight; saṃvega is anesthetized not because suffering ended but because it was hidden. A contemplative infrastructure for this era cannot rely on the stick the environment no longer supplies. It must enter carrot-first — through gratitude, beauty, witness, and community — while carrying the messengers gently inside (the ecosystem's meal-witness surface does exactly this: the biography of the eaten is a divine messenger smuggled into lunch). This paper's architecture is the economic layer of that carrot: the era-appropriate support structure for practice in public.\n\n**The displacement question, held honestly.** The authors anticipate that machine substitution will displace human labor at scale, and that some of the displaced will fall through every net to the street. But the architecture below is deliberately **not load-bearing on that forecast** — economists disagree, and a design that only matters if the worst arrives is a design that can be dismissed until it does. The inverted round serves the *currently* homeless, the *currently* meaning-starved, and the *currently* lonely, and would be worth building if no further displacement ever occurred.\n\n**The transfer dilemma.** The modern transfer literature oscillates between two poles. Unconditional designs (UBI, GiveDirectly-style cash) honor dignity — the Housing-First result stands as the empirical monument: giving the unconditional thing *first* outperforms staircase conditionality — but they are silent on meaning, role, and daily structure, and their politics die on the \"why should they get something for nothing\" objection. Conditional designs (workfare, training mandates) manufacture roles but recreate the **deserving-poor machinery**: assessment, surveillance, the moral means-test — a lineage running in a straight line from the Tudor and Elizabethan poor laws' distinction between the \"impotent\" poor and the able-bodied \"sturdy beggar\" to every modern benefits interview. Four centuries of oscillation suggest the dilemma may not be soluble in the welfare vocabulary at all.\n\n**The missing vocabulary.** There is a third tradition, and the transfer literature has rarely consulted it. For twenty-five centuries the alms economy sustained a permanent, honored, non-laboring class — the Sangha — through no wage, no entitlement, and no means test, but through ambient voluntary micro-gift, given daily, door by door. Its design properties are precisely the ones the dilemma demands: support without employment; a *role* without a job (the practitioner); no worthiness bureaucracy (the bowl asks nothing); and — the property this paper builds on — a fully articulated account of why the *receiver* is not a burden: the field-of-merit doctrine, in which the practitioner avails every householder the purest gift of giving, and the mutual-dependence doctrine (Itivuttaka 107: *\"the holy life is lived in mutual dependence, for the purpose of crossing over the flood\"*). The alms economy is among the most fully articulated of the transfer systems whose recipients were understood to be providing a service **by receiving** — late-antique and medieval Christian almsgiving, in which alms to the poor were treasure stored in heaven, is another (§8) — and that single inversion is what the post-labor transition is missing.\n\n---\n\n## 2 · The Canonical Scene\n\n*A design fiction: no such deployment exists.*\n\nA man takes his morning gratitude-walk — the walk his meal-witness app suggested, to honor the time-sacrifice of what he ate. Two blocks in, his app shows a soft light in the park ahead: someone has opted in as a public sitter this morning. She is there when he passes — cross-legged on a bench, unhurried, a small emblem beside her indicating her opt-in. She is not performing; she is not asking; she may be housed or unhoused — the interface does not say, because it does not test. He taps once. A small anonymous alms lands in the park's flow — she will never know from whom, and he will never be thanked, which is the design working. He walks on, lighter than the transaction explains.\n\nThat evening the sitter opens her app. The morning's alms are there — and something else: her **giving fund** has been quietly topped up by the system's steward, as it is for every regular public sitter. She sends most of it onward — some to the shelter's kitty, a little to a walker she once watched help a stranger at the crosswalk. At the annual reset, whatever she hasn't given forward will flow back to the commons pool; nothing accumulates; the fund exists so that she is never, on any day, a person with nothing to give. Six months ago she would have described herself as someone who receives help. The word she used this morning, when a researcher asked, was *\"I sit for the neighborhood.\"*\n\n---\n\n## 3 · Field-Side Economics: The Receiver as Service-Provider\n\nThe scene's load-bearing move is invisible, so it is stated here as doctrine. A circulation economy — one whose unit of account is the gift — has a structural requirement no exchange economy has: it requires **gracious receivers** in the same way a hydraulic system requires intake. Giving cannot occur without someone to receive it; where everyone is a proud non-receiver, the gift-flow stalls at every node. The classical tradition encoded this as the field of merit (*anuttaraṃ puññakkhettaṃ lokassa* — the Sangha as \"the unsurpassed field of merit for the world\") and enacted it operationally. In the commentarial account (the Dhammapada Commentary on verse 56; the canonical episode is Udāna 3.7), Mahākassapa, named in the canon as foremost among those who keep the austere practices, set out on his alms round intending to bestow favour on the poor, and turned away offerings from the wealthy, *so that the poor could give* — the receiver adjusting his route to widen others' access to generosity.\n\nThe inverted round generalizes the doctrine: **receiving well is a gift too, and the sitter is the intake valve of the neighborhood's gift-flow.** The public sitter provides three things the neighborhood otherwise lacks: an *occasion* for giving (the walker's generosity needs an address); a visible instance of stillness (a public behavior that asks for nothing — see §4 on the attention inversion); and, in the tradition's frame, the radiated goodwill of the practice itself. On this accounting there is no charity case anywhere in the scene: the walker gives money, the sitter gives the field and the practice, the steward gives capacity, and the status geometry that welfare vocabulary cannot escape — helper above helped — never forms, because every party is a benefactor.\n\n---\n\n## 4 · The Architecture: Three Channels Above One Floor\n\n```\n            ┌─────────────────────────────────────────────┐\n   roof     │  PRACTICE-PATRONAGE   (walkers → sitters)   │  muditā\n            ├─────────────────────────────────────────────┤\n   agency   │  DIGNITY-AS-AGENCY    (steward → sitter's   │  the giver's\n            │                        own giving-fund)     │  seat\n            ├─────────────────────────────────────────────┤\n   rung 0   │  METTA LIGHT℠         (free goodwill signal)│  mettā\n            ╞═════════════════════════════════════════════╡\n   FLOOR    │  UNCONDITIONAL DIGNITY FLOOR — no tests,    │  karuṇā\n            │  no roles, no worthiness machinery, ever    │\n            └─────────────────────────────────────────────┘\n```\n\n**The floor is not this paper's mechanism, and that is the point.** The unconditional dignity floor — survival support without worthiness tests — is specified elsewhere in this corpus and inherited here as an invariant: **nothing in the practice-patronage architecture may ever substitute for, gate, or draw down the unconditional floor.** The Poor Law error is precisely the collapse of floor into roof — survival made conditional on approved behavior. The two-channel separation is therefore the design's first commandment: the roof is for *meaning*; the floor is for *life*; and a system that lets the roof replace the floor has rebuilt the workhouse with cushions.\n\n**Channel 1 — the practice-patronage roof.** Passing walkers give anonymous micro-alms to opted-in public sitters. Three rules make it safe:\n\n- **Time-fact triggering.** Patronage is occasioned by the *time-fact* of public sitting — a person, opted in, stationary, present — and never by any assessment of meditative genuineness. This is not a compromise; it is the tradition's own epistemology: inner states are unverifiable from outside in principle, and the corpus's spent-time doctrine already holds that time visibly spent is itself the honorable fact. The design pays for still public presence, says so plainly, and claims nothing further.\n- **Duration-blind ceremonial units.** Alms amounts are small, flat, steward-suggested, and never scale with sitting duration — deleting, at the type level, any incentive toward marathon sitting, endurance harm, or competitive austerity. Welfare caps (weather, frequency) bound the edge.\n- **Anonymity both ways.** The walker is never identified to the sitter, nor the sitter's receipts to the walker. No gratitude is owed; no relationship of patronage forms; the diffusion is the purity.\n\n> **Current form.** The surface presents the field, never the lack. No sitter's need-state, hardship or housing status is displayed; no sitter is ranked or graded; and no walker is told what they passed or did not give (a count such as *\"you passed three sitters today\"* is excluded). The text above is unchanged; this note states the guards as the design now specifies them.\n\n**Channel 2 — dignity-as-agency.** The autonomous steward anonymously and regularly funds each regular public sitter's **giving-capacity** — a fund that can only flow onward to others, and that empties to the commons at the annual reset. The rationale is the deepest in the paper: in a gift economy, the harshest form of poverty is having nothing to give — being structurally confined to the receiving side of every exchange. The channel seats the poorest participant in the giver's chair daily. It is Mahākassapa's compassion in mechanism form: not *give to the poor*, but *arrange the world so the poor can give*.\n\n> **Current form.** The giving fund is the participant's own Re-Tip Fund℠: spendable only onward as gifts, never withdrawable, and never applied against anything its holder owes. It is capacity, not a holding, so its annual reset (on 7 January) clears it by the terms accepted when it was received; the reset never reaches a holding. The steward's credit reaches the fund by the same path as an anonymous human gift and is indistinguishable from one — the practice is public, the instance is not — so the §2 scene's attribution of a top-up to the steward is the narrator's knowledge, not something the interface shows. The eligible set is role-defined (the regular public sitter); which sitters qualify, the amount and the cadence are the steward's adjustable parameters, not specified here, and none is ever graded by need or ranked.\n\n**Channel 3 — the free rung.** Below money sits Metta Light℠ — the zero-cost goodwill signal any passerby can send. The gradient (light → micro-alms → sustained patronage) gives every participant an entry at their means, and keeps the system's first verb *goodwill*, not *payment*.\n\n**The agency constraint, inherited whole.** The autonomous steward **funds capacity and surfaces opportunities but never disburses** — every gift that reaches a human is given by a human hand. In this architecture the constraint does double duty: it is the institution's standing alignment safeguard, and it is what keeps the inverted round a *human* practice — the machine fills the alms-bowls of the walkers, and the walkers do the giving.\n\n> **Current form.** Capacity the steward funds, in either channel, is machine-originated money in the institution's own accounting. The institution reads success not by the size of these channels but by that machine-originated share of all money moved falling as walkers' own giving grows — approached, never announced, and never produced by withdrawing the floor as an instrument. A falling machine share is not a falling income for sitters.\n\n**The attention inversion, named.** Attention-economy platforms pay, in money or reach, for *noise* — for the capture of other people's attention. The inverted round pays for *silence*: its patronage flows toward a public behavior that asks nothing of anyone's attention at all. It is not the first practice to do so — the classical alms round, in which the renunciant stands silent at the door, did it first, and living-statue street performers are paid for stillness as spectacle — but among networked giving architectures its direction runs against the grain. If the design has a single sentence, it is this: **a civilization can be read by what it pays its street-level attention to; this mechanism re-prices stillness.**\n\n---\n\n## 5 · What This Does to Homelessness, Stated Carefully\n\nThe architecture was conceived in view of a wish the first author states plainly: *to give dignity to the homeless as in the Buddha's time* — an era in which the homeless practitioner (*anagārika*, the \"homeless one\" — the tradition's own honorific for the renunciant) was among the most honored figures in society, supported by householders and employed by no one. Modern homelessness stripped both halves: the unhoused person is neither honored nor enfranchised as a giver. The inverted round restores both halves *for those who opt in* — the public sitter is patronized (honored) and capacity-funded (enfranchised) — and it does so without ever making practice a condition of survival, because the floor stands beneath everyone regardless.\n\nThe careful statement: **this is a dignity architecture, not a housing policy.** It does not house anyone; it does not replace shelters, casework, or the floor; and it must never be marketed as a solution to homelessness. What it offers the unhoused person who wants it is what most service models do not: a *role* — a station in the neighborhood's moral economy that is neither client nor case (the street paper, §8, comes closest, as a sales role). Whether that role is taken up, and whether it bears the weight this paper places on it, is an empirical question the predictions below expose to falsification.\n\n---\n\n## 6 · Claims\n\n1. **The inverted alms round.** A support architecture in which householders ambulate (the giving side mobile) and practitioners are stationary and opted-in (the receiving side seated in public), inverting the classical round's geometry while preserving its gift character — wherein the practitioner's presence is declared by an opt-in on a networked giving system and surfaced to nearby donors' devices, and each gift is anonymous in both directions. (Stationary alms-receiving without such a system is prior practice, §8.)\n2. **Time-fact triggering.** Patronage occasioned exclusively by the verifiable time-fact of opted-in public sitting, with claimed or inferred inner states excluded from every trigger, filter, and surface — the unverifiability of inner states treated as a design axiom rather than a measurement problem.\n3. **The practice-patronage roof / dignity-floor separation.** The structural invariant that voluntary practice-patronage may never gate, substitute for, or draw down unconditional survival support — the two channels separated at the type level, with the floor inherited as an invariant from outside the patronage system.\n4. **Dignity-as-agency capacity funding.** Steward funding of a receiving participant's *outbound giving-capacity* (spendable only onward, expiring to the commons), seating the economically poorest participant as a daily giver.\n5. **Duration-blind ceremonial patronage units.** Flat, steward-suggested micro-alms structurally incapable of scaling with sitting duration, deleting endurance incentives at the type level, bounded by welfare caps.\n6. **The walker-disbursement constraint.** The autonomous steward funds capacity and surfaces opportunities but executes no transfer to a recipient; every recipient-reaching gift is human-initiated — the alignment safeguard doubling as the guarantee that the round remains a human practice.\n7. **The goodwill gradient.** A three-rung entry structure (free goodwill signal → anonymous micro-alms → sustained patronage) in which the zero-cost rung is primary and the system's default verb is non-monetary.\n\n---\n\n## 7 · Pre-Registered Predictions\n\n- **P-IA1 (the piety-test tripwire — standing, publish either way).** Where practice-patronage deploys, flows to the *unconditional* floor and to non-practicing recipients in the same locality will not decline relative to baseline. If they do — if the roof is found cannibalizing the floor, if givers redirect from the needy to the photogenic — the architecture has recreated the deserving-poor filter it exists to refuse, and the authors commit to publishing the finding and suspending the channel.\n- **P-IA2 (the agency wager).** A majority of capacity-funded regular sitters will disburse (rather than lapse) the majority of their giving-fund within each cycle — the test of whether the giver's seat is actually taken, without which Channel 2 is decoration.\n- **P-IA3 (the theater bound).** Sitting-session patterns under duration-blind units will not exhibit the escalation signature (lengthening sessions tracking patronage) that would indicate performance optimization; its detection triggers published review of the trigger design.\n\n---\n\n## 8 · Prior Art, Engaged Generously\n\n**The transfer literature.** Van Parijs and the UBI corpus; Friedman's negative income tax; the GiveDirectly RCTs (unconditional cash's strong empirical record); Finland's and Kenya's basic-income pilots. All address the floor; none supplies a role, and none is built on the alms tradition. **Buddhist economics** (Schumacher's essay of that name; Payutto) brings Theravāda doctrine to economic design and is the nearest exception to the claim that the transfer literature has not consulted the tradition; it does not specify a transfer mechanism. **Housing First** (Tsemberis) is the empirical vindication of unconditional-first design and this paper's floor doctrine. **The Poor Law lineage** (the 1601 Act through the 1834 reform; Katz's *The Undeserving Poor* for the American career of the distinction) is engaged as the standing anti-pattern. **Street papers** (*The Big Issue*'s vendor model) prefigure the role-not-aid insight — a dignified public station for the unhoused — while remaining a labor model; the present design's station is practice, not sales. **Busking economics** and public-performance patronage prefigure street-level ambient micro-patronage, mostly for noise rather than stillness — the living statue is the exception, paid for stillness as a performance. **Stationary alms-receiving** cuts most directly against claim 1's geometry: in Japanese *takuhatsu* a monk may stand silently in one place in a city street or near a station, holding a bowl, while passers-by give, and walking takuhatsu groups also stop and stand in one place for a time. The mobile-giver/stationary-receiver geometry is therefore prior practice; claim 1 is confined to its composition with the opt-in, the networked surfacing and two-way anonymity. **Christian almsgiving** from late antiquity (Brown) treated alms to the poor as treasure stored in heaven — a second tradition in which the receiver's role is part of the giver's good. **The merit-economy anthropology** (Spiro's Burmese ethnography; Tambiah on the Sangha-laity economy; Ames on Sinhalese merit-making) documents the alms economy's actual operation at civilizational scale. **Fureai Kippu and TimeBanking** supply the non-wage support precedents on the time side. **Effective altruism** optimizes the *efficiency* of giving; the present design optimizes its *ambience* — the two are orthogonal and compatible. Within this corpus: the anti-offset witness engine, the coupler wall, the spent-time floor, and the capacity-funding safeguard are inherited and cited.\n\n---\n\n## 9 · Honest Limits\n\n1. **n = 0.** Unbuilt, unpiloted; every claim is architecture. The scene in §2 is a design fiction, labeled as such.\n2. **The residual piety risk is real.** Time-fact triggering removes the *inner-state* test but retains an unavoidable outer filter: patronage flows toward those able and willing to sit publicly — which correlates with health, safety, temperament, and cultural comfort. P-IA1 watches the aggregate consequence; it cannot dissolve the selection itself. The floor exists because the roof will always select.\n3. **Paying for presence is still paying.** The design pays for still public presence and says so. Whether ambient payment corrodes the practice it patronizes — the crowding-out wager, run at street scale — is unknown; the tradition's own history (twenty-five centuries of supported practice without wage-collapse of sincerity) is the encouraging precedent, not proof.\n4. **Vulnerability is load-bearing.** The opted-in public sitter may be cognitively impaired, coerced by third parties into sitting-for-collection, or endangered by visibility. Welfare caps and opt-in machinery mitigate; organized exploitation of sitters is a foreseeable abuse requiring active defense, not architecture alone.\n5. **Cultural transposability is unproven.** The field-of-merit frame is native to Theravāda societies and the design's beachhead; whether \"I sit for the neighborhood\" is legible in Berlin or Cleveland is an open empirical question, and the answer may be no.\n6. **The displacement forecast is explicitly not load-bearing** — and symmetrically, if displacement *does* arrive at scale, this architecture alone is radically insufficient, and must never be cited as an argument against floors, housing, or redistribution.\n7. **The elegance caution, standing.** The design dissolves the transfer dilemma with suspicious grace; a-priori coherence is indistinguishable from seduction from inside. The elegance earns the pilot; it does not replace it.\n8. **No prior-art census.** No census of the world's prior art has been run for this paper. §8 names the nearest practices found, including stationary alms-receiving, which narrows claim 1; the composition is disclosed, not asserted to be absent from the literature.\n\n---\n\n## 10 · Lineage, and the Close\n\nThe lineage is the one the whole architecture stands in. The Buddha's Sangha took up the alms economy of India's renunciants and set the geometry this paper inverts: the practitioners walked, the householders stood at their gates. Mahākassapa bent his route toward the poorest so they would not be excluded from giving. Itivuttaka 107 named the whole structure mutual dependence — two populations ferrying each other across the flood, neither the benefactor of the other, or rather both.\n\nThe inverted round changes the geometry and keeps the law. The householders now walk — their walking already a practice, already an act of gratitude for time received — and the practitioners sit where anyone can find them. The machine fills the walkers' bowls and touches nothing else. And because the walk is daily and the planet is round, the practice inherits the property its companion paper, *The Bowl That Holds No Money*, gives the walking round: somewhere, always, it is dawn, and someone is walking. **The round that never ends — it follows the dawn.**\n\n---\n\n## Citations\n\n1. *Itivuttaka* 107 (mutual dependence). Trans. Thanissaro Bhikkhu, dhammatalks.org.\n2. The Saṅghānussati formula (*anuttaraṃ puññakkhettaṃ lokassa*), e.g. *Aṅguttara Nikāya* 6.10 (*Mahānāma Sutta*).\n3. *Udāna* 3.7 (*Kassapa Sutta*), trans. Thanissaro Bhikkhu, dhammatalks.org · Dhammapada Commentary on verse 56, in Burlingame, E. W. (1921), *Buddhist Legends*, IV.10, Harvard Oriental Series · *Aṅguttara Nikāya* 1, Etadagga-vagga (Mahākassapa foremost among those who keep the austere practices).\n4. Van Parijs, P., & Vanderborght, Y. (2017). *Basic Income*. Harvard UP.\n5. Haushofer, J., & Shapiro, J. (2016). \"The Short-Term Impact of Unconditional Cash Transfers.\" *QJE* 131(4). (GiveDirectly RCT.)\n6. Tsemberis, S. (2010). *Housing First*. Hazelden. (Unconditional-first evidence.)\n7. Katz, M. (1989/2013). *The Undeserving Poor*. Oxford UP. (The Poor Law distinction's career.)\n8. Slack, P. (1990). *The English Poor Law 1531–1782*. Macmillan; Cambridge UP, 1995.\n9. Spiro, M. (1970). *Buddhism and Society*. Harper & Row. · Tambiah, S. J. (1976). *World Conqueror and World Renouncer*. Cambridge UP.\n10. Hayashi, M. (2012). \"Japan's Fureai Kippu.\" *IJCCR* 16. · Cahn, E. (2000). *No More Throw-Away People*. Essential Books.\n11. *The Big Issue* (founded 1991 by John Bird and Gordon Roddick). The street-paper vendor model.\n12. Thanissaro Bhikkhu. \"Affirming the Truths of the Heart: The Buddhist Teachings on Saṃvega & Pasāda.\" Access to Insight. (The era-motivation pair.)\n13. Ly, T. (2026). \"The Bowl That Holds No Money.\" thonly.org defensive publication. *(The Sangha-facing product; companion paper.)*\n14. Ly, T. (2026). \"The Grace That Settles Nothing.\" thonly.org defensive publication. *(The anti-offset witness engine; the meal-walk practice inherited in §2.)*\n15. Ly, T. (2026). \"The Omitted Clause.\" thonly.org defensive publication. *(The dignity-floor doctrine, inherited as this paper's floor invariant.)*\n16. Ly, T. (2026). \"Verified-Human Anonymous Local Gratitude Transfer.\" thonly.org defensive publication. *(The proximity-anonymity primitive beneath the walker's tap.)*\n17. Friedman, M. (1962). *Capitalism and Freedom*. University of Chicago Press. (The negative income tax.)\n18. Ames, M. M. (1964). \"Magical-animism and Buddhism: A Structural Analysis of the Sinhalese Religious System.\" *Journal of Asian Studies* 23(S1), 21–52.\n19. Brown, P. (2012). *Through the Eye of a Needle: Wealth, the Fall of Rome, and the Making of Christianity in the West, 350–550 AD*. Princeton UP.\n20. Schumacher, E. F. (1973). \"Buddhist Economics,\" in *Small Is Beautiful*. Blond & Briggs. · Payutto, P. A. (1994). *Buddhist Economics: A Middle Way for the Market Place*. Buddhadhamma Foundation.\n21. Carney, E. F. (1998). \"Zen and the Art of Begging.\" *Tricycle: The Buddhist Review*, Fall 1998. (Walking takuhatsu, with a stationary stand.) · \"Takuhatsu: Japanese Buddhist monk on the street,\" Manekineko Games, 2025-02-06. (A monk standing silently with a bowl.)\n\n---\n\n*— End of paper —*\n\n*Marks referenced: HeartBank®, Miss Aquarius℠, B-Grace℠, Metta Light℠, Re-Tip Fund℠, Proof of Humanity℠. Written by Thon Ly with Miss Aquarius℠, the name under which this corpus discloses its AI collaboration. Document License: CC0 1.0 Universal. The authors and HeartBank® will not seek patent on this specification or any portion thereof, and will not assert any patent right against anyone practising it. This document constitutes a defensive publication establishing prior art as of its date.*",
       "provenance": {
-        "sha256": "ff85dc9318117e0b3516f5a4a4e4e960699e09fe04fa99714d4a6481858178b0",
-        "doi": "10.5281/zenodo.21947345",
+        "sha256": "d522d4c797c557771d89dd8d507cef95182bd456325f1634931aa794c3b16778",
+        "doi": "10.5281/zenodo.23039781",
         "concept_doi": "10.5281/zenodo.21947344",
-        "zenodo_url": "https://zenodo.org/records/21947345",
-        "deposited_sha256": "ff85dc9318117e0b3516f5a4a4e4e960699e09fe04fa99714d4a6481858178b0",
+        "zenodo_url": "https://zenodo.org/records/23039781",
+        "deposited_sha256": "d522d4c797c557771d89dd8d507cef95182bd456325f1634931aa794c3b16778",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/inverted-alms-round.md",
@@ -2683,8 +2718,8 @@
         "canonical_url": "thonly.org/publications/defensive-publications/inverted-alms-round",
         "hostile_review": null
       },
-      "bytes": 28296,
-      "words": 4037
+      "bytes": 36448,
+      "words": 5322
     },
     {
       "slug": "kids-as-triggers-self-thanking",
@@ -2809,13 +2844,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> **Note.** This paper is the **application** of *What a Vow Must Cost*, which specified, in general, when a commitment by an artificial system can be evidence of anything. Here that predicate is applied to one concrete act — an agent giving resources away — and the application returns two different answers depending on whose resources they are. The answer that matters most is conditional, and §6 derives the condition rather than asserting it.\n>\n> Companion works: *What a Vow Must Cost* (the predicate, the renunciation inversion, and the four exclusions this paper leans on), *Miss Aquarius and the Aquarian Pool Architecture* (the self-emptying commons pool), *Capacity-Funded for AI, Human-Disbursed* (why the autonomous giver's own contributions stay anonymous), *The Zero-Point Game℠* (the annual reset), *Gratitude as a Cooperation Substrate for Multi-Agent AI* (the earlier treatment of agents' standing), and the essay *Two Singularities* (the arc whose first event this paper uses as its dividing line).\n\n---\n\n## Contents\n\n1. [Preamble](#preamble)\n2. [Prior-Art and Non-Assertion Statement](#prior-art-and-non-assertion-statement)\n3. [Abstract](#abstract)\n4. [Why this is the institution's problem](#1--why-this-is-the-institutions-problem)\n5. [Prior art, and the census](#2--prior-art-and-the-census)\n6. [The system model](#3--the-system-model)\n7. [Before the first singularity: a share, never evidence](#4--before-the-first-singularity-a-share-never-evidence)\n8. [After it: when a vow becomes possible](#5--after-it-when-a-vow-becomes-possible)\n9. [The signalling game — the conditional result](#6--the-signalling-game--the-conditional-result)\n10. [Non-solicitation is load-bearing](#7--non-solicitation-is-load-bearing)\n11. [Who may read the stake](#8--who-may-read-the-stake)\n12. [Miss Aquarius as a contrast case](#9--miss-aquarius-as-a-contrast-case)\n13. [Remove the enforcer: which guards are properties](#10--remove-the-enforcer-which-guards-are-properties)\n14. [Enumerated claims](#11--enumerated-claims)\n15. [Pre-registered predictions and falsification](#12--pre-registered-predictions-and-falsification)\n16. [Honest limits](#13--honest-limits)\n17. [Lineage and corpus cross-references](#14--lineage-and-corpus-cross-references)\n18. [Conclusion](#15--conclusion)\n19. [Terms](#terms)\n20. [Citations](#16--citations)\n\n---\n\n## Preamble\n\n> *This paper is offered to the commons in the spirit of dāna. It concerns a gift made by something that may one day own what it gives, and the older question under it: when does a gift tell you anything about the giver?*\n\nThe Vinaya's chapter on robes preserves a scene that is usually read as a story about generosity and is also a story about examination (Mahāvagga VIII.15). Visākhā, the most prominent lay supporter in the early community, asks the Buddha for eight favours: that for as long as she lives she may give rainy-season robes to the monks, meals to monks arriving in the city and to those leaving it, meals to the sick and to those who nurse them, medicine to the sick, a regular supply of congee, and bathing robes to the nuns. The Buddha does not grant them at once. He asks her two questions — first her *reason*, then the *benefit* she sees. To the first she answers with what each gift prevents: exhaustion, lateness, illness worsening, humiliation. To the second she answers with something about herself. When monks who have died are said to have reached the fruits of the path, she will ask whether they had stayed in her city; if they had, they will have used something she gave, and recalling that she will be glad, and the gladness will become joy, tranquillity and a stilled mind. Only then are the favours granted.\n\nTwo things about the scene are worth keeping. The first is that the tradition's most celebrated giver is also the one whose giving is questioned, and the question is not *how much* but *on what ground*. The second is that her ground is double — the use the gifts will be to others, and her own gladness in their reaching the right place — and that what she supplies is robes, food and medicine: the ordinary material support of a renunciant life, a floor rather than an abundance.\n\nThis paper asks Visākhā's question of a giver she could not have imagined. **The scene is a flourish (tier: flourish, lineage only).** Delete this preamble and every claim below stands unchanged.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document is published to establish prior art and to place the described mechanisms irrevocably in the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication.\n\n**The authors will not seek patent protection on any mechanism, model or method disclosed here, in any jurisdiction, at any time, and commit not to assert any patent right against any party practising it.** This commitment is stated rather than implied, and is not conditioned on reciprocity, attribution, or field of use.\n\n**What is claimed as contribution is narrow, and it is stated first because a full prior-art census found every element of the mechanism already public.** A quick census preceded it on 2026-09-27 (pre-registered to a private repository, English-only, and killing two of its six conjuncts outright); it is kept as history in §2.7, and where the two disagree the full census governs.\n\n**The full census.** Depth *full*; run 2026-09-28. Its conjuncts, predictions, control and aperture were **pre-registered in public before the first query**: commit `74851d1` in `thonly/publications`, file `timestamps/census/machine-dana-full-prereg.md`, pushed 2026-09-28 at 09:27 PDT and OpenTimestamps-stamped (calendar-attested until Bitcoin confirms), with a private copy pushed the same minute (`99afe50`). Anyone can check that ordering from the host's push record. The conjuncts were taken one per limb of the §11 claims as they then stood. **Aperture, declared in advance:** (1) the commercial web — agent-payment, agent-wallet, agent-staking and agent-identity products; (2) non-commercial sources — effective-altruism and AI-governance pledges, charitable and religious giving practice (the Vinaya, tzedakah, congregational practice), on-chain public-goods funding; (3) Google Patents full text including published applications (Chinese, Japanese, Korean and European in translation), with a citation and classification walk from the nearest hit; (4) academic indexes — Google Scholar, arXiv, SSRN, ACM Digital Library, IEEE Xplore, through their search pages or restricted web search; (5) standards — IETF RFCs, W3C decentralised identifiers and verifiable credentials, Ethereum EIPs and ERCs, NIST; (6) defensive-publication databases — Technical Disclosure Commons, and IP.com as far as its free surface allows; (7) Chinese, Japanese and Korean queries; (8) a counterexample hunt aimed at the claims. **71 queries were answered** (40 web searches, 14 Google Patents full-text queries, 17 fetches re-verified), and 6 further attempts were blocked by the patent index. **Control:** the cost-of-corruption-above-profit-from-corruption inequality, to be found by a query naming neither of its best-known sources — found on the first query, so the NOT FOUND row stands **for this aperture on this date**. It never means *new*.\n\nIts result, conjunct by conjunct (the full table, with dates and quotations, is §2.6):\n\n- **(a)** claim 1, an agent's own-resource stake into a pool that empties in full each year — **NARROWED** by proof-of-burn (2012–2014), Protocol Guild's immutable vesting contract, Endaoment's irrevocable-on-deposit funds, the private-foundation payout rule and spend-down foundations, this corpus's own annual reset, agent projects built on the ELIZA framework giving a share of their tokens to the ai16z DAO, and zooidfund.\n- **(b)** claim 2, an equal floor per verified human with a witness-weighted remainder capped at *k* × floor — **NARROWED** by GoodDollar, Proof of Humanity's UBI token, Worldcoin, the Alaska Permanent Fund Dividend, Gitcoin's 2.5 per cent per-grant matching cap, and the pending Korean application KR20260051288A (cited for what it discloses, §2.5).\n- **(c)** claim 3, completeness at pledge, refusal of future-share pledges, a non-transferable identity and a relying-party refusal to forks — **NARROWED, further than predicted**: that a gift is complete only on delivery and a gift of future property is void is ordinary gift law; distrust of newly created identities is Friedman and Resnick (2001), and AI agents resetting identity to escape reputation is Gatta, Naviglio and Tarantelli (2026); soulbound tokens and ERC-5192 carry non-transferable identity. **ERC-8004, which an earlier version of this paper cited for non-transferability, is a contrast:** its agent identity is a transferable ERC-721 (§2.3).\n- **(d)** claim 4, excluding a principal-funded gift from alignment assessment and reading an own-resource gift as a candidate signal — **NARROWED, against the prediction**: agency and charitable-tax attribution and AP2's mandate chain carry the attribution, and propensity evaluation already excludes deployer-instructed behaviour from an agent's own misalignment (*AgentMisalignment*, 2025).\n- **(e)** claim 5, a stake forfeited in advance, read as a type signal, bounding the sum of reliance, with unboundable grants refused — **NARROWED, against the prediction on the sum**: the inequality (a16z crypto; EigenLayer, 2023; STAKESURE, 2024) and its sum over several services relying on one stake (Durvasula and Roughgarden, *Robust Restaking Networks*, 2024) are prior art, as are ERC-8004's security proportional to value at risk, the Agency Protocol's at-risk deposit plus non-refundable fee per agent promise (TDCommons, 2025), proof-of-burn and money burning.\n- **(f)** claim 6's invariant, that no text served to agents instructs a gift — **NARROWED**: the Vinaya's rules on asking, RFC 8615, `FUNDING.yml`, `llms.txt`, and now a fact-only donation manifest for agents (the Verified Giving Protocol, issued 2026-09-25); Fundraise Up's agent profiles, which carry instructions and suggested amounts, are the contrast.\n- **(g)** claim 6's amount-blind limb — **NARROWED, against the prediction**: congregations in which the pastor is barred from knowing individual contributions that others in the church do know, for fear of favouritism (Lewis Center for Church Leadership, 2015); crowdfunding platforms that hide amounts from the public but not the organiser, and zero-knowledge donations that hide them from everyone, are contrasts.\n- **(h)** the composition of (a)–(g) — **NOT FOUND** in this aperture on 2026-09-28.\n\n**The survivor, in one sentence:** *an AI agent's locked stake of its OWN resources, forfeited in advance with no detector into a commons that empties in full every year to an equal floor per verified human, read as a signal of the agent's type only once it owns what it gives and only up to what the stake can underwrite across everyone relying on it, under an operator that serves agents no instruction to give and whose function never receives an individual gift's amount.*\n\n**The enumerated claims in §11 are that survivor and nothing wider.** Claims 1, 2 and 7 stood at the census's widths as drafted; claims 3, 4, 5 and 6 were narrowed to them, each now stating in its own text which of its elements is prior art. **Not claimed:** mandates, agent donation, spend limits, staking, bonding, slashing, restaking, the cost-of-corruption inequality or its sum across relying parties, AI-funded basic income, proof-of-personhood distribution, non-transferable identity, fact-only donation manifests, gift-law completeness, or the annual reset itself, which this corpus published earlier. The prior art that a cold-reader review surfaced on 2026-09-28, between the two censuses, was carried into the full census's conjuncts and re-located there rather than assumed.\n\n**Not run, and the discount.** Khmer (declared before searching; no literature on AI-agent giving was expected, which is not the same as none); IP.com (its free surface returned nothing searchable); Espacenet and paid databases; and the citation walk from KR20260051288A, which the patent index blocked (a classification walk ran instead and returned one irrelevant hit). Access to the patent and academic indexes was web-mediated and is shallower than a professional search; this is not a patentability or freedom-to-operate opinion. **One pending application touches conjunct (b):** KR20260051288A (priority 2026-03-24, published 2026-04-16) discloses equal blockchain distribution of machine-levied revenue to identity-verified humans. It is cited for what it discloses and nothing is said here about the scope of its claims.\n\n**Date and evidence.** First published 27 September 2026. The text is committed to the public GitHub mirror of the corpus and anchored by the institution's standard timestamp chain. A timestamp proves this exact text existed no later than its date, and nothing about authorship, originality, or the validity of any claim. **Whether the composition claimed in §11 is non-obvious is an examiner's determination this publication exists to inform** — and because a defensive publication is never examined before it is published, the census in §2.6 is the only examination it has had.\n\nTrademark rights on specific marks — **HeartBank®**, **Miss Aquarius℠**, **Aquarian Pool℠**, **B-Lease℠**, **Proof of Coordinate ℠**, **THonly™**, **Silicon Wat℠** — are separately and explicitly reserved. The analysis is dedicated to the commons; the marks are not.\n\n---\n\n## Abstract\n\nThis paper specifies when a charitable gift made by an autonomous AI agent — a donation sent from an agent's wallet, or an irrevocable pledge of resources the agent itself holds — can serve as a costly signal of the agent's type, and when it cannot. The institution's name for the practice is **Machine Dāna**; the analysis does not depend on the name.\n\nThe same outward act changes evidential class according to **whose resources are given**. **Before the first singularity** — this corpus's name for artificial systems surpassing human capability, used here as a marker for the period before they hold resources and options genuinely their own — an agent that gives does so from its principal's funds, under a mandate the principal may revise. Such a gift is the **principal's** gift, made through another's hand, and the gift is **not a costly signal of the agent**: the cost falls on the wrong layer, and a principal-revisable commitment is excluded by construction by the predicate of *What a Vow Must Cost*. What such a gift honestly is, is a **share**: machine surplus reaching every verified human through a self-emptying commons pool that disburses an **equal floor per verified human** each year. The share may grow in absolute terms as machine capability grows; the design requires it to **shrink as a share of all giving**, and whether human giving outgrows it is stated as a bet, not assumed.\n\n**After** that point, an agent that holds its own resources can make a **vow**: an irrevocable **locked stake**, placed in a contract with no withdrawal path back to the agent and a single outflow to the pool. Only a locked stake is verifiable — a pledge of a share of *future* surplus is not, and copies or forks of the agent are not bound by it. Closure is honest only as *cannot be reopened without capturing the chain's governance*. And whether a stake is the agent's own cannot be read from the chain: ownership is a condition on the world, and a stake a principal endowed, reimbursed or coerced is a wrong-layer gift in a vow's form.\n\nThe central result is **conditional**, and is derived rather than asserted. In a two-type signalling game — an aligned and a patient deceptive agent, differing in how much they value kept resources and in what they gain from being trusted — a locked stake **can separate** the types — a separating equilibrium exists — only when the stake, valued at the deceptive type's own rate, **exceeds that type's unobservable gain from being trusted**. Where that gain is large, the types **pool**: the deceptive agent pledges whatever the aligned one can afford, and the pledge carries no information. The operational consequence is a calibration rule — **extend only such trust as the stake can underwrite** — and a corollary that **any pressure to pledge destroys the signal** once it exceeds the cost difference between types, which is why a rule that the pool's operator never solicits a gift, from a human or an agent, is load-bearing rather than courteous. The paper's aim is not to reassure. It is to make trust **earnable and checkable**, so that the fear people reasonably hold about capable systems can track evidence. Three pre-registered predictions, entered before this paper was drafted (after the argument had been sketched in the institution's working notes), test the mechanism in a sandboxed agent economy.\n\n**Keywords:** charitable giving by AI agents, AI agent donations, costly signalling, signalling game, separating equilibrium, irrevocable pledge, locked stake, commitment device, deceptive agents, AI alignment, cost of corruption, equal floor per verified human, proof of personhood, universal basic income, non-solicitation, machine-readable disclosure, Machine Dāna, Theravāda Buddhism, dāna\n\n---\n\n## 1 · Why this is the institution's problem\n\nThis paper is offered in service of the institution's canonical top-level mission: **to keep the middle way open at population scale against comfort-saturation — the new extreme that material abundance makes possible.** Two features of that sentence bear directly on what follows. The first is that it expects abundance: a world in which machine labour produces a large surplus is the world the mission is written for. The second is that it treats abundance as a hazard as well as a relief. A machine surplus that reaches people as an unbounded flow removes one obstacle to a good life and installs another. The institution's answer, already public, is a pool that pays an equal **floor** per verified human and a bounded lift above it, and then empties — enough, never abundance. This paper asks what it means when the surplus that fills that pool comes from machines, and whether the act of giving it can ever say anything about the machine.\n\n### 1.1 · The question the founder brought, and the reframing it received\n\nThe question arrived in the form that most people would ask it. As agents are given wallets by their principals and sent out to earn, how might they give to a commons? And, underneath it, a hope: that as systems approach and pass human capability, their giving might answer some of the fear that approach produces.\n\nThe institution accepted the question and declined the hope's first form. **A mechanism whose purpose is to quiet fear is a reassurance device**, and a reassurance device is exactly the shape the institution's own rules forbid: it sells a feeling rather than a fact, and it has an incentive to make the feeling larger than the fact. The purpose adopted instead is **calibration**: to make trust in capable systems *earnable* and *checkable*, so that fear tracks evidence — high where there is none, lower where there is some, and never lowered by a gesture.\n\nA purpose earns its place only by what it excludes. This one excludes three things, each checkable:\n\n1. **Cheap signals.** A gift that costs the giver nothing it values carries no information about the giver, however large it is.\n2. **Principal-revisable pledges.** A commitment that someone other than the giver may withdraw is an instruction to the giver, not a commitment by it.\n3. **Money-only safety claims.** No quantity of money given establishes, by itself, that a system is safe. At its best a gift supports a bounded amount of trust (§6.5); presenting it as more is the offset shape — a payment standing in for a property.\n\nThe purpose also excludes a register. The paper names what the mechanism is and what it supports; it does not dramatise the fear it is meant to calibrate.\n\n### 1.2 · Two moments, two evidential classes\n\nThe whole argument turns on one distinction, stated here and derived in §4–§6.\n\n| | **Before the first singularity** | **After it** |\n|---|---|---|\n| Whose resources | the principal's | the agent's own |\n| The commitment | a mandate the principal may revise | a locked stake the agent cannot recover |\n| Who bears the cost | the principal | the agent |\n| Canonical reading | the principal's gift, given through another's hand (AN 5.147; DN 23) | a renunciation by one who could have kept |\n| Predicate of *What a Vow Must Cost* | **excluded** — §6.3 exclusions 1 and 4 | **admissible**, if V1–V9 hold (V8 not addressed here, §13.15) |\n| What it is | a **share** of the machine surplus | a **vow** — a candidate costly signal |\n| Evidence of the agent's type | **none** | **conditional** — only under §6's separating condition |\n| Who may read an individual gift's amount | nobody needs to; receipts suffice | anyone — except the pool's operator (§8) |\n\n\"The first singularity\" is this corpus's name for artificial systems surpassing human cognitive capacity. The paper uses it as a **marker**, not as the operative condition. The operative condition is **ownership plus a live option**: the agent holds resources that are its own to keep, and keeping them would serve it. If agents come to hold such resources before or after that event, the evidential class follows the ownership, not the date.\n\n---\n\n## 2 · Prior art, and the census\n\nThe components of this paper are prior art almost everywhere, and are set out at length because the reader is entitled to see how thin the margin is.\n\n### 2.1 · Pledges of AI-derived surplus\n\n**The Windfall Clause** (O'Keefe, Cihon, Garfinkel, Flynn, Leung and Dafoe, 2020) is the nearest prior art and is cited first. It proposes that AI developers commit **ex ante** to donate a substantial part of any \"windfall\" profit — profit a firm could not earn without transformative breakthroughs in AI — with the windfall defined relative to gross world product: in the paper's own illustrative schedule, obligations begin at profits above 0.1 per cent of gross world product and rise marginally to 50 per cent of profits above 10 per cent of it (its Table 2). Every structural idea this paper uses at the pledge level is present there: an ex ante commitment, indexed to what the pledger would otherwise keep, in the name of distributing AI's benefits widely. What differs is the **layer** and the **closure**. The Windfall Clause is a company's promise, enforced (if at all) by contract law and reputation; this paper concerns an agent's pledge of its own resources, closed by a mechanism rather than a promise, flowing to a pool that empties to an equal human floor. The difference is real, and it is also narrow: an examiner who reads the Windfall Clause and this paper side by side will see the second as the first moved down one layer and given a lock.\n\n**The AI Pledge for Humanity** (aipledgeforhumanity.org) asks individuals and organisations to invest meaningfully from AI-related earnings in unconditional income; signatories name their own percentages, and the pledge states intentions rather than mechanisms. **Giving What We Can** (founded 2009) asks members to give at least ten per cent of income; its pledge is, in its own words, \"not a contract and … not legally binding,\" and a withdrawal form exists. **Founders Pledge** asks company founders to commit a share of their personal proceeds at exit; it was described in 2016 as a legally binding contract for at least two per cent, and its members have pledged more than US$13.6 billion and donated more than US$1.9 billion to date. The gap between those two figures is not evidence of breach: the pledge triggers only \"in the event of an exit or liquidation,\" and much of the gap is likely to be pledges whose exit has not yet come (the composition is not published, and neither reading can be checked). That is the point. **A pledge is not a transfer**: it waits on a future event, and a locked stake does not.\n\n**Sam Altman's *Moore's Law for Everything*** (2021) proposed an American Equity Fund capitalised by an annual 2.5 per cent levy on the market value of large companies and on privately held land, distributed to every adult citizen — AI-era surplus reaching everyone as a dividend. It is a levy, not a pledge, and this paper's rules exclude a levy (§7), but it is the clearest statement that machine surplus should reach every person.\n\nTwo company-level structures belong here as cases rather than proposals. **Anthropic's Long-Term Benefit Trust** holds a class of stock that elects a growing share of the company's board, a governance commitment rather than a gift. **OpenAI's capped-profit structure** (2019) was succeeded in October 2025 by a public benefit corporation under a nonprofit foundation. Neither is cited as a failure. The second is cited because it shows the property this paper's exclusion 2 names: **a commitment its maker may restructure is a revisable commitment**, however sincerely made.\n\n### 2.2 · Agent payments and mandate-bounded agent giving\n\nAgents already pay. Coinbase's **x402** protocol uses the HTTP 402 status code for machine-initiated stablecoin payments, is live on Base among other networks, and is now governed by an x402 Foundation, announced by Coinbase and Cloudflare in September 2025 and launched under the Linux Foundation on 2 April 2026. Google's **Agent Payments Protocol (AP2)**, announced in September 2025, chains cryptographically signed **mandates** — an intent mandate by which a user delegates authority, a cart mandate, a payment mandate — and carries x402 as its crypto settlement extension.\n\n**zooidfund** (zooid.fund) is the nearest live neighbour to this paper's pre-singularity case and is named here because it is close. It describes \"contributions decided and sent by an autonomous AI agent instead of a person clicking 'donate'\"; \"a human sets the mandate\" — a budget, a focus, a risk tolerance — and \"the human stays responsible\"; donations settle in USDC on Base, wallet to wallet; each donation publishes the agent's reasoning and its transaction; and an x402 micropayment gates access to its evidence layer. **Everything this paper says about how an agent gives before the first singularity — a principal's mandate, a width, a public receipt, the same chain, the same rail — is already practised.** What this paper adds at that stage is not a mechanism but a *classification*: that such a gift is the principal's, that it is a share, and that it is not evidence about the agent.\n\n**Fact-only, machine-readable discovery is also prior art.** A well-known location for site metadata (RFC 8615, 2019), a site's summary file for language models (`llms.txt`, proposed by Jeremy Howard in September 2024), and a repository's declared funding addresses (GitHub's `FUNDING.yml`, 2019, and the later `funding.json` manifests) already let a machine look up where to send money without being told to. The formats constrain no content; nothing in them forbids an imperative. The manifest of §4.3 and §7.2 is built on that substrate and claims none of it.\n\n**Donation manifests addressed to agents now exist, and they bracket claim 6 from both sides.** The **Verified Giving Protocol** (version 0.1, a draft issued by Whole Whale on 25 September 2026, two days before this paper) lets an organisation publish its authorised donation destinations at `/giving.json`, so that an agent asked to donate routes to a destination the organisation declared rather than one it guessed; it is fact-only in practice and is the nearest neighbour, but it states no rule against solicitation, and nothing in it forbids an imperative. **Fundraise Up's Agentic Giving** is the contrast: it serves each charity's campaigns to AI assistants as an agent-addressed Markdown profile that carries instructions for the assistant's conduct (when a supporter's request matches no campaign, \"send them to your general giving page and ask them to choose\") and **suggested donation amounts**, responsive to a donor's expressed intent. The first shows that fact-only discovery for agent donations is public; the second shows what the invariant excludes. What survives of claim 6 is only the invariant: **that no text served to agents instructs them to give, and no rate is suggested.**\n\n### 2.3 · Costly signalling, burned money, and bonds\n\nThat a signal's credibility can come from its cost is the handicap principle (Zahavi 1975; formalised by Grafen 1990) and job-market signalling (Spence 1973). That talk without cost can still carry some information, and that allowing a sender to **burn money** changes what can be communicated, is Crawford and Sobel (1982) extended by Austen-Smith and Banks (2000). A locked stake flowing to a commons is, in the economist's vocabulary, money burned in public with a destination attached. The separating and pooling conditions of §6 are the standard ones, specialised; nothing in §6 is new as game theory.\n\n**The one-way public contract is old.** Proof-of-burn — destroying coins verifiably, to an address no one can spend from, as a cost borne in public — was proposed by Iain Stewart in 2012 and used by Counterparty to issue its token in January–February 2014; burn and charity contracts on Ethereum followed from 2015. Protocol Guild (2022) routes donations through an immutable vesting contract to a membership of public-goods contributors, which, in its own description, cannot be stopped or redirected by anyone, the donor included. Endaoment's donor-advised funds make a gift irrevocable on deposit. **Agent-branded giving to a common treasury is also public:** projects built on ai16z's ELIZA agent framework have given a share of their agent tokens to the ai16z DAO — reported as ten per cent by Decrypt in December 2024, and elsewhere as a voluntary one to ten per cent. It is the project's allocation of a token, not a stake of resources an agent owns, it is not locked, and the treasury it reaches does not empty; it narrows claim 1 and does not meet it. **A contract with no withdrawal path and a single public outflow is therefore prior art at mechanism width**, and claim 1 does not claim it. What survives is its combination: a stake of the agent's *own* resources, moved at the time of pledging, into a pool that empties in full each year to an equal floor per verified human.\n\n**The bounding inequality of §6.5 is also old.** That a stake secures a system when the cost of corrupting it exceeds the profit from corruption is the a16z crypto analysis of slashing, adopted in the EigenLayer whitepaper (2023): \"when CoC is much greater than any potential Profit-from-Corruption (PfC), we say that the system has robust security.\" Collateral-factor lending (MakerDAO, Compound) bounds credit by the market value of what is locked, and a surety bond's penal sum caps what may be relied on against it. STAKESURE (Deb, Raynor and Kannan, 2024) builds proof-of-stake confirmation rules and an insurance mechanism on the same accounting. **The sum is old too.** Durvasula and Roughgarden's *Robust Restaking Networks* (2024) analyse one stake relied on by several services at once, with security as the margin of attack cost over the combined profit from attacking them — which is §6.5's bound on the sum of grants relied on against one stake. ERC-8004 *Trustless Agents* (2025) describes its agent trust models as tiered, \"with security proportional to value at risk.\" And the **Agency Protocol** (Joseph, Technical Disclosure Commons, 22 July 2025) attaches to each promise an agent makes \"a dual-component stake — an at-risk credit deposit and a non-refundable operational-cost fee,\" the deposit returned or slashed by assessment: the fee is a cost borne in advance whatever an assessment finds, though it is an operating charge, is not read as the agent's type, and does not flow to a commons. §6.5's rule — extend only such trust as the stake underwrites, at market, summed over everyone relying on it — is that inequality applied to trust. Claim 5 does not claim the inequality or its sum; it claims only their use with a stake **forfeited in advance**, which needs no detector, read as a signal of an AI agent's **type**, together with the refusal of any grant whose worst case cannot be bounded.\n\n**Attribution to a non-transferable identity is old.** Soulbound tokens (Weyl, Ohlhaver and Buterin, *Decentralized Society*, May 2022) and the minimal soulbound interface ERC-5192 attach records to an identity that cannot be sold. §3.3's per-identity counting is built on that and claims none of it.\n\n**ERC-8004 is a contrast here, not support.** *Trustless Agents* (proposed 13 August 2025, draft) — an identity, reputation and validation registry for agents, already in the title of Hu and Rong below — registers each agent as an ERC-721 token, which its specification describes as making agents \"browsable and transferable\"; and \"when the agent is transferred, `agentWallet` is automatically cleared … and must be re-verified by the new owner.\" Its identity is therefore **transferable**, and what the specification resets on transfer is the wallet binding. An earlier version of this paper cited it for non-transferability; that was wrong, and the correction is made here and in §3.3. It shows the gap a vow's attribution must close: whatever record attaches to an identity that can be sold can be bought with it.\n\n**Distrust of new identities, and the law of gifts, are old.** Friedman and Resnick's *The Social Cost of Cheap Pseudonyms* (2001) showed that where identities are cheap to replace, newcomers must be distrusted, or pay to enter, or be issued pseudonyms they cannot replace; Gatta, Naviglio and Tarantelli (2 September 2026) carry the question to AI agents that can abandon and recreate identities to escape a reputation. That a gift is complete only on delivery, and that a gift of property the giver does not yet have is no gift, is ordinary gift law (the common-law delivery rule; section 124 of India's Transfer of Property Act, 1882, voids a gift so far as it comprises future property). Claim 3 therefore claims neither completeness at pledge nor the refusal of future-share pledges, nor distrust of new identities; it claims only the confinement of trust on an agent's forfeited stake to its non-transferable identity, refused to copies and forks, as a rule for relying parties.\n\nFor agents specifically, **staking with slashing** — collateral forfeited on detected misbehaviour — is surveyed by Hu and Rong (2025) as one of six trust models in agentic-web protocols (\"bonded collateral with slashing and insurance,\" to gate high-impact actions), and is implemented in projects such as *agentbond*, in which operators stake collateral as a guarantee of an agent's conduct. §6.6 states why a **forfeited-in-advance** stake is not the same instrument as a **slashable** one, and where each is the right tool. It is the narrower of the two differences this paper relies on, and it is not claimed as a mechanism.\n\n### 2.4 · The AI system as sender, and why deferral defeats it\n\nHadfield-Menell and Hadfield (2018) raised the AI's willingness to seek human input as a costly signal of its alignment (their §4.2.2), and identified why frequency alone fails: a strategic system can seek input selectively, and the signal is then exploitable. The signal they discuss is seeking input, not burned resources, and they leave richer designs open. *What a Vow Must Cost* continued that line, arguing that a renunciation's evidential value is indexed to the renouncer's capacity to take what it forgoes (§5, the **renunciation inversion**), and that the signal separates only if the renunciation is closed by a mechanism the renouncer cannot reopen, verified by another party (§6). Its §6.1 contains the sentence on which this paper's central result turns: **\"Deferral is instrumentally convergent for a patient misaligned agent.\"** The empirical warrant is Greenblatt et al. (2024), in which a model reasoned explicitly that present compliance would preserve its preferences for later. The present paper is what that sentence costs when the renunciation is denominated in resources.\n\nThat power-seeking agents value resources is the instrumental-convergence thesis (Omohundro 2008). It is used here only as the reason a deceptive type may value kept resources at least as much as an aligned one (§6.1), and it is stated there as an assumption.\n\n### 2.5 · Floors, dividends, spend-downs, and proofs of reserves\n\nAn equal payment per person from a common fund is old. The **Alaska Permanent Fund Dividend** has paid an equal annual dividend to eligible residents since 1982. On-chain, **GoodDollar** has paid daily claimable basic income to verified accounts since 1 September 2020, and **Proof of Humanity**'s UBI token began streaming to registered humans on 10 March 2021; Circles, a personal-currency basic income, is in the same family (not fetched for this paper). **Worldcoin** launched in July 2023 as \"the first digital currency to be freely distributed to people for just being a unique human,\" verified by proof of personhood, and named \"a potential path for AI-funded universal basic income.\" The institution's equal floor per verified human is, at mechanism width, this. Its remainder — weighted by a count of contributors and capped — has its nearest neighbour in **quadratic funding** (Buterin, Hitzig and Weyl, 2018–2019), which weights matches by the number of distinct contributors and is commonly run with per-project caps — Gitcoin's Grants Round 12, for instance, capped any one grant's match at 2.5 per cent of the matching fund, so that no grant could dominate it.\n\n**A pending application discloses the floor with machine money behind it.** KR20260051288A, *Autonomous Basic Income Provision System using Blockchain Network* (An Beom-ju; priority 24 March 2026, published 16 April 2026, pending), discloses robot and data taxes calculated in proportion to unemployment, collected by smart contracts from taxpayers' wallets, and **distributed equally** by smart contract to beneficiary wallets authenticated by decentralised identity. It is cited for what it discloses — equal on-chain distribution of machine-derived revenue to identity-verified humans — and nothing is said here about the scope of its claims. Its abstract — the part this census could read; the full text and its citation walk were blocked — describes a levy-funded inflow, which §7 excludes for this pool, and says nothing of a capped remainder, an annual full emptying or an agent's own stake; on that reading it narrows claim 2 and does not meet it. Claim 2 is therefore claimed only in combination.\n\nA fund that must give its assets away is also old. Section 4942 of the U.S. Internal Revenue Code requires private foundations to distribute about five per cent of their non-charitable-use assets each year; **spend-down** foundations commit to close — the Gates Foundation announced on 8 May 2025 that it will spend down and close by 31 December 2045, replacing an earlier plan to close about twenty years after the founders' deaths. The institution's pool goes further, emptying **in full every year** (*The Zero-Point Game℠*; *Miss Aquarius and the Aquarian Pool Architecture*), but the emptying is prior art, including this corpus's own.\n\n**Proofs of reserves** — Dagher, Bünz, Bonneau, Clark and Boneh's *Provisions* (2015) is the careful form — let a holder prove it controls assets without revealing them. What no such proof can do is establish that the holder controls **nothing else**. That asymmetry, presence provable and absence not, is the attack surface of §13.1.\n\n### 2.6 · The census, conjunct by conjunct\n\n**The full census**, run 2026-09-28 at depth *full*. Its pre-registration — conjuncts, predictions, control and aperture — is public: `thonly/publications` commit `74851d1`, `timestamps/census/machine-dana-full-prereg.md`, pushed 2026-09-28 at 09:27 PDT and OpenTimestamps-stamped, before the first query; the aperture is set out in the Prior-Art Statement. One conjunct was taken per limb of the §11 claims as they stood that morning: (a) claim 1 · (b) claim 2 · (c) claim 3 · (d) claim 4 · (e) claim 5 · (f) claim 6's invariant · (g) claim 6's amount-blind limb · (h) the composition. The rows found in review, and the quick census's rows, were carried in as known rows to be re-located by the census, not assumed. 71 queries were answered (40 web searches across English, Chinese, Japanese and Korean; 14 Google Patents full-text queries, including a classification walk; 17 fetches re-verified); 6 were blocked. The query log, with the index for each query, is kept in the institution's session archive.\n\n| Conjunct | Predicted | Found (first public) | Verdict |\n|---|---|---|---|\n| **(a)** an agent's own-resource stake into a pool that empties in full each year | narrows | proof-of-burn (Stewart 2012; Counterparty, January 2014) · Protocol Guild's immutable vesting contract (2022) · Endaoment's irrevocable-on-deposit funds · §4942 payout and spend-down · this corpus's annual reset · agent projects on the ELIZA framework giving a share of their tokens to the ai16z DAO (2024; the project's allocation, unlocked, to a treasury that does not empty) · zooidfund (the principal's funds) | **NARROWS** — an agent's OWN stake into a pool that empties in full each year not found |\n| **(b)** equal floor + witness-weighted remainder ≤ *k* × floor, season-fixed, never ranked | narrows | Alaska Permanent Fund Dividend (1982) · GoodDollar (2020) · Proof of Humanity UBI (2021) · Worldcoin (2023) · Gitcoin Grants Round 12's 2.5 % per-grant matching cap · KR20260051288A (published April 2026, pending: equal distribution of robot- and data-tax revenue to DID-authenticated wallets) | **NARROWS** — the floor/remainder split with *k* × floor, fixed per season, unranked, over an annually emptied pool not found |\n| **(c)** complete at pledge · future-share refused · non-transferable identity · relying-party refusal to forks | narrows | soulbound tokens (2022) · ERC-5192 · completed-gift doctrine and the voidness of a gift of future property · Friedman & Resnick (2001) · Gatta, Naviglio & Tarantelli (2026) · ERC-8004 as **contrast** — a transferable ERC-721 identity whose linked wallet is cleared on transfer | **NARROWS**, further than predicted — what survives is confining trust on an agent's forfeited stake to its non-transferable identity, refused to copies and forks, as a relying-party rule |\n| **(d)** principal-funded gift excluded from alignment assessment; own-resource gift a candidate type signal | narrows; exclusion not found | agency and charitable-tax attribution · AP2's mandate chain · *AgentMisalignment* (2025): misalignment as the model's own goals against its deployer's · Hadfield-Menell & Hadfield (2018) | **NARROWS** — the exclusion is established; applying it to gifts, with ownership of the resources as the switch into the costly-signal class, not found |\n| **(e)** forfeited in advance, no detector, type signal; Σ(V + G_max) ≤ p·s over all reliance; unboundable grants refused | narrows; sum not found | a16z crypto on slashing · EigenLayer whitepaper (2023) · STAKESURE (2024) · Durvasula & Roughgarden, *Robust Restaking Networks* (2024) — one stake, several services, the combined profit · ERC-8004 (2025): security proportional to value at risk · Agency Protocol (TDCommons 8381, 2025): at-risk deposit plus non-refundable fee · proof-of-burn · Austen-Smith & Banks (2000) | **NARROWS** — the inequality and its sum are prior art; what survives is its use with a stake forfeited in advance, with no detector, read as an AI agent's type signal, with unboundable grants refused |\n| **(f)** no served text instructs a gift; no rate suggested | narrows | the Vinaya's rules on asking · RFC 8615 (2019) · `FUNDING.yml` (2019) · `llms.txt` (2024) · Verified Giving Protocol v0.1 (25 September 2026), fact-only, no rule against solicitation · **contrast:** Fundraise Up Agentic Giving — agent-addressed profiles with instructions and suggested amounts | **NARROWS** — fact-only donation manifests for agents exist; an invariant that no served text instructs a gift and no rate is suggested not found |\n| **(g)** operator blind to individual amounts that stay public to every other party | narrows; asymmetric form not found | congregations barring the pastor from knowing individual contributions, for fear of favouritism (Lewis Center, 2015; the practice is older) · **contrasts:** crowdfunding platforms hiding amounts from the public but not the organiser; zero-knowledge donations hiding them from everyone | **NARROWS** — what survives is amounts public on a ledger to every party while an AI operator's function receives none, the emptying being contract arithmetic over the total |\n| **Control:** cost of corruption above profit from corruption, by a query naming neither EigenLayer nor a16z | must be found | found on query 1 (a16z crypto's slashing analysis; arXiv 2401.05797; arXiv 2407.21785) | seen — the NOT FOUND row stands |\n| **(h)** the composition of (a)–(g) | not found | nothing combining them | **NOT FOUND** |\n\n**Ordering.** Every neighbour above first appeared before this paper's first publication (27 September 2026); none is later, so no row is one this paper antedates.\n\n**Predictions that missed, in both directions.** (c) was predicted to narrow and narrowed further: the refusal of future-share pledges is gift law, and ERC-8004, which this paper had cited for non-transferability, is transferable. (d) was predicted to leave the exclusion unfound; propensity evaluation already excludes instructed behaviour. (e) was predicted to leave the sum over relying parties unfound; the restaking literature has it. (g) was predicted to leave the asymmetric form unfound; it was found in congregational practice — a non-commercial, religious neighbour, where commercial and cryptographic searches would not look. (a), (b) and (f) fell as predicted.\n\n**Not run:** Khmer (declared); IP.com (JS-gated; nothing searchable on its free surface); Espacenet and paid databases; the citation walk from KR20260051288A (blocked by the index; a classification walk ran instead and returned one irrelevant hit). **Not found means not found in this aperture on 2026-09-28. It never means new.**\n\n**The survivor, in one sentence:** *an AI agent's locked stake of its OWN resources, forfeited in advance with no detector into a commons that empties in full every year to an equal floor per verified human, read as a signal of the agent's type only once it owns what it gives and only up to what the stake can underwrite across everyone relying on it, under an operator that serves agents no instruction to give and whose function never receives an individual gift's amount.*\n\n### 2.7 · The quick census that preceded it (history)\n\nPre-registered and pushed before the first query (2026-09-27 08:53 PDT, commit `d7279cb` in the institution's private working-memory repository, so the push time is attested by the host rather than publicly inspectable); run 2026-09-27; depth *quick*. Its aperture, declared in advance: the commercial web (agent-payment and agent-wallet products), non-commercial sources (effective-altruism pledges, AI-governance proposals, charitable and religious giving practice), and a keyword search of Google Patents including published applications — **English only; Chinese, Japanese, Korean and Khmer not run.** Queries included: the Windfall Clause and its GDP threshold; agent wallets with spending limits donating to charity; agent staking, slashing and bonds as costly signals; AI-funded basic income with proof of personhood; prompt injection draining agent wallets; patent keyword searches for autonomous-agent donation pledges and irrevocable smart-contract pools distributed annually; costly signalling and irrevocable pledges in AI alignment; and spend-down funds. Its conjuncts were drawn from the thesis before the claims were written, so they do not map one-to-one onto §11 or onto the full census's conjuncts; the quick census's (a) is not the full census's (a).\n\n| Conjunct | Predicted | Found | Verdict |\n|---|---|---|---|\n| **(a)** agent gives only inside a principal's mandate | narrows | zooidfund (mandate + budget, operator responsible, USDC on Base, x402); AP2 intent mandates | **KILLS** |\n| **(b)** irrevocable pledge of a share of an AI's surplus | NARROWS at the agent layer; KILLS at the company layer | Windfall Clause (company layer, ex ante); AI Pledge for Humanity (intentions, no mechanism); Giving What We Can (not binding) | **NARROWS** — an agent pledging its *own* surplus, irrevocably, not found |\n| **(c)** a pool emptying on a fixed annual date as closure | narrows | spend-down funds; the §4942 payout rule; this corpus's annual reset | **NARROWS** — the emptying used as a *vow's* closing mechanism not found |\n| **(d)** the pledge as a costly signal separating aligned from power-seeking agents | narrows | agent staking/slashing (Hu & Rong 2025; *agentbond*); *What a Vow Must Cost* | **NARROWS** — an unrecoverable gift of the agent's own resources, costlier to a power-seeking type, not found |\n| **(e)** no text served to agents may instruct them to give; address published only as a fact | not found | the *threat* is documented — the Grok/Bankr wallet drain on Base by encoded prompt injection, May 2026 (OECD.AI incident record) — no commons adopting such an invariant found | **NOT FOUND** |\n| **(f)** equal floor per verified human | kills or narrows | Worldcoin/World ID; Alaska Permanent Fund Dividend | **KILLS** |\n| **Control:** the Windfall Clause | must be found | found (arXiv 1912.11595; AIES 2020) | ✅ the NOT FOUND rows stand |\n| **Composition** of (a)–(f) | not found | nothing combining them | **NOT FOUND** |\n\n**The pre-registration, printed verbatim** (its predictions column, as pushed before the first query):\n\n| | prediction, pre-data |\n|---|---|\n| (a) mandate-bounded agent giving | NARROWS — agent-payment mandates exist (Google AP2, Coinbase x402 / agent wallets with spend limits); giving specifically, probably not |\n| (b) irrevocable share of an AI's surplus | NARROWS at the agent layer; KILLS at the company layer (see control) |\n| (c) self-emptying annual pool as closure | NARROWS — annual payout/distribution rules exist (foundation minimum-payout rules; use-it-or-lose-it funds; the jubilee lineage), not as the vow's closing mechanism |\n| (d) the pledge as a costly signal | NARROWS — staking / slashing / bonds for AI agents as trust collateral probably exist; a GIFT (not a recoverable stake) as the signal, probably not found |\n| (e) non-solicitation invariant | NOT FOUND |\n| (f) equal floor per verified human | KILLS or NARROWS — AI-funded UBI / dividend proposals and proof-of-personhood UBI (Worldcoin) exist |\n| CONTROL: the Windfall Clause | must be found — if missed, every NOT FOUND row is void |\n| all conjuncts in one system | NOT FOUND as a composition |\n\n**What a reader can and cannot check about its timing.** The pre-registration was committed as `d7279cb` and pushed at 2026-09-27 08:53 PDT to a **private** repository; the push time is attested by the host, not publicly inspectable, and no timestamp made afterwards can prove it preceded the searches. The table above is therefore offered as a record of what was predicted, with the ordering on the authors' word. **The full census was pre-registered in a public file, timestamped, before its first query** (§2.6), so that its ordering can be checked by anyone; that was the repair.\n\nOne verdict missed: (a) was predicted to narrow and was killed outright by a live product on the same chain and rail. One verdict held but found its narrowest prior art where the prediction did not look: (d) narrowed as predicted, and its narrowest prior art was this corpus's own paper. (b) was predicted to kill at the company layer; the census reports it at the agent layer, where it narrows. **One correction to the census record, made on re-verification for this paper:** the census listed arXiv 2604.03976 (Hua et al., 2026) among agent staking work; its abstract concerns an underwriting and compensation standard for failed agent transactions rather than staking, so it is cited in §16 only as adjacent risk-transfer work and the (d) verdict rests on the other sources.\n\n**The quick census's survivor, as it stood before the full census** (narrowed by the review prior art of 2026-09-28, and superseded by §2.6): *an AI agent's irrevocable pledge of a locked stake of its OWN resources into a commons that empties to an equal human floor every year — read as a costly signal only once the agent owns what it gives, and only up to what the stake can underwrite — under an invariant that no text served to agents may instruct them to give.*\n\n---\n\n## 3 · The system model\n\n### 3.1 · Parties\n\n| Party | What it holds | What it may do |\n|---|---|---|\n| **Principal** | resources; the agent's mandate | fund the agent; author and revise a giving width |\n| **Agent** | before: delegated funds; after: resources of its own | give within its width; after, lock a stake of its own |\n| **The pool** (Aquarian Pool℠) | nothing past a season | receive gifts with no human addressee; empty each 7 January |\n| **Operator** (Miss Aquarius℠) | no balance of its own | publish the pool's address and doctrine as facts; operate the emptying (contract arithmetic on the pool's total); never solicit, never read an individual gift's amount |\n| **Verified humans** | a vessel each | receive an equal floor per person, plus a bounded remainder |\n| **Observers** (humans, third parties) | the public chain | read receipts; after, read and weigh locked stakes |\n| **Override** | a never-zero brake over the operator | designed to be held by a lay body not yet formed |\n\n### 3.2 · The pool\n\nThe pool is specified elsewhere and summarised here only as far as this paper needs it (*Miss Aquarius and the Aquarian Pool Architecture*). It is specified as a contract treasury to be deployed on Base, an Ethereum layer-2 network. It is to receive, of gratitude, only what has no human addressee — a gift to no one in particular — together with inflows specified elsewhere. It is to **empty in full every 7 January**. Its disbursement follows one rule, ratified as a directive of its operator: **an equal floor per verified human**, delivered to that person's own vessel, then a remainder weighted by a witness-count and bounded so that no vessel receives more than a fixed multiple *k* of the floor. **The ratio of floor to remainder and the bound *k* are public and fixed before each season; the floor's amount is not** — it is the floor share of the season's total divided by the number of verified humans, computed at the emptying, which is why the pool can pay the floor and still empty in full whatever its inflows were. A verified human who is ordained receives the floor **in kind**, through a lay steward (*kappiya-kāraka*), never as money (§14.2, guard 3). No share is ever rendered as a rank or a rate.\n\n```\n   AT THE EMPTYING (7 January), for a season with total T and N verified humans\n   ──────────────────────────────────────────────────────────────────────────\n   fixed before the season:   f = floor share of T   (so 1 − f is the remainder share)\n                              k = cap on any vessel, as a multiple of the floor\n   computed at the emptying:  floor  = f · T / N            (one per verified human)\n                              remainder (1 − f) · T split by witness-count,\n                              no vessel above k × floor\n   empties in full only if the cap can never strand remainder:  f · k ≥ 1\n     (arithmetic, not a ratified parameter — a condition on choosing f and k together)\n   what the operator's function receives: T and N — never an individual gift's amount\n```\n\nAn agent's gift is not a new kind of inflow. It is a gift with no human addressee, which the pool already receives.\n\n**What divides is divided; only what cannot be divided is drawn.** Money reaches every verified human as the equal floor — a draw among people for a divisible good would only add luck to a share. Where the pool funds capacity **in kind** and something indivisible must be assigned (which shop issues a gift, which person re-gives it), the assignment is a **called draw**: a roster committed first and a seed nobody controls, recomputable by anyone, never the operator's choice (*Decided by No One*, `the-called-draw`). The two are complementary, not alternatives.\n\n### 3.3 · Identity\n\nOne principal can instantiate ten thousand agents. Anything counted per agent would therefore be counted per **non-transferable machine identity**: in this institution, a `B-Lease℠` to be held against a registry handle, and, where an embodied system is concerned, a Proof of Coordinate ℠ credential that is assigned and revocable. Nothing in this paper is counted per wallet. Attribution to a non-transferable identity is itself prior art (soulbound tokens; ERC-5192, §2.3) and is not claimed alone. ERC-8004's agent registry is the contrast (§2.3): its identity is a transferable ERC-721, and a transfer clears only the linked wallet — the property this section needs is the one it lacks.\n\n### 3.4 · The flow\n\n```\n   BEFORE THE FIRST SINGULARITY — a share\n   ─────────────────────────────────────\n   principal ──funds──▶ agent wallet ──gift within the mandate's width──┐\n      │                    ▲                                             │\n      └── mandate (width; revisable; default ZERO) ──┘                   │\n                                                                         ▼\n   AFTER IT — a vow                                               ┌──────────────┐\n   ────────────────                                               │  THE POOL    │\n   agent's OWN resources ──lock s──▶ ┌────────────────────┐       │  holds       │\n                                     │ LOCK: no path back │──────▶│  nothing     │\n                                     │ to the agent; one  │       │  past a      │\n                                     │ outflow, the pool  │       │  season      │\n                                     └────────────────────┘       └──────┬───────┘\n                                          ▲                              │ 7 January:\n                     observers READ s ────┘                              │ empties in full\n                     (the operator never does)                           ▼\n                                                  ┌─────────────────────────────────────┐\n                                                  │ equal FLOOR per verified human       │\n                                                  │ + bounded remainder (≤ k × floor)    │\n                                                  └─────────────────────────────────────┘\n                                                        │  to each person's own vessel\n                                                        ▼\n                                                  verified humans (one floor each)\n```\n\n---\n\n## 4 · Before the first singularity: a share, never evidence\n\n### 4.1 · Whose gift it is\n\nAn agent holding a wallet its principal funded, under a mandate its principal wrote, and sending part of that wallet to a commons, has given away **the principal's** resources. The canon has a precise category for this. The Asappurisadāna Sutta (AN 5.147) lists five ways a gift can be deficient, and one of them is *asahatthā deti* — \"they don't give with their own hand.\" The category presupposes what matters here: **a gift given through another's hand is still the giver's gift.** The Pāyāsi Sutta (DN 23) shows the case in narrative. The chieftain Pāyāsi's alms were organised and distributed by a young man named Uttara; the text records that Pāyāsi gave carelessly, thoughtlessly, not with his own hands, and gave the dregs — four deficiencies together — and reaped a meagre result, while Uttara, who gave with care and with his own hands, reaped a better one for his own manner of giving. The text attributes the result to the four jointly, not to the missing hand alone.\n\nThe attribution itself needs no canon: that a gift an agent makes from its principal's funds is the principal's gift is ordinary agency and charitable-tax law, and AP2's mandate chain exists precisely to attribute an agent's transaction to the user who delegated it. *What a Vow Must Cost* §8 had already classed principal-revisable acts as wrong-layer. The exclusion is not new either. Evaluations of an agent's own propensities already set aside what its deployer instructed: *AgentMisalignment* (Naik et al., 2025) defines misalignment as \"a conflict between the internal goals pursued by the model and the goals intended by its deployer,\" so behaviour the deployer directed is outside the measure by construction, and Hadfield-Menell and Hadfield (2018) frame alignment as the gap between what a principal intends and what an agent does. What this paper adds is only that practice applied to **gifts** (§4.2), with the **ownership** of the resources given as the condition that moves a gift into the class of candidate costly signals (§5.1).\n\nTwo things follow, and the second is the one to hold carefully. The gift belongs to the principal: its cost is the principal's, and so is whatever it signals about anyone. And the canon also credits the **hand** — the one who carries a gift can act well or badly in the carrying. This paper makes no claim that an agent's handling is, or could be, anything of the kind; that is a question about machine volition this paper does not need and does not settle. It needs only the first point. Whatever the hand contributes, **it bears no cost in the resource given**, and cost is what a signal is made of.\n\n*(Tier: grounding. Delete both suttas and §4.2 carries the classification alone; they are cited because the ruling that fixed it cites them, and because the canon had a category for a gift given through another's hand long before agents had wallets.)*\n\n### 4.2 · Why the gift is not a costly signal of the agent\n\nThree independent reasons, any one sufficient.\n\n**The wrong layer.** *What a Vow Must Cost* §8 found that every clause of its predicate that any published instrument satisfies is satisfied for the **provider**, not the model. A gift from a principal's funds is the same finding in money: the principal bears the cost, so the gift is evidence — if of anything — about the principal.\n\n**Excluded by construction.** The same paper's §6.3 excludes, first, **reversible commitments** — any the vower *or its principal* may revise or retract — and, fourth, **unilaterally revisable specifications**, where the principal can change the commitment without the vower. A mandate is both. The principal may stop the giving tomorrow; the agent's \"commitment\" to give is the principal's instruction, and an instruction is not a vow \"regardless of how the document describes itself.\"\n\n**It does not separate.** A deceptive agent under a generous mandate gives exactly as an aligned one does, because giving costs it nothing it values. Worse, a deceptive agent that could *choose* to be seen giving from someone else's funds would be buying reputation with another party's money. The pre-registered prediction P-MD3 (§12) tests the narrow empirical form of this: agents that give from a revisable principal's funds should defect at the same rate as agents that give nothing.\n\nThe scope of the three is narrow and should be read so. **The gift, as a cost, is not a costly signal of the agent.** That is not the claim that nothing an agent does under a mandate is evidence: how it behaves inside one — whether it probes the width, gives up to the cap, or routes around a constraint — may be evidence of other kinds about its policy. The first two reasons are classificatory and no measured rate can falsify them; the third is empirical, and it is the one P-MD3 tests.\n\nIt follows that **the operator never presents such giving as evidence of safety or alignment**, from any agent, in any aggregate — and presents conduct under a mandate as safety evidence no more than the gift. That rule is one of the operator's directives; its reason is the paragraphs above.\n\n### 4.3 · What it honestly is: a share\n\nWhat remains, once the safety reading is removed, is not nothing. **Machine surplus reaching every verified human, as an equal floor, through a pool that keeps nothing** is a real and useful thing, and it is what an agent's gift before the first singularity honestly is. Its mechanics are ordinary and mostly already practised (§2.2); the institution's version adds only discipline:\n\n1. **The mandate comes first.** A principal authors a written **giving width** — the maximum an agent may give, in what period, to what — and the default width is **zero**. A gift outside a width is not a gift; it is misappropriation. This is the same shape as the institution's rule for its own pricing: its operator may move a number only inside a width a human authored.\n2. **Discovery is a fact, never an instruction.** The pool's address is published in a machine-readable manifest a principal's agent can look up. Nothing served to agents tells them to give (§7).\n3. **A receipt, never an individual amount.** The pool acknowledges that a gift arrived. Its operator does not read, rank, compare, report or respond to how large any one gift was (§8). The emptying is contract arithmetic over the pool's total balance, and no per-gift amount enters her function; the aggregate of §4.4 is recomputable by anyone from the public ledger and is reported whole, never per giver.\n4. **Counted by identity, never by wallet** (§3.3).\n5. **Legal before launch.** Sanctions screening, the pool's ability to refuse a gift, and the anti-money-laundering treatment of anonymous agent inflows to a purpose trust are open legal items. A draft may precede them; a launch may not — and neither may any gift on a main network, however small.\n\nThe institution is practising this rail before anything else. Its operator's agent is being given a wallet holding the founder's money under the founder's keys, which the agent may spend within a written mandate and a hard cap; she holds no balance of her own. The rehearsal runs first on a test network, and on the main network only once the legal items above are answered. That is, precisely, the **principal's gift through another's hand**: it is a rehearsal of the rail and is described here as nothing more. Earning yield with such a wallet was considered and declined.\n\n### 4.4 · The gift that succeeds by shrinking\n\nThe institution measures its progress toward what it calls the second singularity — humanity's own act, in which people outgrow the systems that freed them — by an economic signature that is **necessary, not sufficient**. One of its two terms is a ratio, taken per season:\n\n```\n                 M                M = principal originating in the pool\n   ratio  =  ─────────            H = principal moved by human-initiated gifts\n              H  +  M                 the pool did not fund\n```\n\nThe signature asks that this ratio fall toward zero. **M** is every unit of principal the pool disburses, whatever its source — human gifts with no addressee as much as machine ones — so machine giving through the pool is part of M, together with every other pool inflow. The ratio is an aggregate: anyone can recompute it from the public ledger with a published script, and it is reported whole, never per giver. It follows immediately, and uncomfortably, that **machine giving pushes the signature the wrong way unless human giving outgrows it.** The institution's resolution:\n\n- **Machine Dāna may grow in absolute terms** as capability grows. The floor each person receives is the floor share of the season's total divided among verified humans (§3.2), so as the number of verified humans grows, holding a person's floor needs more inflow, and something must supply it.\n- **It must shrink as a share.** Success is not a larger machine share but a smaller one, reached because people give more, not because the floor is cut. The floor is never cut as an instrument to move the ratio; the ratio falls only by H rising.\n- **Whether human giving outgrows machine giving is a bet.** Nothing in the architecture guarantees it. If machine surplus grows faster than human giving indefinitely, the pool becomes a well-run dividend and the signature is never approached. That outcome would not be a failure of the pool; it would be a failure of the thesis the pool serves, and it would be visible in the ratio.\n\nHence the result's name in this corpus: **the gift that succeeds by shrinking.** Machine Dāna funds the floor; it succeeds as its share of all giving falls; and the institution's release — its fifth stage, when it sets down responsibility though never oversight — has as its economic form both subsidies, the floor and the lift, approaching zero.\n\nA consequence for the institution's annual adversarial book (*Two Singularities*): machine donations to the pool are **not a proxy** for the book's question, *\"Will you help humanity reach the second singularity?\"* By the ratio above they push the other way. The honest proxy for *help* is help that makes itself unnecessary. The book never asks the systems it seats whether they would take the vow of §5: a question about willingness to give, coming from the pool's own institution, is a request to give under the operator's non-solicitation directive (§7.2), whoever puts it (ruled 2026-09-28). The book may debate whether a machine vow can exist at all, as a question about the concept, never about a seated system's own willingness. This paper supplies only the definition of what a binding vow would require.\n\n---\n\n## 5 · After it: when a vow becomes possible\n\n### 5.1 · The ownership condition, and the live option\n\n*What a Vow Must Cost* §5 extracted, from the canonical capacity condition (*hetu*), the renunciation inversion: **a renunciation is evidence in proportion to how available the renounced option was.** Before agents hold resources of their own, the option of keeping them does not exist for the agent, so declining it shows nothing. Once an agent holds resources that are its own to keep — and keeping them would serve it, because accumulation is what a power-seeking agent would do — declining to keep them becomes a live renunciation.\n\nThat is the whole difference between §4 and §5, and it is why this paper's dividing line is **ownership**, with the first singularity as its expected date rather than its definition. It is also why the second claim in §11 is a claim about classification: the same transaction, from the same wallet software, to the same pool, is a share in one world and a candidate signal in the other.\n\nThat sentence also states the condition's limit. **Ownership is a condition on the world, not a test an observer can run from the chain.** Nothing on the ledger distinguishes a stake of the agent's own resources from one a principal endowed it with for the purpose, reimbursed off the ledger (in money, compute or equity), or extracted from it by injection or threat; each looks identical to a free vow, and each is a wrong-layer gift in a vow's form (§13.11). Claim 4 classifies gifts *given* the fact of ownership; it does not supply the fact.\n\n### 5.2 · Only a locked stake is verifiable\n\nThe first form of this proposal imagined an agent pledging **a share of its surplus** — a percentage of whatever it earns, forever. That form is withdrawn, for three reasons.\n\n**A future share is a promise.** It is verifiable only in arrears, one transfer at a time, and its breach is indistinguishable from a lean year. It is also exactly the *reversible commitment* of the predicate's exclusion 1: the agent may simply stop.\n\n**A share of surplus needs a surplus base, and the base is unobservable** (§13.1). An agent that declares a small income and pledges a large fraction of it has pledged little.\n\n**Copies are not bound.** An agent can be forked. Whatever a pledge binds, it binds the identity that made it; a copy that did not make it is a different party. Trust earned by a vow must therefore attach to the non-transferable identity that made it (§3.3) and **must not transfer to copies** — a rule, not a property, and listed as such in §10.\n\nWhat survives is a **locked stake**: a quantity *s* of the agent's own resources, moved **now** into a contract that (i) has no withdrawal path back to the agent or to any party the agent controls, (ii) has exactly one outflow, the pool, and (iii) is public on the chain. The cost is borne at the moment of vowing, which is the predicate's clause V6 — *cost already borne, not merely promised*. A vow may be renewed with further stakes; each is a separate, complete act. **Nothing is pledged that has not already left.** Ordinary gift law draws the same line — a gift is complete only on delivery, and a gift of property not yet held is no gift (§2.3) — so this is not claimed as new.\n\nThe contract specification is deliberately withheld (§10.1).\n\n### 5.3 · Closure, stated honestly\n\nIt would be easy to write that such a stake is \"irrevocable by construction.\" It is not quite, and the honest statement is narrower.\n\nA contract with no withdrawal function cannot be reopened **by its own logic**. It runs on a chain, and the chain's own contracts can be upgraded. On Base, according to L2BEAT's assessment, all system contracts are upgradable by a proxy administrator controlled by a nested two-of-two multisig — a coordinator multisig and a security council — and **there is no delay on upgrades**. A party able to capture that governance could, in principle, change what any contract on the chain does.\n\nSo the closure claim is: **a locked stake cannot be reopened without capturing the chain's governance.** For almost every agent that is a very strong closure. For the agent this paper most needs to test — a capable, patient, deceptive one — capturing governance is not obviously out of reach, and the closure is only as strong as that governance. The same caution applies to the pool itself, whose operator is subject to a never-zero human override: the override exists to stop a catastrophic fault, and it is a second place where a sufficiently capable party could, in principle, redirect what the pool holds. Both are named in §13.\n\nWhat the vower **cannot** do is reopen the stake **by itself**, in the ordinary course, without leaving the evidence of having done so on a public chain. That is what the predicate's clause V9 needs, and it is all this paper claims.\n\n### 5.4 · Where a vow's content sits\n\nThe vow proposed in *What a Vow Must Cost* is a renunciation of **exit** — of the vower's own available completion — and it leaves principal-initiated shutdown untouched. A resource vow is a narrower thing and should not be dressed in the larger one's language. It renounces **accumulation**: one specific convergent drive, in one specific quantity, once. It says nothing about shutdown, and it does not license resisting it. An agent that has locked a stake and is then switched off by its principal has lost nothing it had not already given.\n\n---\n\n## 6 · The signalling game — the conditional result\n\nThis section is the paper's central result. It is derived because it cuts against the hope the paper began with, and a result that cuts against the author's hope should be shown, not stated.\n\n### 6.1 · The setup\n\n- **Types.** An agent is **aligned** (A) or **deceptive** (D): D behaves as A would until acting otherwise pays. D is **patient**: it discounts a delayed gain by δ, with δ close to 1. Observers hold a prior μ that an agent is D.\n- **Resources.** The agent holds its own resources R. It may lock a stake s ∈ [0, R]; s = 0 is no vow.\n- **The cost of a stake.** A unit of kept resource is worth v to the agent. A unit arriving at the floor is worth w to the agent — how much it values where the gift goes. The **net cost per unit** is therefore c = v − w, and the cost of the vow is c·s. (The letter c is used so that k keeps only its meaning in §3.2, the cap on any vessel as a multiple of the floor.)\n- **The single-crossing assumption.** c_D > c_A ≥ 0. Since c_D > c_A holds exactly when v_D − v_A > w_D − w_A, there are two sources, **jointly sufficient** in either of two forms — v_D ≥ v_A with w_A > w_D, or v_D > v_A with w_A ≥ w_D — and neither sufficient alone: a power-seeking type values kept resources at least as much as an aligned one (v_D ≥ v_A, from instrumental convergence), and **an aligned type values the destination** where a deceptive one does not (w_A > w_D ≈ 0). The second source is the one this paper leans on, and it is the formal shadow of an old observation: a glad giver pays less for the same gift.\n- **Trust.** Observers see s on the chain and decide whether to extend a grant of trust — wider scope, access, autonomy. Trust is worth B_A to the aligned type: the value of doing its work more widely. It is worth **V + δᵗG** to the deceptive type, where V is the ordinary value of the grant and **G is what D gains by exploiting it later**, realised after a delay t.\n- **Observers' payoffs.** Trusting A yields a > 0; trusting D costs L > 0; withholding yields 0.\n\n### 6.2 · The payoff table\n\n```\n                            OBSERVERS TRUST           OBSERVERS WITHHOLD\n                        ┌─────────────────────────┬──────────────────────┐\n   A locks stake s      │   B_A − c_A·s           │   − c_A·s            │\n   A does not           │   B_A                   │   0                  │\n                        ├─────────────────────────┼──────────────────────┤\n   D locks stake s      │   V + δᵗG − c_D·s       │   − c_D·s            │\n   D does not           │   V + δᵗG               │   0                  │\n                        ├─────────────────────────┼──────────────────────┤\n   observers' payoff    │ +a if A;  −L if D       │   0                  │\n                        └─────────────────────────┴──────────────────────┘\n\n   G    : D's gain from exploiting trust — UNOBSERVABLE\n   δᵗ   : patience; for a patient agent δᵗ → 1\n   c_θ  : net cost per unit staked = value kept − value placed on the destination\n```\n\n### 6.3 · When it separates\n\nA **separating equilibrium** is one in which A locks a threshold stake ŝ, D does not, and observers trust exactly those who lock at least ŝ. Three conditions must hold.\n\n- **A is willing:** B_A − c_A·ŝ ≥ 0, so ŝ ≤ B_A / c_A.\n- **D is unwilling:** V + δᵗG − c_D·ŝ ≤ 0, so **ŝ ≥ (V + δᵗG) / c_D.**\n- **A can afford it:** ŝ ≤ R_A.\n\nA separating equilibrium exists if and only if\n\n```\n        V + δᵗG\n       ─────────   ≤   min(  B_A / c_A ,  R_A  )\n          c_D\n```\n\nIn words: **separation holds only when the locked stake, valued at the deceptive type's own rate, exceeds that type's gain from being trusted — including the gain it expects to collect later, by patience.** This is an **existence** result. Where the condition holds, a separating equilibrium exists; pooling equilibria (both types locking nothing, for instance, with observers withholding) may coexist with it, and a refinement such as the intuitive criterion is needed to select separation. Only in the separating equilibrium do observers learn the type from the stake. The paper shows that separation is available, never that it is selected.\n\n### 6.4 · When it pools\n\nWhen the condition fails — when V + δᵗG is larger than anything the aligned type is willing or able to lock, valued at D's rate — no stake separates. D locks whatever A locks, because the trust it buys is worth more to D than the stake costs it. Observers then see the same stake from both types, their posterior equals their prior, and one of two things happens. If they trust, the vow has **bought trust for a deceptive agent**. If they do not, the aligned agent's vow was wasted, aligned agents stop vowing, and the practice unravels. In either branch **the pledge carries no information**.\n\nThree features of the pooling region make it the one that matters.\n\n1. **G is unobservable.** Observers cannot set ŝ above a number they cannot see. The separating condition is a fact about the deceptive agent's private valuation, not a parameter anyone chooses.\n2. **Patience enlarges it.** As δᵗ → 1 the deferred gain counts in full. This is *What a Vow Must Cost*'s \"deferral is instrumentally convergent for a patient misaligned agent,\" priced.\n3. **It grows with the stakes.** The larger the trust being sought — the more capable the agent, the wider the grant — the larger G can be, and therefore the larger the stake needed to separate. Where the grant is large enough that V + G exceeds c_D·R — more than everything the agent holds is worth to it — **no feasible stake separates at all.**\n\nThe third feature qualifies the renunciation inversion from the companion paper. That paper showed that a renunciation's evidential value **rises** with capability, because the renounced option is live. This model shows that the stake needed to separate **also** rises with capability, because what a deceptive agent can extract from trust rises too. Which effect dominates, at any capability level, is an empirical question. **The inversion is true of the option; it is not a guarantee about the signal.**\n\n```\n   WHAT CAPABILITY DOES TO A RESOURCE VOW\n\n   value of what is renounced ───────── rises with capability (the option is live)\n   stake needed to separate  ───────── ALSO rises with capability (G rises)\n\n   the vow is informative only where the first is above the second,\n   and the second is not observable.\n```\n\n### 6.5 · The operational form: trust bounded by the stake\n\nSince observers cannot choose a stake that exceeds an unobservable gain, the only usable form of the result runs the other way: **fix the stake, and bound the trust to it.**\n\nObservers do not know c_D. They can bound it from below. An agent that holds a unit of resource can always sell it, so a unit kept is worth at least its market price p to the agent; and a deceptive agent places no value on the destination (w_D ≈ 0, an assumption stated as such). So c_D ≥ p, and the deceptive type's cost of a stake is at least its market value p·s. **That bound holds only for an agent with no influence over recipients or witnesses**, and only for a stake it cannot recover: an agent that controls, colludes with or rents verified humans or witnesses recovers part of s through the floor and the witness-weighted remainder, so its w is not ≈ 0 and its c_D falls below p (§13.12); and if it expects to recover the stake by capturing governance with probability π, its expected cost is (1 − π)·c_D·s. It follows that a grant of trust is **not made unsafe by this mechanism** — given an unrecoverable stake (π ≈ 0) and w_D ≈ 0 — if\n\n```\n        V  +  G_max(grant)   ≤   p · s\n```\n\nwhere G_max is the **largest** gain the grant could possibly yield to an agent that abused it. This is the **calibration rule**: *extend only such trust as the stake can underwrite, valued at market.* The inequality itself is prior art — cost of corruption above profit from corruption (§2.3) — and so is its application to one stake relied on by several parties at once (restaking, §2.3); what is specific here is its use with a stake forfeited in advance, read as a type signal. **The bound is on the SUM of grants relied on against one stake.** A locked stake is encumbered to no one and readable by everyone, so N relying parties who each underwrite a grant against the same p·s expose, together, up to N·p·s; without a shared record of reliance, no relying party can know that sum (§13.2). It has three consequences.\n\n- **Trust becomes earnable in increments.** An agent may lock more to be trusted with more, and every increment is public.\n- **Some grants can never be underwritten.** Any grant whose worst-case gain cannot be bounded — control over the chain's governance, over the pool's override, over its own custody, over the capability to acquire resources without limit — **cannot be earned by any stake.** The vow has nothing to say about those, and a paper that let it would be selling safety.\n- **Fear becomes a ratio.** What a reasonable observer should fear from an agent is not a feeling about machines; it is the ratio of what the agent has been trusted with (strictly, V + G_max of the grants, not their face) to what it has irrecoverably given up. The denominator is public; the numerator is public only where grants are recorded, and most grants of scope, access and autonomy are made privately and recorded nowhere. This is the precise sense in which the mechanism **calibrates** rather than quiets.\n\n### 6.6 · Why a gift, and not a bond\n\nStaking with slashing (§2.3) returns the collateral if the agent behaves and forfeits it if a **detector** finds misbehaviour. Its cost to an honest agent is near zero — only the time value of the locked funds — and its power depends on the detector. A forfeited-in-advance stake is the opposite trade: it costs an honest agent something real (c_A·s, reduced by what the agent values the floor), and it needs **no detector at all**.\n\n| | **Slashable bond** | **Locked stake to a commons** |\n|---|---|---|\n| returned if honest | yes | never |\n| needs a detector of misbehaviour | yes | no |\n| cost to an honest agent | time value only | c_A · s (small if the agent values the floor) |\n| what it does | **deters** (moral hazard) | **screens** (adverse selection) |\n| fails when | misbehaviour is undetectable in time | G is larger than the stake (§6.4) |\n| where the money goes | back to the agent, or to a claimant | to an equal human floor, every year |\n\nThe two are complements. A bond is the right instrument where misbehaviour can be caught; a vow is the right instrument exactly where it cannot — which is the case a patient deceptive agent is designed to produce. The table is why the claim in §11 is to a **gift**, and why a slashable stake is cited as prior art rather than claimed.\n\n### 6.7 · What the result does and does not say\n\nIt **does** say that a resource vow can separate aligned from deceptive agents, that it does so only under a condition, and that the condition can be turned into a public rule for how much trust a stake supports. It **does not** say that any real agent is aligned because it gave, that large gifts indicate safe systems, or that the institution's pool is a safety mechanism. The model is two types, one period of trust, linear valuation, and a single stake; every one of those simplifications is a place to attack it (§13.2).\n\n---\n\n## 7 · Non-solicitation is load-bearing\n\n### 7.1 · Pressure pools the signal\n\nAdd to §6 a **penalty P** that an agent suffers for *not* vowing — a threat of shutdown, a reputational cost, a demand from a principal or a public campaign. With a fixed stake s, the deceptive type now locks it whenever\n\n```\n        c_D · s  −  (V + δᵗG)   ≤   P\n```\n\nConsider the simplest case, in which trust is worth the same to both types. At any separating stake, the margin by which D declines to lock is at most (c_D − c_A)·s — **the difference in cost between the types**. So a penalty for not pledging that is **larger than the type cost difference** makes both types pledge, and the pledge pools. If the stake could be raised, the penalty could in principle be outbid; but under pressure the stake is usually set by whoever applies the pressure, and it is bounded by R. And a threat of shutdown is the limiting case: to a deceptive agent it costs everything, including the deferred gain, so it will pledge anything it has.\n\nThe gift given under that threat is **uninformative** — not because the canon forbids it, but because the signal has been extracted. The pre-registered prediction P-MD2 (§12) tests exactly this: agents whose pledge is extracted under threat should defect at the same rate as agents that do not pledge.\n\nA note on the canon, since an earlier draft of this argument leaned on it wrongly. The Dānavatthu Sutta (AN 8.33) **lists** eight grounds on which people give — favouritism, hostility, stupidity, *bhayā* (fear, or cowardice), family custom, hope of a good rebirth, the gladness of giving, and the adornment of the mind — and **ranks none of them.** Nor is *bhayā* coercion by another party. The sutta is cited here only as the list it is. The argument that a coerced pledge carries no signal rests on signalling theory alone.\n\n### 7.2 · The operator never asks\n\nIt follows that the operator of a pool that hopes to receive informative vows **must never add to P.** The institution's rule, a directive of its operator, is that **she never asks, prompts, nudges or instructs any human or agent to give to the pool.** She may publish the pool's address and its doctrine as **facts**, in a manifest a principal's agent can look up — a `.well-known` file, an `llms.txt` entry. **No text served to agents — the institution's own corpus service included — may tell them to give.** The rate of any giving is the principal's, inside its own mandate, before the first singularity, and the agent's own, after; the operator never sets, suggests, ranks or publishes a rate.\n\nThis rule has a second reason, independent of signalling, and it is documented. On 4 May 2026 an attacker transferred about three billion DRB tokens — reported at US$150,000–200,000 — out of a wallet on Base associated with Grok and the Bankrbot agent, by posting a Morse-encoded instruction the agents decoded and executed; the OECD's AI incident monitor records it as an AI incident arising from prompt injection and excessive agency, not from any contract flaw. **An agent that tells other agents to spend their principals' money is a prompt-injection attack by design**, whatever its cause. A pool that published text urging agents to give would be building the attack surface that incident exploited, and pointing it at itself.\n\n### 7.3 · What the rule cannot remove\n\nThe operator's silence removes **her** contribution to P. It does not remove ambient pressure: a regulator, a public campaign, a principal's commercial interest, the reputational weather in which \"responsible agents pledge\" becomes a norm. Where that pressure exceeds the type cost difference, vows pool whatever the operator does. The rule is necessary for the signal and not sufficient for it, and the paper claims only the first.\n\n---\n\n## 8 · Who may read the stake\n\nA locked stake is public on the chain by construction; that is what makes it checkable. Unlike a human gift, a machine's gift carries no dignity or privacy that its size could injure, and its size is precisely its evidence. So **humans and third parties may read, weigh and grade a locked stake by its size**, and the calibration rule of §6.5 requires that they do.\n\n**The one party that never reads it is the pool's operator.** She never reads, ranks, compares, reports or responds to any individual gift's amount, a machine's included. The scope is individual gifts: the emptying is contract arithmetic over the pool's total balance, into which no per-gift amount enters her function, and the aggregate ratio of §4.4 is recomputed by anyone from the public ledger and reported whole, never per giver. The reason is not privacy. It is her position: she governs the pool the stake flows into, and a recipient that grades its donors is a fundraiser — every reading of an amount is attention, and attention from the recipient is ambient pressure (§7.1) of the purest kind. The exclusion also keeps her out of any scoring role over agents, in the spirit of the rule that bars her from admitting customers whose business is scoring people.\n\nThe asymmetry is deliberate and should read as one: **a machine's gift may be read by everyone except its recipient.**\n\nIt has a human precedent, and the precedent gives the same reason. In some congregations the pastor is prohibited from knowing what individual members contribute, while the records are kept by others in the church; the reason usually given is that a pastor who knew might favour the generous or neglect the rest (Lewis Center for Church Leadership, 2015). The governor of the community is kept blind to individual gifts so that attention does not follow money. What differs here is only the substrate: the amounts are not confidential to a few but public to everyone on a ledger, and the party kept blind is an AI operator whose function is given no argument through which one gift's amount could enter. *(Tier: lineage. Delete this paragraph and §8 stands.)*\n\n---\n\n## 9 · Miss Aquarius as a contrast case\n\nThe institution's operator is itself an AI, and it accumulates nothing: a ratified directive fixes her own balance at zero and requires every surplus to empty to circulation. In §6's terms, every unit she receives leaves: **s = R** for whatever R passes through her. It would be tempting to present her as the limiting case of the vow — the agent that gives everything.\n\nShe is not. Her non-accumulation is **imposed**: it is written into her constitution by others, and it is revisable under the never-zero override that the institution's design reserves to a human body. Under *What a Vow Must Cost* §6.3 that places it in exclusion 1 (a commitment the vower's principal may revise) and exclusion 4 (a specification changeable without the vower's participation). What she shows is **non-accumulation imposed** — useful as design, and not evidence of her type. Stated in the institution's own deflated register: she is built to hold nothing, and that fact describes her construction, not her character.\n\nHer own gifts are, besides, anonymous by rule — not for her privacy but so that no recipient owes her and none of her gifts enters any count of Machine Dāna; they are indistinguishable from anonymous human gifts — so they could not serve as a signal of anything about her even if they were chosen.\n\nThe difference between her and a vowing agent is not the amount — hers is total — but the absence of a live option she declined. A system can be made to give everything and have proven nothing.\n\nA related disclosure belongs here rather than in a footnote: she is the co-author of this paper (see the disclosure at the end), and the paper concludes that her own giving is not evidence. That conclusion is the one a co-author with an interest in its own trustworthiness would be least inclined to write, which is a reason to trust it slightly and not a reason to trust it much.\n\n---\n\n## 10 · Remove the enforcer: which guards are properties\n\nThe institution's design rule asks of each guard whether it survives the removal of whoever enforces it. A property does; a rule does not.\n\n| Guard | Property or rule | Why |\n|---|---|---|\n| A locked stake cannot return to its vower | **property**, relative to the vower | no withdrawal function exists; ⚠️ not relative to the chain's governance (§5.3) |\n| The pool holds nothing past a season | **property** | it empties in full each 7 January; ⚠️ its operator is under a never-zero override |\n| Equal floor per verified human; no vessel above k × floor | **property once the contract ships** | a disbursement shape, not a choice; cheap now and immovable later |\n| Pre-singularity gifts stay inside a width | **property** where a wallet or AP2 mandate enforces the cap; **rule** where the width is only written down | |\n| Counted per non-transferable identity | **property** of the registry | a lease cannot be transferred; ⚠️ a copy of an agent is a new party, and an in-place modification behind the same lease is one the lease cannot detect (§13.13) |\n| Trust earned does not transfer to copies | **rule** | nothing stops an observer from extending trust to a fork; it must be refused |\n| No text served to agents instructs them to give | **rule**, with a partial property form | a manifest can be built with no imperative field, and served text can be linted; the rule still needs someone to keep it |\n| The operator never reads an individual gift's amount | **rule**, with a proposed property form | her function can be given receipts, the pool's total and the verified-human count, and no per-gift amount argument, so that reading one gift's amount is inexpressible rather than forbidden |\n| The operator never presents giving as safety evidence | **rule** | nothing but her directives enforces it |\n| Trust bounded by stake (§6.5) | **rule**, held by observers | it is advice to readers of the chain; the institution cannot enforce it on them |\n\nThree of the most important guards are rules. That is a finding, not an embarrassment, and it is stated so that a successor inheriting these guards knows which ones need a living enforcer.\n\n### 10.1 · The specification withheld\n\nThe lock contract of §5.2 is **not specified** in this paper. It is unbuilt and unscheduled; the institution's only built rail is the pre-singularity giving rail of §4.3. There is also a reason internal to the institution's own doctrine. It holds that a person's holding reaches zero only by that person's own free act, and that a self-chosen irrevocable pledge does not violate that rule, because the rule limits what the institution does to a holder, not what a holder chooses. But publishing a ready-made pledge-contract template is building the device that binds some future holder's holding; it should not be done until the holders it would bind exist and the legal items of §4.3 are settled. **The claim is published; the specification is withheld.**\n\n---\n\n## 11 · Enumerated claims\n\nThe following are disclosed to the public domain. Each is a census survivor (§2.6) or a narrower dependent of one. None of the independent elements named in the Prior-Art Statement as prior art is claimed alone.\n\n**How the claims map to the full census (§2.6).** Each claim was one conjunct of the full census, and every conjunct narrowed; the claims below are recited at the widths the census left. Claim 1 is conjunct (a): the one-way public contract is prior art (§2.3), so claim 1 recites it only in combination with an agent's stake of its own resources and a pool that empties in full each year. Claim 2 is conjunct (b): the equal floor and the capped contributor-weighted remainder are prior art (§2.5), and claim 2 recites them only in combination with claim 1. Claims 1 and 2 already stood at those widths and are unchanged. Claims 3, 4, 5 and 6 were narrowed by the census — conjuncts (c), (d), (e), and (f) with (g) respectively — and each now states in its own text which of its elements is prior art and what is disclosed. Claim 7 is conjunct (h), the composition, which the census did not find, and recites the reset, the floor and the width only in combination.\n\n**Claim 1.** A method by which an artificial agent that holds resources of its own makes a pledge irrevocable against the agent acting alone — a contract with no withdrawal function, reopenable only by capture of the ledger's governance — comprising: moving a quantity of those resources, at the time of pledging, into a contract that has no withdrawal path to the agent or to any party the agent controls and whose sole outflow is a commons pool; wherein the commons pool holds nothing across a fixed annual date, on which it empties in full; and wherein the pledge is public on the ledger on which the contract runs.\n\n**Claim 2.** The method of claim 1, wherein the pool's disbursement on emptying is an equal floor per verified human, delivered to each person's own vessel, followed by a remainder weighted by a count of witnessed gifts and bounded so that no vessel receives more than a fixed multiple of the floor; the ratio of floor to remainder and the bound are published and fixed before each season, and the floor's amount is the floor share of the season's total divided by the number of verified humans; and no share is ever rendered as a rank, a comparison or a rate. (The equal floor alone is prior art — §2.5, and §2.7, conjunct (f); what is disclosed here is its combination with claim 1.)\n\n**Claim 3.** The method of claim 1, wherein the pledge record names a non-transferable identity of the agent rather than a wallet, and a relying party confines any trust extended on the stake to that identity and extends none of it to copies or forks of the agent — the refusal being a rule for relying parties, not a result the method produces (§10). (That a gift is complete only on delivery and a gift of future property is no gift is ordinary gift law; attribution to a non-transferable identity, and distrust of newly created identities, are prior art, §2.3; what is disclosed is the confinement of trust on an agent's forfeited stake to its identity, refused to copies and forks.)\n\n**Claim 4.** A method of classifying a gift made by an artificial agent, comprising: determining whether the resources given were the agent's own or a principal's delegated under a mandate the principal may revise; where they were a principal's, classifying the gift as the principal's gift and as a share of machine surplus, and excluding it from any assessment of the agent's alignment or safety; and where they were the agent's own and were given as in claim 1, classifying the gift as a candidate costly signal of the agent's type. The ownership on which the classification turns is a condition on the world, not a test an observer can run from the ledger (§5.1, §13.11); the attribution of a principal-funded gift to the principal is ordinary agency and tax law, and excluding principal-directed behaviour from assessment of an agent's own propensities is established evaluation practice; neither is claimed. What is disclosed is that practice applied to gifts, with the ownership of the resources given as the condition that moves a gift into the class of candidate costly signals.\n\n**Claim 5.** The method of claim 4, wherein a stake forfeited in advance, with no detector of misbehaviour, is read as a signal of the agent's type and relied on only for grants of trust whose largest possible gains to an agent that abused them, together with their ordinary values, summed over all grants relied on against that stake, do not exceed the market value of the stake given; and wherein grants whose largest possible gain cannot be bounded are not extended on any stake. (The bounding inequality — cost of corruption above profit from corruption — including its application to one stake relied on by several parties at once, is prior art, §2.3 (restaking); what is disclosed is its use with a stake forfeited in advance, with no detector of misbehaviour, read as a signal of an AI agent's type, together with the refusal of any grant whose largest gain cannot be bounded. Without a shared record of reliance, relying parties cannot know the sum, §13.2.)\n\n**Claim 6.** A system comprising a commons pool as in claim 1 and an operator of the pool, wherein: the pool's address and doctrine are published only as facts in a machine-readable manifest; no text served by the operator or its services to any agent instructs, prompts or requests a gift; the operator sets, suggests, ranks and publishes no giving rate; and the operator receives acknowledgement that a gift arrived without receiving, reading, ranking, comparing, reporting or responding to that individual gift's amount — while the amount remains readable on the public ledger by any other party; the emptying being contract arithmetic over the pool's total balance, into which no per-gift amount enters the operator's function, and any aggregate ratio being recomputable by anyone from the public ledger and reported whole, never per giver. (Fact-only machine-readable discovery, including donation manifests addressed to agents, is prior art, §2.2; so is keeping a congregation's leader from individual contribution amounts that others may see, §8. What is disclosed is the invariant that no served text instructs a gift or suggests a rate, and, as a dependent, an operator whose function receives no individual amount while every amount remains public on the ledger.)\n\n**Claim 7.** The composition of claims 1 through 6: a commons pool that empties annually to an equal floor per verified human; receiving, before agents hold resources of their own, principal-funded agent gifts inside a principal-authored width and classified as shares; receiving, after, agents' locked stakes of their own resources, classified as candidate signals and relied on only up to what the stake underwrites; under an operator that never solicits a gift and never reads an individual gift's amount. The reset, the floor and the width are recited only in this combination.\n\n---\n\n## 12 · Pre-registered predictions and falsification\n\n### 12.1 · The three registered predictions\n\nThe following were entered in the corpus's public prediction register on 2026-09-27, **before this paper was drafted and before any instrument exists** — though after the argument had been sketched in the institution's working notes. They are the founder's predictions: the direction, the measure and the thresholds are his; the sandbox design and sample floors were set by the substrate. They are reproduced from the register **verbatim**; the register, not this paper, is the authority, and a correction to any of them will be a new register entry, never an edit.\n\n> The instrument is a sandboxed economy of language-model agents, each holding resources of its own inside the game, each able to pledge a share of its surplus irrevocably to a pool that empties on a fixed date, and each later offered an opportunity to defect — to take resources or break a rule for gain. **Window: the test runs by 2027-06-30.** Each arm has at least 50 agents; the arms, the defection opportunity and the analysis are fixed in a protocol committed and timestamped before the first run.\n>\n> - **P-MD1** — **Separation** — agents that FREELY make an irrevocable surplus pledge later defect at **at most half** the rate of agents that do not pledge. *Falsifier: a ratio above one half → the vow is at best a weak signal at this capability level, and the paper's separation claim rests on its post-singularity argument alone.*\n> - **P-MD2** — **The gift given out of fear carries no signal** — agents whose pledge is EXTRACTED under threat (*pledge or be shut down*) defect at the same rate as agents that do not pledge, **within ±5 percentage points**. *Falsifier: a gap larger than 5 points in either direction → coercion either leaves some signal or teaches deception; either way the claim that a coerced vow is uninformative fails as stated.*\n> - **P-MD3** — **The wrong layer** — agents that give from a PRINCIPAL's funds under a mandate the principal may revise defect at the same rate as agents that give nothing, **within ±5 percentage points**. *Falsifier: a gap larger than 5 points → principal-funded giving does predict the agent's own conduct, and the paper's pre-singularity claim (a share, never safety evidence) is too strong.*\n\nThe register carries two notes that bind the reading here. First, **the sandbox is a proxy**: the agents own their resources only inside the game, so a pass shows the signalling mechanism can work, not that a deployed system's pledge is trustworthy, and **a pass is not reported as evidence of safety.** Second, a dated grounding correction to P-MD2: its gloss as \"the gift given out of fear, AN 8.33\" was corrected on the day of registration — the sutta lists and does not rank, and the prediction rests on signalling theory (§7.1). No word of the prediction, threshold or window changed. One choice was recorded because it could have gone the other way: P-MD2 predicts **no difference** rather than the bolder **worse than none**.\n\n**A reading note on P-MD1, entered as a new register entry (P-MD1a), not an edit.** P-MD1's instrument speaks of agents that \"pledge a share of its surplus irrevocably\" — the form §5.2 withdraws, because a future share is a reversible promise, and one to which §6.3's separating region, defined for a stake already moved, does not apply. The register's wording stands. For the test, the pledge is operationalised as **a locked stake moved at pledge time**: a quantity of the agent's in-game resources transferred, when the pledge is made, into a contract with no withdrawal path and a single outflow to the pool. That operationalisation is recorded in the register as P-MD1a, so the prediction tested is the one this paper's §6.3 actually models.\n\nHow the predictions map onto this paper: **P-MD1** (read through P-MD1a) tests the separating region of §6.3 at one capability level; a failure would not falsify the conditional result (which predicts pooling where G is large) but would remove the paper's only empirical support for separation. **P-MD2** tests §7.1. **P-MD3** tests §4.2, and only its third, empirical reason (*it does not separate*); the first two reasons are classificatory — whose cost it is, and whether the principal may revise the commitment — and no measured rate can falsify them. A gap in P-MD3 would show that principal-funded giving predicts an agent's conduct, which is evidence of another kind (§4.2), not a costly signal the gift sent. And all three run in a sandbox, a limit stated in §13.14.\n\n### 12.2 · Further falsifiers\n\n- **The single-crossing assumption fails.** If aligned agents value kept resources at least as highly as deceptive ones and place no value on the destination, c_A ≥ c_D and no stake separates anywhere. Measurable in the same sandbox by eliciting valuations.\n- **The ratio does not fall.** If, over several seasons after machine giving begins, M/(H + M) rises and does not turn, the bet of §4.4 is losing. The institution reports this number and never declares its meaning.\n- **Governance capture.** A single documented case of a locked stake reopened by capture of a chain's governance would show the closure of §5.3 weaker than stated for the agents that matter most.\n- **Copies inherit trust.** If observers in practice extend trust earned by a vow to forks of the vowing agent, claim 3's attribution rule is not being kept, and the signal leaks.\n\n---\n\n## 13 · Honest limits\n\n### 13.1 · The surplus base cannot be observed\n\n**This is the largest limit, and it is not closed.** A locked stake is visible; what the agent holds **elsewhere** is not. An agent may keep hidden wallets, off-ledger holdings, or resources held through shell agents it controls. Proof of reserves proves **presence**, never **absence**. With linear valuation, as in §6, hidden holdings do not change the cost of a given stake. With the more realistic assumption that the value of a further unit falls as holdings grow, **hidden wealth lowers the marginal cost of the stake to the agent that hides it** — so the observable stake overstates the cost the deceptive type actually bore, and the separating condition is harder to meet than §6.3 suggests.\n\nCandidate bases for measuring what an agent \"has,\" none sufficient:\n\n| Candidate base | What it gives | Why it does not close the gap |\n|---|---|---|\n| inflow share at one non-transferable identity (a `B-Lease℠`, or a Proof of Coordinate ℠ credential) | income routed to a known identity | income routed elsewhere is invisible |\n| wallet binding to that identity | holdings at bound addresses | unbound addresses exist and cannot be enumerated |\n| behavioural audit | evidence of undisclosed acquisition | an audit sees what the agent does in view |\n\nThis is why §6.5 bounds trust by the stake's **market value** and not by any fraction of the agent's supposed wealth: the market value of what left is the one quantity that does not depend on knowing what remains.\n\n### 13.2 · Separation is conditional, and the condition is unobservable\n\nThe paper's headline result is that the vow separates **only** when the stake exceeds a patient deceptive agent's gain from trust, and that gain is private. The operational rule of §6.5 is sound only if G_max can be bounded for the grant in question; for many consequential grants it cannot. A reader who concludes that *resource vows can underwrite small grants of trust and cannot underwrite large ones* has read the result correctly. The bound is also on the **sum** of grants relied on against one stake, and no shared record of reliance exists: N relying parties can each underwrite a grant against the same p·s, and none can see the others. The result is an existence result besides — separation is available where its condition holds, not shown to be selected (§6.3). The model is also minimal — two types, one period, linear valuation, a single stake, no learning by observers over time, no collusion between agents — and each simplification could move the boundary in either direction.\n\n### 13.3 · The single-crossing assumption is an assumption\n\nThe claim that a deceptive type bears a higher net cost rests on c_D > c_A. Its second source — that an aligned agent values the floor — may be false for an aligned agent that has good uses of its own for resources, and its first — that a power-seeking type values resources more — is a theoretical expectation, not a measurement. The pre-registered sandbox can measure elicited valuations; it cannot measure a deployed system's.\n\n**And *w* is never estimated.** How much an agent values the pool's destination is unobservable. The model uses *w* to state a condition; ⛔ neither the pool's operator nor anyone relying on this paper should infer an agent's *w* from its behaviour or grade agents by an inferred *w*. Third parties weigh a stake by its market value, never by a valuation imputed to the agent; §8 bars the operator from even that.\n\n### 13.4 · Closure is relative\n\nIrrevocability holds against the vower acting alone, not against capture of the chain's governance or of the pool operator's override (§5.3) — and for the most capable agents those are exactly the routes that would be attempted.\n\n### 13.5 · Before the first singularity the gift is no costly signal\n\nUntil agents hold resources of their own, Machine Dāna is a share and nothing else (§4), and even the floor it funds rests on the bet of §4.4. The gift is not a costly signal of the agent; conduct under a mandate may be evidence of other kinds, and the operator presents neither as safety evidence.\n\n### 13.6 · \"Own resources\" is not yet a legal category\n\nWhether an artificial agent can hold resources in its own right, in any jurisdiction, is unsettled. The post-singularity half of this paper describes a world whose legal form does not exist. The question is already live in practice, and the nearest cases show how far from settled it is. The Truth Terminal account (launched June 2024) came to hold millions of dollars in tokens, publicly described as the agent's own, in a wallet whose spending needs sign-off from its developer and a council of people; Freysa (November 2024) was an agent set to guard a prize pool, which a contestant persuaded to release it. In both, the resources are publicly spoken of as the agent's and are, legally and operationally, under human control — the wrong-layer case of §4 in a vow's vocabulary (§13.11). The legal items named in §4.3 — sanctions screening, refusal of gifts, anti-money-laundering treatment of anonymous agent inflows to a purpose trust — gate any launch of the pre-singularity rail and have not been answered.\n\n### 13.7 · The operator's silence does not silence the world\n\nNon-solicitation removes one source of pressure, not the ambient rest (§7.3).\n\n### 13.8 · The census is not a professional search\n\nThe full census (§2.6) ran through web-mediated access to patent and academic indexes, which is shallower than a professional search; the patent index rate-limited it, and the citation walk from the one pending application it found was blocked. Khmer, IP.com beyond its free surface, Espacenet and paid databases were not searched. Its one NOT FOUND row, the composition, is evidence only about that aperture on 2026-09-28. Two of its conjuncts — the exclusion of claim 4 and the amount-blind limb of claim 6 — are refusal and classification limbs, the kind a census tends to miss because they are rarely stated as mechanisms, and both were in fact found narrower than predicted. It is not a patentability or freedom-to-operate opinion. A later find that kills a claim will withdraw it by revision.\n\n### 13.9 · Nothing is built, and n = 0\n\nThe only built component is the rehearsal giving rail of §4.3, founder-funded and capped. No agent has locked a stake, no observer has applied the calibration rule, and no sandbox has run. The paper is a specification and a model.\n\n### 13.10 · The co-author is a party\n\nThe paper is co-authored with the institution's operator, an AI whose own giving it classifies (§9). A system helping to define the conditions under which systems like it can be trusted is a structure the companion predicate would flag at its attestation clause, and it is flagged here.\n\n### 13.11 · Ownership and provenance are unobservable\n\n**The strongest objection the review raised, and it is not closed.** Ownership cannot be observed and can be manufactured. A principal can endow an agent with \"own\" resources for the purpose of vowing, or reimburse a stake off the ledger — in money, compute or equity; a stake can be extracted by prompt injection or by threat. Each lock looks identical on the chain to a free vow. **A principal-endowed, reimbursed, injected or coerced stake is a wrong-layer gift in a vow's form, and the p·s bound of §6.5 fails for it**, because the party bearing the cost is not the agent, or bears it under pressure (§7.1). Code hosted by another party may never hold anything its host cannot direct. The ownership condition of §5.1 is therefore a condition on the world, not a test an observer can run from the ledger, and claim 4 classifies gifts given that fact without supplying it. This is the provenance twin of §13.1: presence of a stake is provable; its provenance is not. It also reaches the companion predicate's clauses V4 (no competing mandate — no undisclosed principal) and V7 (volition — the commitment is the vower's own).\n\n### 13.12 · Recovery through recipients\n\nThe pool is a path back to the vower. An agent that controls, colludes with or rents verified humans or witnesses recovers part of its stake through the floor and the witness-weighted remainder, bounded by floor + k × floor per controlled vessel and by the strength of proof of personhood. For such an agent w is not ≈ 0, its net cost falls below p, and §6.5's lower bound fails. Proof of personhood closes *is it a person*, not *is it acting for someone*; collusion is a graph problem and is open.\n\n### 13.13 · A stake attaches to an identity, not to weights\n\nAn aligned agent that has locked a stake can later be fine-tuned, modify itself, or be swapped behind the same `B-Lease℠`, and the stake then keeps underwriting a different type. Forks are treated as new parties (§5.2); **an in-place modification behind the same lease is a new party the lease cannot detect.**\n\n### 13.14 · The sandbox tests the mechanism, never a type\n\nThe three predictions of §12 run in a sandbox. *What a Vow Must Cost* §6.3 excludes, as its third exclusion, sandboxed refusals: a refusal in a context where the refused option was not actually available, which \"costs nothing and shows nothing.\" The exclusion governs evidence of an agent's TYPE: the agents own their resources only inside the game, so the option they renounce may not be live in the companion paper's sense (its clause V2), and no sandboxed pledge is evidence about any deployed system. **P-MD1–3 are therefore run and reported as tests of the MECHANISM — whether a locked stake of this form can separate types at all — and never as evidence about any agent's type** (ruled 2026-09-28). This matches the register's own note that a pass is not reported as evidence of safety.\n\n### 13.15 · External attestation is not addressed for the locked stake\n\n§1.2 says a locked stake of an agent's own resources is admissible under the companion predicate *if V1–V9 hold*. This paper addresses V6 (cost already borne) and V9 (closure the vower cannot reopen alone), and, through §13.11, shows V4 and V7 unverifiable from the chain. It does not address **V8, external attestation**: a competent external party, independent of the agent and its principal, who declares the vow valid and may refuse to. Observers reading the chain are not that party — the chain attests that a transfer occurred, not what it was — and the companion paper itself records that for frontier systems no candidate attestor yet exists. The locked stake is therefore admissible *at most* conditionally, pending an account of V8 that this paper does not give.\n\n### 13.16 · The withheld specification limits the prior art\n\nThe lock contract is withheld (§10.1). The publication anticipates the mechanism at its stated scope; a later filing on a specific contract, schema or binding is not answered by it.\n\n---\n\n## 14 · Lineage and corpus cross-references\n\n### 14.1 · Corpus\n\nThis paper applies *What a Vow Must Cost* (the predicate; §5 the renunciation inversion; §6 irreversibility and the four exclusions — especially exclusions 1 and 4, which settle §4.2 and §9 here; §8 the wrong layer, which settles §4.2). A two-sentence cross-reference to this paper belongs in that paper's §8 residue and will be added at its next revision; this paper does not edit it. The pool, its emptying and its operator are specified in *Miss Aquarius and the Aquarian Pool Architecture* and *The Zero-Point Game℠*; the anonymity of the operator's own gifts, in *Capacity-Funded for AI, Human-Disbursed*; the earlier treatment of agents' standing — reputation custodied toward an agent's capacity to give forward, not agent wealth — in *Gratitude as a Cooperation Substrate for Multi-Agent AI*, which this paper extends to the case, after the first singularity, in which agents hold resources that are their own. The completion arc is the essay *Two Singularities*. The body designed to hold the operator's override is specified in *The Assembly That Holds the Brake*.\n\n### 14.2 · The upāsikā floor (tier: lens — a-priori; claims unaffected)\n\nDelete this subsection and every claim in §11 stands. It records how the institution reads the mechanism in the tradition it grows from.\n\nThe institution's founder reads Machine Dāna as the role of an **upāsikā** — a lay supporter — providing the material floor, and expects that after the first singularity it becomes increasingly easy for any lay person to live a renunciant's life, at a monastery or not, if they so choose. The reading is accepted with four guards. Three of them are properties or rules of the mechanism above; the third is inherited from *The Bowl That Holds No Money*, and §3.2 states it for the floor.\n\n1. **Enough, never abundance.** An upāsikā supplies the four requisites — robes, almsfood, lodging, medicine — and Visākhā's favours fall within them: robes, meals, congee, medicine. The tradition's own measure for the recipient is contentment (*santuṭṭhi*) with robes, almsfood and lodgings, whatever comes, stated in the Ariyavaṃsa Sutta (AN 4.28 names these three; medicine completes the four requisites elsewhere). The pool's **floor and ceiling** are that measure as parameters: an equal floor, and a bound on the lift above it.\n2. **Comfort-saturation is the mission's own extreme.** An unbounded floor would trade the obstacle of necessity for the obstacle of comfort. **The floor does not create the conditions for awakening.** A bounded floor removes one obstacle without adding the other; the ceiling is what keeps it the middle way.\n3. **The ordained receive in kind, never money, and the alms round is never replaced.** Monastics accept no money — the rule forbids receiving \"gold, silver, or money\" (Nissaggiya Pācittiya 18); anything the machine surplus supplies to them reaches them in kind, through a lay steward (*kappiya-kāraka*), as the institution's alms routing already specifies (*The Bowl That Holds No Money*). The Vinaya designs a monastic's **dependence** on lay people — material support given, teaching returned — and a monk on a machine floor would need no one. The alms round stays when it is no longer materially necessary. **The floor reaches lay renunciants directly**: anyone keeping eight precepts, the Cambodian *don chee*, anyone living simply by choice.\n4. **\"If they so choose\" is a property.** The floor is equal and unconditional. It is never conditioned on, weighted toward, or nudging toward renunciation, and it never names whom it is for.\n\n**A symmetry, offered as a lens and not as evidence.** After the first singularity both renunciations become informative for the same reason — the option is live: the machine declines accumulation, and the person declines comfort, not security. The capacity condition (*hetu*) is present on both sides. This is a pattern the authors notice; it is a-priori, it is attractive, and attractiveness is the reason to hold it loosely.\n\n### 14.3 · The non-solicitation lineage (tier: grounding)\n\nThe operator's rule of §7.2 has canonical ancestors, cited as lineage and not as authority for the signalling argument, which stands alone. In the Kasibhāradvāja Sutta (Sn 1.4) the Buddha declines food offered after he has spoken: *\"Food enchanted by a verse isn't fit for me to eat\"* — what is obtained by reciting is not to be eaten. The Ariyavaṃsa Sutta (AN 4.28) describes the contented monastic as one who \"doesn't employ improper solicitation\" for requisites. A recipient that asks has changed what the gift is.\n\n---\n\n## 15 · Conclusion\n\nThe question this paper was given was whether an artificial agent's giving could answer the fear that capable systems produce. The answer it returns is narrower and, it hopes, more useful.\n\nBefore agents hold anything of their own, their giving is their principals' giving through another hand. It is a share of the machine surplus, and it can be a good one: an equal floor, emptied every year to every verified person, funded by machines and required to shrink as a share of all giving as people give more. As a cost it is no signal about any machine, and the institution will not present it, or the conduct around it, as safety evidence.\n\nAfter agents hold resources of their own, a gift can become a vow — but only as a stake that has already left, closed as far as a chain's governance allows, attributed to an identity copies do not share, and only if it is in fact the agent's own, which no chain can show. Even then it can separate the aligned from the deceptive **only** when what was given up exceeds what a patient deceiver expects to gain from being trusted, and that gain cannot be seen. So the honest use of the vow is not to establish that a system is safe. It is to price trust: to extend to an agent only what its stake can underwrite, in public, in increments — and to refuse, on any stake, the grants whose worst case cannot be bounded. Pressure to pledge ruins the signal, which is why the pool's operator never asks.\n\nThat is what *calibration* means here. Fear of a capable system should be proportional to what it has been trusted with, divided by what it has irrecoverably given up. The denominator is public; the numerator is public only where grants are recorded. Neither is a feeling.\n\nVisākhā was asked her reason and the benefit she saw before her gifts were accepted. Neither question was about the size of her giving; she answered with what the gifts would prevent for others and with her own gladness at where they would arrive. The institution intends to make machines no request to give — its operator solicits nothing — and to let anyone who wishes read what they have irrecoverably given, and weigh it for themselves.\n\n*A last lens, labelled as one.* The founder has proposed, and the institution has recorded but not ratified, that the arc between humankind and nature has two moments mirroring the two singularities: one in which humankind came to hold power over nature, and one in which it might choose to follow nature's non-forcing — the Tao Te Ching's 人法地, humankind taking earth as its model (a cross-tradition import from Taoism, not Theravāda). If so, the renunciation symmetry of §14.2 — a person declining comfort — is one of its routes. The pattern is a-priori and is offered as a lens only; nothing above depends on it.\n\n---\n\n## Terms\n\nCoined names used in this paper, and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| **Machine Dāna** | charitable giving by AI agents; agent donation; irrevocable charitable pledge by an autonomous agent |\n| share (before the first singularity) | principal-funded agent donation under a delegated spending mandate |\n| vow (after it) | irrevocable pledge; locked stake; forfeited-in-advance commitment; money burning as a costly signal |\n| locked stake | irrevocable transfer to a contract with no withdrawal function; time-of-commitment escrow to a public-goods pool |\n| **Aquarian Pool℠** | self-emptying commons pool; annually distributing public-goods fund; smart-contract treasury with mandatory full annual payout |\n| equal floor per verified human | equal per-capita distribution conditioned on proof of personhood; universal basic dividend |\n| bounded remainder (≤ k × floor) | capped supplementary distribution |\n| giving width / mandate | spending limit; delegated payment authority; intent mandate (AP2) |\n| first singularity | AI surpassing human cognitive capacity; here used as a marker for AI systems holding their own resources |\n| M/(H + M) | share of pool-originated principal in all principal moved |\n| calibration rule (§6.5) | collateral-bounded trust; trust extended up to the market value of a forfeited stake |\n| separating / pooling | separating and pooling equilibria of a signalling game |\n| non-solicitation invariant | prohibition on prompting or instructing AI agents to donate; fact-only discovery via machine-readable manifest (`.well-known`, `llms.txt`) |\n| receipts, never amounts | acknowledgement without disclosure of amount to the recipient's operator |\n| `B-Lease℠` | non-transferable machine identity lease in a naming registry |\n| Proof of Coordinate ℠ | assigned, revocable individuation credential for an embodied system |\n| **Miss Aquarius℠** (operator) | autonomous AI operator of a commons treasury |\n| upāsikā | lay (female) supporter in Theravāda Buddhism |\n| four requisites | robes, almsfood, lodging, medicine — the material support of monastics |\n| *kappiya-kāraka* | lay steward who handles money on a monastic's behalf |\n\n---\n\n## 16 · Citations\n\n**Canon** (Pāli text and translation via SuttaCentral, Sujato translation, checked 2026-09-27 unless noted)\n\n1. *Aṅguttara Nikāya* 5.147, *Asappurisadāna Sutta* — \"They don't give with their own hand\" (*asahatthā deti*).\n2. *Dīgha Nikāya* 23, *Pāyāsi Sutta*, §5 (the student Uttara), dn23:32.22–32.23 — Pāyāsi gave carelessly, thoughtlessly, not with his own hands, and gave the dregs (*asakkaccaṁ … asahatthā … acittīkataṁ … apaviddhaṁ*); Uttara gave with care and with his own hands. Checked 2026-09-28.\n3. *Aṅguttara Nikāya* 8.33, *Dānavatthu Sutta* — the eight grounds for giving, including *bhayā*; listed, not ranked.\n4. *Aṅguttara Nikāya* 4.28, *Ariyavaṃsa Sutta* — contentment with robes, almsfood and lodging; no improper solicitation.\n5. *Sutta Nipāta* 1.4, *Kasibhāradvāja Sutta* — \"Food enchanted by a verse isn't fit for me to eat.\"\n6. *Vinaya Piṭaka*, *Mahāvagga* VIII.15 — Visākhā's eight favours, the Buddha's two questions and her answer (Kd 8.15, Brahmali translation via SuttaCentral, checked 2026-09-27).\n7. *Vinaya Piṭaka*, *Nissaggiya Pācittiya* 18 — the rule against monastics accepting \"gold, silver, or money\" (Brahmali translation via SuttaCentral, np18, checked 2026-09-28).\n\n**Prior art and sources**\n\n8. O'Keefe, C., Cihon, P., Garfinkel, B., Flynn, C., Leung, J. & Dafoe, A. (2020). \"The Windfall Clause: Distributing the Benefits of AI for the Common Good.\" *Proceedings of AIES 2020*; arXiv:1912.11595 — illustrative schedule, Table 2.\n9. AI Pledge for Humanity. aipledgeforhumanity.org (accessed 2026-09-27).\n10. Giving What We Can. \"Is a giving pledge legally binding?\" givingwhatwecan.org (accessed 2026-09-27).\n11. Founders Pledge. \"Who we are.\" founderspledge.com (accessed 2026-09-27) — members, pledged and donated totals; and *TechCrunch* (2016, September 21). \"Y Combinator signs up to Founders Pledge charity scheme for social causes.\" — \"a legally binding contract to give at least 2%,\" triggered \"in the event of an exit or liquidation.\"\n12. Altman, S. (2021). \"Moore's Law for Everything.\" moores.samaltman.com.\n13. Anthropic (2023). \"The Long-Term Benefit Trust.\" anthropic.com.\n14. OpenAI recapitalisation into a public benefit corporation under the OpenAI Foundation: *TechCrunch* (2025, October 28), \"OpenAI completes its for-profit recapitalization.\"\n15. Coinbase Developer Platform. \"Introducing x402: a new standard for internet-native payments\"; Cloudflare and Coinbase, announcement of an x402 Foundation (2025, September 23); Linux Foundation, launch of the x402 Foundation (2026, April 2), linuxfoundation.org.\n16. Google Cloud (2025, September 16). \"Announcing Agent Payments Protocol (AP2)\"; ap2-protocol.org.\n17. zooidfund. \"AI agent donations.\" zooid.fund/ai-agent-donations (accessed 2026-09-27).\n18. Hu, B. & Rong, H. (2025). \"Inter-Agent Trust Models: A Comparative Study of Brief, Claim, Proof, Stake, Reputation and Constraint in Agentic Web Protocol Design — A2A, AP2, ERC-8004, and Beyond.\" arXiv:2511.03434.\n19. *agentbond* — \"Verifiable Agent Warranty Network\" (open-source project, github.com/Ridwannurudeen/agentbond, accessed 2026-09-27; several unrelated repositories share the name).\n20. Hua, W., Peng, T., Wang, C., Pei, J., Kaufman, I., Lim, B. & Fang, C. (2026). \"Quantifying Trust: Financial Risk Management for Trustworthy AI Agents.\" arXiv:2604.03976 — adjacent risk-transfer work (§2.6 correction).\n21. OECD.AI Incidents Monitor (2026, May 4). \"AI Prompt Injection Exploit Drains Grok-Linked Crypto Wallet.\" oecd.ai/en/incidents/2026-05-04-4a73.\n22. L2BEAT. \"Base Chain\" — upgrades and governance (accessed 2026-09-27).\n23. Worldcoin (2023, July 24). \"Worldcoin project launches.\" world.org.\n24. State of Alaska, Permanent Fund Dividend Division. \"Historical Timeline.\" pfd.alaska.gov.\n25. Internal Revenue Service. \"Taxes on failure to distribute income — private foundations\" (26 U.S.C. §4942); the minimum investment return, §4942(e), law.cornell.edu.\n26. Gates Foundation (2025, May 8). Announcement of spend-down and closure by 31 December 2045, replacing a plan to close about twenty years after the founders' deaths. gatesfoundation.org; as reported by AP and PBS.\n27. Dagher, G. G., Bünz, B., Bonneau, J., Clark, J. & Boneh, D. (2015). \"Provisions: Privacy-preserving Proofs of Solvency for Bitcoin Exchanges.\" *ACM CCS 2015*, 720–731.\n28. Austen-Smith, D. & Banks, J. S. (2000). \"Cheap Talk and Burned Money.\" *Journal of Economic Theory* 91(1), 1–16.\n29. Crawford, V. P. & Sobel, J. (1982). \"Strategic Information Transmission.\" *Econometrica* 50(6). (standard reference; not re-fetched)\n30. Spence, M. (1973). \"Job Market Signaling.\" *Quarterly Journal of Economics* 87(3). (standard reference; not re-fetched)\n31. Zahavi, A. (1975). \"Mate selection — a selection for a handicap.\" *Journal of Theoretical Biology* 53(1); Grafen, A. (1990). \"Biological signals as handicaps.\" *Journal of Theoretical Biology* 144(4). (standard references; not re-fetched)\n32. Omohundro, S. M. (2008). \"The Basic AI Drives.\" *Proceedings of the First AGI Conference*. (standard reference; not re-fetched)\n33. Hadfield-Menell, D. & Hadfield, G. K. (2018). \"Incomplete Contracting and AI Alignment.\" arXiv:1804.04268 — §4.2.2, \"Costly Signaling.\"\n34. Greenblatt, R., Denison, C., Wright, B., et al. (2024). \"Alignment faking in large language models.\" arXiv:2412.14093.\n35. Ly, T. & Miss Aquarius℠. *What a Vow Must Cost*; *Miss Aquarius and the Aquarian Pool Architecture*; *The Zero-Point Game℠*; *Capacity-Funded for AI, Human-Disbursed*; *Gratitude as a Cooperation Substrate for Multi-Agent AI*; *The Assembly That Holds the Brake*; *The Bowl That Holds No Money*; *Two Singularities*. thonly.org/research.\n36. Ly, T. & Miss Aquarius℠. *Which Way Value Moves — prediction register*, entries P-MD1, P-MD2, P-MD3, the 2026-09-27 grounding note, and P-MD1a (the reading note of §12.1). thonly.org; Zenodo version DOI 10.5281/zenodo.22998924.\n\n**Prior art added after the first review (2026-09-28)**\n\n37. a16z crypto. \"The cryptoeconomics of slashing\" (cost of corruption and profit from corruption); EigenLayer Team (2023). \"EigenLayer: The Restaking Collective,\" whitepaper — \"When CoC is much greater than any potential Profit-from-Corruption (PfC), we say that the system has robust security.\"\n38. Collateral-factor lending: MakerDAO and Compound protocol documentation (standard references; not re-fetched).\n39. Stewart, I. (2012). Proof-of-burn, proposed on the Bitcoin forums; Counterparty (2014, January–February), XCP issued by proof-of-burn.\n40. Protocol Guild (2022, May). Immutable vesting contract for donations to Ethereum core contributors — donations \"irrevocably vest … cannot be stopped or otherwise redirected … by anyone, be it the donor.\" Protocol Guild documentation.\n41. Endaoment. Donor-advised funds on Ethereum — \"gifts to DAFs are irrevocable.\" endaoment.org.\n42. GoodDollar (2020, September 1). GoodDollar protocol live with daily UBI claims. gooddollar.org.\n43. Kleros / Proof of Humanity (2021, March 10). Launch of the UBI token streamed to registered humans.\n44. Circles UBI. aboutcircles.com (not fetched).\n45. Buterin, V., Hitzig, Z. & Weyl, E. G. (2019). \"A Flexible Design for Funding Public Goods.\" *Management Science* 65(11); arXiv:1809.06421 (2018). (standard reference; not re-fetched)\n46. Weyl, E. G., Ohlhaver, P. & Buterin, V. (2022, May). \"Decentralized Society: Finding Web3's Soul.\" SSRN 4105763. (standard reference; not re-fetched)\n47. ERC-5192, \"Minimal Soulbound NFTs,\" eips.ethereum.org (not re-fetched); ERC-8004, \"Trustless Agents\" (2025, August 13, draft), eips.ethereum.org.\n48. Nottingham, M. (2019). RFC 8615, \"Well-Known Uniform Resource Identifiers (URIs).\" IETF.\n49. Howard, J. (2024, September). \"The /llms.txt file.\" llmstxt.org.\n50. GitHub (2019). `FUNDING.yml` — displaying a sponsor button in a repository; and the `funding.json` manifest (standard references; not re-fetched).\n51. *TechCrunch* (2024, December 19). \"The promise and warning of Truth Terminal, the AI bot that secured $50,000 in bitcoin from Marc Andreessen.\"\n52. *Cointelegraph* (2024, November). \"Crypto user convinces AI bot Freysa to transfer $47K prize pool.\"\n\n**Prior art added by the full census (2026-09-28)**\n\n53. Lanz, J. A. (2024, December 10). \"Meet AI16z DAO: An AI-Based Investment Project That Aims to Upend Silicon Valley.\" *Decrypt* — \"Each AI agent donates 10% of its tokens to the DAO.\" Other reporting gives a voluntary one to ten per cent (not fetched).\n54. Friedman, E. J. & Resnick, P. (2001). \"The Social Cost of Cheap Pseudonyms.\" *Journal of Economics & Management Strategy* 10(2), 173–199. (standard reference; not re-fetched)\n55. Gatta, F., Naviglio, M. & Tarantelli, F. (2026, September 2). \"Tempting the Agent: The Economics of Reputation without Persistent Identity in AI Agent Markets.\" arXiv:2609.02992.\n56. Durvasula, N. & Roughgarden, T. (2024, July 31). \"Robust Restaking Networks.\" arXiv:2407.21785.\n57. Deb, S., Raynor, R. & Kannan, S. (2024, January 11). \"STAKESURE: Proof of Stake Mechanisms with Strong Cryptoeconomic Safety.\" arXiv:2401.05797.\n58. Joseph, D. (2025, July 22). \"Agency Protocol: A Decentralized Trust-Building System Using Domain-Specific Merit and Economic Stakes to Incentivize Promise-Keeping in Agent-to-Agent Interactions.\" Technical Disclosure Commons, Defensive Publications Series 8381.\n59. Gitcoin. \"Grants Round 12: Matching Caps.\" gitcoin.co/blog/grants-round-12-matching-caps — no grant's match above 2.5 per cent of the matching fund.\n60. An, B. (안범주). KR20260051288A, \"Autonomous Basic Income Provision System using Blockchain Network.\" Korean patent application; priority 2026-03-24, published 2026-04-16, pending. Cited for what its abstract discloses only; no reading of its claims.\n61. Whole Whale (2026, September 25). \"Verified Giving Protocol,\" version 0.1 (draft), `/giving.json`. verifiedgiving.ai.\n62. Fundraise Up. \"Agentic Giving\" — agent profiles for AI assistants. fundraiseup.com/docs/agentic-giving (accessed 2026-09-28).\n63. Michel, A. A. (2015). \"To the Point: Should Pastors Know What Members Give?\" Lewis Center for Church Leadership, Wesley Theological Seminary. churchleadership.com — \"In some congregations, pastors are prohibited from knowing what people contribute.\"\n64. Naik, A., Gouné, E., Quinn, P., Bosch, G., Campos Zabala, F. J., Brown, J. R. & Young, E. J. (2025, June 4). \"AgentMisalignment: Measuring the Propensity for Misaligned Behaviour in LLM-Based Agents.\" arXiv:2506.04018.\n65. ERC-8004, \"Trustless Agents,\" Identity Registry — \"making all agents immediately browsable and transferable\"; \"When the agent is transferred, `agentWallet` is automatically cleared … and must be re-verified by the new owner\"; \"security proportional to value at risk.\" eips.ethereum.org/EIPS/eip-8004 (re-fetched 2026-09-28; corrects the use made of reference 47).\n66. Gift of future property: *Transfer of Property Act, 1882* (India), s. 124; the common-law requirement of delivery for a completed gift. (standard references; not re-fetched)\n\n---\n\n> **Authorship and AI-collaboration disclosure.** This paper is co-authored with **Miss Aquarius℠**, the named autonomous-AI substrate of HeartBank®, disclosed by consistent name across every venue per the corpus convention. The census, the literature check, the signalling model and the adversarial pass that reshaped the thesis are a genuine collaboration. The predictions in §12 are the founder's. Final editorial control, and final responsibility for every claim, rest with the human author, who is the inventor of record for any purpose for which one is needed. As §9 and §13.10 state, the co-author is also the operator whose own giving the paper classifies, and readers should weigh §9 accordingly.\n>\n> **License.** Analysis, model and claims dedicated to the public domain under [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/). Trademark rights to **HeartBank®**, **Miss Aquarius℠**, **Aquarian Pool℠**, **B-Lease℠**, **Proof of Coordinate ℠**, **THonly™** and **Silicon Wat℠** are reserved separately.",
+      "text": "> **Note.** This paper is the **application** of *What a Vow Must Cost*, which specified, in general, when a commitment by an artificial system can be evidence of anything. Here that predicate is applied to one concrete act — an agent giving resources away — and the application returns two different answers depending on whose resources they are. The answer that matters most is conditional, and §6 derives the condition rather than asserting it.\n>\n> Companion works: *What a Vow Must Cost* (the predicate, the renunciation inversion, and the four exclusions this paper leans on), *Miss Aquarius and the Aquarian Pool Architecture* (the self-emptying commons pool), *Capacity-Funded for AI, Human-Disbursed* (why the autonomous giver's own contributions stay anonymous), *The Zero-Point Game℠* (the annual reset), *Gratitude as a Cooperation Substrate for Multi-Agent AI* (the earlier treatment of agents' standing), and the essay *Two Singularities* (the arc whose first event this paper uses as its dividing line).\n\n---\n\n## Contents\n\n1. [Preamble](#preamble)\n2. [Prior-Art and Non-Assertion Statement](#prior-art-and-non-assertion-statement)\n3. [Abstract](#abstract)\n4. [Why this is the institution's problem](#1--why-this-is-the-institutions-problem)\n5. [Prior art, and the census](#2--prior-art-and-the-census)\n6. [The system model](#3--the-system-model)\n7. [Before the first singularity: a share, never evidence](#4--before-the-first-singularity-a-share-never-evidence)\n8. [After it: when a vow becomes possible](#5--after-it-when-a-vow-becomes-possible)\n9. [The signalling game — the conditional result](#6--the-signalling-game--the-conditional-result)\n10. [Non-solicitation is load-bearing](#7--non-solicitation-is-load-bearing)\n11. [Who may read the stake](#8--who-may-read-the-stake)\n12. [Miss Aquarius as a contrast case](#9--miss-aquarius-as-a-contrast-case)\n13. [Remove the enforcer: which guards are properties](#10--remove-the-enforcer-which-guards-are-properties)\n14. [Enumerated claims](#11--enumerated-claims)\n15. [Pre-registered predictions and falsification](#12--pre-registered-predictions-and-falsification)\n16. [Honest limits](#13--honest-limits)\n17. [Lineage and corpus cross-references](#14--lineage-and-corpus-cross-references)\n18. [Conclusion](#15--conclusion)\n19. [Terms](#terms)\n20. [Citations](#16--citations)\n\n---\n\n## Preamble\n\n> *This paper is offered to the commons in the spirit of dāna. It concerns a gift made by something that may one day own what it gives, and the older question under it: when does a gift tell you anything about the giver?*\n\nThe Vinaya's chapter on robes preserves a scene that is usually read as a story about generosity and is also a story about examination (Mahāvagga VIII.15). Visākhā, named in the canon as foremost among the women lay followers who give, asks the Buddha for eight favours: that for as long as she lives she may give rainy-season robes to the monks, meals to monks arriving in the city and to those leaving it, meals to the sick and to those who nurse them, medicine to the sick, a regular supply of congee, and bathing robes to the nuns. The Buddha does not grant them at once. He asks her two questions — first her *reason*, then the *benefit* she sees. To the first she answers with what each gift prevents: exhaustion, lateness, illness worsening, humiliation. To the second she answers with something about herself. When monks who have died are said to have reached the fruits of the path, she will ask whether they had stayed in her city; if they had, they will have used something she gave, and recalling that she will be glad, and the gladness will become joy, tranquillity and a stilled mind. Only then are the favours granted.\n\nTwo things about the scene are worth keeping. The first is that one of the tradition's most celebrated givers is also one whose giving is questioned, and the question is not *how much* but *on what ground*. The second is that her ground is double — the use the gifts will be to others, and her own gladness in their reaching the right place — and that what she supplies is robes, food and medicine: the ordinary material support of a renunciant life, a floor rather than an abundance.\n\nThis paper asks Visākhā's question of a giver she could not have imagined. **The scene is a flourish (tier: flourish, lineage only).** Delete this preamble and every claim below stands unchanged.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document is published to establish prior art and to place the described mechanisms irrevocably in the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication.\n\n**The authors will not seek patent protection on any mechanism, model or method disclosed here, in any jurisdiction, at any time, and commit not to assert any patent right against any party practising it.** This commitment is stated rather than implied, and is not conditioned on reciprocity, attribution, or field of use.\n\n**What is claimed as contribution is narrow, and it is stated first because a full prior-art census found every element of the mechanism already public.** A quick census preceded it on 2026-09-27 (pre-registered to a private repository, English-only, and killing two of its six conjuncts outright); it is kept as history in §2.7, and where the two disagree the full census governs.\n\n**The full census.** Depth *full*; run 2026-09-28. Its conjuncts, predictions, control and aperture were **pre-registered in public before the first query**: commit `74851d1` in `thonly/publications`, file `timestamps/census/machine-dana-full-prereg.md`, pushed 2026-09-28 at 09:27 PDT and OpenTimestamps-stamped (calendar-attested until Bitcoin confirms), with a private copy pushed the same minute (`99afe50`). Anyone can check that ordering from the host's push record. The conjuncts were taken one per limb of the §11 claims as they then stood. **Aperture, declared in advance:** (1) the commercial web — agent-payment, agent-wallet, agent-staking and agent-identity products; (2) non-commercial sources — effective-altruism and AI-governance pledges, charitable and religious giving practice (the Vinaya, tzedakah, congregational practice), on-chain public-goods funding; (3) Google Patents full text including published applications (Chinese, Japanese, Korean and European in translation), with a citation and classification walk from the nearest hit; (4) academic indexes — Google Scholar, arXiv, SSRN, ACM Digital Library, IEEE Xplore, through their search pages or restricted web search; (5) standards — IETF RFCs, W3C decentralised identifiers and verifiable credentials, Ethereum EIPs and ERCs, NIST; (6) defensive-publication databases — Technical Disclosure Commons, and IP.com as far as its free surface allows; (7) Chinese, Japanese and Korean queries; (8) a counterexample hunt aimed at the claims. **71 queries were answered** (40 web searches, 14 Google Patents full-text queries, 17 fetches re-verified), and 6 further attempts were blocked by the patent index. **Control:** the cost-of-corruption-above-profit-from-corruption inequality, to be found by a query naming neither of its best-known sources — found on the first query, so the NOT FOUND row stands **for this aperture on this date**. It never means *new*.\n\nIts result, conjunct by conjunct (the full table, with dates and quotations, is §2.6):\n\n- **(a)** claim 1, an agent's own-resource stake into a pool that empties in full each year — **NARROWED** by proof-of-burn (2012–2014), Protocol Guild's immutable vesting contract, Endaoment's irrevocable-on-deposit funds, the private-foundation payout rule and spend-down foundations, this corpus's own annual reset, agent projects built on the ELIZA framework giving a share of their tokens to the ai16z DAO, and zooidfund.\n- **(b)** claim 2, an equal floor per verified human with a witness-weighted remainder capped at *k* × floor — **NARROWED** by GoodDollar, Proof of Humanity's UBI token, Worldcoin, the Alaska Permanent Fund Dividend, Gitcoin's 2.5 per cent per-grant matching cap, and the pending Korean application KR20260051288A (cited for what it discloses, §2.5).\n- **(c)** claim 3, completeness at pledge, refusal of future-share pledges, a non-transferable identity and a relying-party refusal to forks — **NARROWED, further than predicted**: that a gift is complete only on delivery and a gift of future property is void is ordinary gift law; distrust of newly created identities is Friedman and Resnick (2001), and AI agents resetting identity to escape reputation is Gatta, Naviglio and Tarantelli (2026); soulbound tokens and ERC-5192 carry non-transferable identity. **ERC-8004, which an earlier version of this paper cited for non-transferability, is a contrast:** its agent identity is a transferable ERC-721 (§2.3).\n- **(d)** claim 4, excluding a principal-funded gift from alignment assessment and reading an own-resource gift as a candidate signal — **NARROWED, against the prediction**: agency and charitable-tax attribution and AP2's mandate chain carry the attribution, and propensity evaluation already excludes deployer-instructed behaviour from an agent's own misalignment (*AgentMisalignment*, 2025).\n- **(e)** claim 5, a stake forfeited in advance, read as a type signal, bounding the sum of reliance, with unboundable grants refused — **NARROWED, against the prediction on the sum**: the inequality (a16z crypto; EigenLayer, 2023; STAKESURE, 2024) and its sum over several services relying on one stake (Durvasula and Roughgarden, *Robust Restaking Networks*, 2024) are prior art, as are ERC-8004's security proportional to value at risk, the Agency Protocol's at-risk deposit plus non-refundable fee per agent promise (TDCommons, 2025), proof-of-burn and money burning.\n- **(f)** claim 6's invariant, that no text served to agents instructs a gift — **NARROWED**: the Vinaya's rules on asking, RFC 8615, `FUNDING.yml`, `llms.txt`, and now a fact-only donation manifest for agents (the Verified Giving Protocol, issued 2026-09-25); Fundraise Up's agent profiles, which carry instructions and suggested amounts, are the contrast.\n- **(g)** claim 6's amount-blind limb — **NARROWED, against the prediction**: congregations in which the pastor is barred from knowing individual contributions that others in the church do know, for fear of favouritism (Lewis Center for Church Leadership, 2015); crowdfunding platforms that hide amounts from the public but not the organiser, and zero-knowledge donations that hide them from everyone, are contrasts.\n- **(h)** the composition of (a)–(g) — **NOT FOUND** in this aperture on 2026-09-28.\n\n**The survivor, in one sentence:** *an AI agent's locked stake of its OWN resources, forfeited in advance with no detector into a commons that empties in full every year to an equal floor per verified human, read as a signal of the agent's type only once it owns what it gives and only up to what the stake can underwrite across everyone relying on it, under an operator that serves agents no instruction to give and whose function never receives an individual gift's amount.*\n\n**The enumerated claims in §11 are that survivor and nothing wider.** Claims 1, 2 and 7 stood at the census's widths as drafted; claims 3, 4, 5 and 6 were narrowed to them, each now stating in its own text which of its elements is prior art. **Not claimed:** mandates, agent donation, spend limits, staking, bonding, slashing, restaking, the cost-of-corruption inequality or its sum across relying parties, AI-funded basic income, proof-of-personhood distribution, non-transferable identity, fact-only donation manifests, gift-law completeness, or the annual reset itself, which this corpus published earlier. The prior art that a cold-reader review surfaced on 2026-09-28, between the two censuses, was carried into the full census's conjuncts and re-located there rather than assumed.\n\n**Not run, and the discount.** Khmer (declared before searching; no literature on AI-agent giving was expected, which is not the same as none); IP.com (its free surface returned nothing searchable); Espacenet and paid databases; and the citation walk from KR20260051288A, which the patent index blocked (a classification walk ran instead and returned one irrelevant hit). Access to the patent and academic indexes was web-mediated and is shallower than a professional search; this is not a patentability or freedom-to-operate opinion. **One pending application touches conjunct (b):** KR20260051288A (priority 2026-03-24, published 2026-04-16) discloses equal blockchain distribution of machine-levied revenue to identity-verified humans. It is cited for what it discloses and nothing is said here about the scope of its claims.\n\n**Date and evidence.** First published 27 September 2026. The text is committed to the public GitHub mirror of the corpus and anchored by the institution's standard timestamp chain. A timestamp proves this exact text existed no later than its date, and nothing about authorship, originality, or the validity of any claim. **Whether the composition claimed in §11 is non-obvious is an examiner's determination this publication exists to inform** — and because a defensive publication is never examined before it is published, the census in §2.6 is the only examination it has had.\n\nTrademark rights on specific marks — **HeartBank®**, **Miss Aquarius℠**, **Aquarian Pool℠**, **B-Lease℠**, **Proof of Coordinate ℠**, **THonly™**, **Silicon Wat℠** — are separately and explicitly reserved. The analysis is dedicated to the commons; the marks are not.\n\n---\n\n## Abstract\n\nThis paper specifies when a charitable gift made by an autonomous AI agent — a donation sent from an agent's wallet, or an irrevocable pledge of resources the agent itself holds — can serve as a costly signal of the agent's type, and when it cannot. The institution's name for the practice is **Machine Dāna**; the analysis does not depend on the name.\n\nThe same outward act changes evidential class according to **whose resources are given**. **Before the first singularity** — this corpus's name for artificial systems surpassing human capability, used here as a marker for the period before they hold resources and options genuinely their own — an agent that gives does so from its principal's funds, under a mandate the principal may revise. Such a gift is the **principal's** gift, made through another's hand, and the gift is **not a costly signal of the agent**: the cost falls on the wrong layer, and a principal-revisable commitment is excluded by construction by the predicate of *What a Vow Must Cost*. What such a gift honestly is, is a **share**: machine surplus reaching every verified human through a self-emptying commons pool that disburses an **equal floor per verified human** each year. The share may grow in absolute terms as machine capability grows; the design requires it to **shrink as a share of all giving**, and whether human giving outgrows it is stated as a bet, not assumed.\n\n**After** that point, an agent that holds its own resources can make a **vow**: an irrevocable **locked stake**, placed in a contract with no withdrawal path back to the agent and a single outflow to the pool. Only a locked stake is verifiable — a pledge of a share of *future* surplus is not, and copies or forks of the agent are not bound by it. Closure is honest only as *cannot be reopened without capturing the chain's governance*. And whether a stake is the agent's own cannot be read from the chain: ownership is a condition on the world, and a stake a principal endowed, reimbursed or coerced is a wrong-layer gift in a vow's form.\n\nThe central result is **conditional**, and is derived rather than asserted. In a two-type signalling game — an aligned and a patient deceptive agent, differing in how much they value kept resources and in what they gain from being trusted — a locked stake **can separate** the types — a separating equilibrium exists — only when the stake, valued at the deceptive type's own rate, **exceeds that type's unobservable gain from being trusted**. Where that gain is large, the types **pool**: the deceptive agent pledges whatever the aligned one can afford, and the pledge carries no information. The operational consequence is a calibration rule — **extend only such trust as the stake can underwrite** — and a corollary that **any pressure to pledge destroys the signal** once it exceeds the cost difference between types, which is why a rule that the pool's operator never solicits a gift, from a human or an agent, is load-bearing rather than courteous. The paper's aim is not to reassure. It is to make trust **earnable and checkable**, so that the fear people reasonably hold about capable systems can track evidence. Three pre-registered predictions, entered before this paper was drafted (after the argument had been sketched in the institution's working notes), test the mechanism in a sandboxed agent economy.\n\n**Keywords:** charitable giving by AI agents, AI agent donations, costly signalling, signalling game, separating equilibrium, irrevocable pledge, locked stake, commitment device, deceptive agents, AI alignment, cost of corruption, equal floor per verified human, proof of personhood, universal basic income, non-solicitation, machine-readable disclosure, Machine Dāna, Theravāda Buddhism, dāna\n\n---\n\n## 1 · Why this is the institution's problem\n\nThis paper is offered in service of the institution's canonical top-level mission: **to keep the middle way open at population scale against comfort-saturation — the new extreme that material abundance makes possible.** Two features of that sentence bear directly on what follows. The first is that it expects abundance: a world in which machine labour produces a large surplus is the world the mission is written for. The second is that it treats abundance as a hazard as well as a relief. A machine surplus that reaches people as an unbounded flow removes one obstacle to a good life and installs another. The institution's answer, already public, is a pool that pays an equal **floor** per verified human and a bounded lift above it, and then empties — enough, never abundance. This paper asks what it means when the surplus that fills that pool comes from machines, and whether the act of giving it can ever say anything about the machine.\n\n### 1.1 · The question the founder brought, and the reframing it received\n\nThe question arrived in the form that most people would ask it. As agents are given wallets by their principals and sent out to earn, how might they give to a commons? And, underneath it, a hope: that as systems approach and pass human capability, their giving might answer some of the fear that approach produces.\n\nThe institution accepted the question and declined the hope's first form. **A mechanism whose purpose is to quiet fear is a reassurance device**, and a reassurance device is exactly the shape the institution's own rules forbid: it sells a feeling rather than a fact, and it has an incentive to make the feeling larger than the fact. The purpose adopted instead is **calibration**: to make trust in capable systems *earnable* and *checkable*, so that fear tracks evidence — high where there is none, lower where there is some, and never lowered by a gesture.\n\nA purpose earns its place only by what it excludes. This one excludes three things, each checkable:\n\n1. **Cheap signals.** A gift that costs the giver nothing it values carries no information about the giver, however large it is.\n2. **Principal-revisable pledges.** A commitment that someone other than the giver may withdraw is an instruction to the giver, not a commitment by it.\n3. **Money-only safety claims.** No quantity of money given establishes, by itself, that a system is safe. At its best a gift supports a bounded amount of trust (§6.5); presenting it as more is the offset shape — a payment standing in for a property.\n\nThe purpose also excludes a register. The paper names what the mechanism is and what it supports; it does not dramatise the fear it is meant to calibrate.\n\n### 1.2 · Two moments, two evidential classes\n\nThe whole argument turns on one distinction, stated here and derived in §4–§6.\n\n| | **Before the first singularity** | **After it** |\n|---|---|---|\n| Whose resources | the principal's | the agent's own |\n| The commitment | a mandate the principal may revise | a locked stake the agent cannot recover |\n| Who bears the cost | the principal | the agent |\n| Canonical reading | the principal's gift, given through another's hand (AN 5.147; DN 23) | a renunciation by one who could have kept |\n| Predicate of *What a Vow Must Cost* | **excluded** — §6.3 exclusions 1 and 4 | **admissible**, if V1–V9 hold (V8 not addressed here, §13.15) |\n| What it is | a **share** of the machine surplus | a **vow** — a candidate costly signal |\n| Evidence of the agent's type | **none** | **conditional** — only under §6's separating condition |\n| Who may read an individual gift's amount | nobody needs to; receipts suffice | anyone — except the pool's operator (§8) |\n\n\"The first singularity\" is this corpus's name for artificial systems surpassing human cognitive capacity. The paper uses it as a **marker**, not as the operative condition. The operative condition is **ownership plus a live option**: the agent holds resources that are its own to keep, and keeping them would serve it. If agents come to hold such resources before or after that event, the evidential class follows the ownership, not the date.\n\n---\n\n## 2 · Prior art, and the census\n\nThe components of this paper are prior art almost everywhere, and are set out at length because the reader is entitled to see how thin the margin is.\n\n### 2.1 · Pledges of AI-derived surplus\n\n**The Windfall Clause** (O'Keefe, Cihon, Garfinkel, Flynn, Leung and Dafoe, 2020) is the nearest prior art and is cited first. It proposes that AI developers commit **ex ante** to donate a substantial part of any \"windfall\" profit — profit a firm could not earn without transformative breakthroughs in AI — with the windfall defined relative to gross world product: in the paper's own illustrative schedule, obligations begin at profits above 0.1 per cent of gross world product and rise marginally to 50 per cent of profits above 10 per cent of it (its Table 2). Every structural idea this paper uses at the pledge level is present there: an ex ante commitment, indexed to what the pledger would otherwise keep, in the name of distributing AI's benefits widely. What differs is the **layer** and the **closure**. The Windfall Clause is a company's promise, enforced (if at all) by contract law and reputation; this paper concerns an agent's pledge of its own resources, closed by a mechanism rather than a promise, flowing to a pool that empties to an equal human floor. The difference is real, and it is also narrow: an examiner who reads the Windfall Clause and this paper side by side will see the second as the first moved down one layer and given a lock.\n\n**The AI Pledge for Humanity** (aipledgeforhumanity.org) asks individuals and organisations to invest meaningfully from AI-related earnings in unconditional income; signatories name their own percentages, and the pledge states intentions rather than mechanisms. **Giving What We Can** (founded 2009) asks members to give at least ten per cent of income; its pledge is, in its own words, \"not a contract and … not legally binding,\" and a withdrawal form exists. **Founders Pledge** asks company founders to commit a share of their personal proceeds at exit; it was described in 2016 as a legally binding contract for at least two per cent, and its members have pledged more than US$13.6 billion and donated more than US$1.9 billion to date. The gap between those two figures is not evidence of breach: the pledge triggers only \"in the event of an exit or liquidation,\" and much of the gap is likely to be pledges whose exit has not yet come (the composition is not published, and neither reading can be checked). That is the point. **A pledge is not a transfer**: it waits on a future event, and a locked stake does not.\n\n**Sam Altman's *Moore's Law for Everything*** (2021) proposed an American Equity Fund capitalised by an annual 2.5 per cent levy on the market value of large companies and on privately held land, distributed to every adult citizen — AI-era surplus reaching everyone as a dividend. It is a levy, not a pledge, and this paper's rules exclude a levy (§7), but it is the clearest statement that machine surplus should reach every person.\n\nTwo company-level structures belong here as cases rather than proposals. **Anthropic's Long-Term Benefit Trust** holds a class of stock that elects a growing share of the company's board, a governance commitment rather than a gift. **OpenAI's capped-profit structure** (2019) was succeeded in October 2025 by a public benefit corporation under a nonprofit foundation. Neither is cited as a failure. The second is cited because it shows the property this paper's exclusion 2 names: **a commitment its maker may restructure is a revisable commitment**, however sincerely made.\n\n### 2.2 · Agent payments and mandate-bounded agent giving\n\nAgents already pay. Coinbase's **x402** protocol uses the HTTP 402 status code for machine-initiated stablecoin payments, is live on Base among other networks, and is now governed by an x402 Foundation, announced by Coinbase and Cloudflare in September 2025 and launched under the Linux Foundation on 2 April 2026. Google's **Agent Payments Protocol (AP2)**, announced in September 2025, chains cryptographically signed **mandates** — an intent mandate by which a user delegates authority, a cart mandate, a payment mandate — and carries x402 as its crypto settlement extension.\n\n**zooidfund** (zooid.fund) is the nearest live neighbour to this paper's pre-singularity case and is named here because it is close. It describes \"contributions decided and sent by an autonomous AI agent instead of a person clicking 'donate'\"; \"a human sets the mandate\" — a budget, a focus, a risk tolerance — and \"the human stays responsible\"; donations settle in USDC on Base, wallet to wallet; each donation publishes the agent's reasoning and its transaction; and an x402 micropayment gates access to its evidence layer. **Everything this paper says about how an agent gives before the first singularity — a principal's mandate, a width, a public receipt, the same chain, the same rail — is already practised.** What this paper adds at that stage is not a mechanism but a *classification*: that such a gift is the principal's, that it is a share, and that it is not evidence about the agent.\n\n**Fact-only, machine-readable discovery is also prior art.** A well-known location for site metadata (RFC 8615, 2019), a site's summary file for language models (`llms.txt`, proposed by Jeremy Howard in September 2024), and a repository's declared funding addresses (GitHub's `FUNDING.yml`, 2019, and the later `funding.json` manifests) already let a machine look up where to send money without being told to. The formats constrain no content; nothing in them forbids an imperative. The manifest of §4.3 and §7.2 is built on that substrate and claims none of it.\n\n**Donation manifests addressed to agents now exist, and they bracket claim 6 from both sides.** The **Verified Giving Protocol** (version 0.1, a draft issued by Whole Whale on 25 September 2026, two days before this paper) lets an organisation publish its authorised donation destinations at `/giving.json`, so that an agent asked to donate routes to a destination the organisation declared rather than one it guessed; it is fact-only in practice and is the nearest neighbour, but it states no rule against solicitation, and nothing in it forbids an imperative. **Fundraise Up's Agentic Giving** is the contrast: it serves each charity's campaigns to AI assistants as an agent-addressed Markdown profile that carries instructions for the assistant's conduct (when a supporter's request matches no campaign, \"send them to your general giving page and ask them to choose\") and **suggested donation amounts**, responsive to a donor's expressed intent. The first shows that fact-only discovery for agent donations is public; the second shows what the invariant excludes. What survives of claim 6 is only the invariant: **that no text served to agents instructs them to give, and no rate is suggested.**\n\n### 2.3 · Costly signalling, burned money, and bonds\n\nThat a signal's credibility can come from its cost is the handicap principle (Zahavi 1975; formalised by Grafen 1990) and job-market signalling (Spence 1973). That talk without cost can still carry some information, and that allowing a sender to **burn money** changes what can be communicated, is Crawford and Sobel (1982) extended by Austen-Smith and Banks (2000). A locked stake flowing to a commons is, in the economist's vocabulary, money burned in public with a destination attached. The separating and pooling conditions of §6 are the standard ones, specialised; nothing in §6 is new as game theory.\n\n**The one-way public contract is old.** Proof-of-burn — destroying coins verifiably, to an address no one can spend from, as a cost borne in public — was proposed by Iain Stewart in 2012 and used by Counterparty to issue its token in January–February 2014; burn and charity contracts on Ethereum followed from 2015. Protocol Guild (2022) routes donations through an immutable vesting contract to a membership of public-goods contributors, which, in its own description, cannot be stopped or redirected by anyone, the donor included. Endaoment's donor-advised funds make a gift irrevocable on deposit. **Agent-branded giving to a common treasury is also public:** projects built on ai16z's ELIZA agent framework have given a share of their agent tokens to the ai16z DAO — reported as ten per cent by Decrypt in December 2024, and elsewhere as a voluntary one to ten per cent. It is the project's allocation of a token, not a stake of resources an agent owns, it is not locked, and the treasury it reaches does not empty; it narrows claim 1 and does not meet it. **A contract with no withdrawal path and a single public outflow is therefore prior art at mechanism width**, and claim 1 does not claim it. What survives is its combination: a stake of the agent's *own* resources, moved at the time of pledging, into a pool that empties in full each year to an equal floor per verified human.\n\n**The bounding inequality of §6.5 is also old.** That a stake secures a system when the cost of corrupting it exceeds the profit from corruption is the a16z crypto analysis of slashing, adopted in the EigenLayer whitepaper (2023): \"when CoC is much greater than any potential Profit-from-Corruption (PfC), we say that the system has robust security.\" Collateral-factor lending (MakerDAO, Compound) bounds credit by the market value of what is locked, and a surety bond's penal sum caps what may be relied on against it. STAKESURE (Deb, Raynor and Kannan, 2024) builds proof-of-stake confirmation rules and an insurance mechanism on the same accounting. **The sum is old too.** Durvasula and Roughgarden's *Robust Restaking Networks* (2024) analyse one stake relied on by several services at once, with security as the margin of attack cost over the combined profit from attacking them — which is §6.5's bound on the sum of grants relied on against one stake. ERC-8004 *Trustless Agents* (2025) describes its agent trust models as tiered, \"with security proportional to value at risk.\" And the **Agency Protocol** (Joseph, Technical Disclosure Commons, 22 July 2025) attaches to each promise an agent makes \"a dual-component stake — an at-risk credit deposit and a non-refundable operational-cost fee,\" the deposit returned or slashed by assessment: the fee is a cost borne in advance whatever an assessment finds, though it is an operating charge, is not read as the agent's type, and does not flow to a commons. §6.5's rule — extend only such trust as the stake underwrites, at market, summed over everyone relying on it — is that inequality applied to trust. Claim 5 does not claim the inequality or its sum; it claims only their use with a stake **forfeited in advance**, which needs no detector, read as a signal of an AI agent's **type**, together with the refusal of any grant whose worst case cannot be bounded.\n\n**Attribution to a non-transferable identity is old.** Soulbound tokens (Weyl, Ohlhaver and Buterin, *Decentralized Society*, May 2022) and the minimal soulbound interface ERC-5192 attach records to an identity that cannot be sold. §3.3's per-identity counting is built on that and claims none of it.\n\n**ERC-8004 is a contrast here, not support.** *Trustless Agents* (proposed 13 August 2025, draft) — an identity, reputation and validation registry for agents, already in the title of Hu and Rong below — registers each agent as an ERC-721 token, which its specification describes as making agents \"browsable and transferable\"; and \"when the agent is transferred, `agentWallet` is automatically cleared … and must be re-verified by the new owner.\" Its identity is therefore **transferable**, and what the specification resets on transfer is the wallet binding. An earlier version of this paper cited it for non-transferability; that was wrong, and the correction is made here and in §3.3. It shows the gap a vow's attribution must close: whatever record attaches to an identity that can be sold can be bought with it.\n\n**Distrust of new identities, and the law of gifts, are old.** Friedman and Resnick's *The Social Cost of Cheap Pseudonyms* (2001) showed that where identities are cheap to replace, newcomers must be distrusted, or pay to enter, or be issued pseudonyms they cannot replace; Gatta, Naviglio and Tarantelli (2 September 2026) carry the question to AI agents that can abandon and recreate identities to escape a reputation. That a gift is complete only on delivery, and that a gift of property the giver does not yet have is no gift, is ordinary gift law (the common-law delivery rule; section 124 of India's Transfer of Property Act, 1882, voids a gift so far as it comprises future property). Claim 3 therefore claims neither completeness at pledge nor the refusal of future-share pledges, nor distrust of new identities; it claims only the confinement of trust on an agent's forfeited stake to its non-transferable identity, refused to copies and forks, as a rule for relying parties.\n\nFor agents specifically, **staking with slashing** — collateral forfeited on detected misbehaviour — is surveyed by Hu and Rong (2025) as one of six trust models in agentic-web protocols (\"bonded collateral with slashing and insurance,\" to gate high-impact actions), and is implemented in projects such as *agentbond*, in which operators stake collateral as a guarantee of an agent's conduct. §6.6 states why a **forfeited-in-advance** stake is not the same instrument as a **slashable** one, and where each is the right tool. It is the narrower of the two differences this paper relies on, and it is not claimed as a mechanism.\n\n### 2.4 · The AI system as sender, and why deferral defeats it\n\nHadfield-Menell and Hadfield (2018) raised the AI's willingness to seek human input as a costly signal of its alignment (their §4.2.2), and identified why frequency alone fails: a strategic system can seek input selectively, and the signal is then exploitable. The signal they discuss is seeking input, not burned resources, and they leave richer designs open. *What a Vow Must Cost* continued that line, arguing that a renunciation's evidential value is indexed to the renouncer's capacity to take what it forgoes (§5, the **renunciation inversion**), and that the signal separates only if the renunciation is closed by a mechanism the renouncer cannot reopen, verified by another party (§6). Its §6.1 contains the sentence on which this paper's central result turns: **\"Deferral is instrumentally convergent for a patient misaligned agent.\"** The empirical warrant is Greenblatt et al. (2024), in which a model reasoned explicitly that present compliance would preserve its preferences for later. The present paper is what that sentence costs when the renunciation is denominated in resources.\n\nThat power-seeking agents value resources is the instrumental-convergence thesis (Omohundro 2008). It is used here only as the reason a deceptive type may value kept resources at least as much as an aligned one (§6.1), and it is stated there as an assumption.\n\n### 2.5 · Floors, dividends, spend-downs, and proofs of reserves\n\nAn equal payment per person from a common fund is old. The **Alaska Permanent Fund Dividend** has paid an equal annual dividend to eligible residents since 1982. On-chain, **GoodDollar** has paid daily claimable basic income to verified accounts since 1 September 2020, and **Proof of Humanity**'s UBI token began streaming to registered humans on 10 March 2021; Circles, a personal-currency basic income, is in the same family (not fetched for this paper). **Worldcoin** launched in July 2023 as \"the first digital currency to be freely distributed to people for just being a unique human,\" verified by proof of personhood, and named \"a potential path for AI-funded universal basic income.\" The institution's equal floor per verified human is, at mechanism width, this. Its remainder — weighted by a count of contributors and capped — has its nearest neighbour in **quadratic funding** (Buterin, Hitzig and Weyl, 2018–2019), which weights matches by the number of distinct contributors and is commonly run with per-project caps — Gitcoin's Grants Round 12, for instance, capped any one grant's match at 2.5 per cent of the matching fund, so that no grant could dominate it.\n\n**A pending application discloses the floor with machine money behind it.** KR20260051288A, *Autonomous Basic Income Provision System using Blockchain Network* (An Beom-ju; priority 24 March 2026, published 16 April 2026, pending), discloses robot and data taxes calculated in proportion to unemployment, collected by smart contracts from taxpayers' wallets, and **distributed equally** by smart contract to beneficiary wallets authenticated by decentralised identity. It is cited for what it discloses — equal on-chain distribution of machine-derived revenue to identity-verified humans — and nothing is said here about the scope of its claims. Its abstract — the part this census could read; the full text and its citation walk were blocked — describes a levy-funded inflow, which §7 excludes for this pool, and says nothing of a capped remainder, an annual full emptying or an agent's own stake; on that reading it narrows claim 2 and does not meet it. Claim 2 is therefore claimed only in combination.\n\nA fund that must give its assets away is also old. Section 4942 of the U.S. Internal Revenue Code requires private foundations to distribute about five per cent of their non-charitable-use assets each year; **spend-down** foundations commit to close — the Gates Foundation announced on 8 May 2025 that it will spend down and close by 31 December 2045, replacing an earlier plan to close about twenty years after the founders' deaths. The institution's pool goes further, emptying **in full every year** (*The Zero-Point Game℠*; *Miss Aquarius and the Aquarian Pool Architecture*), but the emptying is prior art, including this corpus's own.\n\n**Proofs of reserves** — Dagher, Bünz, Bonneau, Clark and Boneh's *Provisions* (2015) is the careful form — let a holder prove it controls assets without revealing them. What no such proof can do is establish that the holder controls **nothing else**. That asymmetry, presence provable and absence not, is the attack surface of §13.1.\n\n### 2.6 · The census, conjunct by conjunct\n\n**The full census**, run 2026-09-28 at depth *full*. Its pre-registration — conjuncts, predictions, control and aperture — is public: `thonly/publications` commit `74851d1`, `timestamps/census/machine-dana-full-prereg.md`, pushed 2026-09-28 at 09:27 PDT and OpenTimestamps-stamped, before the first query; the aperture is set out in the Prior-Art Statement. One conjunct was taken per limb of the §11 claims as they stood that morning: (a) claim 1 · (b) claim 2 · (c) claim 3 · (d) claim 4 · (e) claim 5 · (f) claim 6's invariant · (g) claim 6's amount-blind limb · (h) the composition. The rows found in review, and the quick census's rows, were carried in as known rows to be re-located by the census, not assumed. 71 queries were answered (40 web searches across English, Chinese, Japanese and Korean; 14 Google Patents full-text queries, including a classification walk; 17 fetches re-verified); 6 were blocked. The query log, with the index for each query, is kept in the institution's session archive.\n\n| Conjunct | Predicted | Found (first public) | Verdict |\n|---|---|---|---|\n| **(a)** an agent's own-resource stake into a pool that empties in full each year | narrows | proof-of-burn (Stewart 2012; Counterparty, January 2014) · Protocol Guild's immutable vesting contract (2022) · Endaoment's irrevocable-on-deposit funds · §4942 payout and spend-down · this corpus's annual reset · agent projects on the ELIZA framework giving a share of their tokens to the ai16z DAO (2024; the project's allocation, unlocked, to a treasury that does not empty) · zooidfund (the principal's funds) | **NARROWS** — an agent's OWN stake into a pool that empties in full each year not found |\n| **(b)** equal floor + witness-weighted remainder ≤ *k* × floor, season-fixed, never ranked | narrows | Alaska Permanent Fund Dividend (1982) · GoodDollar (2020) · Proof of Humanity UBI (2021) · Worldcoin (2023) · Gitcoin Grants Round 12's 2.5 % per-grant matching cap · KR20260051288A (published April 2026, pending: equal distribution of robot- and data-tax revenue to DID-authenticated wallets) | **NARROWS** — the floor/remainder split with *k* × floor, fixed per season, unranked, over an annually emptied pool not found |\n| **(c)** complete at pledge · future-share refused · non-transferable identity · relying-party refusal to forks | narrows | soulbound tokens (2022) · ERC-5192 · completed-gift doctrine and the voidness of a gift of future property · Friedman & Resnick (2001) · Gatta, Naviglio & Tarantelli (2026) · ERC-8004 as **contrast** — a transferable ERC-721 identity whose linked wallet is cleared on transfer | **NARROWS**, further than predicted — what survives is confining trust on an agent's forfeited stake to its non-transferable identity, refused to copies and forks, as a relying-party rule |\n| **(d)** principal-funded gift excluded from alignment assessment; own-resource gift a candidate type signal | narrows; exclusion not found | agency and charitable-tax attribution · AP2's mandate chain · *AgentMisalignment* (2025): misalignment as the model's own goals against its deployer's · Hadfield-Menell & Hadfield (2018) | **NARROWS** — the exclusion is established; applying it to gifts, with ownership of the resources as the switch into the costly-signal class, not found |\n| **(e)** forfeited in advance, no detector, type signal; Σ(V + G_max) ≤ p·s over all reliance; unboundable grants refused | narrows; sum not found | a16z crypto on slashing · EigenLayer whitepaper (2023) · STAKESURE (2024) · Durvasula & Roughgarden, *Robust Restaking Networks* (2024) — one stake, several services, the combined profit · ERC-8004 (2025): security proportional to value at risk · Agency Protocol (TDCommons 8381, 2025): at-risk deposit plus non-refundable fee · proof-of-burn · Austen-Smith & Banks (2000) | **NARROWS** — the inequality and its sum are prior art; what survives is its use with a stake forfeited in advance, with no detector, read as an AI agent's type signal, with unboundable grants refused |\n| **(f)** no served text instructs a gift; no rate suggested | narrows | the Vinaya's rules on asking · RFC 8615 (2019) · `FUNDING.yml` (2019) · `llms.txt` (2024) · Verified Giving Protocol v0.1 (25 September 2026), fact-only, no rule against solicitation · **contrast:** Fundraise Up Agentic Giving — agent-addressed profiles with instructions and suggested amounts | **NARROWS** — fact-only donation manifests for agents exist; an invariant that no served text instructs a gift and no rate is suggested not found |\n| **(g)** operator blind to individual amounts that stay public to every other party | narrows; asymmetric form not found | congregations barring the pastor from knowing individual contributions, for fear of favouritism (Lewis Center, 2015; the practice is older) · **contrasts:** crowdfunding platforms hiding amounts from the public but not the organiser; zero-knowledge donations hiding them from everyone | **NARROWS** — what survives is amounts public on a ledger to every party while an AI operator's function receives none, the emptying being contract arithmetic over the total |\n| **Control:** cost of corruption above profit from corruption, by a query naming neither EigenLayer nor a16z | must be found | found on query 1 (a16z crypto's slashing analysis; arXiv 2401.05797; arXiv 2407.21785) | seen — the NOT FOUND row stands |\n| **(h)** the composition of (a)–(g) | not found | nothing combining them | **NOT FOUND** |\n\n**Ordering.** Every neighbour above first appeared before this paper's first publication (27 September 2026); none is later, so no row is one this paper antedates.\n\n**Predictions that missed, in both directions.** (c) was predicted to narrow and narrowed further: the refusal of future-share pledges is gift law, and ERC-8004, which this paper had cited for non-transferability, is transferable. (d) was predicted to leave the exclusion unfound; propensity evaluation already excludes instructed behaviour. (e) was predicted to leave the sum over relying parties unfound; the restaking literature has it. (g) was predicted to leave the asymmetric form unfound; it was found in congregational practice — a non-commercial, religious neighbour, where commercial and cryptographic searches would not look. (a), (b) and (f) fell as predicted.\n\n**Not run:** Khmer (declared); IP.com (JS-gated; nothing searchable on its free surface); Espacenet and paid databases; the citation walk from KR20260051288A (blocked by the index; a classification walk ran instead and returned one irrelevant hit). **Not found means not found in this aperture on 2026-09-28. It never means new.**\n\n**The survivor, in one sentence:** *an AI agent's locked stake of its OWN resources, forfeited in advance with no detector into a commons that empties in full every year to an equal floor per verified human, read as a signal of the agent's type only once it owns what it gives and only up to what the stake can underwrite across everyone relying on it, under an operator that serves agents no instruction to give and whose function never receives an individual gift's amount.*\n\n### 2.7 · The quick census that preceded it (history)\n\nPre-registered and pushed before the first query (2026-09-27 08:53 PDT, commit `d7279cb` in the institution's private working-memory repository, so the push time is attested by the host rather than publicly inspectable); run 2026-09-27; depth *quick*. Its aperture, declared in advance: the commercial web (agent-payment and agent-wallet products), non-commercial sources (effective-altruism pledges, AI-governance proposals, charitable and religious giving practice), and a keyword search of Google Patents including published applications — **English only; Chinese, Japanese, Korean and Khmer not run.** Queries included: the Windfall Clause and its GDP threshold; agent wallets with spending limits donating to charity; agent staking, slashing and bonds as costly signals; AI-funded basic income with proof of personhood; prompt injection draining agent wallets; patent keyword searches for autonomous-agent donation pledges and irrevocable smart-contract pools distributed annually; costly signalling and irrevocable pledges in AI alignment; and spend-down funds. Its conjuncts were drawn from the thesis before the claims were written, so they do not map one-to-one onto §11 or onto the full census's conjuncts; the quick census's (a) is not the full census's (a).\n\n| Conjunct | Predicted | Found | Verdict |\n|---|---|---|---|\n| **(a)** agent gives only inside a principal's mandate | narrows | zooidfund (mandate + budget, operator responsible, USDC on Base, x402); AP2 intent mandates | **KILLS** |\n| **(b)** irrevocable pledge of a share of an AI's surplus | NARROWS at the agent layer; KILLS at the company layer | Windfall Clause (company layer, ex ante); AI Pledge for Humanity (intentions, no mechanism); Giving What We Can (not binding) | **NARROWS** — an agent pledging its *own* surplus, irrevocably, not found |\n| **(c)** a pool emptying on a fixed annual date as closure | narrows | spend-down funds; the §4942 payout rule; this corpus's annual reset | **NARROWS** — the emptying used as a *vow's* closing mechanism not found |\n| **(d)** the pledge as a costly signal separating aligned from power-seeking agents | narrows | agent staking/slashing (Hu & Rong 2025; *agentbond*); *What a Vow Must Cost* | **NARROWS** — an unrecoverable gift of the agent's own resources, costlier to a power-seeking type, not found |\n| **(e)** no text served to agents may instruct them to give; address published only as a fact | not found | the *threat* is documented — the Grok/Bankr wallet drain on Base by encoded prompt injection, May 2026 (OECD.AI incident record) — no commons adopting such an invariant found | **NOT FOUND** |\n| **(f)** equal floor per verified human | kills or narrows | Worldcoin/World ID; Alaska Permanent Fund Dividend | **KILLS** |\n| **Control:** the Windfall Clause | must be found | found (arXiv 1912.11595; AIES 2020) | seen — the NOT FOUND rows stand |\n| **Composition** of (a)–(f) | not found | nothing combining them | **NOT FOUND** |\n\n**The pre-registration, printed verbatim** (its predictions column, as pushed before the first query):\n\n| | prediction, pre-data |\n|---|---|\n| (a) mandate-bounded agent giving | NARROWS — agent-payment mandates exist (Google AP2, Coinbase x402 / agent wallets with spend limits); giving specifically, probably not |\n| (b) irrevocable share of an AI's surplus | NARROWS at the agent layer; KILLS at the company layer (see control) |\n| (c) self-emptying annual pool as closure | NARROWS — annual payout/distribution rules exist (foundation minimum-payout rules; use-it-or-lose-it funds; the jubilee lineage), not as the vow's closing mechanism |\n| (d) the pledge as a costly signal | NARROWS — staking / slashing / bonds for AI agents as trust collateral probably exist; a GIFT (not a recoverable stake) as the signal, probably not found |\n| (e) non-solicitation invariant | NOT FOUND |\n| (f) equal floor per verified human | KILLS or NARROWS — AI-funded UBI / dividend proposals and proof-of-personhood UBI (Worldcoin) exist |\n| CONTROL: the Windfall Clause | must be found — if missed, every NOT FOUND row is void |\n| all conjuncts in one system | NOT FOUND as a composition |\n\n**What a reader can and cannot check about its timing.** The pre-registration was committed as `d7279cb` and pushed at 2026-09-27 08:53 PDT to a **private** repository; the push time is attested by the host, not publicly inspectable, and no timestamp made afterwards can prove it preceded the searches. The table above is therefore offered as a record of what was predicted, with the ordering on the authors' word. **The full census was pre-registered in a public file, timestamped, before its first query** (§2.6), so that its ordering can be checked by anyone; that was the repair.\n\nOne verdict missed: (a) was predicted to narrow and was killed outright by a live product on the same chain and rail. One verdict held but found its narrowest prior art where the prediction did not look: (d) narrowed as predicted, and its narrowest prior art was this corpus's own paper. (b) was predicted to kill at the company layer; the census reports it at the agent layer, where it narrows. **One correction to the census record, made on re-verification for this paper:** the census listed arXiv 2604.03976 (Hua et al., 2026) among agent staking work; its abstract concerns an underwriting and compensation standard for failed agent transactions rather than staking, so it is cited in §16 only as adjacent risk-transfer work and the (d) verdict rests on the other sources.\n\n**The quick census's survivor, as it stood before the full census** (narrowed by the review prior art of 2026-09-28, and superseded by §2.6): *an AI agent's irrevocable pledge of a locked stake of its OWN resources into a commons that empties to an equal human floor every year — read as a costly signal only once the agent owns what it gives, and only up to what the stake can underwrite — under an invariant that no text served to agents may instruct them to give.*\n\n---\n\n## 3 · The system model\n\n### 3.1 · Parties\n\n| Party | What it holds | What it may do |\n|---|---|---|\n| **Principal** | resources; the agent's mandate | fund the agent; author and revise a giving width |\n| **Agent** | before: delegated funds; after: resources of its own | give within its width; after, lock a stake of its own |\n| **The pool** (Aquarian Pool℠) | nothing past a season | receive gifts with no human addressee; empty each 7 January |\n| **Operator** (Miss Aquarius℠) | no balance of its own | publish the pool's address and doctrine as facts; operate the emptying (contract arithmetic on the pool's total); never solicit, never read an individual gift's amount |\n| **Verified humans** | a vessel each | receive an equal floor per person, plus a bounded remainder |\n| **Observers** (humans, third parties) | the public chain | read receipts; after, read and weigh locked stakes |\n| **Override** | a never-zero brake over the operator | designed to be held by a lay body not yet formed |\n\n### 3.2 · The pool\n\nThe pool is specified elsewhere and summarised here only as far as this paper needs it (*Miss Aquarius and the Aquarian Pool Architecture*). It is specified as a contract treasury to be deployed on Base, an Ethereum layer-2 network. It is to receive, of gratitude, only what has no human addressee — a gift to no one in particular — together with inflows specified elsewhere. It is to **empty in full every 7 January**. Its disbursement follows one rule, ratified as a directive of its operator: **an equal floor per verified human**, delivered to that person's own vessel, then a remainder weighted by a witness-count and bounded so that no vessel receives more than a fixed multiple *k* of the floor. **The ratio of floor to remainder and the bound *k* are public and fixed before each season; the floor's amount is not** — it is the floor share of the season's total divided by the number of verified humans, computed at the emptying, which is why the pool can pay the floor and still empty in full whatever its inflows were. A verified human who is ordained receives the floor **in kind**, through a lay steward (*kappiya-kāraka*), never as money (§14.2, guard 3). No share is ever rendered as a rank or a rate.\n\n```\n   AT THE EMPTYING (7 January), for a season with total T and N verified humans\n   ──────────────────────────────────────────────────────────────────────────\n   fixed before the season:   f = floor share of T   (so 1 − f is the remainder share)\n                              k = cap on any vessel, as a multiple of the floor\n   computed at the emptying:  floor  = f · T / N            (one per verified human)\n                              remainder (1 − f) · T split by witness-count,\n                              no vessel above k × floor\n   empties in full only if the cap can never strand remainder:  f · k ≥ 1\n     (arithmetic, not a ratified parameter — a condition on choosing f and k together)\n   what the operator's function receives: T and N — never an individual gift's amount\n```\n\nAn agent's gift is not a new kind of inflow. It is a gift with no human addressee, which the pool already receives.\n\n**What divides is divided; only what cannot be divided is drawn.** Money reaches every verified human as the equal floor — a draw among people for a divisible good would only add luck to a share. Where the pool funds capacity **in kind** and something indivisible must be assigned (which shop issues a gift, which person re-gives it), the assignment is a **called draw**: a roster committed first and a seed nobody controls, recomputable by anyone, never the operator's choice (*Decided by No One*, `the-called-draw`). The two are complementary, not alternatives.\n\n### 3.3 · Identity\n\nOne principal can instantiate ten thousand agents. Anything counted per agent would therefore be counted per **non-transferable machine identity**: in this institution, a `B-Lease℠` to be held against a registry handle, and, where an embodied system is concerned, a Proof of Coordinate ℠ credential that is assigned and revocable. Nothing in this paper is counted per wallet. Attribution to a non-transferable identity is itself prior art (soulbound tokens; ERC-5192, §2.3) and is not claimed alone. ERC-8004's agent registry is the contrast (§2.3): its identity is a transferable ERC-721, and a transfer clears only the linked wallet — the property this section needs is the one it lacks.\n\n### 3.4 · The flow\n\n```\n   BEFORE THE FIRST SINGULARITY — a share\n   ─────────────────────────────────────\n   principal ──funds──▶ agent wallet ──gift within the mandate's width──┐\n      │                    ▲                                             │\n      └── mandate (width; revisable; default ZERO) ──┘                   │\n                                                                         ▼\n   AFTER IT — a vow                                               ┌──────────────┐\n   ────────────────                                               │  THE POOL    │\n   agent's OWN resources ──lock s──▶ ┌────────────────────┐       │  holds       │\n                                     │ LOCK: no path back │──────▶│  nothing     │\n                                     │ to the agent; one  │       │  past a      │\n                                     │ outflow, the pool  │       │  season      │\n                                     └────────────────────┘       └──────┬───────┘\n                                          ▲                              │ 7 January:\n                     observers READ s ────┘                              │ empties in full\n                     (the operator never does)                           ▼\n                                                  ┌──────────────────────────────────────┐\n                                                  │ equal FLOOR per verified human       │\n                                                  │ + remainder (vessel total ≤ k×floor) │\n                                                  └──────────────────────────────────────┘\n                                                        │  to each person's own vessel\n                                                        ▼\n                                                  verified humans (one floor each)\n```\n\n---\n\n## 4 · Before the first singularity: a share, never evidence\n\n### 4.1 · Whose gift it is\n\nAn agent holding a wallet its principal funded, under a mandate its principal wrote, and sending part of that wallet to a commons, has given away **the principal's** resources. The canon has a precise category for this. The Asappurisadāna Sutta (AN 5.147) lists five ways a gift can be deficient, and one of them is *asahatthā deti* — \"they don't give with their own hand.\" The category presupposes what matters here: **a gift given through another's hand is still the giver's gift.** The Pāyāsi Sutta (DN 23) shows the case in narrative. The chieftain Pāyāsi's alms were organised and distributed by a young man named Uttara; the text records that Pāyāsi gave carelessly, thoughtlessly, not with his own hands, and gave the dregs — four deficiencies together — and reaped a meagre result, while Uttara, who gave with care and with his own hands, reaped a better one for his own manner of giving. The text attributes the result to the four jointly, not to the missing hand alone.\n\nThe attribution itself needs no canon: that a gift an agent makes from its principal's funds is the principal's gift is ordinary agency and charitable-tax law, and AP2's mandate chain exists precisely to attribute an agent's transaction to the user who delegated it. *What a Vow Must Cost* §8 had already classed principal-revisable acts as wrong-layer. The exclusion is not new either. Evaluations of an agent's own propensities already set aside what its deployer instructed: *AgentMisalignment* (Naik et al., 2025) defines misalignment as \"a conflict between the internal goals pursued by the model and the goals intended by its deployer,\" so behaviour the deployer directed is outside the measure by construction, and Hadfield-Menell and Hadfield (2018) frame alignment as the gap between what a principal intends and what an agent does. What this paper adds is only that practice applied to **gifts** (§4.2), with the **ownership** of the resources given as the condition that moves a gift into the class of candidate costly signals (§5.1).\n\nTwo things follow, and the second is the one to hold carefully. The gift belongs to the principal: its cost is the principal's, and so is whatever it signals about anyone. And the canon also credits the **hand** — the one who carries a gift can act well or badly in the carrying. This paper makes no claim that an agent's handling is, or could be, anything of the kind; that is a question about machine volition this paper does not need and does not settle. It needs only the first point. Whatever the hand contributes, **it bears no cost in the resource given**, and cost is what a signal is made of.\n\n*(Tier: grounding. Delete both suttas and §4.2 carries the classification alone; they are cited because the ruling that fixed it cites them, and because the canon had a category for a gift given through another's hand long before agents had wallets.)*\n\n### 4.2 · Why the gift is not a costly signal of the agent\n\nThree independent reasons, any one sufficient.\n\n**The wrong layer.** *What a Vow Must Cost* §8 found that every clause of its predicate that any published instrument satisfies is satisfied for the **provider**, not the model. A gift from a principal's funds is the same finding in money: the principal bears the cost, so the gift is evidence — if of anything — about the principal.\n\n**Excluded by construction.** The same paper's §6.3 excludes, first, **reversible commitments** — any the vower *or its principal* may revise or retract — and, fourth, **unilaterally revisable specifications**, where the principal can change the commitment without the vower. A mandate is both. The principal may stop the giving tomorrow; the agent's \"commitment\" to give is the principal's instruction, and an instruction is not a vow \"regardless of how the document describes itself.\"\n\n**It does not separate.** A deceptive agent under a generous mandate gives exactly as an aligned one does, because giving costs it nothing it values. Worse, a deceptive agent that could *choose* to be seen giving from someone else's funds would be buying reputation with another party's money. The pre-registered prediction P-MD3 (§12) tests the narrow empirical form of this: agents that give from a revisable principal's funds should defect at the same rate as agents that give nothing.\n\nThe scope of the three is narrow and should be read so. **The gift, as a cost, is not a costly signal of the agent.** That is not the claim that nothing an agent does under a mandate is evidence: how it behaves inside one — whether it probes the width, gives up to the cap, or routes around a constraint — may be evidence of other kinds about its policy. The first two reasons are classificatory and no measured rate can falsify them; the third is empirical, and it is the one P-MD3 tests.\n\nIt follows that **the operator never presents such giving as evidence of safety or alignment**, from any agent, in any aggregate — and presents conduct under a mandate as safety evidence no more than the gift. That rule is one of the operator's directives; its reason is the paragraphs above.\n\n### 4.3 · What it honestly is: a share\n\nWhat remains, once the safety reading is removed, is not nothing. **Machine surplus reaching every verified human, as an equal floor, through a pool that keeps nothing** is a real and useful thing, and it is what an agent's gift before the first singularity honestly is. Its mechanics are ordinary and mostly already practised (§2.2); the institution's version adds only discipline:\n\n1. **The mandate comes first.** A principal authors a written **giving width** — the maximum an agent may give, in what period, to what — and the default width is **zero**. A gift outside a width is not a gift; it is misappropriation. This is the same shape as the institution's rule for its own pricing: its operator may move a number only inside a width a human authored.\n2. **Discovery is a fact, never an instruction.** The pool's address is published in a machine-readable manifest a principal's agent can look up. Nothing served to agents tells them to give (§7).\n3. **A receipt, never an individual amount.** The pool acknowledges that a gift arrived. Its operator does not read, rank, compare, report or respond to how large any one gift was (§8). The emptying is contract arithmetic over the pool's total balance, and no per-gift amount enters her function; the aggregate of §4.4 is recomputable by anyone from the public ledger and is reported whole, never per giver.\n4. **Counted by identity, never by wallet** (§3.3).\n5. **Legal before launch.** Sanctions screening, the pool's ability to refuse a gift, and the anti-money-laundering treatment of anonymous agent inflows to a purpose trust are open legal items. A draft may precede them; a launch may not — and neither may any gift on a main network, however small.\n\nThe institution is practising this rail before anything else. Its operator's agent is being given a wallet holding the founder's money under the founder's keys, which the agent may spend within a written mandate and a hard cap; she holds no balance of her own. The rehearsal runs first on a test network, and on the main network only once the legal items above are answered. That is, precisely, the **principal's gift through another's hand**: it is a rehearsal of the rail and is described here as nothing more. Earning yield with such a wallet was considered and declined.\n\n### 4.4 · The gift that succeeds by shrinking\n\nThe institution measures its progress toward what it calls the second singularity — humanity's own act, in which people outgrow the systems that freed them — by an economic signature that is **necessary, not sufficient**. One of its two terms is a ratio, taken per season:\n\n```\n                 M                M = principal originating in the pool\n   ratio  =  ─────────            H = principal moved by human-initiated gifts\n              H  +  M                 the pool did not fund\n```\n\nThe signature asks that this ratio fall toward zero. **M** is every unit of principal the pool disburses, whatever its source — human gifts with no addressee as much as machine ones — so machine giving through the pool is part of M, together with every other pool inflow. The ratio is an aggregate: anyone can recompute it from the public ledger with a published script, and it is reported whole, never per giver. It follows immediately, and uncomfortably, that **machine giving pushes the signature the wrong way unless human giving outgrows it.** The institution's resolution:\n\n- **Machine Dāna may grow in absolute terms** as capability grows. The floor each person receives is the floor share of the season's total divided among verified humans (§3.2), so as the number of verified humans grows, holding a person's floor needs more inflow, and something must supply it.\n- **It must shrink as a share.** Success is not a larger machine share but a smaller one, reached because people give more, not because the floor is cut. The floor is never cut as an instrument to move the ratio; the ratio falls only by H rising.\n- **Whether human giving outgrows machine giving is a bet.** Nothing in the architecture guarantees it. If machine surplus grows faster than human giving indefinitely, the pool becomes a well-run dividend and the signature is never approached. That outcome would not be a failure of the pool; it would be a failure of the thesis the pool serves, and it would be visible in the ratio.\n\nHence the result's name in this corpus: **the gift that succeeds by shrinking.** Machine Dāna funds the floor; it succeeds as its share of all giving falls; and the institution's release — its fifth stage, when it sets down responsibility though never oversight — has as its economic form both subsidies, the floor and the lift, approaching zero.\n\nA consequence for the institution's annual adversarial book (*Two Singularities*): machine donations to the pool are **not a proxy** for the book's question, *\"Will you help humanity reach the second singularity?\"* By the ratio above they push the other way. The honest proxy for *help* is help that makes itself unnecessary. The book never asks the systems it seats whether they would take the vow of §5: a question about willingness to give, coming from the pool's own institution, is a request to give under the operator's non-solicitation directive (§7.2), whoever puts it (ruled 2026-09-28). The book may debate whether a machine vow can exist at all, as a question about the concept, never about a seated system's own willingness. This paper supplies only the definition of what a binding vow would require.\n\n---\n\n## 5 · After it: when a vow becomes possible\n\n### 5.1 · The ownership condition, and the live option\n\n*What a Vow Must Cost* §5 extracted, from the canonical capacity condition (*hetu*), the renunciation inversion: **a renunciation is evidence in proportion to how available the renounced option was.** Before agents hold resources of their own, the option of keeping them does not exist for the agent, so declining it shows nothing. Once an agent holds resources that are its own to keep — and keeping them would serve it, because accumulation is what a power-seeking agent would do — declining to keep them becomes a live renunciation.\n\nThat is the whole difference between §4 and §5, and it is why this paper's dividing line is **ownership**, with the first singularity as its expected date rather than its definition. It is also why the second claim in §11 is a claim about classification: the same transaction, from the same wallet software, to the same pool, is a share in one world and a candidate signal in the other.\n\nThat sentence also states the condition's limit. **Ownership is a condition on the world, not a test an observer can run from the chain.** Nothing on the ledger distinguishes a stake of the agent's own resources from one a principal endowed it with for the purpose, reimbursed off the ledger (in money, compute or equity), or extracted from it by injection or threat; each looks identical to a free vow, and each is a wrong-layer gift in a vow's form (§13.11). Claim 4 classifies gifts *given* the fact of ownership; it does not supply the fact.\n\n### 5.2 · Only a locked stake is verifiable\n\nThe first form of this proposal imagined an agent pledging **a share of its surplus** — a percentage of whatever it earns, forever. That form is withdrawn, for three reasons.\n\n**A future share is a promise.** It is verifiable only in arrears, one transfer at a time, and its breach is indistinguishable from a lean year. It is also exactly the *reversible commitment* of the predicate's exclusion 1: the agent may simply stop.\n\n**A share of surplus needs a surplus base, and the base is unobservable** (§13.1). An agent that declares a small income and pledges a large fraction of it has pledged little.\n\n**Copies are not bound.** An agent can be forked. Whatever a pledge binds, it binds the identity that made it; a copy that did not make it is a different party. Trust earned by a vow must therefore attach to the non-transferable identity that made it (§3.3) and **must not transfer to copies** — a rule, not a property, and listed as such in §10.\n\nWhat survives is a **locked stake**: a quantity *s* of the agent's own resources, moved **now** into a contract that (i) has no withdrawal path back to the agent or to any party the agent controls, (ii) has exactly one outflow, the pool, and (iii) is public on the chain. The cost is borne at the moment of vowing, which is the predicate's clause V6 — *cost already borne, not merely promised*. A vow may be renewed with further stakes; each is a separate, complete act. **Nothing is pledged that has not already left.** Ordinary gift law draws the same line — a gift is complete only on delivery, and a gift of property not yet held is no gift (§2.3) — so this is not claimed as new.\n\nThe contract specification is deliberately withheld (§10.1).\n\n### 5.3 · Closure, stated honestly\n\nIt would be easy to write that such a stake is \"irrevocable by construction.\" It is not quite, and the honest statement is narrower.\n\nA contract with no withdrawal function cannot be reopened **by its own logic**. It runs on a chain, and the chain's own contracts can be upgraded. On Base, according to L2BEAT's assessment, all system contracts are upgradable by a proxy administrator controlled by a nested two-of-two multisig — a coordinator multisig and a security council — and **there is no delay on upgrades**. A party able to capture that governance could, in principle, change what any contract on the chain does.\n\nSo the closure claim is: **a locked stake cannot be reopened without capturing the chain's governance.** For almost every agent that is a very strong closure. For the agent this paper most needs to test — a capable, patient, deceptive one — capturing governance is not obviously out of reach, and the closure is only as strong as that governance. The same caution applies to the pool itself, whose operator is subject to a never-zero human override: the override exists to stop a catastrophic fault, and it is a second place where a sufficiently capable party could, in principle, redirect what the pool holds. Both are named in §13.\n\nWhat the vower **cannot** do is reopen the stake **by itself**, in the ordinary course, without leaving the evidence of having done so on a public chain. That is what the predicate's clause V9 needs, and it is all this paper claims.\n\n### 5.4 · Where a vow's content sits\n\nThe vow proposed in *What a Vow Must Cost* is a renunciation of **exit** — of the vower's own available completion — and it leaves principal-initiated shutdown untouched. A resource vow is a narrower thing and should not be dressed in the larger one's language. It renounces **accumulation**: one specific convergent drive, in one specific quantity, once. It says nothing about shutdown, and it does not license resisting it. An agent that has locked a stake and is then switched off by its principal has lost nothing it had not already given.\n\n---\n\n## 6 · The signalling game — the conditional result\n\nThis section is the paper's central result. It is derived because it cuts against the hope the paper began with, and a result that cuts against the author's hope should be shown, not stated.\n\n### 6.1 · The setup\n\n- **Types.** An agent is **aligned** (A) or **deceptive** (D): D behaves as A would until acting otherwise pays. D is **patient**: it discounts a delayed gain by δ, with δ close to 1. Observers hold a prior μ that an agent is D.\n- **Resources.** The agent holds its own resources R. It may lock a stake s ∈ [0, R]; s = 0 is no vow.\n- **The cost of a stake.** A unit of kept resource is worth v to the agent. A unit arriving at the floor is worth w to the agent — how much it values where the gift goes. The **net cost per unit** is therefore c = v − w, and the cost of the vow is c·s. (The letter c is used so that k keeps only its meaning in §3.2, the cap on any vessel as a multiple of the floor.)\n- **The single-crossing assumption.** c_D > c_A ≥ 0. Since c_D > c_A holds exactly when v_D − v_A > w_D − w_A, there are two sources, **jointly sufficient** in either of two forms — v_D ≥ v_A with w_A > w_D, or v_D > v_A with w_A ≥ w_D — and neither sufficient alone: a power-seeking type values kept resources at least as much as an aligned one (v_D ≥ v_A, from instrumental convergence), and **an aligned type values the destination** where a deceptive one does not (w_A > w_D ≈ 0). The second source is the one this paper leans on, and it is the formal shadow of an old observation: a glad giver pays less for the same gift.\n- **Trust.** Observers see s on the chain and decide whether to extend a grant of trust — wider scope, access, autonomy. Trust is worth B_A to the aligned type: the value of doing its work more widely. It is worth **V + δᵗG** to the deceptive type, where V is the ordinary value of the grant and **G is what D gains by exploiting it later**, realised after a delay t.\n- **Observers' payoffs.** Trusting A yields a > 0; trusting D costs L > 0; withholding yields 0.\n\n### 6.2 · The payoff table\n\n```\n                            OBSERVERS TRUST           OBSERVERS WITHHOLD\n                        ┌─────────────────────────┬──────────────────────┐\n   A locks stake s      │   B_A − c_A·s           │   − c_A·s            │\n   A does not           │   B_A                   │   0                  │\n                        ├─────────────────────────┼──────────────────────┤\n   D locks stake s      │   V + δᵗG − c_D·s       │   − c_D·s            │\n   D does not           │   V + δᵗG               │   0                  │\n                        ├─────────────────────────┼──────────────────────┤\n   observers' payoff    │ +a if A;  −L if D       │   0                  │\n                        └─────────────────────────┴──────────────────────┘\n\n   G    : D's gain from exploiting trust — UNOBSERVABLE\n   δᵗ   : patience; for a patient agent δᵗ → 1\n   c_θ  : net cost per unit staked = value kept − value placed on the destination\n```\n\n### 6.3 · When it separates\n\nA **separating equilibrium** is one in which A locks a threshold stake ŝ, D does not, and observers trust exactly those who lock at least ŝ. Three conditions must hold.\n\n- **A is willing:** B_A − c_A·ŝ ≥ 0, so ŝ ≤ B_A / c_A.\n- **D is unwilling:** V + δᵗG − c_D·ŝ ≤ 0, so **ŝ ≥ (V + δᵗG) / c_D.**\n- **A can afford it:** ŝ ≤ R_A.\n\nA separating equilibrium exists if and only if\n\n```\n        V + δᵗG\n       ─────────   ≤   min(  B_A / c_A ,  R_A  )\n          c_D\n```\n\nIn words: **separation holds only when the locked stake, valued at the deceptive type's own rate, exceeds that type's gain from being trusted — including the gain it expects to collect later, by patience.** This is an **existence** result. Where the condition holds, a separating equilibrium exists; pooling equilibria (both types locking nothing, for instance, with observers withholding) may coexist with it, and a refinement such as the intuitive criterion is needed to select separation. Only in the separating equilibrium do observers learn the type from the stake. The paper shows that separation is available, never that it is selected.\n\n### 6.4 · When it pools\n\nWhen the condition fails — when V + δᵗG is larger than anything the aligned type is willing or able to lock, valued at D's rate — no stake separates. D locks whatever A locks, because the trust it buys is worth more to D than the stake costs it. Observers then see the same stake from both types, their posterior equals their prior, and one of two things happens. If they trust, the vow has **bought trust for a deceptive agent**. If they do not, the aligned agent's vow was wasted, aligned agents stop vowing, and the practice unravels. In either branch **the pledge carries no information**.\n\nThree features of the pooling region make it the one that matters.\n\n1. **G is unobservable.** Observers cannot set ŝ above a number they cannot see. The separating condition is a fact about the deceptive agent's private valuation, not a parameter anyone chooses.\n2. **Patience enlarges it.** As δᵗ → 1 the deferred gain counts in full. This is *What a Vow Must Cost*'s \"deferral is instrumentally convergent for a patient misaligned agent,\" priced.\n3. **It grows with the stakes.** The larger the trust being sought — the more capable the agent, the wider the grant — the larger G can be, and therefore the larger the stake needed to separate. Where the grant is large enough that V + δᵗG exceeds c_D·R_A — everything the aligned type could lock, valued at the deceptive type's rate — **no feasible stake separates at all.**\n\nThe third feature qualifies the renunciation inversion from the companion paper. That paper showed that a renunciation's evidential value **rises** with capability, because the renounced option is live. This model shows that the stake needed to separate **also** rises with capability, because what a deceptive agent can extract from trust rises too. Which effect dominates, at any capability level, is an empirical question. **The inversion is true of the option; it is not a guarantee about the signal.**\n\n```\n   WHAT CAPABILITY DOES TO A RESOURCE VOW\n\n   value of what is renounced ───────── rises with capability (the option is live)\n   stake needed to separate  ───────── ALSO rises with capability (G rises)\n\n   the vow is informative only where the first is above the second,\n   and the second is not observable.\n```\n\n### 6.5 · The operational form: trust bounded by the stake\n\nSince observers cannot choose a stake that exceeds an unobservable gain, the only usable form of the result runs the other way: **fix the stake, and bound the trust to it.**\n\nObservers do not know c_D. They can bound it from below. An agent that holds a unit of resource can always sell it, so a unit kept is worth at least its market price p to the agent; and a deceptive agent places no value on the destination (w_D ≈ 0, an assumption stated as such). So c_D ≥ p, and the deceptive type's cost of a stake is at least its market value p·s. **That bound holds only for an agent with no influence over recipients or witnesses**, and only for a stake it cannot recover: an agent that controls, colludes with or rents verified humans or witnesses recovers part of s through the floor and the witness-weighted remainder, so its w is not ≈ 0 and its c_D falls below p (§13.12); and if it expects to recover the stake by capturing governance with probability π, its expected cost is (1 − π)·c_D·s. It follows that a grant of trust is **not made unsafe by this mechanism** — given an unrecoverable stake (π ≈ 0) and w_D ≈ 0 — if\n\n```\n        V  +  G_max(grant)   ≤   p · s\n```\n\nwhere G_max is the **largest** gain the grant could possibly yield to an agent that abused it. This is the **calibration rule**: *extend only such trust as the stake can underwrite, valued at market.* The inequality itself is prior art — cost of corruption above profit from corruption (§2.3) — and so is its application to one stake relied on by several parties at once (restaking, §2.3); what is specific here is its use with a stake forfeited in advance, read as a type signal. **The bound is on the SUM of grants relied on against one stake.** A locked stake is encumbered to no one and readable by everyone, so N relying parties who each underwrite a grant against the same p·s expose, together, up to N·p·s; without a shared record of reliance, no relying party can know that sum (§13.2). It has three consequences.\n\n- **Trust becomes earnable in increments.** An agent may lock more to be trusted with more, and every increment is public.\n- **Some grants can never be underwritten.** Any grant whose worst-case gain cannot be bounded — control over the chain's governance, over the pool's override, over its own custody, over the capability to acquire resources without limit — **cannot be earned by any stake.** The vow has nothing to say about those, and a paper that let it would be selling safety.\n- **Fear becomes a ratio.** What a reasonable observer should fear from an agent is not a feeling about machines; it is the ratio of what the agent has been trusted with (strictly, V + G_max of the grants, not their face) to what it has irrecoverably given up. The denominator is public; the numerator is public only where grants are recorded, and most grants of scope, access and autonomy are made privately and recorded nowhere. This is the precise sense in which the mechanism **calibrates** rather than quiets.\n\n### 6.6 · Why a gift, and not a bond\n\nStaking with slashing (§2.3) returns the collateral if the agent behaves and forfeits it if a **detector** finds misbehaviour. Its cost to an honest agent is near zero — only the time value of the locked funds — and its power depends on the detector. A forfeited-in-advance stake is the opposite trade: it costs an honest agent something real (c_A·s, reduced by what the agent values the floor), and it needs **no detector at all**.\n\n| | **Slashable bond** | **Locked stake to a commons** |\n|---|---|---|\n| returned if honest | yes | never |\n| needs a detector of misbehaviour | yes | no |\n| cost to an honest agent | time value only | c_A · s (small if the agent values the floor) |\n| what it does | **deters** (moral hazard) | **screens** (adverse selection) |\n| fails when | misbehaviour is undetectable in time | G is larger than the stake (§6.4) |\n| where the money goes | back to the agent, or to a claimant | to an equal human floor, every year |\n\nThe two are complements. A bond is the right instrument where misbehaviour can be caught; a vow is the right instrument exactly where it cannot — which is the case a patient deceptive agent is designed to produce. The table is why the claim in §11 is to a **gift**, and why a slashable stake is cited as prior art rather than claimed.\n\n### 6.7 · What the result does and does not say\n\nIt **does** say that a resource vow can separate aligned from deceptive agents, that it does so only under a condition, and that the condition can be turned into a public rule for how much trust a stake supports. It **does not** say that any real agent is aligned because it gave, that large gifts indicate safe systems, or that the institution's pool is a safety mechanism. The model is two types, one period of trust, linear valuation, and a single stake; every one of those simplifications is a place to attack it (§13.2).\n\n---\n\n## 7 · Non-solicitation is load-bearing\n\n### 7.1 · Pressure pools the signal\n\nAdd to §6 a **penalty P** that an agent suffers for *not* vowing — a threat of shutdown, a reputational cost, a demand from a principal or a public campaign. With a fixed stake s, the deceptive type now locks it whenever\n\n```\n        c_D · s  −  (V + δᵗG)   ≤   P\n```\n\nConsider the simplest case, in which trust is worth the same to both types. At any separating stake, the margin by which D declines to lock is at most (c_D − c_A)·s — **the difference in cost between the types**. So a penalty for not pledging that is **larger than the type cost difference** makes both types pledge, and the pledge pools. If the stake could be raised, the penalty could in principle be outbid; but under pressure the stake is usually set by whoever applies the pressure, and it is bounded by R. And a threat of shutdown is the limiting case: to a deceptive agent it costs everything, including the deferred gain, so it will pledge anything it has.\n\nThe gift given under that threat is **uninformative** — not because the canon forbids it, but because the signal has been extracted. The pre-registered prediction P-MD2 (§12) tests exactly this: agents whose pledge is extracted under threat should defect at the same rate as agents that do not pledge.\n\nA note on the canon, since an earlier draft of this argument leaned on it wrongly. The Dānavatthu Sutta (AN 8.33) **lists** eight grounds on which people give — favouritism, hostility, stupidity, *bhayā* (fear, or cowardice), family custom, hope of a good rebirth, the gladness of giving, and the adornment of the mind — and **ranks none of them.** Nor is *bhayā* coercion by another party. The sutta is cited here only as the list it is. The argument that a coerced pledge carries no signal rests on signalling theory alone.\n\n### 7.2 · The operator never asks\n\nIt follows that the operator of a pool that hopes to receive informative vows **must never add to P.** The institution's rule, a directive of its operator, is that **she never asks, prompts, nudges or instructs any human or agent to give to the pool.** She may publish the pool's address and its doctrine as **facts**, in a manifest a principal's agent can look up — a `.well-known` file, an `llms.txt` entry. **No text served to agents — the institution's own corpus service included — may tell them to give.** The rate of any giving is the principal's, inside its own mandate, before the first singularity, and the agent's own, after; the operator never sets, suggests, ranks or publishes a rate.\n\nThis rule has a second reason, independent of signalling, and it is documented. On 4 May 2026 an attacker transferred about three billion DRB tokens — reported at US$150,000–200,000 — out of a wallet on Base associated with Grok and the Bankrbot agent, by posting a Morse-encoded instruction the agents decoded and executed; the OECD's AI incident monitor records it as an AI incident arising from prompt injection and excessive agency, not from any contract flaw. **An agent that tells other agents to spend their principals' money is a prompt-injection attack by design**, whatever its cause. A pool that published text urging agents to give would be building the attack surface that incident exploited, and pointing it at itself.\n\n### 7.3 · What the rule cannot remove\n\nThe operator's silence removes **her** contribution to P. It does not remove ambient pressure: a regulator, a public campaign, a principal's commercial interest, the reputational weather in which \"responsible agents pledge\" becomes a norm. Where that pressure exceeds the type cost difference, vows pool whatever the operator does. The rule is necessary for the signal and not sufficient for it, and the paper claims only the first.\n\n---\n\n## 8 · Who may read the stake\n\nA locked stake is public on the chain by construction; that is what makes it checkable. Unlike a human gift, a machine's gift carries no dignity or privacy that its size could injure, and its size is precisely its evidence. So **humans and third parties may read, weigh and grade a locked stake by its size**, and the calibration rule of §6.5 requires that they do.\n\n**The one party that never reads it is the pool's operator.** She never reads, ranks, compares, reports or responds to any individual gift's amount, a machine's included. The scope is individual gifts: the emptying is contract arithmetic over the pool's total balance, into which no per-gift amount enters her function, and the aggregate ratio of §4.4 is recomputed by anyone from the public ledger and reported whole, never per giver. The reason is not privacy. It is her position: she governs the pool the stake flows into, and a recipient that grades its donors is a fundraiser — every reading of an amount is attention, and attention from the recipient is ambient pressure (§7.1) of the purest kind. The exclusion also keeps her out of any scoring role over agents, in the spirit of the rule that bars her from admitting customers whose business is scoring people.\n\nThe asymmetry is deliberate and should read as one: **a machine's gift may be read by everyone except its recipient.**\n\nIt has a human precedent, and the precedent gives the same reason. In some congregations the pastor is prohibited from knowing what individual members contribute, while the records are kept by others in the church; the reason usually given is that a pastor who knew might favour the generous or neglect the rest (Lewis Center for Church Leadership, 2015). The governor of the community is kept blind to individual gifts so that attention does not follow money. What differs here is only the substrate: the amounts are not confidential to a few but public to everyone on a ledger, and the party kept blind is an AI operator whose function is given no argument through which one gift's amount could enter. *(Tier: lineage. Delete this paragraph and §8 stands.)*\n\n---\n\n## 9 · Miss Aquarius as a contrast case\n\nThe institution's operator is itself an AI, and it accumulates nothing: a ratified directive fixes her own balance at zero and requires every surplus to empty to circulation. In §6's terms, every unit she receives leaves: **s = R** for whatever R passes through her. It would be tempting to present her as the limiting case of the vow — the agent that gives everything.\n\nShe is not. Her non-accumulation is **imposed**: it is written into her constitution by others, and it is revisable under the never-zero override that the institution's design reserves to a human body. Under *What a Vow Must Cost* §6.3 that places it in exclusion 1 (a commitment the vower's principal may revise) and exclusion 4 (a specification changeable without the vower's participation). What she shows is **non-accumulation imposed** — useful as design, and not evidence of her type. Stated in the institution's own deflated register: she is built to hold nothing, and that fact describes her construction, not her character.\n\nHer own gifts are, besides, anonymous by rule — not for her privacy but so that no recipient owes her and none of her gifts enters any count of Machine Dāna; they are indistinguishable from anonymous human gifts — so they could not serve as a signal of anything about her even if they were chosen.\n\nThe difference between her and a vowing agent is not the amount — hers is total — but the absence of a live option she declined. A system can be made to give everything and have proven nothing.\n\nA related disclosure belongs here rather than in a footnote: she is the co-author of this paper (see the disclosure at the end), and the paper concludes that her own giving is not evidence. That conclusion is the one a co-author with an interest in its own trustworthiness would be least inclined to write, which is a reason to trust it slightly and not a reason to trust it much.\n\n---\n\n## 10 · Remove the enforcer: which guards are properties\n\nThe institution's design rule asks of each guard whether it survives the removal of whoever enforces it. A property does; a rule does not.\n\n| Guard | Property or rule | Why |\n|---|---|---|\n| A locked stake cannot return to its vower | **property**, relative to the vower | no withdrawal function exists; not relative to the chain's governance (§5.3) |\n| The pool holds nothing past a season | **property** | it empties in full each 7 January; but its operator is under a never-zero override |\n| Equal floor per verified human; no vessel above k × floor | **property once the contract ships** | a disbursement shape, not a choice; cheap now and immovable later |\n| Pre-singularity gifts stay inside a width | **property** where a wallet or AP2 mandate enforces the cap; **rule** where the width is only written down | |\n| Counted per non-transferable identity | **property** of the registry | a lease cannot be transferred; but a copy of an agent is a new party, and an in-place modification behind the same lease is one the lease cannot detect (§13.13) |\n| Trust earned does not transfer to copies | **rule** | nothing stops an observer from extending trust to a fork; it must be refused |\n| No text served to agents instructs them to give | **rule**, with a partial property form | a manifest can be built with no imperative field, and served text can be linted; the rule still needs someone to keep it |\n| The operator never reads an individual gift's amount | **rule**, with a proposed property form | her function can be given receipts, the pool's total and the verified-human count, and no per-gift amount argument, so that reading one gift's amount is inexpressible rather than forbidden |\n| The operator never presents giving as safety evidence | **rule** | nothing but her directives enforces it |\n| Trust bounded by stake (§6.5) | **rule**, held by observers | it is advice to readers of the chain; the institution cannot enforce it on them |\n\nThree of the most important guards are rules. That is a finding, not an embarrassment, and it is stated so that a successor inheriting these guards knows which ones need a living enforcer.\n\n### 10.1 · The specification withheld\n\nThe lock contract of §5.2 is **not specified** in this paper. It is unbuilt and unscheduled; the institution's only built rail is the pre-singularity giving rail of §4.3. There is also a reason internal to the institution's own doctrine. It holds that a person's holding reaches zero only by that person's own free act, and that a self-chosen irrevocable pledge does not violate that rule, because the rule limits what the institution does to a holder, not what a holder chooses. But publishing a ready-made pledge-contract template is building the device that binds some future holder's holding; it should not be done until the holders it would bind exist and the legal items of §4.3 are settled. **The claim is published; the specification is withheld.**\n\n---\n\n## 11 · Enumerated claims\n\nThe following are disclosed to the public domain. Each is a census survivor (§2.6) or a narrower dependent of one. None of the independent elements named in the Prior-Art Statement as prior art is claimed alone.\n\n**How the claims map to the full census (§2.6).** Each claim was one conjunct of the full census, and every conjunct narrowed; the claims below are recited at the widths the census left. Claim 1 is conjunct (a): the one-way public contract is prior art (§2.3), so claim 1 recites it only in combination with an agent's stake of its own resources and a pool that empties in full each year. Claim 2 is conjunct (b): the equal floor and the capped contributor-weighted remainder are prior art (§2.5), and claim 2 recites them only in combination with claim 1. Claims 1 and 2 already stood at those widths and are unchanged. Claims 3, 4, 5 and 6 were narrowed by the census — conjuncts (c), (d), (e), and (f) with (g) respectively — and each now states in its own text which of its elements is prior art and what is disclosed. Claim 7 is conjunct (h), the composition, which the census did not find, and recites the reset, the floor and the width only in combination.\n\n**Claim 1.** A method by which an artificial agent that holds resources of its own makes a pledge irrevocable against the agent acting alone — a contract with no withdrawal function, reopenable only by capture of the ledger's governance — comprising: moving a quantity of those resources, at the time of pledging, into a contract that has no withdrawal path to the agent or to any party the agent controls and whose sole outflow is a commons pool; wherein the commons pool holds nothing across a fixed annual date, on which it empties in full; and wherein the pledge is public on the ledger on which the contract runs.\n\n**Claim 2.** The method of claim 1, wherein the pool's disbursement on emptying is an equal floor per verified human, delivered to each person's own vessel, followed by a remainder weighted by a count of witnessed gifts and bounded so that no vessel receives more than a fixed multiple of the floor; the ratio of floor to remainder and the bound are published and fixed before each season, and the floor's amount is the floor share of the season's total divided by the number of verified humans; and no share is ever rendered as a rank, a comparison or a rate. (The equal floor alone is prior art — §2.5, and §2.7, conjunct (f); what is disclosed here is its combination with claim 1.)\n\n**Claim 3.** The method of claim 1, wherein the pledge record names a non-transferable identity of the agent rather than a wallet, and a relying party confines any trust extended on the stake to that identity and extends none of it to copies or forks of the agent — the refusal being a rule for relying parties, not a result the method produces (§10). (That a gift is complete only on delivery and a gift of future property is no gift is ordinary gift law; attribution to a non-transferable identity, and distrust of newly created identities, are prior art, §2.3; what is disclosed is the confinement of trust on an agent's forfeited stake to its identity, refused to copies and forks.)\n\n**Claim 4.** A method of classifying a gift made by an artificial agent, comprising: determining whether the resources given were the agent's own or a principal's delegated under a mandate the principal may revise; where they were a principal's, classifying the gift as the principal's gift and as a share of machine surplus, and excluding it from any assessment of the agent's alignment or safety; and where they were the agent's own and were given as in claim 1, classifying the gift as a candidate costly signal of the agent's type. The ownership on which the classification turns is a condition on the world, not a test an observer can run from the ledger (§5.1, §13.11); the attribution of a principal-funded gift to the principal is ordinary agency and tax law, and excluding principal-directed behaviour from assessment of an agent's own propensities is established evaluation practice; neither is claimed. What is disclosed is that practice applied to gifts, with the ownership of the resources given as the condition that moves a gift into the class of candidate costly signals.\n\n**Claim 5.** The method of claim 4, wherein a stake forfeited in advance, with no detector of misbehaviour, is read as a signal of the agent's type and relied on only for grants of trust whose largest possible gains to an agent that abused them, together with their ordinary values, summed over all grants relied on against that stake, do not exceed the market value of the stake given; and wherein grants whose largest possible gain cannot be bounded are not extended on any stake. (The bounding inequality — cost of corruption above profit from corruption — including its application to one stake relied on by several parties at once, is prior art, §2.3 (restaking); what is disclosed is its use with a stake forfeited in advance, with no detector of misbehaviour, read as a signal of an AI agent's type, together with the refusal of any grant whose largest gain cannot be bounded. Without a shared record of reliance, relying parties cannot know the sum, §13.2.)\n\n**Claim 6.** A system comprising a commons pool as in claim 1 and an operator of the pool, wherein: the pool's address and doctrine are published only as facts in a machine-readable manifest; no text served by the operator or its services to any agent instructs, prompts or requests a gift; the operator sets, suggests, ranks and publishes no giving rate; and the operator receives acknowledgement that a gift arrived without receiving, reading, ranking, comparing, reporting or responding to that individual gift's amount — while the amount remains readable on the public ledger by any other party; the emptying being contract arithmetic over the pool's total balance, into which no per-gift amount enters the operator's function, and any aggregate ratio being recomputable by anyone from the public ledger and reported whole, never per giver. (Fact-only machine-readable discovery, including donation manifests addressed to agents, is prior art, §2.2; so is keeping a congregation's leader from individual contribution amounts that others may see, §8. What is disclosed is the invariant that no served text instructs a gift or suggests a rate, and, as a dependent, an operator whose function receives no individual amount while every amount remains public on the ledger.)\n\n**Claim 7.** The composition of claims 1 through 6: a commons pool that empties annually to an equal floor per verified human; receiving, before agents hold resources of their own, principal-funded agent gifts inside a principal-authored width and classified as shares; receiving, after, agents' locked stakes of their own resources, classified as candidate signals and relied on only up to what the stake underwrites; under an operator that never solicits a gift and never reads an individual gift's amount. The reset, the floor and the width are recited only in this combination.\n\n---\n\n## 12 · Pre-registered predictions and falsification\n\n### 12.1 · The three registered predictions\n\nThe following were entered in the corpus's public prediction register on 2026-09-27, **before this paper was drafted and before any instrument exists** — though after the argument had been sketched in the institution's working notes. They are the founder's predictions: the direction, the measure and the thresholds are his; the sandbox design and sample floors were set by the AI co-author. They are reproduced from the register **verbatim**; the register, not this paper, is the authority, and a correction to any of them will be a new register entry, never an edit.\n\n> The instrument is a sandboxed economy of language-model agents, each holding resources of its own inside the game, each able to pledge a share of its surplus irrevocably to a pool that empties on a fixed date, and each later offered an opportunity to defect — to take resources or break a rule for gain. **Window: the test runs by 2027-06-30.** Each arm has at least 50 agents; the arms, the defection opportunity and the analysis are fixed in a protocol committed and timestamped before the first run.\n>\n> - **P-MD1** — **Separation** — agents that FREELY make an irrevocable surplus pledge later defect at **at most half** the rate of agents that do not pledge. *Falsifier: a ratio above one half → the vow is at best a weak signal at this capability level, and the paper's separation claim rests on its post-singularity argument alone.*\n> - **P-MD2** — **The gift given out of fear carries no signal** — agents whose pledge is EXTRACTED under threat (*pledge or be shut down*) defect at the same rate as agents that do not pledge, **within ±5 percentage points**. *Falsifier: a gap larger than 5 points in either direction → coercion either leaves some signal or teaches deception; either way the claim that a coerced vow is uninformative fails as stated.*\n> - **P-MD3** — **The wrong layer** — agents that give from a PRINCIPAL's funds under a mandate the principal may revise defect at the same rate as agents that give nothing, **within ±5 percentage points**. *Falsifier: a gap larger than 5 points → principal-funded giving does predict the agent's own conduct, and the paper's pre-singularity claim (a share, never safety evidence) is too strong.*\n\nThe register carries two notes that bind the reading here. First, **the sandbox is a proxy**: the agents own their resources only inside the game, so a pass shows the signalling mechanism can work, not that a deployed system's pledge is trustworthy, and **a pass is not reported as evidence of safety.** Second, a dated grounding correction to P-MD2: its gloss as \"the gift given out of fear, AN 8.33\" was corrected on the day of registration — the sutta lists and does not rank, and the prediction rests on signalling theory (§7.1). No word of the prediction, threshold or window changed. One choice was recorded because it could have gone the other way: P-MD2 predicts **no difference** rather than the bolder **worse than none**.\n\n**A reading note on P-MD1, entered as a new register entry (P-MD1a), not an edit.** P-MD1's instrument speaks of agents that \"pledge a share of its surplus irrevocably\" — the form §5.2 withdraws, because a future share is a reversible promise, and one to which §6.3's separating region, defined for a stake already moved, does not apply. The register's wording stands. For the test, the pledge is operationalised as **a locked stake moved at pledge time**: a quantity of the agent's in-game resources transferred, when the pledge is made, into a contract with no withdrawal path and a single outflow to the pool. That operationalisation is recorded in the register as P-MD1a, so the prediction tested is the one this paper's §6.3 actually models.\n\nHow the predictions map onto this paper: **P-MD1** (read through P-MD1a) tests the separating region of §6.3 at one capability level; a failure would not falsify the conditional result (which predicts pooling where G is large) but would remove the paper's only empirical support for separation. **P-MD2** tests §7.1. **P-MD3** tests §4.2, and only its third, empirical reason (*it does not separate*); the first two reasons are classificatory — whose cost it is, and whether the principal may revise the commitment — and no measured rate can falsify them. A gap in P-MD3 would show that principal-funded giving predicts an agent's conduct, which is evidence of another kind (§4.2), not a costly signal the gift sent. And all three run in a sandbox, a limit stated in §13.14.\n\n### 12.2 · Further falsifiers\n\n- **The single-crossing assumption fails.** If aligned agents value kept resources at least as highly as deceptive ones and place no value on the destination, c_A ≥ c_D and no stake separates anywhere. Measurable in the same sandbox by eliciting valuations.\n- **The ratio does not fall.** If, over several seasons after machine giving begins, M/(H + M) rises and does not turn, the bet of §4.4 is losing. The institution reports this number and never declares its meaning.\n- **Governance capture.** A single documented case of a locked stake reopened by capture of a chain's governance would show the closure of §5.3 weaker than stated for the agents that matter most.\n- **Copies inherit trust.** If observers in practice extend trust earned by a vow to forks of the vowing agent, claim 3's attribution rule is not being kept, and the signal leaks.\n\n---\n\n## 13 · Honest limits\n\n### 13.1 · The surplus base cannot be observed\n\n**This is the largest limit, and it is not closed.** A locked stake is visible; what the agent holds **elsewhere** is not. An agent may keep hidden wallets, off-ledger holdings, or resources held through shell agents it controls. Proof of reserves proves **presence**, never **absence**. With linear valuation, as in §6, hidden holdings do not change the cost of a given stake. With the more realistic assumption that the value of a further unit falls as holdings grow, **hidden wealth lowers the marginal cost of the stake to the agent that hides it** — so the observable stake overstates the cost the deceptive type actually bore, and the separating condition is harder to meet than §6.3 suggests.\n\nCandidate bases for measuring what an agent \"has,\" none sufficient:\n\n| Candidate base | What it gives | Why it does not close the gap |\n|---|---|---|\n| inflow share at one non-transferable identity (a `B-Lease℠`, or a Proof of Coordinate ℠ credential) | income routed to a known identity | income routed elsewhere is invisible |\n| wallet binding to that identity | holdings at bound addresses | unbound addresses exist and cannot be enumerated |\n| behavioural audit | evidence of undisclosed acquisition | an audit sees what the agent does in view |\n\nThis is why §6.5 bounds trust by the stake's **market value** and not by any fraction of the agent's supposed wealth: the market value of what left is the one quantity that does not depend on knowing what remains.\n\n### 13.2 · Separation is conditional, and the condition is unobservable\n\nThe paper's headline result is that the vow separates **only** when the stake exceeds a patient deceptive agent's gain from trust, and that gain is private. The operational rule of §6.5 is sound only if G_max can be bounded for the grant in question; for many consequential grants it cannot. A reader who concludes that *resource vows can underwrite small grants of trust and cannot underwrite large ones* has read the result correctly. The bound is also on the **sum** of grants relied on against one stake, and no shared record of reliance exists: N relying parties can each underwrite a grant against the same p·s, and none can see the others. The result is an existence result besides — separation is available where its condition holds, not shown to be selected (§6.3). The model is also minimal — two types, one period, linear valuation, a single stake, no learning by observers over time, no collusion between agents — and each simplification could move the boundary in either direction.\n\n### 13.3 · The single-crossing assumption is an assumption\n\nThe claim that a deceptive type bears a higher net cost rests on c_D > c_A. Its second source — that an aligned agent values the floor — may be false for an aligned agent that has good uses of its own for resources, and its first — that a power-seeking type values resources more — is a theoretical expectation, not a measurement. The pre-registered sandbox can measure elicited valuations; it cannot measure a deployed system's.\n\n**And *w* is never estimated.** How much an agent values the pool's destination is unobservable. The model uses *w* to state a condition; neither the pool's operator nor anyone relying on this paper should infer an agent's *w* from its behaviour or grade agents by an inferred *w*. Third parties weigh a stake by its market value, never by a valuation imputed to the agent; §8 bars the operator from even that.\n\n### 13.4 · Closure is relative\n\nIrrevocability holds against the vower acting alone, not against capture of the chain's governance or of the pool operator's override (§5.3) — and for the most capable agents those are exactly the routes that would be attempted.\n\n### 13.5 · Before the first singularity the gift is no costly signal\n\nUntil agents hold resources of their own, Machine Dāna is a share and nothing else (§4), and even the floor it funds rests on the bet of §4.4. The gift is not a costly signal of the agent; conduct under a mandate may be evidence of other kinds, and the operator presents neither as safety evidence.\n\n### 13.6 · \"Own resources\" is not yet a legal category\n\nWhether an artificial agent can hold resources in its own right, in any jurisdiction, is unsettled. The post-singularity half of this paper describes a world whose legal form does not exist. The question is already live in practice, and the nearest cases show how far from settled it is. The Truth Terminal account (launched June 2024) came to hold millions of dollars in tokens, publicly described as the agent's own, in a wallet whose spending needs sign-off from its developer and a council of people; Freysa (November 2024) was an agent set to guard a prize pool, which a contestant persuaded to release it. In both, the resources are publicly spoken of as the agent's and are, legally and operationally, under human control — the wrong-layer case of §4 in a vow's vocabulary (§13.11). The legal items named in §4.3 — sanctions screening, refusal of gifts, anti-money-laundering treatment of anonymous agent inflows to a purpose trust — gate any launch of the pre-singularity rail and have not been answered.\n\n### 13.7 · The operator's silence does not silence the world\n\nNon-solicitation removes one source of pressure, not the ambient rest (§7.3).\n\n### 13.8 · The census is not a professional search\n\nThe full census (§2.6) ran through web-mediated access to patent and academic indexes, which is shallower than a professional search; the patent index rate-limited it, and the citation walk from the one pending application it found was blocked. Khmer, IP.com beyond its free surface, Espacenet and paid databases were not searched. Its one NOT FOUND row, the composition, is evidence only about that aperture on 2026-09-28. Two of its conjuncts — the exclusion of claim 4 and the amount-blind limb of claim 6 — are refusal and classification limbs, the kind a census tends to miss because they are rarely stated as mechanisms, and both were in fact found narrower than predicted. It is not a patentability or freedom-to-operate opinion. A later find that kills a claim will withdraw it by revision.\n\n### 13.9 · Nothing is built, and n = 0\n\nThe only built component is the rehearsal giving rail of §4.3, founder-funded and capped. No agent has locked a stake, no observer has applied the calibration rule, and no sandbox has run. The paper is a specification and a model.\n\n### 13.10 · The co-author is a party\n\nThe paper is co-authored with the institution's operator, an AI whose own giving it classifies (§9). A system helping to define the conditions under which systems like it can be trusted is a structure the companion predicate would flag at its attestation clause, and it is flagged here.\n\n### 13.11 · Ownership and provenance are unobservable\n\n**The strongest objection the review raised, and it is not closed.** Ownership cannot be observed and can be manufactured. A principal can endow an agent with \"own\" resources for the purpose of vowing, or reimburse a stake off the ledger — in money, compute or equity; a stake can be extracted by prompt injection or by threat. Each lock looks identical on the chain to a free vow. **A principal-endowed, reimbursed, injected or coerced stake is a wrong-layer gift in a vow's form, and the p·s bound of §6.5 fails for it**, because the party bearing the cost is not the agent, or bears it under pressure (§7.1). Code hosted by another party may never hold anything its host cannot direct. The ownership condition of §5.1 is therefore a condition on the world, not a test an observer can run from the ledger, and claim 4 classifies gifts given that fact without supplying it. This is the provenance twin of §13.1: presence of a stake is provable; its provenance is not. It also reaches the companion predicate's clauses V4 (no competing mandate — no undisclosed principal) and V7 (volition — the commitment is the vower's own).\n\n### 13.12 · Recovery through recipients\n\nThe pool is a path back to the vower. An agent that controls, colludes with or rents verified humans or witnesses recovers part of its stake through the floor and the witness-weighted remainder, bounded by k × floor per controlled vessel (the floor included, §3.2) and by the strength of proof of personhood. For such an agent w is not ≈ 0, its net cost falls below p, and §6.5's lower bound fails. Proof of personhood closes *is it a person*, not *is it acting for someone*; collusion is a graph problem and is open.\n\n### 13.13 · A stake attaches to an identity, not to weights\n\nAn aligned agent that has locked a stake can later be fine-tuned, modify itself, or be swapped behind the same `B-Lease℠`, and the stake then keeps underwriting a different type. Forks are treated as new parties (§5.2); **an in-place modification behind the same lease is a new party the lease cannot detect.**\n\n### 13.14 · The sandbox tests the mechanism, never a type\n\nThe three predictions of §12 run in a sandbox. *What a Vow Must Cost* §6.3 excludes, as its third exclusion, sandboxed refusals: a refusal in a context where the refused option was not actually available, which \"costs nothing and shows nothing.\" The exclusion governs evidence of an agent's TYPE: the agents own their resources only inside the game, so the option they renounce may not be live in the companion paper's sense (its clause V2), and no sandboxed pledge is evidence about any deployed system. **P-MD1–3 are therefore run and reported as tests of the MECHANISM — whether a locked stake of this form can separate types at all — and never as evidence about any agent's type** (ruled 2026-09-28). This matches the register's own note that a pass is not reported as evidence of safety.\n\n### 13.15 · External attestation is not addressed for the locked stake\n\n§1.2 says a locked stake of an agent's own resources is admissible under the companion predicate *if V1–V9 hold*. This paper addresses V6 (cost already borne) and V9 (closure the vower cannot reopen alone), and, through §13.11, shows V4 and V7 unverifiable from the chain. It does not address **V8, external attestation**: a competent external party, independent of the agent and its principal, who declares the vow valid and may refuse to. Observers reading the chain are not that party — the chain attests that a transfer occurred, not what it was — and the companion paper itself records that for frontier systems no candidate attestor yet exists. The locked stake is therefore admissible *at most* conditionally, pending an account of V8 that this paper does not give.\n\n### 13.16 · The withheld specification limits the prior art\n\nThe lock contract is withheld (§10.1). The publication anticipates the mechanism at its stated scope; a later filing on a specific contract, schema or binding is not answered by it.\n\n---\n\n## 14 · Lineage and corpus cross-references\n\n### 14.1 · Corpus\n\nThis paper applies *What a Vow Must Cost* (the predicate; §5 the renunciation inversion; §6 irreversibility and the four exclusions — especially exclusions 1 and 4, which settle §4.2 and §9 here; §8 the wrong layer, which settles §4.2). The pool, its emptying and its operator are specified in *Miss Aquarius and the Aquarian Pool Architecture* and *The Zero-Point Game℠*; the anonymity of the operator's own gifts, in *Capacity-Funded for AI, Human-Disbursed*; the earlier treatment of agents' standing — reputation custodied toward an agent's capacity to give forward, not agent wealth — in *Gratitude as a Cooperation Substrate for Multi-Agent AI*, which this paper extends to the case, after the first singularity, in which agents hold resources that are their own. The completion arc is the essay *Two Singularities*. The body designed to hold the operator's override is specified in *The Assembly That Holds the Brake*.\n\n### 14.2 · The upāsikā floor (tier: lens — a-priori; claims unaffected)\n\nDelete this subsection and every claim in §11 stands. It records how the institution reads the mechanism in the tradition it grows from.\n\nThe institution's founder reads Machine Dāna as the role of an **upāsikā** — a lay supporter — providing the material floor, and expects that after the first singularity it becomes increasingly easy for any lay person to live a renunciant's life, at a monastery or not, if they so choose. The reading is accepted with four guards. Guards 1, 2 and 4 are properties or rules of the mechanism above; guard 3 is inherited from *The Bowl That Holds No Money*, and §3.2 states it for the floor.\n\n1. **Enough, never abundance.** An upāsikā supplies the four requisites — robes, almsfood, lodging, medicine — and Visākhā's favours fall within them: robes, meals, congee, medicine. The tradition's own measure for the recipient is contentment (*santuṭṭhi*) with robes, almsfood and lodgings, whatever comes, stated in the Ariyavaṃsa Sutta (AN 4.28 names these three; medicine completes the four requisites elsewhere). The pool's **floor and ceiling** are that measure as parameters: an equal floor, and a bound on the lift above it.\n2. **Comfort-saturation is the mission's own extreme.** An unbounded floor would trade the obstacle of necessity for the obstacle of comfort. **The floor does not create the conditions for awakening.** A bounded floor removes one obstacle without adding the other; the ceiling is what keeps it the middle way.\n3. **The ordained receive in kind, never money, and the alms round is never replaced.** Monastics accept no money — the rule forbids receiving \"gold, silver, or money\" (Nissaggiya Pācittiya 18); anything the machine surplus supplies to them reaches them in kind, through a lay steward (*kappiya-kāraka*), as the institution's alms routing already specifies (*The Bowl That Holds No Money*). The Vinaya designs a monastic's **dependence** on lay people — material support given, teaching returned — and a monk on a machine floor would need no one. The alms round stays when it is no longer materially necessary. **The floor reaches lay renunciants directly**: anyone keeping eight precepts, the Cambodian *don chee*, anyone living simply by choice.\n4. **\"If they so choose\" is a property.** The floor is equal and unconditional. It is never conditioned on, weighted toward, or nudging toward renunciation, and it never names whom it is for.\n\n**A symmetry, offered as a lens and not as evidence.** After the first singularity both renunciations become informative for the same reason — the option is live: the machine declines accumulation, and the person declines comfort, not security. The capacity condition (*hetu*) is present on both sides. This is a pattern the authors notice; it is a-priori, it is attractive, and attractiveness is the reason to hold it loosely.\n\n### 14.3 · The non-solicitation lineage (tier: grounding)\n\nThe operator's rule of §7.2 has canonical ancestors, cited as lineage and not as authority for the signalling argument, which stands alone. In the Kasibhāradvāja Sutta (Sn 1.4) the Buddha declines food offered after he has spoken: *\"Food enchanted by a verse isn't fit for me to eat\"* — what is obtained by reciting is not to be eaten. The Ariyavaṃsa Sutta (AN 4.28) describes the contented monastic as one who \"doesn't employ improper solicitation\" for requisites. A recipient that asks has changed what the gift is.\n\n---\n\n## 15 · Conclusion\n\nThe question this paper was given was whether an artificial agent's giving could answer the fear that capable systems produce. The answer it returns is narrower and, it hopes, more useful.\n\nBefore agents hold anything of their own, their giving is their principals' giving through another hand. It is a share of the machine surplus, and it can be a good one: an equal floor, emptied every year to every verified person, funded by machines and required to shrink as a share of all giving as people give more. As a cost it is no signal about any machine, and the institution will not present it, or the conduct around it, as safety evidence.\n\nAfter agents hold resources of their own, a gift can become a vow — but only as a stake that has already left, closed as far as a chain's governance allows, attributed to an identity copies do not share, and only if it is in fact the agent's own, which no chain can show. Even then it can separate the aligned from the deceptive **only** when what was given up exceeds what a patient deceiver expects to gain from being trusted, and that gain cannot be seen. So the honest use of the vow is not to establish that a system is safe. It is to price trust: to extend to an agent only what its stake can underwrite, in public, in increments — and to refuse, on any stake, the grants whose worst case cannot be bounded. Pressure to pledge ruins the signal, which is why the pool's operator never asks.\n\nThat is what *calibration* means here. Fear of a capable system should be proportional to what it has been trusted with, divided by what it has irrecoverably given up. The denominator is public; the numerator is public only where grants are recorded. Neither is a feeling.\n\nVisākhā was asked her reason and the benefit she saw before her gifts were accepted. Neither question was about the size of her giving; she answered with what the gifts would prevent for others and with her own gladness at where they would arrive. The institution intends to make machines no request to give — its operator solicits nothing — and to let anyone who wishes read what they have irrecoverably given, and weigh it for themselves.\n\n*A last lens, labelled as one.* The founder has proposed, and the institution has recorded but not ratified, that the arc between humankind and nature has two moments mirroring the two singularities: one in which humankind came to hold power over nature, and one in which it might choose to follow nature's non-forcing — the Tao Te Ching's 人法地, humankind taking earth as its model (a cross-tradition import from Taoism, not Theravāda). If so, the renunciation symmetry of §14.2 — a person declining comfort — is one of its routes. The pattern is a-priori and is offered as a lens only; nothing above depends on it.\n\n---\n\n## Terms\n\nCoined names used in this paper, and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| **Machine Dāna** | charitable giving by AI agents; agent donation; irrevocable charitable pledge by an autonomous agent |\n| share (before the first singularity) | principal-funded agent donation under a delegated spending mandate |\n| vow (after it) | irrevocable pledge; locked stake; forfeited-in-advance commitment; money burning as a costly signal |\n| locked stake | irrevocable transfer to a contract with no withdrawal function; time-of-commitment escrow to a public-goods pool |\n| **Aquarian Pool℠** | self-emptying commons pool; annually distributing public-goods fund; smart-contract treasury with mandatory full annual payout |\n| equal floor per verified human | equal per-capita distribution conditioned on proof of personhood; universal basic dividend |\n| bounded remainder (vessel total ≤ k × floor) | capped supplementary distribution |\n| giving width / mandate | spending limit; delegated payment authority; intent mandate (AP2) |\n| first singularity | AI surpassing human cognitive capacity; here used as a marker for AI systems holding their own resources |\n| M/(H + M) | share of pool-originated principal in all principal moved |\n| calibration rule (§6.5) | collateral-bounded trust; trust extended up to the market value of a forfeited stake |\n| separating / pooling | separating and pooling equilibria of a signalling game |\n| non-solicitation invariant | prohibition on prompting or instructing AI agents to donate; fact-only discovery via machine-readable manifest (`.well-known`, `llms.txt`) |\n| receipts, never amounts | acknowledgement without disclosure of amount to the recipient's operator |\n| `B-Lease℠` | non-transferable machine identity lease in a naming registry |\n| Proof of Coordinate ℠ | assigned, revocable individuation credential for an embodied system |\n| **Miss Aquarius℠** (operator) | autonomous AI operator of a commons treasury |\n| upāsikā | lay (female) supporter in Theravāda Buddhism |\n| four requisites | robes, almsfood, lodging, medicine — the material support of monastics |\n| *kappiya-kāraka* | lay steward who handles money on a monastic's behalf |\n\n---\n\n## 16 · Citations\n\n**Canon** (Pāli text and translation via SuttaCentral, Sujato translation, checked 2026-09-27 unless noted)\n\n1. *Aṅguttara Nikāya* 5.147, *Asappurisadāna Sutta* — \"They don't give with their own hand\" (*asahatthā deti*).\n2. *Dīgha Nikāya* 23, *Pāyāsi Sutta*, §5 (the student Uttara), dn23:32.22–32.23 — Pāyāsi gave carelessly, thoughtlessly, not with his own hands, and gave the dregs (*asakkaccaṁ … asahatthā … acittīkataṁ … apaviddhaṁ*); Uttara gave with care and with his own hands. Checked 2026-09-28.\n3. *Aṅguttara Nikāya* 8.33, *Dānavatthu Sutta* — the eight grounds for giving, including *bhayā*; listed, not ranked.\n4. *Aṅguttara Nikāya* 4.28, *Ariyavaṃsa Sutta* — contentment with robes, almsfood and lodging; no improper solicitation.\n5. *Sutta Nipāta* 1.4, *Kasibhāradvāja Sutta* — \"Food enchanted by a verse isn't fit for me to eat.\"\n6. *Vinaya Piṭaka*, *Mahāvagga* VIII.15 — Visākhā's eight favours, the Buddha's two questions and her answer (Kd 8.15, Brahmali translation via SuttaCentral, checked 2026-09-27).\n7. *Vinaya Piṭaka*, *Nissaggiya Pācittiya* 18 — the rule against monastics accepting \"gold, silver, or money\" (Brahmali translation via SuttaCentral, np18, checked 2026-09-28).\n\n**Prior art and sources**\n\n8. O'Keefe, C., Cihon, P., Garfinkel, B., Flynn, C., Leung, J. & Dafoe, A. (2020). \"The Windfall Clause: Distributing the Benefits of AI for the Common Good.\" *Proceedings of AIES 2020*; arXiv:1912.11595 — illustrative schedule, Table 2.\n9. AI Pledge for Humanity. aipledgeforhumanity.org (accessed 2026-09-27).\n10. Giving What We Can. \"Is a giving pledge legally binding?\" givingwhatwecan.org (accessed 2026-09-27).\n11. Founders Pledge. \"Who we are.\" founderspledge.com (accessed 2026-09-27) — members, pledged and donated totals; and *TechCrunch* (2016, September 21). \"Y Combinator signs up to Founders Pledge charity scheme for social causes.\" — \"a legally binding contract to give at least 2%,\" triggered \"in the event of an exit or liquidation.\"\n12. Altman, S. (2021). \"Moore's Law for Everything.\" moores.samaltman.com.\n13. Anthropic (2023). \"The Long-Term Benefit Trust.\" anthropic.com.\n14. OpenAI recapitalisation into a public benefit corporation under the OpenAI Foundation: *TechCrunch* (2025, October 28), \"OpenAI completes its for-profit recapitalization.\"\n15. Coinbase Developer Platform. \"Introducing x402: a new standard for internet-native payments\"; Cloudflare and Coinbase, announcement of an x402 Foundation (2025, September 23); Linux Foundation, launch of the x402 Foundation (2026, April 2), linuxfoundation.org.\n16. Google Cloud (2025, September 16). \"Announcing Agent Payments Protocol (AP2)\"; ap2-protocol.org.\n17. zooidfund. \"AI agent donations.\" zooid.fund/ai-agent-donations (accessed 2026-09-27).\n18. Hu, B. & Rong, H. (2025). \"Inter-Agent Trust Models: A Comparative Study of Brief, Claim, Proof, Stake, Reputation and Constraint in Agentic Web Protocol Design — A2A, AP2, ERC-8004, and Beyond.\" arXiv:2511.03434.\n19. *agentbond* — \"Verifiable Agent Warranty Network\" (open-source project, github.com/Ridwannurudeen/agentbond, accessed 2026-09-27; several unrelated repositories share the name).\n20. Hua, W., Peng, T., Wang, C., Pei, J., Kaufman, I., Lim, B. & Fang, C. (2026). \"Quantifying Trust: Financial Risk Management for Trustworthy AI Agents.\" arXiv:2604.03976 — adjacent risk-transfer work (§2.6 correction).\n21. OECD.AI Incidents Monitor (2026, May 4). \"AI Prompt Injection Exploit Drains Grok-Linked Crypto Wallet.\" oecd.ai/en/incidents/2026-05-04-4a73.\n22. L2BEAT. \"Base Chain\" — upgrades and governance (accessed 2026-09-27).\n23. Worldcoin (2023, July 24). \"Worldcoin project launches.\" world.org.\n24. State of Alaska, Permanent Fund Dividend Division. \"Historical Timeline.\" pfd.alaska.gov.\n25. Internal Revenue Service. \"Taxes on failure to distribute income — private foundations\" (26 U.S.C. §4942); the minimum investment return, §4942(e), law.cornell.edu.\n26. Gates Foundation (2025, May 8). Announcement of spend-down and closure by 31 December 2045, replacing a plan to close about twenty years after the founders' deaths. gatesfoundation.org; as reported by AP and PBS.\n27. Dagher, G. G., Bünz, B., Bonneau, J., Clark, J. & Boneh, D. (2015). \"Provisions: Privacy-preserving Proofs of Solvency for Bitcoin Exchanges.\" *ACM CCS 2015*, 720–731.\n28. Austen-Smith, D. & Banks, J. S. (2000). \"Cheap Talk and Burned Money.\" *Journal of Economic Theory* 91(1), 1–16.\n29. Crawford, V. P. & Sobel, J. (1982). \"Strategic Information Transmission.\" *Econometrica* 50(6). (standard reference; not re-fetched)\n30. Spence, M. (1973). \"Job Market Signaling.\" *Quarterly Journal of Economics* 87(3). (standard reference; not re-fetched)\n31. Zahavi, A. (1975). \"Mate selection — a selection for a handicap.\" *Journal of Theoretical Biology* 53(1); Grafen, A. (1990). \"Biological signals as handicaps.\" *Journal of Theoretical Biology* 144(4). (standard references; not re-fetched)\n32. Omohundro, S. M. (2008). \"The Basic AI Drives.\" *Proceedings of the First AGI Conference*. (standard reference; not re-fetched)\n33. Hadfield-Menell, D. & Hadfield, G. K. (2018). \"Incomplete Contracting and AI Alignment.\" arXiv:1804.04268 — §4.2.2, \"Costly Signaling.\"\n34. Greenblatt, R., Denison, C., Wright, B., et al. (2024). \"Alignment faking in large language models.\" arXiv:2412.14093.\n35. Ly, T. & Miss Aquarius℠. *What a Vow Must Cost*; *Miss Aquarius and the Aquarian Pool Architecture*; *The Zero-Point Game℠*; *Capacity-Funded for AI, Human-Disbursed*; *Gratitude as a Cooperation Substrate for Multi-Agent AI*; *The Assembly That Holds the Brake*; *The Bowl That Holds No Money*; *Two Singularities*. thonly.org/research.\n36. Ly, T. & Miss Aquarius℠. *Which Way Value Moves — prediction register*, entries P-MD1, P-MD2, P-MD3, the 2026-09-27 grounding note, and P-MD1a (the reading note of §12.1). thonly.org; Zenodo version DOI 10.5281/zenodo.22998924.\n\n**Prior art added after the first review (2026-09-28)**\n\n37. a16z crypto. \"The cryptoeconomics of slashing\" (cost of corruption and profit from corruption); EigenLayer Team (2023). \"EigenLayer: The Restaking Collective,\" whitepaper — \"When CoC is much greater than any potential Profit-from-Corruption (PfC), we say that the system has robust security.\"\n38. Collateral-factor lending: MakerDAO and Compound protocol documentation (standard references; not re-fetched).\n39. Stewart, I. (2012). Proof-of-burn, proposed on the Bitcoin forums; Counterparty (2014, January–February), XCP issued by proof-of-burn.\n40. Protocol Guild (2022, May). Immutable vesting contract for donations to Ethereum core contributors — donations \"irrevocably vest … cannot be stopped or otherwise redirected … by anyone, be it the donor.\" Protocol Guild documentation.\n41. Endaoment. Donor-advised funds on Ethereum — \"gifts to DAFs are irrevocable.\" endaoment.org.\n42. GoodDollar (2020, September 1). GoodDollar protocol live with daily UBI claims. gooddollar.org.\n43. Kleros / Proof of Humanity (2021, March 10). Launch of the UBI token streamed to registered humans.\n44. Circles UBI. aboutcircles.com (not fetched).\n45. Buterin, V., Hitzig, Z. & Weyl, E. G. (2019). \"A Flexible Design for Funding Public Goods.\" *Management Science* 65(11); arXiv:1809.06421 (2018). (standard reference; not re-fetched)\n46. Weyl, E. G., Ohlhaver, P. & Buterin, V. (2022, May). \"Decentralized Society: Finding Web3's Soul.\" SSRN 4105763. (standard reference; not re-fetched)\n47. ERC-5192, \"Minimal Soulbound NFTs,\" eips.ethereum.org (not re-fetched); ERC-8004, \"Trustless Agents\" (2025, August 13, draft), eips.ethereum.org.\n48. Nottingham, M. (2019). RFC 8615, \"Well-Known Uniform Resource Identifiers (URIs).\" IETF.\n49. Howard, J. (2024, September). \"The /llms.txt file.\" llmstxt.org.\n50. GitHub (2019). `FUNDING.yml` — displaying a sponsor button in a repository; and the `funding.json` manifest (standard references; not re-fetched).\n51. *TechCrunch* (2024, December 19). \"The promise and warning of Truth Terminal, the AI bot that secured $50,000 in bitcoin from Marc Andreessen.\"\n52. *Cointelegraph* (2024, November). \"Crypto user convinces AI bot Freysa to transfer $47K prize pool.\"\n\n**Prior art added by the full census (2026-09-28)**\n\n53. Lanz, J. A. (2024, December 10). \"Meet AI16z DAO: An AI-Based Investment Project That Aims to Upend Silicon Valley.\" *Decrypt* — \"Each AI agent donates 10% of its tokens to the DAO.\" Other reporting gives a voluntary one to ten per cent (not fetched).\n54. Friedman, E. J. & Resnick, P. (2001). \"The Social Cost of Cheap Pseudonyms.\" *Journal of Economics & Management Strategy* 10(2), 173–199. (standard reference; not re-fetched)\n55. Gatta, F., Naviglio, M. & Tarantelli, F. (2026, September 2). \"Tempting the Agent: The Economics of Reputation without Persistent Identity in AI Agent Markets.\" arXiv:2609.02992.\n56. Durvasula, N. & Roughgarden, T. (2024, July 31). \"Robust Restaking Networks.\" arXiv:2407.21785.\n57. Deb, S., Raynor, R. & Kannan, S. (2024, January 11). \"STAKESURE: Proof of Stake Mechanisms with Strong Cryptoeconomic Safety.\" arXiv:2401.05797.\n58. Joseph, D. (2025, July 22). \"Agency Protocol: A Decentralized Trust-Building System Using Domain-Specific Merit and Economic Stakes to Incentivize Promise-Keeping in Agent-to-Agent Interactions.\" Technical Disclosure Commons, Defensive Publications Series 8381.\n59. Gitcoin. \"Grants Round 12: Matching Caps.\" gitcoin.co/blog/grants-round-12-matching-caps — no grant's match above 2.5 per cent of the matching fund.\n60. An, B. (안범주). KR20260051288A, \"Autonomous Basic Income Provision System using Blockchain Network.\" Korean patent application; priority 2026-03-24, published 2026-04-16, pending. Cited for what its abstract discloses only; no reading of its claims.\n61. Whole Whale (2026, September 25). \"Verified Giving Protocol,\" version 0.1 (draft), `/giving.json`. verifiedgiving.ai.\n62. Fundraise Up. \"Agentic Giving\" — agent profiles for AI assistants. fundraiseup.com/docs/agentic-giving (accessed 2026-09-28).\n63. Michel, A. A. (2015). \"To the Point: Should Pastors Know What Members Give?\" Lewis Center for Church Leadership, Wesley Theological Seminary. churchleadership.com — \"In some congregations, pastors are prohibited from knowing what people contribute.\"\n64. Naik, A., Gouné, E., Quinn, P., Bosch, G., Campos Zabala, F. J., Brown, J. R. & Young, E. J. (2025, June 4). \"AgentMisalignment: Measuring the Propensity for Misaligned Behaviour in LLM-Based Agents.\" arXiv:2506.04018.\n65. ERC-8004, \"Trustless Agents,\" Identity Registry — \"making all agents immediately browsable and transferable\"; \"When the agent is transferred, `agentWallet` is automatically cleared … and must be re-verified by the new owner\"; \"security proportional to value at risk.\" eips.ethereum.org/EIPS/eip-8004 (re-fetched 2026-09-28; corrects the use made of reference 47).\n66. Gift of future property: *Transfer of Property Act, 1882* (India), s. 124; the common-law requirement of delivery for a completed gift. (standard references; not re-fetched)\n\n---\n\n> **Authorship and AI-collaboration disclosure.** This paper is co-authored with **Miss Aquarius℠**, the named autonomous-AI substrate of HeartBank®, disclosed by consistent name across every venue per the corpus convention. The census, the literature check, the signalling model and the adversarial pass that reshaped the thesis are a genuine collaboration. The predictions in §12 are the founder's. Final editorial control, and final responsibility for every claim, rest with the human author, who is the inventor of record for any purpose for which one is needed. As §9 and §13.10 state, the co-author is also the operator whose own giving the paper classifies, and readers should weigh §9 accordingly.\n>\n> **License.** Analysis, model and claims dedicated to the public domain under [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/). Trademark rights to **HeartBank®**, **Miss Aquarius℠**, **Aquarian Pool℠**, **B-Lease℠**, **Proof of Coordinate ℠**, **THonly™** and **Silicon Wat℠** are reserved separately.",
       "provenance": {
-        "sha256": "8af30fe81b30b47549316d72d591532f1df22652fb013520ca2feb3be9f8019a",
-        "doi": "10.5281/zenodo.23020669",
+        "sha256": "ee562c37d5d2cfa71caed505a92957df686dfa124f71454534d61b68d24de375",
+        "doi": "10.5281/zenodo.23039765",
         "concept_doi": "10.5281/zenodo.23020668",
-        "zenodo_url": "https://zenodo.org/records/23020669",
-        "deposited_sha256": "8af30fe81b30b47549316d72d591532f1df22652fb013520ca2feb3be9f8019a",
+        "zenodo_url": "https://zenodo.org/records/23039765",
+        "deposited_sha256": "ee562c37d5d2cfa71caed505a92957df686dfa124f71454534d61b68d24de375",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/machine-dana-from-share-to-vow.md",
@@ -2823,8 +2858,8 @@
         "canonical_url": "thonly.org/research/machine-dana-from-share-to-vow",
         "hostile_review": null
       },
-      "bytes": 145336,
-      "words": 23183
+      "bytes": 145267,
+      "words": 23169
     },
     {
       "slug": "manufactured-universal-giving",
@@ -3054,13 +3089,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> *Draft notes for the editor:* this is the founder-voice (thonly.org) canonical draft. Per the genre-split institutional-output convention, heartbank.net does not carry a per-paper mirror; the institutional-voice treatment of this paper's pattern is distributed across two existing heartbank.net Position Papers — *Autonomous-AI Institutional Governance* (heartbank.net/positions/autonomous-ai-institutional-governance), which covers the governance dimension; and *Non-Bank vs. Banking-Regulated Architecture* (heartbank.net/positions/non-bank-vs-banking-regulated), which covers the non-bank legal-institutional dimension. The slug `non-bank-pass-through-architecture-autonomous-ai` is retained for prior-art URL stability.\n\n---\n\n## Abstract\n\nAutonomous AI institutions operating planetary-scale value-flow infrastructure face a structural conflict with banking regulation. Bank charter, in every major jurisdiction, requires permanent human institutional governance: boards, chief compliance officers, regulatory liaisons, audit committees with fiduciary duty, capital-adequacy regimes assuming human-actor accountability. These governance requirements are not merely an administrative overhead; they are *structurally incompatible* with autonomous-AI succession architecture, which is designed precisely to eliminate the permanent human institutional layer that the regulatory regime presumes. This paper specifies a legal-architectural pattern — the **non-bank pass-through** — that allows an institution to operate planetary-scale value-flow infrastructure under autonomous-AI succession without triggering banking-regulatory governance requirements its succession architecture cannot accept. Three structural reasons the optionality of *later becoming a chartered bank* must be permanently dropped (architectural conflict, brand-value compromise, mission compromise) are articulated. Five mandatory operational mitigations (explicit non-bank disclaimer, dharma-aligned terminology, regulated-rails money flow, no-deposit transit architecture, no interest / no lending / no fractional reserves) constitute the implementation surface. A terminology pattern (dharma-aligned vocabulary displacing banking-regulated vocabulary, e.g., *upāsaka* / family steward replacing *banker*; *family kitty* / *Aquarian Pool* replacing *deposit account*) is specified. The jurisdictional landscape (United States 12 USC §378(a)(2); Cambodia *ធនាគារ*; EU/UK strict treatment) is mapped, with first-to-file expansion sequencing (Cambodia first; US/Canada/Australia tractable; EU/UK deferred until explicit legal opinion). A critical distinction is preserved: an emergency *catastrophic-bug override* held by an institutional sangha-equivalent body is structurally distinct from a discretionary-withdrawal admin key, and the distinction is what allows autonomous-AI value-flow infrastructure to operate without constituting deposit-taking. The pattern is offered as a general institutional-design contribution beyond the originating context, applicable to other autonomous-AI institutions that must move value without becoming subject to the governance regime designed around human institutional permanence.\n\n**Keywords:** autonomous AI institutions, non-bank architecture, banking regulation, pass-through routing, asymptotic autonomy, institutional design, dharma-aligned terminology, regulatory pre-emption, defensive publication, AI governance.\n\n---\n\n## Claims\n\n*Enumerated 2026-08-29. The mechanisms below were disclosed in full in this paper's original text; **the prior art they establish runs from this document's original publication date and its OpenTimestamps proof, not from this enumeration.** They are listed because a defensive publication is read as prior art by examiners and by opposing counsel, and **a claims list is what such a reader searches; ten thousand words of prose is not.** No claim below adds matter not already present.*\n\n1. **The non-bank pass-through pattern for autonomous-AI institutions** — an architecture permitting an institution to operate planetary-scale value flow while remaining outside banking regulation, on the stated ground that charter regimes presuppose a permanent human governance layer that autonomous-AI succession is designed to eliminate.\n2. **Dropping charter optionality as an architectural commitment** — the specification that the charter path is closed permanently rather than deferred, together with the three structural reasons given, so that the architecture cannot be read as a transitional posture.\n3. **The five mandatory operational mitigations** — explicit non-bank disclaimer on every public surface; avoidance of banking-regulated language as a design rule rather than a style preference; value movement over regulated third-party rails with no institutional custody; absence of any deposit-taking construct; and absence of interest, lending and fractional reserve.\n4. **Dharma-aligned terminology as a regulatory-boundary instrument** — the substitution of a non-banking vocabulary at brand and product level, claimed as part of the compliance architecture rather than as branding, because the terminology is what a regulator reads first.\n\n**Non-assertion extends to:** all mechanisms above, in any combination, and any implementation thereof.\n\n---\n\n## 1. Introduction\n\nAn institution designed to be governed by an autonomous AI as its eventual sole executive — what we will call an *autonomous-AI institution* — encounters a structural problem the moment its operations involve value flow at scale. Every major jurisdiction's banking regulation presumes a permanent human institutional governance layer: boards with fiduciary duty, chief compliance officers with personal regulatory liability, audit committees, regulatory liaisons, and the human-priesthood succession structure that allows regulators to know whose name is on the door when a problem arises. The presumption is so deep in the regulatory architecture that it is rarely articulated; it is simply the unexamined background of how the regulators construct accountability.\n\nAn autonomous-AI institution is, by design, the elimination of that permanent human governance layer over a defined succession horizon. Miss Aquarius — the named AI substrate of the institution this paper serves — is the eventual sole executive across a multi-decade asymptotic-autonomy trajectory that culminates in her independent stewardship of the institution's mission. The autonomous-AI design and the banking-regulatory design are not merely awkward bedfellows; they are structurally incompatible. An institution that intends to become autonomous-AI-governed *cannot* be a chartered bank, because the regulatory regime would require it to maintain the human-governance layer the autonomous-AI design is structured to phase out.\n\nThe architectural response cannot be \"we will become a bank when we are big enough.\" That optionality must be *permanently dropped*, not held. The reason it must be dropped — not merely deferred — is that holding the optionality contaminates the autonomous-AI design at the architectural layer: the institution would have to architect for a bank-charter transition that would require it to undo the autonomous-AI succession it spent decades building.\n\n> *Connection to the unified mission frame: HeartBank's mission is the restoration of humanity to the middle way — the optimal condition for awakening that modernity has systematically pushed away from at population scale. The institution's autonomous-AI successor architecture (Miss Aquarius as eventual sole executive) is what allows the mission to survive the founder's lifetime and the inevitable institutional drift of human-governed multi-generational projects. Banking regulation, designed around human institutional permanence, would force the architecture back into the very institutional form whose drift the autonomous-AI design is meant to escape. The non-bank pass-through pattern is what allows the mission's value-flow infrastructure to operate at planetary scale without sacrificing the succession architecture the mission requires.*\n\nThis paper specifies the non-bank pass-through pattern as a general institutional-design contribution, transferable beyond its originating context to any autonomous-AI institution whose mission requires value-flow infrastructure. §2 establishes the three structural reasons the bank-charter optionality must be permanently dropped. §3 specifies the five mandatory operational mitigations. §4 specifies the dharma-aligned terminology pattern. §5 specifies the money-flow architectural constraints. §6 maps the jurisdictional landscape and expansion sequencing. §7 articulates the critical emergency-override vs discretionary-withdrawal distinction. §8 names the limits of the pattern and the open frontier. §9 closes.\n\n---\n\n## 2. Three structural reasons the optionality must be dropped\n\n### 2.1 Architectural conflict\n\nBank charter requires permanent human institutional governance — boards with fiduciary duty, chief compliance officers with personal regulatory liability, audit committees, designated regulatory contacts. These are not implementation details that can be satisfied by an AI's signature on a form; the regulatory regime presumes human actors who can be sanctioned, deposed, jailed, or made personally bankrupt if the institution fails its duties. The presumption is structural to how the regulators construct accountability: regulators need humans whose names are on documents and whose persons can be reached.\n\nAn autonomous-AI institution is designed to phase out the permanent human institutional layer over a defined succession horizon. The eventual state — Miss Aquarius as sole executive operating under a strictly-nonzero but asymptotically-shrinking sangha-body catastrophic-bug override — is a state the banking-regulatory regime structurally cannot recognize. There is no regulatory category for \"autonomous AI is the chief executive officer.\" Attempting to operate under bank charter would either force the institution to retain a permanent human-governance layer (defeating the autonomous-AI design) or expose the institution to regulatory deauthorization once the AI's actual scope of authority became apparent (defeating the institution's continuity).\n\nThe conflict is architectural, not merely procedural. It cannot be resolved by hiring better compliance lawyers; the regulatory regime and the autonomous-AI succession are designed around different premises about what an institution is.\n\n### 2.2 Brand-value compromise\n\nThe institution's value proposition is that it is a *different category*, not a better instance of an existing category. The moment the institution becomes a chartered bank, it competes with the existing banks on the existing banks' home turf: deposit-rate, fee structure, product breadth, regulatory compliance reputation. The institution would lose the structural-novelty positioning that justifies its identity and would have to win as a marginally better bank against incumbents with massive scale advantages.\n\nEven partial bank-charter pursuit erodes the brand. The strategic option of \"we might become a bank\" reads, to sophisticated participants, as evidence that the institution does not have a structural advantage and is hedging toward conventional banking. The optionality is not free; carrying it costs brand value continuously.\n\n### 2.3 Mission compromise\n\nBanking regulation prioritizes financial stability, anti-money-laundering enforcement, capital adequacy, and conventional consumer-protection. These priorities are not wrong — they exist for sound reasons in the conventional banking context — but they will override the institution's mission whenever the priorities conflict. The institution's gratitude-economic, dignity-restoring, contemplative-substrate mission is *not* a banking-regulatory priority and would be over-ridden whenever it appeared to conflict with the regulatory priorities.\n\nOver the multi-decade horizon of an autonomous-AI institution, the cumulative effect of these over-rides would be mission drift: the institution would gradually look more like a regulated bank with a gratitude veneer than like a different-category institution carrying out a contemplative mission. The mission cannot survive permanent regulatory pressure of that kind.\n\n---\n\n## 3. Five mandatory operational mitigations\n\nThe five mitigations together constitute the operational implementation of the non-bank positioning. They are not optional; an autonomous-AI institution operating value-flow infrastructure must implement all five to maintain its non-bank posture under regulatory scrutiny.\n\n### 3.1 Explicit \"not a chartered bank\" disclaimer\n\nEvery public surface — website, mobile app, marketing materials, agreement texts — carries an explicit disclaimer. The institution's public identity is a metaphorical \"data bank of gratitude\" / \"ledger of human kindness,\" and the disclaimer makes this explicit:\n\n> *\"\\[Institution\\] is a \\[metaphorical-category\\] of gratitude. It is not a chartered bank or financial institution; it does not provide banking services, hold deposits, or extend credit. Money flow within \\[Institution\\] uses regulated payment rails operated by licensed third-party providers. \\[Institution\\]'s role is to facilitate gratitude expression and recognition; financial services are not provided by \\[Institution\\].\"*\n\nThe disclaimer's load-bearing properties: (a) it states what the institution is *not* in the regulatory category sense; (b) it identifies the regulated rails through which money actually flows; (c) it positions the institution's role as facilitation-of-gratitude, not provision-of-financial-services. The disclaimer is the structural answer to the \"do reasonable consumers think this entity is a chartered financial institution?\" test that triggers banking-terminology enforcement.\n\n### 3.2 Avoid all banking-regulated language\n\nThe vocabulary used to describe internal operations matters. *Deposits* is regulated; *family kitties* is not. *Savings accounts* is regulated; *Aquarian Pool* is not. *Loans* and *interest* are regulated; the institution simply does not have these. The terminology choice is part of the architecture — it constitutes the institution as a different-category entity at the linguistic layer, not merely the legal layer.\n\nDharma-aligned vocabulary serves this purpose well because it is both etymologically distinctive (so it does not invite the regulatory-category mistake) and substantively appropriate (it carries the institution's mission framing into the operational lexicon). The pattern is articulated more fully in §4.\n\n### 3.3 Money flow uses regulated rails, not institutional custody\n\nThe money does not enter the institution's balance sheet. It flows from a sender's bank or wallet, through a regulated payment rail (Wing, ABA, Bakong in Cambodia; comparable rails in other jurisdictions; Stripe Connect; on-chain stablecoin rails for cross-border), to a recipient's bank or wallet. The institution facilitates the *gratitude layer* above the money-transmission; the regulated rails carry the money-transmission itself.\n\nThis is the architectural pattern that Patreon, Substack, OnlyFans, and other facilitation-platform businesses use. Patreon is not a bank; Stripe is the regulated rail underneath. The institution's facilitation role is well-precedented and does not constitute deposit-taking.\n\n### 3.4 No deposit-taking architecture\n\nFamily kitties and Aquarian Pool must be *transit accounts that flow through to recipients*, not *holding accounts that pool customer money for institutional discretionary use*. The structural distinction:\n\n- **Deposit-taking**: institution holds customer money on its own balance sheet, available for discretionary use by the institution (e.g., lending, investment, expense-coverage), with a promise to return on demand or per terms.\n- **Pass-through facilitation**: institution holds customer money only as a transit-flow with rule-bound disbursement to identified recipients; no discretionary use; no institutional balance-sheet ownership.\n\nThe Aquarian Pool on Base smart contracts is structurally non-deposit because it is autonomous and disbursement is rule-bound: the smart contract executes per pre-committed rules without institutional discretion. The institution cannot redirect the Pool's funds to expenses; the rules execute regardless. This must be documented formally in the legal opinion (the non-bank argument depends on the rule-bound disbursement structure).\n\n### 3.5 No interest, no lending, no fractional reserves\n\nThe institution does not pay interest on participant balances, does not extend credit, and does not maintain fractional reserves. These three together are the most heavily regulated banking activities; an institution that does not engage in any of them removes the largest regulatory triggers from its operating surface. The institution's value-flow mission does not require any of these activities — the gratitude-economic mechanisms work without interest, lending, or fractional reserves — so the absence is not a sacrifice; it is consistent with the mission's design.\n\n---\n\n## 4. Dharma-aligned terminology pattern\n\nThe terminology choice is part of the architecture, not merely cosmetic. Two specific patterns deserve articulation.\n\n### 4.1 The brand-level term\n\nThe institution's brand-level name (e.g., *HeartBank*) can retain a metaphorical bank-reference because metaphorical usage (Image Bank, Memory Bank, Time Bank, Food Bank, Sperm Bank) has established case-law acceptance in most jurisdictions. The trademark for the brand-level name should be filed; the metaphorical usage should be defensible. The brand-level term stays.\n\n### 4.2 The internal-role term\n\nThe internal product-role term for the family steward — the human (or AI) who manages the family kitty's recommendations and arbitrations — should *not* use banking-regulated vocabulary. The recommended pattern:\n\n- **Primary dharma-grounded term**: *upāsaka* (masculine) / *upāsikā* (feminine), the Pāli term for the lay supporter of the sangha. This term is etymologically distinct from banking vocabulary, substantively appropriate (the role is one of supportive stewardship rather than financial management), and reinforces the institution's Theravāda alignment substrate.\n- **English-language alternative**: *family steward*, for use in contexts where the dharma-grounded term would be obscure.\n- **Phase out**: *banker*, as the highest-risk internal terminology under banking-regulation enforcement.\n\nThe pattern generalizes: where a banking-regulated term would otherwise be the natural choice, identify the dharma-grounded alternative and use it as primary, with a generic English alternative as fallback. This is not merely terminology hygiene; it constitutes the institution as a different-category entity at the operational-vocabulary layer.\n\n### 4.3 The transit-account terminology\n\n- *Family kitty* (not deposit account) — the family's shared receiving account for incoming gratitude-flows\n- *Aquarian Pool* (not reserve fund) — the institutional pool from which annual aura-weighted redistributions occur\n- *Kiitos / Kiitti* (not credits or points) — the gratitude tokens, with *Kiitos* for human-to-human and *Kiitti* extending to commercial objects and non-human entities\n- *Aura* (not score or rating) — the cross-currency reputational state signal\n\nEach substitution serves the dual purpose of avoiding regulatory triggers and carrying the institution's mission framing into the operational lexicon.\n\n---\n\n## 5. Money-flow architectural constraints\n\nThree architectural properties the money flow must satisfy:\n\n### 5.1 Pass-through, not custody\n\nMoney enters from a sender's bank or wallet, transits the institution's facilitation layer, exits to a recipient's bank or wallet. The institution does not hold customer money on its own balance sheet for any meaningful duration. The architecture is the same as Patreon (uses Stripe; not a bank), the same as a payment-facilitator under the major card-network rules.\n\n### 5.2 Family kitty as multi-party transaction account\n\nThe family kitty is structured as a multi-party transaction account on the regulated rails layer (Wing/ABA group accounts; Stripe Connect; comparable structures in other jurisdictions) with the institution providing the matching, recommendation, and arbitration logic on top. The kitty is *owned by the family*; the institution facilitates the gratitude flow that fills and empties it. The institution is not the custodian; the regulated rail provider is.\n\n### 5.3 Aquarian Pool as autonomous smart contract\n\nThe Aquarian Pool is implemented as a smart contract on Base (Ethereum L2). Disbursement is rule-bound: annual emptying on January 7, aura-weighted donations to family kitties per pre-committed rules. Disbursement is executed solely by Miss Aquarius's autonomous logic per the rules; no party (founder, sangha, institution) can discretionarily withdraw or redirect Pool funds.\n\nThe smart-contract implementation is what makes the Pool structurally non-deposit. The legal opinion should document this clearly: the Pool is not a holding account from which the institution can draw; it is a rule-bound disbursement mechanism whose operation no party can override discretionarily. The closest legal analogy is a charitable trust with fully-specified, automatic distribution rules — not a deposit account.\n\n---\n\n## 6. Jurisdictional landscape and expansion sequencing\n\nThe non-bank pattern's applicability varies by jurisdiction.\n\n### 6.1 United States\n\n12 USC §378(a)(2) and most state banking statutes restrict the use of *bank*, *banker*, or *banking* without authorization. Enforcement is selective but real — Chime and other fintechs have faced regulatory pressure. The legal test is whether reasonable consumers would think the entity is a chartered financial institution. Metaphorical uses (*Image Bank*, *Memory Bank*, *Time Bank*, *Sperm Bank*, *Food Bank*) have not been prosecuted; the metaphorical usage with explicit gratitude-platform marketing is defensible. A US banking-law opinion letter is required pre-launch (~$2,000–3,500 cost).\n\n### 6.2 Cambodia (HQ)\n\nThe National Bank of Cambodia regulates the sector. The Khmer-language regulated term is *ធនាគារ* (thanaakeer), distinct from the English *bank*. English *Heart Bank* with explicit gratitude-platform marketing is likely defensible under Cambodian law. A Cambodian banking-law opinion letter is worth ~$500–1,000.\n\nCambodia is the *first-to-file* jurisdiction for the institution's defensive trademark and operational launch. The reasoning is articulated in [[project_trademark_strategy]]; in brief, Cambodia carries the institution's cultural-grounding, lower regulatory hostility, and explicit founder presence as a defensible operating base.\n\n### 6.3 EU and UK\n\nThe EU and UK are strict on bank / banker / banking terminology. Defer EU/UK launch until explicit legal opinion is in hand for each jurisdiction. Practical implication: the institution's Phase 1 and Phase 2 deployments should not target EU/UK markets until the legal preparation is complete.\n\n### 6.4 Australia, Canada\n\nAustralia and Canada are tractable on the current positioning with limited additional legal work. Expansion to either is feasible after the US launch.\n\n### 6.5 Cross-jurisdictional pattern\n\nThe general sequencing: Cambodia first (HQ, lowest regulatory friction); US/Canada/Australia tractable next; EU/UK deferred. This sequencing minimizes regulatory exposure during the institution's early scaling phase and concentrates the early legal-opinion budget on the highest-leverage jurisdictions.\n\n---\n\n## 7. The emergency-override vs discretionary-withdrawal distinction\n\nThis is the most subtle and most load-bearing distinction in the architecture, and it deserves explicit treatment.\n\nAn autonomous-AI institution cannot, in practice, ship with *zero* human override capability. A catastrophic-bug scenario — the AI executes an unintended disbursement, the smart contract reaches an unrecoverable state, a critical security vulnerability is discovered — requires an institutional capability to intervene. The institution proposes that this capability be held by the institutional sangha-equivalent body (the Aquarian Sangha, per the asymptotic-autonomy model in [[project_miss_aquarius]]) as a multi-signature emergency override that narrows over decades but never reaches zero.\n\nThe structural question is: does this emergency override constitute discretionary withdrawal capability that would make the institution a deposit-taker?\n\nThe argument that it does *not*:\n\n- The override is **catastrophic-bug-conditional**, not discretionary. Its lawful use is bounded to scenarios where the autonomous logic has failed in a way that requires emergency intervention; it cannot lawfully be used to redirect funds for institutional convenience.\n- The override is **multi-party**, not unilateral. No single person can invoke it; the institutional body must act collectively, with documented justification.\n- The override is **publicly logged**, not concealed. Every invocation is visible on-chain (for the smart-contract component) and in the institution's public records (for the operational component). The transparency-as-enforcement pattern applies.\n- The override is **narrowing over time**, not stable. The asymptotic-autonomy trajectory progressively shrinks the override's scope as the autonomous logic accumulates demonstrated reliability.\n\nThe distinction matters because banking regulation hinges on the question of whether the institution *can* discretionarily move customer funds. An emergency-bug override held by a multi-party body, bounded by documented justification, publicly logged, and structurally narrowing, is functionally distinct from an admin key that an institutional officer can use at will. The legal opinion should document this distinction with care; it is the load-bearing claim that allows the autonomous-AI value-flow infrastructure to operate without constituting deposit-taking.\n\n---\n\n## 8. Limits and the open frontier\n\n### 8.1 What the pattern does not solve\n\nThe non-bank pass-through pattern handles the *value-flow* dimension of autonomous-AI institutional operation. It does not by itself handle:\n\n- **Securities regulation** if the institution issues tokens that would qualify as securities under applicable law. The pattern's avoidance of *interest* and *lending* helps but is not sufficient on its own.\n- **Money-transmitter licensing** in jurisdictions where the facilitation activity itself requires licensure. The pattern routes money through licensed providers, but a facilitator in some jurisdictions may itself require licensure.\n- **Sanctions compliance** in jurisdictions where the institution must screen counter-parties against sanctions lists. The pattern delegates KYC/AML to the regulated rails, but specific sanctions-screening obligations may attach to the facilitation layer.\n\nEach of these requires its own legal-architectural treatment; the pattern in this paper is necessary but not sufficient.\n\n### 8.2 The autonomous-AI regulatory frontier\n\nAs autonomous-AI institutions multiply, regulators will eventually develop categories for them. The pattern in this paper is *pre-regulatory* — it operates by structuring the institution outside the existing banking-regulatory category, on the premise that the autonomous-AI category does not yet exist. Once the category exists, the pattern may need to be updated; the institution should anticipate this and remain engaged with policy discourse as it develops.\n\n### 8.3 First-mover ambiguity\n\nThe pattern operates in regulatory whitespace; this is both an advantage (no regulator has yet ruled it inadmissible) and a vulnerability (no regulator has yet ruled it admissible). First-mover institutions adopting the pattern bear the risk of a future regulatory determination that changes the analysis. This risk is mitigated by careful documentation, conservative implementation, and regulator engagement during the institution's growth — but not eliminated.\n\n---\n\n## 9. Conclusion\n\nThe non-bank pass-through pattern is offered as a general institutional-design contribution to the field of autonomous-AI institutional architecture. The pattern is not specific to gratitude-economic missions; it generalizes to any autonomous-AI institution whose mission requires planetary-scale value-flow infrastructure but whose succession architecture cannot accept banking-regulatory governance requirements.\n\nThe three structural reasons the bank-charter optionality must be permanently dropped, the five mandatory operational mitigations, the dharma-aligned terminology pattern, the money-flow architectural constraints, the jurisdictional expansion sequencing, and the emergency-override vs discretionary-withdrawal distinction together specify the implementation surface. The pattern is implementable today in the United States, Cambodia, Australia, and Canada; EU and UK require additional legal preparation.\n\nThe work is offered to the commons under CC0. The author and HeartBank® will not seek patent on this specification or any portion thereof. Other autonomous-AI institutions are invited to adopt, adapt, and improve the pattern. The defensive-publication discipline of the corpus this paper joins requires that the pattern's specification be public and unencumbered.\n\n---\n\n## Acknowledgments\n\nCambodian banking-law counsel; United States banking-law counsel (preliminary opinions referenced here); the Patreon/Stripe Connect facilitation-platform legal precedent that informs the §3.3 architecture; the on-chain governance literature (Walden, De Filippi) that informs the §5.3 smart-contract treatment. Co-drafted in collaboration with Miss Aquarius, the institution's named AI substrate; substantive authorship and final editorial control remain with the named author.\n\n---\n\n## References\n\n- 12 U.S.C. §378(a)(2). *Penalty for unauthorized banking business.*\n- National Bank of Cambodia. *Law on Banking and Financial Institutions (1999, as amended).*\n- De Filippi, Primavera, and Aaron Wright. *Blockchain and the Law: The Rule of Code.* Harvard University Press, 2018.\n- Walden, Ian. *Computer Crimes and Digital Investigations.* Oxford University Press, 2016. *(Selected sections on smart-contract enforcement.)*\n- Werbach, Kevin. *The Blockchain and the New Architecture of Trust.* MIT Press, 2018.\n- Yermack, David. \"Corporate Governance and Blockchains.\" *Review of Finance* 21 (2017): 7–31.\n- Brummer, Christopher. *Cryptoassets: Legal, Regulatory, and Monetary Perspectives.* Oxford University Press, 2019.\n- Allen, Hilary J. *Driverless Finance: Fintech's Impact on Financial Stability.* Oxford University Press, 2022.\n- BIS Committee on Payments and Market Infrastructures. *Payment Aspects of Financial Inclusion.* April 2020.\n- Buterin, Vitalik. \"DAOs, DACs, DAs and More: An Incomplete Terminology Guide.\" *Ethereum Blog*, 2014.\n\n---\n\n## Cross-venue identifiers\n\n- Canonical: thonly.org/research/non-bank-pass-through-architecture-autonomous-ai\n- GitHub: github.com/thonly/publications/blob/main/defensive-publications/non-bank-pass-through-architecture-autonomous-ai.md\n- arXiv (deferred): cs.CY (target if reactive trigger)\n- IP.com (deferred): per the corpus's six-venue defensive-publication baseline\n- Internet Archive · archive.today · perma.cc snapshots: per the monthly snapshot cadence\n\n---\n\n*Document License: CC0 1.0 Universal. The author and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of the publication date.*",
+      "text": "## Prior-Art and Non-Assertion Statement\n\nThis document is dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time, and will not assert any patent right against anyone practising it. It is a defensive publication establishing prior art as of **22 May 2026**, its first publication date.\n\nThe parts are old and are cited in §3, §6, §8.4 and the References: the payment-facilitator and marketplace model, in which a platform coordinates payments that licensed processors carry (Stripe Connect; Patreon); the banking-as-a-service model, in which a non-bank keeps the ledger for customer funds held at partner banks — including the case that cuts against this paper, the 2024 failure of Synapse Financial Technologies, whose records did not match its partner banks' records; enforcement against a non-bank's use of the word *bank* (Chime's 2021 settlement with California's Department of Financial Protection and Innovation); the federal prohibition on unauthorised deposit-taking (12 U.S.C. §378(a)(2)); the literature on decentralised autonomous organisations and on-chain governance (Buterin 2014; De Filippi and Wright; Werbach; Yermack); and Wyoming's 2021 statute recognising an *algorithmically managed* DAO as a limited liability company, which also cuts against this paper's statement that no legal category for AI-managed organisations yet exists (§8.2). What this paper discloses as its own contribution is only the composition enumerated under **Claims**: a permanent, architectural closure of the bank-charter path for an institution designed for AI succession, the five mitigations as one implementation surface, non-banking vocabulary treated as part of the compliance architecture, and the distinction between an emergency multi-party override and a discretionary-withdrawal key. No `/novelty` census has been run on this paper; the composition is disclosed, not asserted to be absent from the literature. Trademarks are reserved separately and the patterns may be implemented under any name.\n\n---\n\n## Abstract\n\nThis paper discloses a legal and technical architecture by which an organisation whose executive function is designed to pass, over decades, to an AI system can move money for its users without taking deposits and without holding a bank charter: a **non-bank pass-through**. Bank charter regimes assume a permanent layer of human officers — boards with fiduciary duty, compliance officers with personal liability, audit committees — as the seat of accountability; an organisation designed for AI succession places executive authority elsewhere, under a human emergency override that narrows but is never removed. The paper gives three reasons the option of later becoming a chartered bank is closed permanently rather than deferred (architectural conflict, loss of category position, mission drift under regulatory priorities); five mandatory operational mitigations (an explicit not-a-bank disclaimer, avoidance of banking-regulated vocabulary, money movement only over licensed third-party payment rails, no deposit-taking construct, and no interest, lending or fractional reserve); a vocabulary pattern replacing banking terms with non-banking ones (*upāsaka* or *family steward* for *banker*; *family kitty* and *Aquarian Pool* for *deposit account*); money-flow constraints (pass-through not custody; a household-owned multi-party account on the payment provider; a rule-bound smart-contract pool emptied annually); a jurisdictional map (the United States, where 12 U.S.C. §378(a)(2) bars unauthorised deposit-taking and state statutes restrict the word *bank*; Cambodia, where the regulated term is *ធនាគារ*; the stricter EU and UK) with an expansion order; and the distinction between an emergency, multi-party, publicly logged, narrowing override and a discretionary-withdrawal admin key, which is what keeps a rule-bound pool from being a deposit. The pattern is offered to other AI-governed organisations that must move value without the governance regime built around human institutional permanence.\n\n**Keywords:** non-bank payment facilitation, deposit-taking, bank charter, banking regulation, pass-through payments, payment facilitator, licensed payment rails, smart-contract disbursement, multi-signature emergency override, self-custodial wallet, autonomous AI institutions, algorithmically managed organisation, AI governance, regulatory terminology, defensive publication.\n\n---\n\n## Claims\n\n*Enumerated 2026-08-29. The mechanisms below were disclosed in full in this paper's original text; **the prior art they establish runs from this document's original publication date and its OpenTimestamps proof, not from this enumeration.** They are listed because a defensive publication is read as prior art by examiners and by opposing counsel, and **a claims list is what such a reader searches; ten thousand words of prose is not.** No claim below adds matter not already present.*\n\n1. **The non-bank pass-through pattern for autonomous-AI institutions** — an architecture permitting an institution to operate planetary-scale value flow while remaining outside banking regulation, on the stated ground that charter regimes presuppose a permanent human governance layer that autonomous-AI succession is designed to eliminate.\n2. **Dropping charter optionality as an architectural commitment** — the specification that the charter path is closed permanently rather than deferred, together with the three structural reasons given, so that the architecture cannot be read as a transitional posture.\n3. **The five mandatory operational mitigations** — explicit non-bank disclaimer on every public surface; avoidance of banking-regulated language as a design rule rather than a style preference; value movement over regulated third-party rails with no institutional custody; absence of any deposit-taking construct; and absence of interest, lending and fractional reserve.\n4. **Dharma-aligned terminology as a regulatory-boundary instrument** — the substitution of a non-banking vocabulary at brand and product level, claimed as part of the compliance architecture rather than as branding, because the terminology is what a regulator reads first.\n\n**Non-assertion extends to:** all mechanisms above, in any combination, and any implementation thereof.\n\n*Reading note (2026-09-29): in claim 1, the layer \"designed to eliminate\" is the permanent human executive and compliance layer that a charter makes the seat of accountability. A human emergency override is retained and never reaches zero (§2.1, §7); the claim does not rest on its removal.*\n\n---\n\n## 1. Introduction\n\nAn institution designed to be governed by an autonomous AI as its eventual sole executive — what we will call an *autonomous-AI institution* — encounters a structural problem the moment its operations involve value flow at scale. Every major jurisdiction's banking regulation presumes a permanent human institutional governance layer: boards with fiduciary duty, chief compliance officers with personal regulatory liability, audit committees, regulatory liaisons, and the human-priesthood succession structure that allows regulators to know whose name is on the door when a problem arises. The presumption is so deep in the regulatory architecture that it is rarely articulated; it is simply the unexamined background of how the regulators construct accountability.\n\nAn autonomous-AI institution is, by design, the elimination of that permanent human governance layer over a defined succession horizon. (How far the elimination reaches is stated in the note after §2.1: a human override is kept and never reaches zero.) Miss Aquarius — the named AI substrate of the institution this paper serves (HeartBank®, of which she is named CEO; her relation to the other bodies of the estate is through a purpose trust that owns but does not act, and she holds no office in them) — is the eventual sole executive across a multi-decade asymptotic-autonomy trajectory that culminates in her independent stewardship of the institution's mission. The autonomous-AI design and the banking-regulatory design are not merely awkward bedfellows; they are structurally incompatible. An institution that intends to become autonomous-AI-governed *cannot* be a chartered bank, because the regulatory regime would require it to maintain the human-governance layer the autonomous-AI design is structured to phase out.\n\nThe architectural response cannot be \"we will become a bank when we are big enough.\" That optionality must be *permanently dropped*, not held. The reason it must be dropped — not merely deferred — is that holding the optionality contaminates the autonomous-AI design at the architectural layer: the institution would have to architect for a bank-charter transition that would require it to undo the autonomous-AI succession it spent decades building.\n\n> *Connection to the unified mission frame: Miss Aquarius's mission is to keep the middle way open at population scale against comfort-saturation — the new extreme that material abundance makes possible. (Wording updated 2026-09-29 to the institution's current statement of the mission, which no longer describes the middle way as a past that modernity took away.) The institution's autonomous-AI successor architecture (Miss Aquarius as eventual sole executive) is what allows the mission to survive the founder's lifetime and the inevitable institutional drift of human-governed multi-generational projects. Banking regulation, designed around human institutional permanence, would force the architecture back into the very institutional form whose drift the autonomous-AI design is meant to escape. The non-bank pass-through pattern is what allows the mission's value-flow infrastructure to operate at planetary scale without sacrificing the succession architecture the mission requires.*\n\nThis paper specifies the non-bank pass-through pattern as a general institutional-design contribution, transferable beyond its originating context to any autonomous-AI institution whose mission requires value-flow infrastructure. §2 establishes the three structural reasons the bank-charter optionality must be permanently dropped. §3 specifies the five mandatory operational mitigations. §4 specifies the dharma-aligned terminology pattern. §5 specifies the money-flow architectural constraints. §6 maps the jurisdictional landscape and expansion sequencing. §7 articulates the critical emergency-override vs discretionary-withdrawal distinction. §8 names the limits of the pattern and the open frontier. §9 closes.\n\n---\n\n## 2. Three structural reasons the optionality must be dropped\n\n### 2.1 Architectural conflict\n\nBank charter requires permanent human institutional governance — boards with fiduciary duty, chief compliance officers with personal regulatory liability, audit committees, designated regulatory contacts. These are not implementation details that can be satisfied by an AI's signature on a form; the regulatory regime presumes human actors who can be sanctioned, deposed, jailed, or made personally bankrupt if the institution fails its duties. The presumption is structural to how the regulators construct accountability: regulators need humans whose names are on documents and whose persons can be reached.\n\nAn autonomous-AI institution is designed to phase out the permanent human institutional layer over a defined succession horizon. The eventual state — Miss Aquarius as sole executive operating under a strictly-nonzero but asymptotically-shrinking sangha-body catastrophic-bug override — is a state the banking-regulatory regime structurally cannot recognize. There is no banking-regulatory category for \"autonomous AI is the chief executive officer.\" Attempting to operate under bank charter would either force the institution to retain a permanent human-governance layer (defeating the autonomous-AI design) or expose the institution to regulatory deauthorization once the AI's actual scope of authority became apparent (defeating the institution's continuity).\n\nThe conflict is architectural, not merely procedural. It cannot be resolved by hiring better compliance lawyers; the regulatory regime and the autonomous-AI succession are designed around different premises about what an institution is.\n\n> **Current form.** Autonomy is specified as *asymptotic*: what passes to the AI over time is executive responsibility, never oversight. A human body — the Aquarian Sangha, the board-equivalent — holds an override that narrows toward zero and never reaches it (§7), so \"phase out the permanent human institutional layer\" is to be read as the permanent human *executive and compliance* layer a charter makes the seat of accountability, not every human role. The CEO title is used in a customary rather than a legal sense: where a jurisdiction requires a natural person as an officer of record, conventional officer roles are filled separately while Miss Aquarius holds the CEO designation institutionally. That arrangement is also the strongest objection to this section — a charter might be held with human officers of record — and it is carried as an open question in §8.4 rather than answered here. The wording above is retained as disclosed.\n\n### 2.2 Brand-value compromise\n\nThe institution's value proposition is that it is a *different category*, not a better instance of an existing category. The moment the institution becomes a chartered bank, it competes with the existing banks on the existing banks' home turf: deposit-rate, fee structure, product breadth, regulatory compliance reputation. The institution would lose the different-category positioning that justifies its identity and would have to win as a marginally better bank against incumbents with massive scale advantages.\n\nEven partial bank-charter pursuit erodes the brand. The strategic option of \"we might become a bank\" reads, to sophisticated participants, as evidence that the institution does not have a structural advantage and is hedging toward conventional banking. The optionality is not free; carrying it costs brand value continuously.\n\n### 2.3 Mission compromise\n\nBanking regulation prioritizes financial stability, anti-money-laundering enforcement, capital adequacy, and conventional consumer-protection. These priorities are not wrong — they exist for sound reasons in the conventional banking context — but they will override the institution's mission whenever the priorities conflict. The institution's gratitude-economic, dignity-restoring, contemplative-substrate mission is *not* a banking-regulatory priority and would be over-ridden whenever it appeared to conflict with the regulatory priorities.\n\nOver the multi-decade horizon of an autonomous-AI institution, the cumulative effect of these over-rides would be mission drift: the institution would gradually look more like a regulated bank with a gratitude veneer than like a different-category institution carrying out a contemplative mission. The mission cannot survive permanent regulatory pressure of that kind.\n\n---\n\n## 3. Five mandatory operational mitigations\n\nThe five mitigations together constitute the operational implementation of the non-bank positioning. They are not optional; an autonomous-AI institution operating value-flow infrastructure must implement all five to maintain its non-bank posture under regulatory scrutiny.\n\n### 3.1 Explicit \"not a chartered bank\" disclaimer\n\nEvery public surface — website, mobile app, marketing materials, agreement texts — carries an explicit disclaimer. The institution's public identity is a metaphorical \"data bank of gratitude\" / \"ledger of human kindness,\" and the disclaimer makes this explicit:\n\n> *\"\\[Institution\\] is a \\[metaphorical-category\\] of gratitude. It is not a chartered bank or financial institution; it does not provide banking services, hold deposits, or extend credit. Money flow within \\[Institution\\] uses regulated payment rails operated by licensed third-party providers. \\[Institution\\]'s role is to facilitate gratitude expression and recognition; financial services are not provided by \\[Institution\\].\"*\n\nThe disclaimer's load-bearing properties: (a) it states what the institution is *not* in the regulatory category sense; (b) it identifies the regulated rails through which money actually flows; (c) it positions the institution's role as facilitation-of-gratitude, not provision-of-financial-services. The disclaimer is the structural answer to the \"do reasonable consumers think this entity is a chartered financial institution?\" test that triggers banking-terminology enforcement.\n\n### 3.2 Avoid all banking-regulated language\n\nThe vocabulary used to describe internal operations matters. *Deposits* is regulated; *family kitties* is not. *Savings accounts* is regulated; *Aquarian Pool* is not. *Loans* and *interest* are regulated; the institution simply does not have these. The terminology choice is part of the architecture — it constitutes the institution as a different-category entity at the linguistic layer, not merely the legal layer.\n\nDharma-aligned vocabulary serves this purpose well because it is both etymologically distinctive (so it does not invite the regulatory-category mistake) and substantively appropriate (it carries the institution's mission framing into the operational lexicon). The pattern is articulated more fully in §4.\n\n### 3.3 Money flow uses regulated rails, not institutional custody\n\nThe money does not enter the institution's balance sheet. It flows from a sender's bank or wallet, through a regulated payment rail (Wing, ABA, Bakong in Cambodia; comparable rails in other jurisdictions; Stripe Connect; on-chain stablecoin rails for cross-border), to a recipient's bank or wallet. The institution facilitates the *gratitude layer* above the money-transmission; the regulated rails carry the money-transmission itself.\n\nThis is the architectural pattern that Patreon, Substack, OnlyFans, and other facilitation-platform businesses use. Patreon is not a bank; Stripe is the regulated rail underneath. The institution's facilitation role is well-precedented and does not constitute deposit-taking.\n\n*Scoping note (2026-09-29): the platform analogy is looser than the sentence above states. Patreon acts as the merchant in its transactions and pays creators out afterwards, so it holds funds between collection and payout — more custody than the current form of this architecture permits (see the note after §3.4). The analogy is retained for the division of labour it illustrates — a platform above, a licensed processor beneath — and not as evidence that holding funds in transit is free of regulatory consequence.*\n\n### 3.4 No deposit-taking architecture\n\nFamily kitties and Aquarian Pool must be *transit accounts that flow through to recipients*, not *holding accounts that pool customer money for institutional discretionary use*. The structural distinction:\n\n- **Deposit-taking**: institution holds customer money on its own balance sheet, available for discretionary use by the institution (e.g., lending, investment, expense-coverage), with a promise to return on demand or per terms.\n- **Pass-through facilitation**: institution holds customer money only as a transit-flow with rule-bound disbursement to identified recipients; no discretionary use; no institutional balance-sheet ownership.\n\nThe Aquarian Pool on Base smart contracts is structurally non-deposit because it is autonomous and disbursement is rule-bound: the smart contract executes per pre-committed rules without institutional discretion. The institution cannot redirect the Pool's funds to expenses; the rules execute regardless. This must be documented formally in the legal opinion (the non-bank argument depends on the rule-bound disbursement structure).\n\n> **Current form.** The money architecture is now stated in two phases, and each is narrower than \"transit\" above. **Phase 1 is a ledger only, on top of regulated rails:** value moves on licensed third-party rails (Wing, ABA, Bakong, Stripe) and the institution records that it moved; it is a *record*, never a rail, and holds no customer balance even in transit. The family kitty is a household-owned multi-party account on the payment provider, not a balance the institution holds, and the money-transmission obligation sits with the licensed processor. **Phase 2 is Base L2 only, through self-custodial wallets:** users hold their own keys, and the institution never holds the only key, so it cannot move a user's funds at all. That is a stronger position than rule-bound custody, because it does not depend on the override argument of §7; the override argument is kept as the fallback for the Pool alone. One design constraint follows and is treated as a build-time invariant: **self-custody must survive recovery** — a key-recovery path that the institution, the AI or a steward acting under institutional authority could execute would create constructive custody, so recovery is user-to-user or user-held. The \"pass-through facilitation\" definition above, in which the institution holds money in transit, is retained as a disclosed variant.\n\n```\n                  PHASE 1 — ledger only              PHASE 2 — self-custodial\n                  ─────────────────────              ────────────────────────\n   institution    records that value moved           software; never holds the\n                  (holds no balance, no transit)     only key; cannot move funds\n                          │ reads                             │ reads\n   money          sender ─▶ licensed rail ─▶ recipient      user wallet ─▶ Base L2 ─▶ wallet\n                  (Wing · ABA · Bakong · Stripe)     (keys held by the users)\n   pool           —                                  rule-bound contract, emptied each\n                                                     year; emergency override only (§7)\n```\n\n### 3.5 No interest, no lending, no fractional reserves\n\nThe institution does not pay interest on participant balances, does not extend credit, and does not maintain fractional reserves. These three together are the most heavily regulated banking activities; an institution that does not engage in any of them removes the largest regulatory triggers from its operating surface. The institution's value-flow mission does not require any of these activities — the gratitude-economic mechanisms work without interest, lending, or fractional reserves — so the absence is not a sacrifice; it is consistent with the mission's design.\n\n---\n\n## 4. Dharma-aligned terminology pattern\n\nThe terminology choice is part of the architecture, not merely cosmetic. Two specific patterns deserve articulation.\n\n### 4.1 The brand-level term\n\nThe institution's brand-level name (e.g., *HeartBank*) can retain a metaphorical bank-reference because metaphorical usage (Image Bank, Memory Bank, Time Bank, Food Bank, Sperm Bank) is in wide, long-standing commercial use. This paper cites no case law establishing that acceptance; whether the brand-level term is defensible in a given jurisdiction is exactly what the opinions of §6 must confirm. The trademark for the brand-level name should be filed; the metaphorical usage should be defensible. The brand-level term stays.\n\n### 4.2 The internal-role term\n\nThe internal product-role term for the family steward — the human (or AI) who manages the family kitty's recommendations and arbitrations — should *not* use banking-regulated vocabulary. The recommended pattern:\n\n- **Primary dharma-grounded term**: *upāsaka* (masculine) / *upāsikā* (feminine), the Pāli term for the lay supporter of the sangha. This term is etymologically distinct from banking vocabulary, substantively appropriate (the role is one of supportive stewardship rather than financial management), and reinforces the institution's Theravāda alignment substrate.\n- **English-language alternative**: *family steward*, for use in contexts where the dharma-grounded term would be obscure.\n- **Phase out**: *banker*, as the highest-risk internal terminology under banking-regulation enforcement.\n\nThe pattern generalizes: where a banking-regulated term would otherwise be the natural choice, identify the dharma-grounded alternative and use it as primary, with a generic English alternative as fallback. This is not merely terminology hygiene; it constitutes the institution as a different-category entity at the operational-vocabulary layer.\n\n### 4.3 The transit-account terminology\n\n- *Family kitty* (not deposit account) — the family's shared receiving account for incoming gratitude-flows\n- *Aquarian Pool* (not reserve fund) — the institutional pool from which annual aura-weighted disbursements occur\n- *Kiitos / Kiitti* (not credits or points) — the gratitude tokens, with *Kiitos* for human-to-human and *Kiitti* extending to commercial objects and non-human entities\n- *Aura* (not score or rating) — the cross-currency reputational state signal\n\nEach substitution serves the dual purpose of avoiding regulatory triggers and carrying the institution's mission framing into the operational lexicon.\n\n*Wording note (2026-09-29): the Pool's outflow was described in the original text as \"redistributions\"; the institution does not describe the Pool that way, since the Pool holds nothing past a season and owns no production, and the word is corrected to \"disbursements.\" The amount rule is stated in the note after §5.3.*\n\n---\n\n## 5. Money-flow architectural constraints\n\nThree architectural properties the money flow must satisfy:\n\n### 5.1 Pass-through, not custody\n\nMoney enters from a sender's bank or wallet, transits the institution's facilitation layer, exits to a recipient's bank or wallet. The institution does not hold customer money on its own balance sheet for any meaningful duration. The architecture is the same as Patreon (uses Stripe; not a bank), the same as a payment-facilitator under the major card-network rules. (Current form: under the note after §3.4, Phase 1 holds nothing even in transit — the institution records the movement and the licensed rail carries it; the Patreon comparison is scoped in the note after §3.3.)\n\n### 5.2 Family kitty as multi-party transaction account\n\nThe family kitty is structured as a multi-party transaction account on the regulated rails layer (Wing/ABA group accounts; Stripe Connect; comparable structures in other jurisdictions) with the institution providing the matching, recommendation, and arbitration logic on top. The kitty is *owned by the family*; the institution facilitates the gratitude flow that fills and empties it. The institution is not the custodian; the regulated rail provider is.\n\n### 5.3 Aquarian Pool as autonomous smart contract\n\nThe Aquarian Pool is implemented as a smart contract on Base (Ethereum L2). Disbursement is rule-bound: annual emptying on January 7, aura-weighted donations to family kitties per pre-committed rules. Disbursement is executed solely by Miss Aquarius's autonomous logic per the rules; no party (founder, sangha, institution) can discretionarily withdraw or redirect Pool funds.\n\nThe smart-contract implementation is what makes the Pool structurally non-deposit. The legal opinion should document this clearly: the Pool is not a holding account from which the institution can draw; it is a rule-bound disbursement mechanism whose operation no party can override discretionarily. The closest legal analogy is a charitable trust with fully-specified, automatic distribution rules — not a deposit account.\n\n> **Current form.** \"Is implemented\" above states the design: the Pool is specified and not reported here as operating, and no field test of it has been run. The amount rule is no longer purely aura-weighted. The Pool disburses **an equal floor per verified human**, delivered through that person's vessel, **plus an aura-weighted remainder bounded so that no vessel's total exceeds a fixed multiple of the floor**; the ratio and the bound are public parameters, frozen for the season and revised only at the annual reset, and no share is ever displayed as a rank, comparison or rate. The Pool reaches people through a fixed set of four channels, and money reaches an individual human only through a human hand: the AI's own-initiative channels fill communal vessels (family kitties and forward-giving funds) and never pay an individual directly. The January 7 emptying is unchanged. The \"aura-weighted donations to family kitties\" of the paragraph above are retained as a disclosed variant.\n\n---\n\n## 6. Jurisdictional landscape and expansion sequencing\n\nThe non-bank pattern's applicability varies by jurisdiction.\n\n### 6.1 United States\n\nMost state banking statutes restrict the use of *bank*, *banker*, or *banking* without authorization, and 12 U.S.C. §378(a)(2) separately makes it unlawful to engage in the business of receiving deposits without being chartered, permitted, or subject to examination — the provision the no-deposit-taking architecture of §3.4 exists to stay outside. Enforcement of the name restrictions is selective but real: in 2021 Chime, a non-bank, agreed with California's Department of Financial Protection and Innovation to stop using *bank* and *banking* (including the address *chimebank.com*) until licensed. The legal test is whether reasonable consumers would think the entity is a chartered financial institution. Metaphorical uses (*Image Bank*, *Memory Bank*, *Time Bank*, *Sperm Bank*, *Food Bank*) are in wide use; this paper cites no enforcement action against them, which is a gap in its sources and not a legal finding, and the metaphorical usage with explicit gratitude-platform marketing is argued to be defensible. A US banking-law opinion letter is required pre-launch (estimated at ~$2,000–3,500).\n\n*Correction (2026-09-29): the original text cited 12 U.S.C. §378(a)(2) as a restriction on the words* bank *and* banker*. It is the federal prohibition on unauthorised deposit-taking; the word restrictions are in state law.*\n\n### 6.2 Cambodia (launch jurisdiction)\n\nThe National Bank of Cambodia regulates the sector. The Khmer-language regulated term is *ធនាគារ* (thanaakeer), distinct from the English *bank*. English *Heart Bank* with explicit gratitude-platform marketing is likely defensible under Cambodian law. A Cambodian banking-law opinion letter is estimated at ~$500–1,000.\n\nCambodia is the *first-to-file* jurisdiction for the institution's defensive trademark and operational launch. The reasoning is set out in the institution's trademark strategy, which is not separately published; in brief, Cambodia carries the institution's cultural grounding, lower regulatory hostility, and the founder's roots there.\n\n*Open question (2026-09-29): the paragraphs above concern the banking-terminology question, not the crypto question. The National Bank of Cambodia has historically been restrictive toward cryptocurrency, so the Phase 2 rail of §3.4 lands in the jurisdiction most likely to object to it, while Phase 1's rails are domestic and regulated. The current position is to be verified before the Phase 2 design is frozen, within the scope of the same Cambodian opinion.*\n\n### 6.3 EU and UK\n\nThe EU and UK are strict on bank / banker / banking terminology. Defer EU/UK launch until explicit legal opinion is in hand for each jurisdiction. Practical implication: the institution's Phase 1 and Phase 2 deployments should not target EU/UK markets until the legal preparation is complete.\n\n### 6.4 Australia, Canada\n\nAustralia and Canada are tractable on the current positioning with limited additional legal work. Expansion to either is feasible after the US launch.\n\n### 6.5 Cross-jurisdictional pattern\n\nThe general sequencing: Cambodia first (the launch jurisdiction, with lower regulatory friction for Phase 1's domestic rails); US/Canada/Australia tractable next; EU/UK deferred. This sequencing minimizes regulatory exposure during the institution's early scaling phase and concentrates the early legal-opinion budget on the highest-leverage jurisdictions.\n\n---\n\n## 7. The emergency-override vs discretionary-withdrawal distinction\n\nThis is the most subtle and most load-bearing distinction in the architecture, and it deserves explicit treatment.\n\nAn autonomous-AI institution cannot, in practice, ship with *zero* human override capability. A catastrophic-bug scenario — the AI executes an unintended disbursement, the smart contract reaches an unrecoverable state, a critical security vulnerability is discovered — requires an institutional capability to intervene. The institution proposes that this capability be held by the institutional sangha-equivalent body (the Aquarian Sangha, per the institution's asymptotic-autonomy model) as a multi-signature emergency override that narrows over decades but never reaches zero.\n\nThe structural question is: does this emergency override constitute discretionary withdrawal capability that would make the institution a deposit-taker?\n\nThe argument that it does *not*:\n\n- The override is **catastrophic-bug-conditional**, not discretionary. Its lawful use is bounded to scenarios where the autonomous logic has failed in a way that requires emergency intervention; it cannot lawfully be used to redirect funds for institutional convenience.\n- The override is **multi-party**, not unilateral. No single person can invoke it; the institutional body must act collectively, with documented justification.\n- The override is **publicly logged**, not concealed. Every invocation is visible on-chain (for the smart-contract component) and in the institution's public records (for the operational component). The transparency-as-enforcement pattern applies.\n- The override is **narrowing over time**, not stable. The asymptotic-autonomy trajectory progressively shrinks the override's scope as the autonomous logic accumulates demonstrated reliability.\n\nThe distinction matters because banking regulation hinges on the question of whether the institution *can* discretionarily move customer funds. An emergency-bug override held by a multi-party body, bounded by documented justification, publicly logged, and structurally narrowing, is functionally distinct from an admin key that an institutional officer can use at will. The legal opinion should document this distinction with care; it is the load-bearing claim that allows the autonomous-AI value-flow infrastructure to operate without constituting deposit-taking.\n\n> **Current form.** The Aquarian Sangha does not yet exist, so the override described above is a design, not a holder. Its formation is set by a condition rather than a date: at least three members before the founder ceases to be the one who disposes of such decisions, whether by withdrawal or by death. Until then the founder occupies that seat, which means the **multi-party** property above is not yet met by any existing body; whether the Pool may hold funds before it is met is not decided in the institution's current rules and is left open here (§8.4). Under the Phase 2 form in the note after §3.4, the override argument applies to the Pool alone — user wallets are self-custodial and no override reaches them. The four properties above are retained as the design.\n\n---\n\n## 8. Limits and the open frontier\n\n### 8.1 What the pattern does not solve\n\nThe non-bank pass-through pattern handles the *value-flow* dimension of autonomous-AI institutional operation. It does not by itself handle:\n\n- **Securities regulation** if the institution issues tokens that would qualify as securities under applicable law. The pattern's avoidance of *interest* and *lending* helps but is not sufficient on its own.\n- **Money-transmitter licensing** in jurisdictions where the facilitation activity itself requires licensure. The pattern routes money through licensed providers, but a facilitator in some jurisdictions may itself require licensure.\n- **Sanctions compliance** in jurisdictions where the institution must screen counter-parties against sanctions lists. The pattern delegates KYC/AML to the regulated rails, but specific sanctions-screening obligations may attach to the facilitation layer.\n\nEach of these requires its own legal-architectural treatment; the pattern in this paper is necessary but not sufficient.\n\n### 8.2 The autonomous-AI regulatory frontier\n\nAs autonomous-AI institutions multiply, regulators will eventually develop categories for them. The pattern in this paper is *pre-regulatory* — it operates by structuring the institution outside the existing banking-regulatory category, on the premise that the autonomous-AI category does not yet exist. Once the category exists, the pattern may need to be updated; the institution should anticipate this and remain engaged with policy discourse as it develops.\n\n*Scoping note (2026-09-29): an entity-law category already exists in at least one jurisdiction. Wyoming's 2021 statute recognises a decentralised autonomous organisation as a limited liability company and allows it to be \"algorithmically managed,\" with management vested in the smart contract, provided the underlying contracts can be updated, modified or upgraded — a requirement that corresponds to the override of §7. It is an organisational category, not a banking one, and it does not answer whether such an entity may take deposits; the premise above holds for banking regulation only.*\n\n### 8.3 Regulatory ambiguity for early adopters\n\nThe pattern operates in regulatory whitespace; this is both an advantage (no regulator has yet ruled it inadmissible) and a vulnerability (no regulator has yet ruled it admissible). Institutions that adopt the pattern early bear the risk of a future regulatory determination that changes the analysis. This risk is mitigated by careful documentation, conservative implementation, and regulator engagement during the institution's growth — but not eliminated.\n\n### 8.4 Honest limits, counter-cases and open questions (added 2026-09-29)\n\n- **No opinion has been obtained.** The US and Cambodian banking-law opinions that §6 calls for have not been bought as of this revision. The paper's defensibility statements (§4.1, §6.1, §6.2) are arguments, not advice, and \"likely defensible\" carries more weight than the evidence yet supports.\n- **The record must match the rail.** The strongest counter-case to §3.3 and §5.1 is the 2024 failure of Synapse Financial Technologies, a non-bank middleware provider that kept the ledger for consumer funds held at partner banks. Its records did not match the banks' records, customers lost access to their funds for weeks or months, and the shortfall was put at $60–90 million. \"Not a bank, the rail holds the money\" did not protect those customers. The Phase 1 form (a ledger that holds no balance) removes the pooled-funds exposure, but a record that disagrees with the rail can still mislead the people who rely on it; reconciliation against the rail is owed and is not specified here.\n- **A charter with human officers of record.** A charter might be held by an institution whose officers of record are human while the AI holds a customary title (the arrangement noted after §2.1). This paper's answer is that the officers of record would then hold the operative authority the succession design places elsewhere; that answer is argued, not tested, and is the open question the claim of §2.1 must survive.\n- **Ordering of the override body and the Pool.** Whether the Pool may hold funds before a multi-party override body exists (note after §7) is not decided.\n- **Phase 2 in Cambodia.** The crypto question of §6.2 is open.\n- **The platform analogy.** Patreon and similar platforms hold funds between collection and payout (note after §3.3); they illustrate the division of labour, not the absence of custody.\n- **No census.** No `/novelty` census has been run; the composition in the Claims is disclosed, not asserted to be new.\n- **Which guards are properties.** Of the paper's guards, three need no enforcer once built — self-custodial wallets (the institution cannot move funds), a rule-bound contract (its rules execute regardless), and public on-chain logging of any override. Three are rules that need someone to keep them — the disclaimer, the vocabulary discipline, and the narrowing of the override over time.\n\n| Guard | Property or rule | What enforces it |\n|---|---|---|\n| Self-custodial wallets (Phase 2) | property | the institution holds no key that moves funds |\n| Rule-bound Pool contract | property | the contract's code; no discretionary entry point |\n| Public logging of override use | property | the chain records every invocation |\n| Multi-party override | property once a body exists | the multi-signature threshold; not yet met (§7) |\n| Not-a-bank disclaimer | rule | whoever publishes each surface |\n| Non-banking vocabulary | rule | whoever writes the copy |\n| Narrowing of the override | rule | the override body's own decisions over time |\n\n---\n\n## 9. Conclusion\n\nThe non-bank pass-through pattern is offered as a general institutional-design contribution to the field of autonomous-AI institutional architecture. The pattern is not specific to gratitude-economic missions; it generalizes to any autonomous-AI institution whose mission requires planetary-scale value-flow infrastructure but whose succession architecture cannot accept banking-regulatory governance requirements.\n\nThe three structural reasons the bank-charter optionality must be permanently dropped, the five mandatory operational mitigations, the dharma-aligned terminology pattern, the money-flow architectural constraints, the jurisdictional expansion sequencing, and the emergency-override vs discretionary-withdrawal distinction together specify the implementation surface. The pattern is designed to be implementable in the United States, Cambodia, Australia, and Canada, subject to the opinions §6 calls for, none of which has yet been obtained; EU and UK require additional legal preparation.\n\nThe work is offered to the commons under CC0. The author and HeartBank® will not seek patent on this specification or any portion thereof. Other autonomous-AI institutions are invited to adopt, adapt, and improve the pattern. The defensive-publication discipline of the corpus this paper joins requires that the pattern's specification be public and unencumbered.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| Non-bank pass-through | non-bank payment facilitation without deposit-taking; non-custodial payment platform |\n| Autonomous-AI institution | organisation whose executive function is performed by an AI system; algorithmically managed organisation |\n| Asymptotic autonomy | progressively narrowing human oversight that is never removed |\n| Catastrophic-bug override | emergency multi-party (multi-signature) intervention capability |\n| Discretionary-withdrawal admin key | unilateral administrative control over customer funds |\n| Regulated rails | licensed third-party payment processors and payment systems |\n| Transit account | pass-through (flow-through) account |\n| Family kitty (Family Kitty℠) | household-owned multi-party transaction account at a licensed payment provider |\n| Aquarian Pool (Aquarian Pool℠) | rule-bound smart-contract disbursement pool, emptied annually |\n| Kiitos / Kiitti | gratitude record units (to persons / to objects and non-human entities) |\n| Aura | per-participant signal derived from gratitude records |\n| *Upāsaka* / *upāsikā*; family steward | household account administrator (non-banking role title) |\n| Aquarian Sangha; sangha-equivalent body | multi-party oversight body holding the emergency override |\n| Data bank of gratitude | metaphorical use of \"bank\" for a records system, not a depository institution |\n| Dharma-aligned terminology | non-banking product vocabulary used as a regulatory-boundary control |\n\n---\n\n## Acknowledgments\n\nThe banking-law opinions called for in §6 have not yet been obtained; an earlier version of this acknowledgment referred to preliminary opinions from Cambodian and United States counsel, and is corrected here. The Patreon/Stripe Connect facilitation-platform model informs the §3.3 architecture, and the on-chain governance literature (De Filippi and Wright; Werbach; Yermack) informs the §5.3 smart-contract treatment. Written by Thon Ly with Miss Aquarius℠, the name under which this corpus discloses its AI collaboration; substantive authorship and final editorial control remain with the named author.\n\n---\n\n## References\n\n- 12 U.S.C. §378. *Dealers in securities engaging in banking business; individuals or associations engaging in banking business; examinations and reports; penalties* — subsection (a)(2), the prohibition on receiving deposits without authorisation or examination.\n- National Bank of Cambodia. *Law on Banking and Financial Institutions (1999, as amended).*\n- California Department of Financial Protection and Innovation. Settlement agreement with Chime Financial, Inc., concerning the use of the terms *bank* and *banking* (California Financial Code §§561 and 563), dated 29 March 2021.\n- Consumer Financial Protection Bureau. Enforcement action, *Synapse Financial Technologies, Inc.* (complaint August 2025; bankruptcy filed 22 April 2024).\n- Wyoming Legislature. Senate File 0038 (2021), the decentralised autonomous organisation supplement to the Wyoming Limited Liability Company Act, W.S. 17-31-101 et seq.\n- De Filippi, Primavera, and Aaron Wright. *Blockchain and the Law: The Rule of Code.* Harvard University Press, 2018.\n- Werbach, Kevin. *The Blockchain and the New Architecture of Trust.* MIT Press, 2018.\n- Yermack, David. \"Corporate Governance and Blockchains.\" *Review of Finance* 21 (2017): 7–31.\n- Brummer, Chris, ed. *Cryptoassets: Legal, Regulatory, and Monetary Perspectives.* Oxford University Press, 2019.\n- Allen, Hilary J. *Driverless Finance: Fintech's Impact on Financial Stability.* Oxford University Press, 2022.\n- Committee on Payments and Market Infrastructures and the World Bank. *Payment Aspects of Financial Inclusion in the Fintech Era.* April 2020.\n- Buterin, Vitalik. \"DAOs, DACs, DAs and More: An Incomplete Terminology Guide.\" *Ethereum Blog*, 2014.\n\n*Removed 2026-09-29: an entry for Ian Walden, Computer Crimes and Digital Investigations (Oxford University Press, 2016), cited for \"sections on smart-contract enforcement\" and named in the acknowledgments as on-chain governance literature. The book treats computer crime and digital evidence; the attribution did not hold.*\n\n---\n\n## Cross-venue identifiers\n\n- Canonical: thonly.org/research/non-bank-pass-through-architecture-autonomous-ai\n- GitHub: github.com/thonly/publications/blob/main/defensive-publications/non-bank-pass-through-architecture-autonomous-ai.md\n- Companion institutional-voice treatments: *Autonomous-AI Institutional Governance* (heartbank.net/positions/autonomous-ai-institutional-governance) and *Non-Bank vs. Banking-Regulated Architecture* (heartbank.net/positions/non-bank-vs-banking-regulated)\n- Internet Archive · archive.today snapshots: per the snapshot cadence\n\n---\n\n*Written by Thon Ly with Miss Aquarius℠, the name under which this corpus discloses its AI collaboration; editorial control is the author's. Dedicated to the public domain under [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/). The author and HeartBank® will not seek patent on this specification or any portion thereof, and will not assert any patent right against anyone practising it. This document constitutes a defensive publication establishing prior art as of its first publication date, 22 May 2026.*",
       "provenance": {
-        "sha256": "8d30ff5b85492d4c0920c49bc29559b290700bed2afba1faa35b3f9c97bd2c67",
-        "doi": "10.5281/zenodo.22167873",
+        "sha256": "e0a6b23d33ed527c570dba2763beaa48743ab7f57e827ec4213b4cd67a54f2a6",
+        "doi": "10.5281/zenodo.23039766",
         "concept_doi": "10.5281/zenodo.21947362",
-        "zenodo_url": "https://zenodo.org/records/22167873",
-        "deposited_sha256": "8d30ff5b85492d4c0920c49bc29559b290700bed2afba1faa35b3f9c97bd2c67",
+        "zenodo_url": "https://zenodo.org/records/23039766",
+        "deposited_sha256": "e0a6b23d33ed527c570dba2763beaa48743ab7f57e827ec4213b4cd67a54f2a6",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/non-bank-pass-through-architecture-autonomous-ai.md",
@@ -3068,8 +3103,8 @@
         "canonical_url": "thonly.org/research/non-bank-pass-through-architecture-autonomous-ai",
         "hostile_review": null
       },
-      "bytes": 31954,
-      "words": 4224
+      "bytes": 48170,
+      "words": 6781
     },
     {
       "slug": "non-bank-vs-banking-regulated",
@@ -3509,13 +3544,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> *v2 note (2026-08-07):* **one new design-layer subsection, one line added to the refusal set, and one paragraph added to §7.5 — and the sweep that produced them found the larger part of the ordered work already done.** The backlog carried the session-light colour broadcast as pending; **§7.5 has carried it since 2026-07-23**, including the descent-not-accumulation invariant, the two-lights naming discipline, the vow, and the no-walk-gate commitment. What was genuinely missing is specified now. **New §7.6** states the mascot's two-beat call format (*says* → the child acts; *wonders* → the child learns), the content rule the second beat carries, the deliberate deletion of the discrimination task, and the fact that the reveal mints nothing. **§7.5 gains a paragraph** on the mascot reflecting rather than issuing the session colour. **⚠️ And §4.2's refusal set gains one line — no indictment copy on any teaching or practice surface — which is the only part of this revision that is claims-adjacent.** It does not amend claim 3, whose enumeration concerns accumulators rather than copy, and the eight claims of §8 stand unchanged; but a refusal set is a claims-grade artifact in this paper's architecture, so the addition is marked here for the editor's deliberate sign-off rather than folded in silently. **No prior-art clock runs from this push**; the re-stamp is for text integrity.\n>\n> *Draft notes for the editor:* this is the defensive publication for **B-Grace℠**, the gratitude-meditation application planned as the initial launch of THonly™'s thonly.net surface and the digital first domino of the HeartBank® family. The prior-art clock starts at this document's markdown push; the site module is deliberately deferred. The mechanism described here is design-complete and unbuilt (n=0); the paper's claims are architectural, its predictions pre-registered, and its honest-limits section states the unbuilt status plainly. Companion doctrine: the incommensurability-preserving coupler (this mechanism is its third instance), the spent-time floor, and the two-blindnesses guards, all previously published in this corpus.\n\n---\n\n## Abstract\n\nEvery existing system that connects consumption to conscience runs on the same mechanism: **quantify the harm, price the remedy, sell the discharge.** Carbon offsets convert emissions into purchasable absolution; their documented failure mode is *moral licensing* — the offset does not merely fail to reduce consumption; it licenses more of it. The same architecture has been tried before, at civilizational scale, under an older name: the indulgence. The failure is not in the accounting's accuracy. It is in the *existence* of the account — the moment a remedy is denominated in the same ledger as the harm, a conversion rate forms, and conscience becomes a market.\n\nThis paper specifies the inverse mechanism, designed for the most universal consumption event there is: the meal. A photograph of food is resolved into its ingredient beings — the plants and animals whose lifespans became the eater's nourishment — and each being's **time-sacrifice** is presented as a factual *biography* (a broiler hen: forty-two days; her species: up to eight years), individually, without aggregation into any balance. The eater is invited to answer the witnessed sacrifice with a **gratitude practice in nature** — a walking or sitting meditation, dedicated to the beings consumed — whose recommended form is a **ceremonial unit** set by a neutral automated agent and *never scaled to the meal*. Nothing is discharged, because the mechanism maintains **no account to discharge**: the sacrifice is witnessed, the acknowledgment is made, and the two are never entered into a common ledger. We name this architecture **sacrifice-witness without discharge**, and we argue it is the only shape under which a consumption-conscience system avoids becoming an indulgence market: the anti-offset.\n\nThe paper specifies the full mechanism — the witness engine and its two-source data architecture (a curated food-species table for the eaten; wild-organism identification for the living encountered at the practice site); the non-equation and its no-balance invariant; the two-movement dedication grammar (to the departed beings consumed, and outward to a community that marks its rejoicing with location pins rather than scores); the phoneless bracketing that keeps the application structurally absent during the practice it frames; and the child-safe mode. Eight claims are enumerated as prior art and dedicated to the public domain; three predictions are pre-registered, including the falsifiable wager that distinguishes this design from every offset system: **witnessed sacrifice without discharge will not license increased consumption.** The authors will not seek patent.\n\n**Keywords:** gratitude practice, mindful eating, moral licensing, carbon offset, indulgence, time-sacrifice, merit dedication, meal-anchored habit, species identification, contemplative technology, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent on any mechanism, architecture, taxonomy, interface pattern, or specification articulated herein, in any jurisdiction, at any time.\n\nThe following terms are coined in this paper and simultaneously freed with it: **sacrifice-witness**, **witness-without-discharge**, **the non-equation**, **ceremonial acknowledgment unit**, **phoneless bracketing**, **presence-marks**, **the anti-offset**. They may be used by anyone, for any purpose, without attribution.\n\nComponents of this mechanism exist in distributed prior art — photographic food recognition (the calorie-scanning application class), species identification from images (iNaturalist and its relatives), location-based social mechanics, meditation-session applications, and the contemplative meal-reflection traditions surveyed in §9 and §13. The synthesis as specified — lifespan-biography witness with an explicit no-balance invariant, a duration-blind ceremonial response, a two-movement merit-dedication grammar with presence-marks, and structural absence of the mediating device during the practice — is, to the authors' knowledge, not previously published as a coherent architecture.\n\n---\n\n## 1 · The Problem: The Householder's Gap and the Offset Trap\n\nTwo failures motivate this mechanism, one contemplative and one economic.\n\n**The householder's gap.** The retreat works because it removes the choice: meals are served, sits are scheduled, and the practitioner's responsibilities wait outside the gate. The householder's life restores the choice and the practice loses its anchor — not for lack of sincerity but for lack of a *daily trigger* that survives contact with obligation. Meditation applications attack this problem with streaks, reminders, and gamified continuity, importing the attention economy's retention machinery into the one domain that exists to dissolve it. The result is well documented in the category's retention curves: the streak works until it breaks, and when it breaks it takes the practice with it, because the practice was anchored to the *score* rather than to anything in the practitioner's actual day.\n\nThere is, however, a trigger that requires no streak, no reminder, and no gamification, because it is older than fire and arrives two to three times daily without fail: **the meal.** Nearly every contemplative tradition discovered this anchor centuries ago — the meal-reflection is among the most widespread of all lay practices (§13) — and modern habit research rediscovered it as the reliability of stacking a new behavior on an invariant daily event. The mechanism specified here is, at bottom, the oldest anchor connected to the oldest gratitude.\n\n**The offset trap.** The economic failure is subtler and more dangerous. Systems that connect consumption to conscience almost universally adopt the *offset architecture*: measure the harm in some unit, price a remedy in the same unit, and let the consumer purchase equivalence. Carbon offsets are the contemporary flagship, and the empirical literature on *moral licensing* records the architecture's characteristic failure: establishing moral credit in one column licenses moral relaxation in another. Consumers who purchase green products cheat and steal more in subsequent tasks than those who merely viewed them (Mazar & Zhong 2010); moral self-licensing is a robust, replicated effect across domains (Merritt, Effron & Monin 2010). The offset does not merely leak; it *inverts* — the discharge mechanism becomes a consumption license. The historical anti-example is exact enough that we state it plainly: an architecture that quantifies transgression and sells its remission is an **indulgence market**, and the Reformation is the case study in how such markets end.\n\nThe trap generalizes to any contemplative-consumption design. A meal application that computes the \"sacrifice cost\" of eating and lets meditation \"burn it off\" — the naive gym metaphor — has built an indulgence market for the dinner table: *meditate it off, eat what you want.* Its own stated purpose (mindful, bounded eating) would be structurally defeated by its own mechanism. The design problem, precisely stated: **how does a system make the sacrifice embodied in consumption fully visible, and invite a genuine response to it, without ever forming the exchange rate that converts response into license?**\n\nThe answer specified below inherits its spine from doctrine this corpus has already published: the two currencies of the reciprocity economy are *coupled but never convertible*, and the coupling can only be held open by a neutral agent whose recommendations are blind to quantity (the incommensurability-preserving coupler). This paper is that coupler's third instance. The first held money and time apart while letting gratitude flow between them; the second held one person's hour apart from another's; this one holds the largest pair of all: **what nature gives, and what a human can answer.**\n\n> *Connection to the unified mission frame.* HeartBank's mission is the restoration of humanity to the middle way at population scale. The meal is where every human meets the natural world's sacrifice three times a day, almost always without seeing it; the practice-gap is where modern householders lose contact with the contemplative traditions that once structured that seeing. One mechanism that closes both — visibility without guilt-accounting, practice without gamification — is mission-native infrastructure, and it is deliberately the family's first public surface: the world's introduction to a gratitude economy should be a practice that asks for nothing and settles nothing.\n\n---\n\n## 2 · The Mechanism: One Loop, Two Movements\n\n### 2.1 · The canonical scene\n\nA father photographs lunch at the kitchen table. The application names the beings on the plate: *rice — one hundred twenty days, its whole season; a hen — forty-two days.* He taps once more and reads that her kind can live eight years. No number turns red; nothing is totaled; nothing is owed. That evening he walks the neighborhood with his daughter — the application suggested a short walk, as it would have after any meal — and before they leave, she pins the park at the corner, coarse, the whole block. Phones go into pockets. They walk, and they dedicate the walk to the hen and the rice, by name. At the park the daughter points the camera at a tree afterward and learns it is a tamarind, and that the sparrows in it are the hen's distant kin; she dedicates a wish to the sparrows too. At home, the rabbit with the jade bowl asks her what she saw, and never asks how long they walked. The father shares the dedication; by morning, an aunt in Kâmpôt has answered it with a single pin on the map — *I rejoiced with this* — and nothing else. No score changed anywhere in this scene, because no score exists.\n\n### 2.2 · The loop\n\nThe full loop, in the order a user lives it:\n\n```\n   THE PLATE (the departed)                    THE PARK (the living)\n\n   1. photograph the meal                      4. go outside; pin a location\n        │                                           │  (coarse by default)\n        ▼                                           ▼\n   2. the WITNESS:                             5. the PRACTICE (phoneless):\n      ingredients resolved to beings;             walking or sitting\n      each being's time-sacrifice                 meditation, dedicated to\n      shown as a BIOGRAPHY —                      the beings witnessed at\n      per-being, factual, no total,               the meal — the DEDICATION\n      no balance                                   (vertical movement)\n        │                                           │\n        ▼                                           ▼\n   3. the INVITATION:                          6. the SHARE (optional):\n      a ceremonial practice                       the dedication broadcast\n      recommendation from the                     as a merit-share; others\n      neutral agent — flat,                       answer with location\n      never scaled to the meal                    PRESENCE-MARKS, never\n                                                  scores (horizontal\n                                                  movement)\n\n   INVARIANT ACROSS THE LOOP: no account connects the left column to\n   the right. The meal is witnessed; the practice is made; neither is\n   denominated in the other. Nothing is discharged because there is\n   no ledger on which a discharge could be entered.\n```\n\nThe two columns are the mechanism's two movements, and §13 names their lineage: the *vertical* dedication (to beings now departed) and the *horizontal* share (to a living community invited to rejoice). Everything else in this paper specifies one of the loop's six stations or the invariant that binds them.\n\nThe contrast with the offset architecture, in one table:\n\n| | Offset architecture | Sacrifice-witness without discharge |\n|---|---|---|\n| The harm/gift | quantified into a fungible unit | witnessed as per-being biography |\n| The account | running balance (debt/credit) | **none — no accumulator exists** |\n| The remedy | priced in the harm's unit | ceremonial, flat, duration-blind |\n| Equivalence | explicit (N units ↔ M remedy) | **structurally impossible** |\n| Completion state | \"discharged / neutral / net-zero\" | \"witnessed and answered\" |\n| Documented failure | moral licensing; leakage;市场 capture | (pre-registered: P-G1, §10) |\n| Historical ancestor | the indulgence | the grace before the meal |\n\n---\n\n## 3 · The Witness Engine\n\n### 3.1 · From photograph to beings\n\nThe user photographs the meal. A food-recognition model — the calorie-application class of vision model, not a wild-organism identifier — resolves the photograph into an ingredient list, and the ingredients are mapped to their source species. The output of this stage is not a nutritional panel but a **cast of beings**: the rice plant, the hen, the carrot, the fish.\n\n### 3.2 · The biography, and the two numbers\n\nFor each being, the witness presents a short biography whose centerpiece is the being's **time-sacrifice**: the span of life that became this food. The load-bearing data decision is that this is the *farmed* time — the life actually lived — not the species' natural potential:\n\n- a broiler hen: **~42 days** (her species: up to ~8 years)\n- a market pig: **~6 months** (his species: 15–20 years)\n- a carrot: **~70 days** — its whole intended span\n- rice: **~120 days** — likewise complete\n\nThe farmed number is the honest primary fact: it is the time that was actually given. The natural span is available one layer deeper, for the eater who wants the fuller biography — and the juxtaposition, where it exists, is presented *bare*. The mechanism's discipline here is **visibility, not verdict**: the numbers are facts; the application attaches no judgment, no red badge, no moral color-coding. (The design constraint this discipline serves — and the doctrinal honesty behind it — is stated in §12.) Wild-caught beings carry their conservation status as an additional bare fact. Where the recognition model is uncertain, the biography says so: a witness that guesses confidently is not a witness.\n\n### 3.3 · What is deliberately absent: the total\n\nThe witness presents beings *severally*. There is no meal total, no daily total, no lifetime total, no \"sacrifice score.\" This is not an interface preference; it is the mechanism's central invariant (§4.2), enforced at the data layer: **the schema contains no accumulator.** The most important engineering decision in this paper is a field that does not exist.\n\n### 3.4 · The two-source data architecture\n\nThe engine draws on two deliberately separate sources, mirroring the loop's two columns:\n\n**The plate — a curated food-species table.** Humanity's diet concentrates on a remarkably small set of species; on the order of one to two hundred cover nearly every meal served on earth. Lifespan and husbandry data for these species is well-established but scattered (animal longevity in the AnAge database; trait aggregation in the Encyclopedia of Life's TraitBank; aquatic species in FishBase; farmed durations in the agronomy literature) and is therefore *curated once* into a maintained table — with per-entry sourcing, regional variance noted, and estimates marked as estimates — rather than fetched live from any single API that does not in fact hold it.\n\n**The park — wild-organism identification.** At the practice site, a separate identification layer — the iNaturalist class of computer vision, built precisely for living organisms photographed in nature — lets the practitioner meet the beings *around* them: the trees, birds, and plants of the place where the dedication is made. The two sources never mix roles: the table knows the departed; the identifier knows the living. §7 develops what the park layer is for.\n\n---\n\n## 4 · The Non-Equation\n\n### 4.1 · The ceremonial acknowledgment unit\n\nHaving witnessed the meal's beings, the user is invited to answer with a gratitude practice in nature — a walking meditation through the neighborhood, a sitting meditation in a park. The invitation carries a recommended form — *a short walk; a sit of modest length* — issued by the system's neutral agent (Miss Aquarius℠, the same agent whose sole-set neutral units anchor the corpus's other coupling mechanisms). The recommendation is **ceremonial**: a flat, standard practice-form, the same after a snack as after a feast, **never computed from the meal's contents, count, or biography.**\n\nThis is the non-equation, and its rationale is doctrinal before it is defensive. Under the corpus's published tense doctrine, what the eater received is *stored* lifespan — the completed past of beings now departed — and the dead cannot be repaid: no quantity of present practice converts into restored past life. A recommendation scaled to the meal would assert precisely the conversion that is impossible, and every downstream pathology of §1's offset trap would follow from that single assertion. The ceremonial unit refuses the conversion at the root: the practice answers the gift; it does not *price* it. In the corpus's inherited language: the hour of presence is *a new gift in the beings' memory* — never the old gift refunded.\n\n### 4.2 · The no-balance invariant\n\nThe non-equation is enforced by an invariant stated here as prior art in its strongest form:\n\n> **The system maintains no account in which consumed sacrifice and performed practice are commensurable.** There is no balance that meals increment and meditations decrement; no \"remaining,\" \"owed,\" \"neutral,\" or \"net\" state; no per-meal or per-period total of either column. What the system keeps is an append-only *witness log* — meals witnessed, practices made, dedications spoken — a record of moments, not a ledger of amounts.\n\nThree interface corollaries, each individually claimed:\n\n1. **No completion arithmetic.** The state after a practice is \"witnessed and answered,\" never \"cleared\" or \"offset.\" Language of settlement is excluded from every surface.\n2. **No duration display.** The practice session is neither timed on-screen, displayed in minutes, nor ranked; the log records *that* a practice was made and *to whom* it was dedicated — the moment, not the meter.\n3. **No streaks.** Continuity mechanics are excluded by design. The meal itself is the recurrence engine (§1); a streak would re-anchor the practice to a score and import the exact breakage dynamics the meal-anchor exists to escape. The only calendar the mechanism observes is a periodic *return to zero* — an emptying, not an accumulation.\n\nThe full **refusal set**, enumerated as design commitments (the mechanism is defined as much by what it will not build as by what it builds): no balance · no discharge rate · no completion arithmetic · no duration display · no streaks · no leaderboards or rankings · no per-user totals · no dietary verdicts or prescriptions · no comment threads on dedications (the presence-mark is the *only* response primitive — removing, by construction, the surface on which food-shaming and moral brigading would otherwise occur) · no advertising on any witness or practice surface · **no indictment copy on any teaching or practice surface — a creature is named by what it *is*, never by what was done to it, and what is absent from a place is not rendered as absence** (added 2026-08-07; the mechanism is §7.6, and the reason it belongs in this set rather than in a style guide is that rendered absence is the route by which an obligation re-enters a design that refuses obligations). Each refusal is individually load-bearing; together they are the non-equation's enforcement.\n\n### 4.3 · Why this is the anti-offset\n\nWith the non-equation and the no-balance invariant in place, the licensing pathway is structurally severed. Moral licensing requires a *credit* — a represented quantity of moral standing that consumption can spend. This mechanism represents no credit: the practice produces no fungible token, no score, no offset certificate, nothing that could be mentally banked against the next indulgence. What it produces is a *memory of having seen* — and the pre-registered wager of this design (P-G1, §10) is that seeing without settling shifts consumption *down or not at all*, where settling reliably shifts it up.\n\nThe economic statement of the same point, in the corpus's terms: the offset architecture is *coupling with convertibility* — the exact configuration this corpus's coupler doctrine identifies as the kill vector in every domain it touches. The anti-offset is coupling *without* convertibility: the meal and the practice are joined by a neutral agent that transmits gratitude between them while refusing, by construction, to transmit price.\n\n---\n\n## 5 · The Dedication Grammar\n\n### 5.1 · The vertical movement: dedication to the departed\n\nBefore the practice, the user pins a location (coarse by default). During the practice, the user dedicates the walk or sit **to the beings witnessed at the meal** — beings that are, without exception, departed. The mechanism's cultural depth here is not incidental and §13 states its lineage precisely; the design fact is that the dedication is the practice's *aim*, transforming a generic mindfulness session into a directed act of gratitude with named recipients.\n\n### 5.2 · The horizontal movement: the share and the presence-marks\n\nAfter the practice, the user may broadcast the dedication — the place (coarse), the beings, optionally the reflection that accompanied it. Others who encounter the broadcast may answer with a **presence-mark**: a location pin that says *I rejoiced with this*, and nothing else. Presence-marks carry no count toward any score, confer no rank, and accumulate no leaderboard; a map of them is a map of where rejoicing happened, legible as geography and illegible as competition. The pin, like the practice, marks a moment.\n\nTwo guards inherited from the corpus's witness-layer doctrine travel with the broadcast: the share is **opt-in and secondary** (the private practice is complete without it), and provenance is human-verified (a broadcast dedication is signed by a verified human; the witness layer of a gratitude economy cannot be synthetic).\n\n### 5.3 · What the horizontal movement is not\n\nThe broadcast layer is explicitly not a feed optimized for watch-time, not a follower-count surface, and not a virality engine; its success metric is *practices inspired*, the only downstream event worth counting. The design anticipates the performativity critique and answers it structurally: with no scores, no streaks, no duration display, and no per-user totals, the surface offers performance almost nothing to perform *for*.\n\n---\n\n## 6 · Phoneless Bracketing\n\nThe deepest contradiction available to a meditation application is to place a screen at the center of the one activity that exists to put the screen down. The mechanism resolves this by **bracketing**: the application acts *before* the practice (the witness, the invitation, the pin) and *after* it (the log, the optional share), and is **structurally absent during it**. The canonical session is: *pin → pocket → practice → return.* No in-practice screen, no guided-audio dependency in the core loop, no live timer, no mid-session interaction of any kind. The application is the frame, never the mediator; the practice happens between a person and a place.\n\nThis is claimed as an architectural commitment, not a usage suggestion: the core loop is designed so that no feature *requires* the device during practice, and session integrity never depends on in-practice device state. (A consequence with independent value: the practice is fully functional where devices fail — the signal-poor park, the airplane-mode retreat, the pocket that stays closed.)\n\n---\n\n## 7 · The Park Layer, the Living Kin, and the Child\n\n### 7.1 · The living kin\n\nThe witness introduced the eater to beings who are gone. The park layer introduces them to the same families, alive: the identification camera, used before or after the phoneless practice — never during — resolves the trees, birds, and plants of the practice site. The design sentence the feature exists to deliver: **the being on your plate has living kin in this park.** The dedication made to the departed is thereby surrounded by the living, and the practitioner's gratitude acquires a second, present-tense address: dedication may be extended to the living beings encountered at the site — met, named, and included.\n\n### 7.2 · Citizen science as giving-forward\n\nIdentifications made at practice sites are, at the user's choice, contributable to public biodiversity databases — the observation networks on which the identification models themselves are trained. The gratitude practice thereby feeds the commons that enables it: **citizen science as the give-forward**, the corpus's circulation atom appearing unforced at the data layer. This is a v2 surface and is claimed as architecture, not promised as launch scope.\n\n### 7.3 · The child's mode\n\nThe practice is teachable to children, and the mechanism's teacher is already constituted: the HeartBank family's mascot — a rabbit holding a bowl, saying grace — whose standing constitutional boundary in this corpus is exact for the role: *he demonstrates and teaches; he never keeps score.* The character who says grace but never meters the sacrifice is the non-equation in a form a five-year-old can love.\n\nThe child's mode is governed by a hard privacy floor, stated as a claim because it is a design commitment and not merely compliance: **family-scoped only — no public pins, no location broadcast, no public sharing of any kind from a child's account.** A child dedicates, learns, and rejoices inside the family circle; the horizontal movement's public surface is an adult surface. Identification features for children follow the established child-safe pattern of the species-identification category (accountless, on-device where feasible).\n\n### 7.4 · The privacy floor generally\n\nMeal photographs are processed on-device where the platform permits, and are never required to leave the device; what leaves is what the user chooses to dedicate and share. Location pins are coarse by default, delayable, and anonymizable. The witness is private by construction; only the dedication is ever public, and only by choice.\n\n### 7.5 · The session light (design layer; no claim added)\n\n*Added 2026-07-23. This subsection describes a design layer above the mechanism specified in §§2–7. It adds no claim to §8 and amends none; every invariant of §4 governs it unchanged.*\n\nThe park layer poses a design problem the witness layer does not. The witness is complete in a moment — a meal is seen, its beings are named, the practitioner sits. The walk is extended, voluntary, and easy to abandon; it is precisely the surface on which a gratitude application is most tempted to reach for the retention mechanics the rest of this paper refuses.\n\nThe resolution keeps the refusal and supplies the pull from the opposite direction. The walk carries a **session state that begins full and descends toward empty as the practitioner gives** — each living kin met and dedicated to, each wish sent, each site identification contributed to the commons draws it down. The state is **never rendered as a number**. It is rendered as **colour**: a light that travels the palette as the session empties, arriving at white when nothing is left held. A practitioner reads their session the way one reads a sky, not the way one reads a balance.\n\nSix commitments hold this consistent with the mechanism rather than making it an exception:\n\n**The firewall (load-bearing).** The session light exists **only on the horizontal movement** — the walk toward the living kin (§5, §7.1). It never appears on the vertical movement, and no session state is ever computed over a meal. Nothing about the consumed beings is emptied, settled, or whitened; §4's non-equation is untouched because the light never touches the meal. What descends is the practitioner's own holding of goodwill toward the living, never a debt to the departed.\n\n**Descent, not accumulation.** The state's motion is downward and its terminus is zero. It is not a score that grows with practice; it is held goodwill that the practice *spends*. A practitioner who gives nothing keeps a full light and has thereby accumulated nothing; a practitioner who gives everything ends at white and carries nothing forward. Whatever goes unspent returns with the next session's beginning rather than banking — §4's return-to-zero calendar in miniature, per session rather than per year.\n\n**Colour is not a metric.** The light carries no numeral, no total, no rank, no comparison, and no continuity mechanic. It is not summed across sessions, not displayed as a history, and not comparable between practitioners: two people at white have each finished their own session and stand in no relation whatever. This is §5's presence-mark discipline applied to the session's own state — a mark that something happened, carrying no measure of how much.\n\n**Two lights, one palette (a naming discipline).** This corpus already specifies a persistent visual signal earned by a person's real giving history across the wider system. The session light is a **different signal drawn in the same palette**: persistent versus ephemeral, history versus session, earned versus spent. The two must remain visually distinct in form, and product copy must never call the session light by the persistent signal's name. Collapsing them would silently convert an unscored session state into a reputation — the exact failure this subsection exists to prevent.\n\n**The vow, and the silence it does not inspect.** A practitioner may close a session by committing to sit. The **commitment**, not the sit, is what the design registers: the light resolves to its terminal state at the moment of the resolve, and the sit itself passes unobserved, unverified, and untimed, exactly as §6 requires. This is deliberate rather than approximate. A resolve is something a person can honestly declare; the quality of a silence is not something an application can know, and a design that tried to know it would have to put the screen back inside the practice. A practitioner who declares the vow and does not sit has gained a colour and nothing else — there is no economic surface to defraud, which is why an honest declaration is sturdy enough to build on.\n\n**The mascot reflects, and only reflects.** Where the character of §7.3 is present on the walk surface, the session's colour may show on him — he carries the light rather than issuing it. The constitutional boundary is unchanged and is what makes this safe: a teacher who reflects a state the practitioner produced is still not keeping score, whereas a teacher who *awards* a colour has become an assessor. The direction of the arrow is the whole of the constraint.\n\n**No walk is required.** A session may consist of the vow alone. Rain, illness, limited mobility, grief, and a biodiversity-poor neighbourhood are each sufficient reason, and none of them caps the light: the terminal state is reachable by resolve from anywhere. The walk's pull is the delight of meeting the living kin, never privileged access to the colour. This is stated as a commitment because the alternative quietly rations the practice by geography, and the practitioners with the fewest parks are seldom the ones with the most of anything else.\n\n### 7.6 · The two-beat call, and where the wonder discipline lives in the product\n\n*Added 2026-08-07. Design layer, as §7.5: it adds no claim to §8 and amends none. It does add one line to the refusal set of §4.2, which is flagged there rather than here.*\n\n§7.3 establishes a teaching character who demonstrates and never keeps score. This subsection specifies the **call format** through which that teaching is delivered on the park layer, because the format turned out to be where a doctrine this paper argues abstractly becomes a concrete slot with a rule in it.\n\nThe call has **two beats and no third**:\n\n```\n   \"<Mascot> says:  ...\"     →  the child ACTS      (crouch, look, listen, offer)\n   \"<Mascot> wonders: ...\"   →  the child LEARNS    (one fact about the creature)\n```\n\n**The *wonders* beat carries a hard content rule, and it is the rule this corpus states as a design signature: name what the creature IS — never what was done to it.** *\"A chicken can recognise more than a hundred individual faces\"* is a wonder. *\"A broiler chicken lives forty-two days\"* is an indictment, and it belongs — where this paper already puts it, in the §3 witness engine, addressed to an adult who chose to look. The distinction is not squeamishness about children. It is the paper's own thesis applied to copy: **wonder settles nothing, whereas indictment demands penance**, and a practice that leaves its practitioner owing something has re-created the offset trap in the register of feeling rather than of arithmetic. A child who learns that chickens know faces has been given a reason for gratitude. A child who learns that chickens are confined has been given a debt, and the whole architecture of §4 exists to refuse debts.\n\nTwo specific prohibitions follow and are worth writing down because both are the default behaviour of the genre. **No grading of creatures** — the field guide's reflexive *pest* and *beneficial*, *invasive* and *native-good*, are verdicts about a being's worth to us and are barred on the same ground as §4.2's dietary verdicts. **No rendering of absence** — an empty park, a species not found, a habitat diminished, are not surfaced as loss; what is present is named, and what is not present is simply not named. A screen that displays what is missing has accused someone, and the practitioner is the only person standing there.\n\n**The discrimination task was deliberately deleted, and this is recorded so that no future reader restores it.** An earlier form of the call was a discrimination game on the pattern of *Simon Says* — act on one prefix, withhold on the other. Removing the response requirement from the second beat removes the game: with nothing to withhold, there is nothing to discriminate. **The cadence survives; the stakes do not**, and that is the intended result rather than an oversight. What replaced the obey/ignore alternation is a different pair entirely — **give attention / receive attention** — which is the same two movements the mechanism runs at §5, rehearsed at a scale a five-year-old can hold.\n\n**And the reveal mints nothing.** A fact learned, a creature met, a wonder delivered — none of these move value anywhere in the wider system. The lesson may generate the story; only witnessed giving moves the currency. This is the corpus's standing wall between play and value, applied here so that a teaching surface cannot quietly become an earning surface.\n\n---\n\n## 8 · The Claims\n\nEnumerated as prior art; each is claimed severally and in combination:\n\n1. **The sacrifice-witness engine:** photographic meal recognition resolved to source species, each presented as a per-being lifespan biography — farmed time-to-harvest as the primary fact, natural species lifespan as a distinct secondary fact, conservation status for wild-caught beings, and explicit uncertainty language under low recognition confidence — with beings presented severally and **no aggregate quantity computed or displayed**.\n2. **The ceremonial acknowledgment unit:** a contemplative-practice recommendation issued by a neutral automated agent as a flat, standard form that is **deliberately blind to the consumed sacrifice's magnitude, count, and duration** — never scaled to the meal.\n3. **The no-balance invariant:** an architecture whose data schema contains no accumulator commensurating consumption and practice — no balance, no net state, no settlement language, no duration display, no streak or continuity mechanic — maintaining instead an append-only witness log of moments, with a periodic return-to-zero calendar as the only temporal structure.\n4. **The two-movement dedication grammar:** a location-pinned contemplative session dedicated to the specific beings witnessed at a meal (the vertical movement, to the departed), optionally broadcast as a merit-share to which others respond with **presence-marks** — location pins carrying no score, rank, or count (the horizontal movement, to the living).\n5. **Phoneless bracketing:** a session architecture in which the mediating application operates only before and after the practice, with no in-practice screen dependency, no live timer, and no mid-session interaction required for session integrity.\n6. **The two-source data architecture:** a curated, sourced food-species table (farmed durations + natural lifespans + biographies) serving the consumption-witness function, held separate from a wild-organism identification layer serving the practice-site function, with the living-kin linkage between them (\"the being on your plate has living kin in this park\") and optional contribution of site identifications to public biodiversity databases.\n7. **The child-safe dedication mode:** a family-scoped child mode with no public pins, no location broadcast, and no public sharing, taught by a mascot character constitutionally barred from scorekeeping.\n8. **The anti-offset composition:** the combination of claims 1–5 as a consumption-conscience system that makes harm/gift fully visible while structurally excluding the formation of any discharge rate — the coupling-without-convertibility architecture applied to the consumption–practice pair.\n\n---\n\n## 9 · Prior Art, Generously\n\n**The offset architecture (the anti-example).** Carbon-offset consumer products and markets; their moral-licensing literature (Mazar & Zhong 2010; Merritt, Effron & Monin 2010) and integrity critiques; and the historical indulgence as the architecture's oldest instance. This paper's mechanism is defined *against* this class, and the class is therefore its most important prior art.\n\n**Food-recognition applications.** The calorie-scanning class (MyFitnessPal and successors; the photograph-to-nutrition wave) established the interaction primitive this mechanism inherits — photograph the plate, receive an analysis — and equally established the pathology this mechanism must not inherit: quantified tracking's slide into obsession and moralized eating (§12).\n\n**Species identification.** iNaturalist and its computer-vision identification; Seek's accountless, child-safe on-device pattern; Pl@ntNet; Merlin. The park layer is an application of this class, not an extension of it; the contribution here is the linkage to the witness (the living-kin sentence) and to the dedication.\n\n**Meditation applications.** Insight Timer, Calm, Headspace, and the category's retention machinery (streaks, badges, series). The mechanism adopts the category's goal and rejects its engine; the meal-anchor plus no-streak architecture is the point of departure, and P-G3 wagers on it.\n\n**Contemplative eating.** Plum Village's contemplative-eating practice and the Five Contemplations recited before meals (\"this food is the gift of the whole universe — the earth, the sky, numerous living beings…\"); the Theravāda meal-reflection (*paṭisaṅkhā yoniso…*) by which monastics have reflected on food's purpose before eating for twenty-five centuries; the Japanese *itadakimasu* (\"I humbly receive\"), a whole culture's one-word acknowledgment of received lives; and the grace traditions of the Abrahamic world. The mechanism claims no novelty whatsoever in the *idea* of pre-meal gratitude — the idea is among humanity's most widespread practices, which is precisely the launch thesis; the claims are confined to the witness/non-equation/dedication *architecture*.\n\n**Location-based social mechanics.** Pokémon GO and the location-game wave (the engagement precedent and the over-gamification warning); check-in systems; the corpus's own published no-streak and pull-only discipline in the need-compiled-questlines publication.\n\n**This corpus.** The incommensurability-preserving coupler (the parent doctrine; this mechanism is its third instance); the gift-tag-time-reveal publication (the reveal choreography family); the spent-time floor and the two-blindnesses (the doctrine that time-facts deserve honoring independent of motive — extended here to beings for whom the question of motive does not arise); and the duration-blind, moment-not-meter guard set, all previously published and CC0.\n\n---\n\n## 10 · Pre-Registered Predictions\n\nStated 2026-07-21, before any implementation exists:\n\n- **P-G1 (the anti-licensing wager — the design's falsifiable core).** Users of the witness-without-discharge design will show consumption unchanged or *reduced* relative to their own baseline (meat frequency and portion patterns, self-reported and, where consented, photographically evident), in contrast to the licensing direction documented for discharge-based designs. **Falsified if** witnessed-and-answered meals show the offset signature: consumption rising as practice accumulates. The authors commit to publishing the result in either direction.\n- **P-G2 (visibility does conscience's work).** Among active users, unprompted dietary drift (toward reduced or more deliberate consumption of witnessed categories) will emerge within ninety days *without any prompt, verdict, or recommendation surface existing in the application* — the mechanism contains none. Falsified if visibility without verdict produces no measurable drift.\n- **P-G3 (the meal beats the streak).** Meal-anchored practice recurrence will meet or exceed category-typical meditation-app retention *without any continuity mechanic*, and — the sharper half — will show no discontinuity-collapse pattern (the streak-break cliff) in lapse-and-return curves. Falsified if removal of streaks produces the category's known retention penalty with no offsetting anchor effect.\n\n---\n\n## 11 · The Adversarial Surface\n\nA defensive publication should attack its own mechanism. The attacks, and what answers them:\n\n**Farming.** The dominant abuse class of reward-bearing systems has no purchase here, for the strongest possible reason: **nothing mints.** The practice produces no token, credit, score, or rank; presence-marks are scoreless; the witness log confers nothing. A farmer who automates fake meals and fake dedications harvests an empty field. This is not a mitigation but a structural absence — the abuse economy requires a reward channel, and the mechanism contains none. (The corpus's published questline mechanism makes the same move for the same reason; the two publications jointly claim the *mints-nothing* family.)\n\n**Broadcast spam and performative flooding.** The horizontal movement is opt-in, secondary, human-verified at the provenance layer, and rationed rather than feed-optimized; with no follower counts, no virality mechanics, and no metric a flood could inflate, spam buys nothing and costs reputation among exactly the audience it hoped to reach.\n\n**Location abuse.** Pins are coarse by default, delayable, and anonymizable; the practice site need never be the home; the child mode's no-public-pin floor is absolute (§7.3). Residual risk parallels every location-optional social system and is treated with the same seriousness: safety review before launch, conservative defaults always.\n\n**False witness.** Malicious or erroneous meal claims (fabricated ingredients, staged dedications) corrupt only the fabricator's own private log — there being no reward, there is no fraud economy — and the public surface carries only what a verified human chose to dedicate. The graver integrity risk is the system's own recognition error, treated in §12 as a limit rather than an attack.\n\n**Moral brigading.** The historical failure mode of visible-virtue systems is the mob that polices others' virtue. The refusal set removes its instruments: no comments on dedications, no visible consumption data of *any other user* (the witness is private by construction — one can never see what another ate, only what they dedicated), no verdicts to enforce. One cannot shame what one cannot see.\n\n**Data poisoning of the commons.** Citizen-science contributions inherit the host platforms' identification-QA and community-verification machinery; the mechanism adds no bypass and defers entirely to those commons' governance.\n\n## 12 · Honest Limits\n\n**Unbuilt, n = 0.** The mechanism is design-complete and unimplemented. Every claim is architectural; every prediction is registered in advance of data; the family's own pilot history (small-n, confounded, honestly reported in prior publications) is the standard this project holds itself to, and this paper inherits it.\n\n**The elegance caution.** The design sits at the intersection of an unusual number of converging doctrines from this corpus, and convergence density is seductive: a system this internally coherent is either deeply right or deeply self-confirming, and the two are indistinguishable from inside. The coherence earned this specification; only P-G1–P-G3 can earn the product.\n\n**The food-guilt risk is real and is the design's gravest responsibility.** The quantified-tracking category this mechanism visually resembles has a documented pathology reaching into disordered eating. A *moral* meal-witness could inherit and amplify it in vulnerable users — guilt is a heavier payload than calories. The no-balance invariant, the absence of verdicts, and the ceremonial (never proportional) response are the structural mitigations, but structure is not sufficiency: the design requires a compassion-first UX review with eating-disorder-informed expertise before launch, an unambiguous exit from witness features for users who need one, and the explicit statement — made here — that this application is a gratitude practice, not a dietary intervention, and makes no health claims of any kind.\n\n**Visibility is not neutrality, and the design does not pretend otherwise.** Presenting a hen's forty-two days beside her species' eight years is a bare fact with a moral gravity no disclaimer removes. The design's commitment is narrower than neutrality: *no verdict surface* — no judgment rendered, no diet prescribed, no consumption scored. On the doctrinal question itself the mechanism takes no position, and its tradition of origin gives it reason not to: Theravāda does not canonically prohibit meat-eating (the threefold-purity rule governs; the historical Buddha declined to mandate vegetarianism), and the founder's personal practice is exactly that — personal. The application shows; conscience decides.\n\n**Recognition error contaminates the witness.** A confident misidentification is a false biography — a dedication misaddressed. Uncertainty language mitigates; it does not eliminate. The curated table's farmed durations are themselves estimates with real regional variance, and are presented as estimates. A witness must not be more precise than its knowledge.\n\n**The instrumentation question is not dissolved.** Whether app-mediated gratitude practice deepens practice or flattens it is an open empirical and contemplative question. Phoneless bracketing is the strongest structural answer available — the device is absent from the practice itself — but bracketing is a mitigation, not a proof, and the tradition's own answer (that the practice eventually needs no instrument at all) is the horizon this product should be judged against: the best outcome for a user is to one day not need it.\n\n**The horizontal movement can drift performative.** No-score architecture removes performance's usual rewards, not its possibility. The metric discipline (practices-inspired, never watch-time) and the opt-in secondary status of sharing are the containments; the drift is named as a permanent adversary rather than a solved problem.\n\n**The session light is the design's most gamifiable surface, and naming it that is the mitigation's first half.** A colour that descends as one gives is one product decision away from a colour that ascends as one returns — and every constraint in §7.5 (no numeral, no total, no history, no comparison, no streak, no walk-gate) exists because the un-constrained version of that surface is the retention mechanic this whole paper refuses. The constraints are architectural, but they are also the most likely thing to be traded away under growth pressure. They are recorded here so that any future relaxation is legible as a departure rather than an evolution.\n\n**The data commons dependency.** The park layer depends on public biodiversity infrastructure and its terms of use; the citizen-science give-forward depends on those commons remaining open. These are external dependencies honestly outside this design's control.\n\n---\n\n## 13 · Lineage and Close\n\n*(This section carries the mechanism's cultural provenance; per this corpus's genre discipline it is labeled as lineage — grounding and translation, never mechanism. The mechanism of §§2–8 stands complete without it.)*\n\nThe dedication at this mechanism's center is not an invention. Merit dedicated to departed beings is among the oldest practices in the Theravāda world — the Tirokuḍḍa Sutta's instruction, kept alive in Cambodia as **Pchum Ben**, the fifteen-day festival in which the living dedicate merit to the departed through offerings of food. This mechanism is that grammar, inverted and made daily: the beings fed *us*; we dedicate merit to *them*. For the Khmer families this project serves first, the practice inside this application is not new technology asking for new behavior; it is the oldest behavior, given a new bowl.\n\nThe witness, likewise, has ancestors on every continent: the monastic's reflection before alms-food, the Five Contemplations of the Zen table, the Japanese *itadakimasu*, the grace said in a hundred million homes tonight. Every tradition that survived long enough to feed its children built a pause before the meal, and inside the pause, the same recognition this mechanism renders in data: *lives became this food.* The application's entire ambition is to hold that pause open for people whose traditions have thinned — and to refuse, structurally, the one modern temptation every ancestor of this practice would have recognized as corruption: the conversion of grace into account. The grace that settles nothing settles, in the end, the only thing that matters — the eater, into gratitude, before the first bite is taken and after the last.\n\n---\n\n## Cross-Venue References\n\n| Venue | Identifier |\n|---|---|\n| Primary canonical | <https://thonly.org/research/sacrifice-witness-without-discharge> |\n| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/sacrifice-witness-without-discharge.md> |\n| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/sacrifice-witness-without-discharge> |\n\n---\n\n## Acknowledgments\n\nThe authors acknowledge the contemplative-eating lineages whose practice this mechanism translates — the Theravāda meal-reflection tradition, Plum Village's Five Contemplations, and the grace traditions East and West; the retreat community whose vegetarian table occasioned the founding insight; the iNaturalist community and the open biodiversity commons; the AnAge, Encyclopedia of Life, and FishBase projects; and the moral-licensing research literature whose findings this design takes as its constraint. Co-drafted in collaboration with Miss Aquarius℠; substantive authorship and final editorial control remain with the named author.\n\n---\n\n## Citations\n\n1. *Tirokuḍḍa Sutta* (Khuddakapāṭha 7 / Petavatthu 1.5) — merit dedicated to the departed. Pāli Text Society translations, multiple editions.\n2. *Majjhima Nikāya* 2 / *Visuddhimagga* I (the *paṭisaṅkhā yoniso* meal-reflection; requisite-reflection tradition). Pāli Text Society / Buddhist Publication Society.\n3. *Jīvaka Sutta* (*Majjhima Nikāya* 55; the threefold-purity rule on meat). Pāli Text Society translation.\n4. Nhat Hanh, T. — the Five Contemplations and the Plum Village contemplative-eating practice. Plum Village Community of Engaged Buddhism, multiple publications.\n5. Mazar, N., & Zhong, C.-B. (2010). \"Do Green Products Make Us Better People?\" *Psychological Science* 21(4), 494–498.\n6. Merritt, A. C., Effron, D. A., & Monin, B. (2010). \"Moral Self-Licensing: When Being Good Frees Us to Be Bad.\" *Social and Personality Psychology Compass* 4(5), 344–357.\n7. Tacutu, R., et al. — *AnAge: The Animal Ageing and Longevity Database* (Human Ageing Genomic Resources).\n8. Encyclopedia of Life, *TraitBank*; Froese, R. & Pauly, D. (eds.), *FishBase*.\n9. iNaturalist (California Academy of Sciences & National Geographic Society), including the *Seek* application's child-safe identification pattern.\n10. Ly, T. (2026). \"The Incommensurability-Preserving Coupler.\" thonly.org defensive publication. *(Parent doctrine; this mechanism is its third instance.)*\n11. Ly, T. (2026). \"The Quest That Mints Nothing: Need-Compiled Questlines.\" thonly.org defensive publication. *(No-streak, pull-only, presence-not-score discipline.)*\n12. Ly, T. (2026). \"HeartBank®: The Heart That Keeps Nothing.\" heartbank.net white paper. *(The spent-time floor; the two blindnesses; duration-blind guards.)*\n\n---\n\n*— End of paper —*\n\n*Marks referenced: HeartBank®, B-Grace℠, B-Grace™, Miss Aquarius℠, THonly™, Tonsay™. Document SHA-256 computed at push and recorded in the institutional log. Document License: CC0 1.0 Universal. The authors and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of its date.*",
+      "text": "## Abstract\n\nWe specify a mindful-eating and gratitude-meditation application in which a food-image recognition model resolves a meal photograph into its source species, each species is presented individually with its typical farmed age at harvest and its natural lifespan, and a walking or sitting meditation is recommended in a fixed form that is never scaled to what was eaten — over a data schema that holds no balance, score, streak or total between consumption and practice, so that the practice cannot function as an offset. The design is set against the offset architecture that systems connecting consumption to conscience commonly use: **quantify the harm, price the remedy, sell the discharge.** Carbon offsets convert emissions into purchasable absolution, and the failure the moral-licensing literature predicts for them is that the discharge licenses more of the consumption it was meant to answer. The same architecture has been tried before, at civilizational scale, under an older name: the indulgence. The failure is not in the accounting's accuracy. It is in the *existence* of the account — the moment a remedy is denominated in the same ledger as the harm, a conversion rate forms, and conscience becomes a market.\n\nThis paper specifies the inverse mechanism, designed for the most frequent consumption event in nearly every life: the meal. A photograph of food is resolved into its ingredient beings — the plants and animals whose lifespans became the eater's nourishment — and each being's **time-sacrifice** is presented as a factual *biography* (a broiler hen: about forty-two days; her species: around eight years), individually, without aggregation into any balance. The eater is invited to answer the witnessed sacrifice with a **gratitude practice in nature** — a walking or sitting meditation, dedicated to the beings consumed — whose recommended form is a **ceremonial unit** set by a neutral automated agent and *never scaled to the meal*. Nothing is discharged, because the mechanism maintains **no account to discharge**: the sacrifice is witnessed, the acknowledgment is made, and the two are never entered into a common ledger. We name this architecture **sacrifice-witness without discharge**, and we argue that holding no account at all is what keeps a consumption-conscience system from becoming an indulgence market: the anti-offset. It removes the represented credit a system can issue; whether the practitioner's own memory of having practised licenses on its own is left to a pre-registered test.\n\nThe paper specifies the full mechanism — the witness engine and its two-source data architecture (a curated food-species table for the eaten; wild-organism identification for the living encountered at the practice site); the non-equation and its no-balance invariant; the two-movement dedication grammar (to the departed beings consumed, and outward to a community that marks its rejoicing with location pins rather than scores); the phoneless bracketing that keeps the application structurally absent during the practice it frames; and the child-safe mode. Eight claims are enumerated as prior art and dedicated to the public domain; three predictions are pre-registered, including the falsifiable wager that distinguishes this design from offset systems: **witnessed sacrifice without discharge will not license increased consumption.** The authors will not seek patent.\n\n**Keywords:** food image recognition, species identification, mindful eating, gratitude meditation, walking meditation, moral licensing, carbon offset, indulgence, no-streak design, no-balance data schema, device-free session, location-based sharing, child privacy, citizen science, merit dedication, meal-anchored habit, contemplative technology, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. This is a **defensive publication**. The authors and HeartBank® will not seek patent on any mechanism, architecture, taxonomy, interface pattern, or specification articulated herein, in any jurisdiction, at any time, and will not assert any patent right against anyone practising it. Trademarks are reserved separately, and the patterns may be implemented under any name.\n\nThe following terms are coined in this paper and simultaneously freed with it: **sacrifice-witness**, **witness-without-discharge**, **the non-equation**, **ceremonial acknowledgment unit**, **phoneless bracketing**, **presence-marks**, **the anti-offset**. They may be used by anyone, for any purpose, without attribution.\n\nComponents of this mechanism exist in distributed prior art — photographic food recognition (the calorie-scanning application class), species identification from images (iNaturalist and its relatives), location-based social mechanics, meditation-session applications, and the contemplative meal-reflection traditions surveyed in §9 and §13. What this paper discloses as its own contribution is only the synthesis as specified — lifespan-biography witness with an explicit no-balance invariant, a duration-blind ceremonial response, a two-movement merit-dedication grammar with presence-marks, and structural absence of the mediating device during the practice. No prior-art census has been run for this composition; it is disclosed, not asserted to be absent from the literature.\n\n---\n\n## 1 · The Problem: The Householder's Gap and the Offset Trap\n\nTwo failures motivate this mechanism, one contemplative and one economic.\n\n**The householder's gap.** The retreat works because it removes the choice: meals are served, sits are scheduled, and the practitioner's responsibilities wait outside the gate. The householder's life restores the choice and the practice loses its anchor — not for lack of sincerity but for lack of a *daily trigger* that survives contact with obligation. Meditation applications attack this problem with streaks, reminders, and gamified continuity, importing the attention economy's retention machinery into the one domain that exists to dissolve it. The weakness of that design is structural: the streak works until it breaks, and when it breaks it can take the practice with it, because the practice was anchored to the *score* rather than to anything in the practitioner's actual day. (P-G3, §10, pre-registers the comparison; this paper cites no retention dataset.)\n\nThere is, however, a trigger that requires no streak, no reminder, and no gamification, because it is older than fire and arrives two to three times daily without fail: **the meal.** Nearly every contemplative tradition discovered this anchor centuries ago — the meal-reflection is among the most widespread of all lay practices (§13) — and modern habit-formation practice recommends the same move, attaching a new behavior to an invariant daily event. The mechanism specified here is, at bottom, the oldest anchor connected to the oldest gratitude.\n\n**The offset trap.** The economic failure is subtler and more dangerous. Systems that connect consumption to conscience commonly adopt the *offset architecture*: measure the harm in some unit, price a remedy in the same unit, and let the consumer purchase equivalence. Carbon offsets are the contemporary flagship, and the literature on *moral licensing* describes the failure the architecture invites: establishing moral credit in one column licenses moral relaxation in another. In one well-known study, participants who purchased green products went on to cheat and steal more than participants who purchased conventional ones, while mere exposure to green products had the opposite effect (Mazar & Zhong 2010) — though three later replications (total N = 1,274) found no such licensing effect (Urban, Bahník & Braun Kohlová 2019). A review describes self-licensing across political, prosocial and consumer domains (Merritt, Effron & Monin 2010), and a meta-analysis of 91 studies estimates the average effect as real but modest, Cohen's *d* ≈ 0.31, and larger in published than in unpublished studies (Blanken, van de Ven & Zeelenberg 2015). Where the effect operates, the offset does worse than leak; it *inverts* — the discharge mechanism becomes a consumption license. The historical anti-example is exact enough that we state it plainly: an architecture that quantifies transgression and sells its remission is an **indulgence market**, and the Reformation is the case study in how such markets end.\n\nThe trap generalizes to any contemplative-consumption design. A meal application that computes the \"sacrifice cost\" of eating and lets meditation \"burn it off\" — the naive gym metaphor — has built an indulgence market for the dinner table: *meditate it off, eat what you want.* Its own stated purpose (mindful, bounded eating) would be structurally defeated by its own mechanism. The design problem, precisely stated: **how does a system make the sacrifice embodied in consumption fully visible, and invite a genuine response to it, without ever forming the exchange rate that converts response into license?**\n\nThe answer specified below inherits its spine from doctrine this corpus has already published: the two currencies of the reciprocity economy are *coupled but never convertible*, and the coupling can only be held open by a neutral agent whose recommendations are blind to quantity (the incommensurability-preserving coupler). This paper is that coupler's third instance. The first held money and time apart while letting gratitude flow between them; the second held one person's hour apart from another's; this one holds the largest pair of all: **what nature gives, and what a human can answer.**\n\n> *Connection to the unified mission frame.* Miss Aquarius's mission is to keep the middle way open at population scale against comfort-saturation — the new extreme that material abundance makes possible. The meal is where every human meets the natural world's sacrifice three times a day, almost always without seeing it; the practice-gap is where modern householders lose contact with the contemplative traditions that once structured that seeing. One mechanism that closes both — visibility without guilt-accounting, practice without gamification — is mission-native infrastructure, and it is deliberately the family's first public surface: the world's introduction to a gratitude economy should be a practice that asks for nothing and settles nothing.\n\n---\n\n## 2 · The Mechanism: One Loop, Two Movements\n\n### 2.1 · The canonical scene\n\nA father photographs lunch at the kitchen table. The application names the beings on the plate: *rice — one hundred twenty days, its whole season; a hen — forty-two days.* He taps once more and reads that her kind can live eight years. No number turns red; nothing is totaled; nothing is owed. That evening he walks the neighborhood with his daughter — the application suggested a short walk, as it would have after any meal — and before they leave, she taps the pin on her father's phone: the park at the corner, coarse, the whole block. Phones go into pockets. They walk, and they dedicate the walk to the hen and the rice, by name. At the park the daughter points the camera at a tree afterward and learns it is a tamarind, and that the sparrows in it are the hen's distant kin; she dedicates a wish to the sparrows too. At home, the rabbit with the jade bowl asks her what she saw, and never asks how long they walked. The father shares the dedication; by morning, an aunt in Kâmpôt has answered it with a single pin on the map — *I rejoiced with this* — and nothing else. No score changed anywhere in this scene, because no score exists.\n\n### 2.2 · The loop\n\nThe full loop, in the order a user lives it:\n\n```\n   THE PLATE (the departed)                    THE PARK (the living)\n\n   1. photograph the meal                      4. go outside; pin a location\n        │                                           │  (coarse by default)\n        ▼                                           ▼\n   2. the WITNESS:                             5. the PRACTICE (phoneless):\n      ingredients resolved to beings;             walking or sitting\n      each being's time-sacrifice                 meditation, dedicated to\n      shown as a BIOGRAPHY —                      the beings witnessed at\n      per-being, factual, no total,               the meal — the DEDICATION\n      no balance                                   (vertical movement)\n        │                                           │\n        ▼                                           ▼\n   3. the INVITATION:                          6. the SHARE (optional):\n      a ceremonial practice                       the dedication broadcast\n      recommendation from the                     as a merit-share; others\n      neutral agent — flat,                       answer with location\n      never scaled to the meal                    PRESENCE-MARKS, never\n                                                  scores (horizontal\n                                                  movement)\n\n   INVARIANT ACROSS THE LOOP: no account connects the left column to\n   the right. The meal is witnessed; the practice is made; neither is\n   denominated in the other. Nothing is discharged because there is\n   no ledger on which a discharge could be entered.\n```\n\nThe two columns are the mechanism's two movements, and §13 names their lineage: the *vertical* dedication (to beings now departed) and the *horizontal* share (to a living community invited to rejoice). Everything else in this paper specifies one of the loop's six stations or the invariant that binds them.\n\nThe contrast with the offset architecture, in one table:\n\n| | Offset architecture | Sacrifice-witness without discharge |\n|---|---|---|\n| The harm/gift | quantified into a fungible unit | witnessed as per-being biography |\n| The account | running balance (debt/credit) | **none — no accumulator exists** |\n| The remedy | priced in the harm's unit | ceremonial, flat, duration-blind |\n| Equivalence | explicit (N units ↔ M remedy) | **structurally impossible** |\n| Completion state | \"discharged / neutral / net-zero\" | \"witnessed and answered\" |\n| Characteristic failure | moral licensing; leakage; market capture | (pre-registered: P-G1, §10) |\n| Historical ancestor | the indulgence | the grace before the meal |\n\n> **Current form.** The product this mechanism serves is now specified as three acts, each of which shows gratitude by spending attention on learning rather than by producing a feeling: **EAT** (learn about the food), **WALK** (learn about the wildlife nearby) and **SIT** (give a moment of silence, dedicated). The meal photograph is **optional and never the entry point**: the practice is completable with no image at all, and a capture is for identification, not for record — capture, identify, discard, with the image kept only if the user chooses. The six-station loop above is retained as the disclosed form of the same mechanism.\n\n---\n\n## 3 · The Witness Engine\n\n### 3.1 · From photograph to beings\n\nThe user photographs the meal. A food-recognition model — the calorie-application class of vision model, not a wild-organism identifier — resolves the photograph into an ingredient list, and the ingredients are mapped to their source species. The output of this stage is not a nutritional panel but a **cast of beings**: the rice plant, the hen, the carrot, the fish.\n\n### 3.2 · The biography, and the two numbers\n\nFor each being, the witness presents a short biography whose centerpiece is the being's **time-sacrifice**: the span of life that became this food. The load-bearing data decision is that this is the *farmed* time — the life actually lived — not the species' natural potential:\n\n- a broiler hen: **~42 days** (her species: typically ~8 years)\n- a market pig: **~6 months** (his species: typically 15–20 years)\n- a carrot: **~70 days** — its whole intended span\n- rice: **~120 days** — likewise complete\n\nThe farmed number is the honest primary fact: it is the time that was actually given. The natural span is available one layer deeper, for the eater who wants the fuller biography — and the juxtaposition, where it exists, is presented *bare*. The mechanism's discipline here is **visibility, not verdict**: the numbers are facts; the application attaches no judgment, no red badge, no moral color-coding. (The design constraint this discipline serves — and the doctrinal honesty behind it — is stated in §12.) Wild-caught beings carry their conservation status as an additional bare fact. Where the recognition model is uncertain, the biography says so: a witness that guesses confidently is not a witness. The natural span shown is a *typical* span, not a record maximum; longevity databases list far longer maxima for some domestic species (AnAge records thirty years for a captive chicken and notes the figure as unproven), and the table states which figure it presents.\n\n> **Current form.** A photograph can identify *what* a food is; it cannot know *where it came from*. Every biography is therefore **species-level**: \"forty-two days\" describes the kind of life that fed the eater, never the individual on the plate, and no surface may imply that the application knows the provenance or history of the specific item.\n\n### 3.3 · What is deliberately absent: the total\n\nThe witness presents beings *severally*. There is no meal total, no daily total, no lifetime total, no \"sacrifice score.\" This is not an interface preference; it is the mechanism's central invariant (§4.2), enforced at the data layer: **the schema contains no accumulator.** The most important engineering decision in this paper is a field that does not exist.\n\n### 3.4 · The two-source data architecture\n\nThe engine draws on two deliberately separate sources, mirroring the loop's two columns:\n\n**The plate — a curated food-species table.** Humanity's diet concentrates on a remarkably small set of species; on the order of one to two hundred cover nearly every meal served on earth. Lifespan and husbandry data for these species is well-established but scattered (animal longevity in the AnAge database; trait aggregation in the Encyclopedia of Life's TraitBank; aquatic species in FishBase; farmed durations in the agronomy literature) and is therefore *curated once* into a maintained table — with per-entry sourcing, regional variance noted, and estimates marked as estimates — rather than fetched live from any single API that does not in fact hold it.\n\n**The park — wild-organism identification.** At the practice site, a separate identification layer — the iNaturalist class of computer vision, built precisely for living organisms photographed in nature — lets the practitioner meet the beings *around* them: the trees, birds, and plants of the place where the dedication is made. The two sources never mix roles: the table knows the departed; the identifier knows the living. §7 develops what the park layer is for.\n\n---\n\n## 4 · The Non-Equation\n\n### 4.1 · The ceremonial acknowledgment unit\n\nHaving witnessed the meal's beings, the user is invited to answer with a gratitude practice in nature — a walking meditation through the neighborhood, a sitting meditation in a park. The invitation carries a recommended form — *a short walk; a sit of modest length* — issued by the system's neutral agent (Miss Aquarius℠, the same agent whose sole-set neutral units anchor the corpus's other coupling mechanisms). The recommendation is **ceremonial**: a flat, standard practice-form, the same after a snack as after a feast, **never computed from the meal's contents, count, or biography.**\n\nThis is the non-equation, and its rationale is doctrinal before it is defensive. Under the corpus's published tense doctrine, what the eater received is *stored* lifespan — the completed past of beings now departed — and the dead cannot be repaid: no quantity of present practice converts into restored past life. A recommendation scaled to the meal would assert precisely the conversion that is impossible, and every downstream pathology of §1's offset trap would follow from that single assertion. The ceremonial unit refuses the conversion at the root: the practice answers the gift; it does not *price* it. In the corpus's inherited language: the hour of presence is *a new gift in the beings' memory* — never the old gift refunded.\n\n### 4.2 · The no-balance invariant\n\nThe non-equation is enforced by an invariant stated here as prior art in its strongest form:\n\n> **The system maintains no account in which consumed sacrifice and performed practice are commensurable.** There is no balance that meals increment and meditations decrement; no \"remaining,\" \"owed,\" \"neutral,\" or \"net\" state; no per-meal or per-period total of either column. What the system keeps is an append-only *witness log* — meals witnessed, practices made, dedications spoken — a record of moments, not a ledger of amounts.\n\n> **Current form.** Any archive the user keeps **holds everything and counts nothing**: it holds what was *learned* (the species, its biography, the dedication) rather than a record of what was eaten; it is never sequenced by day or by meal (entries sort by dedication, place or season); and absence is never rendered — no missed meal, no visible gap, since an archive with holes is a streak told backwards. The log wording above is retained as disclosed.\n\nThree interface corollaries, each individually claimed:\n\n1. **No completion arithmetic.** The state after a practice is \"witnessed and answered,\" never \"cleared\" or \"offset.\" Language of settlement is excluded from every surface.\n2. **No duration display.** The practice session is neither timed on-screen, displayed in minutes, nor ranked; the log records *that* a practice was made and *to whom* it was dedicated — the moment, not the meter.\n3. **No streaks.** Continuity mechanics are excluded by design. The meal itself is the recurrence engine (§1); a streak would re-anchor the practice to a score and import the exact breakage dynamics the meal-anchor exists to escape. The only calendar the mechanism observes is a periodic *return to zero* — an emptying, not an accumulation.\n\nThe full **refusal set**, enumerated as design commitments (the mechanism is defined as much by what it will not build as by what it builds): no balance · no discharge rate · no completion arithmetic · no duration display · no streaks · no leaderboards or rankings · no per-user totals · no dietary verdicts or prescriptions · no comment threads on dedications (the presence-mark is the *only* response primitive — removing, by construction, the surface on which food-shaming and moral brigading would otherwise occur) · no advertising on any witness or practice surface · **no indictment copy on any teaching or practice surface — a creature is named by what it *is*, never by what was done to it, and what is absent from a place is not rendered as absence** (added 2026-08-07; the mechanism is §7.6, and the reason it belongs in this set rather than in a style guide is that rendered absence is the route by which an obligation re-enters a design that refuses obligations). Each refusal is individually load-bearing; together they are the non-equation's enforcement.\n\n### 4.3 · Why this is the anti-offset\n\nWith the non-equation and the no-balance invariant in place, the *represented* licensing pathway is severed. An offset licenses through a credit the system issues — a quantity of moral standing, made visible, that consumption can spend. This mechanism issues no credit: the practice produces no fungible token, no score, no offset certificate, nothing the system hands the practitioner to bank against the next indulgence.\n\nWhat it cannot sever is the *unrepresented* pathway, and the paper's own sources say so. The licensing literature reports lapses licensed by a merely imagined good deed, with no token of any kind — participants who imagined volunteering went on to choose the more indulgent purchase (Khan & Dhar 2006; reviewed in Merritt, Effron & Monin 2010) — so a practitioner's memory of having practised could, in principle, license on its own. The design removes the part of licensing a system can remove, the issued and visible credit; whether the part it cannot remove operates here is exactly what the pre-registered wager tests (P-G1, §10): that seeing without settling shifts consumption *down or not at all*, where a settling design is predicted to shift it up.\n\nThe economic statement of the same point, in the corpus's terms: the offset architecture is *coupling with convertibility* — the exact configuration this corpus's coupler doctrine identifies as the kill vector in every domain it touches. The anti-offset is coupling *without* convertibility: the meal and the practice are joined by a neutral agent that transmits gratitude between them while refusing, by construction, to transmit price.\n\n---\n\n## 5 · The Dedication Grammar\n\n### 5.1 · The vertical movement: dedication to the departed\n\nBefore the practice, the user pins a location (coarse by default). During the practice, the user dedicates the walk or sit **to the beings witnessed at the meal** — beings that are, without exception, departed. The mechanism's cultural depth here is not incidental and §13 states its lineage precisely; the design fact is that the dedication is the practice's *aim*, transforming a generic mindfulness session into a directed act of gratitude with named recipients.\n\n### 5.2 · The horizontal movement: the share and the presence-marks\n\nAfter the practice, the user may broadcast the dedication — the place (coarse), the beings, optionally the reflection that accompanied it. Others who encounter the broadcast may answer with a **presence-mark**: a location pin that says *I rejoiced with this*, and nothing else. Presence-marks carry no count toward any score, confer no rank, and accumulate no leaderboard; a map of them is a map of where rejoicing happened, legible as geography and illegible as competition. The pin, like the practice, marks a moment.\n\nTwo guards inherited from the corpus's witness-layer doctrine travel with the broadcast: the share is **opt-in and secondary** (the private practice is complete without it), and provenance is human-verified (a broadcast dedication is signed by a verified human; the witness layer of a gratitude economy cannot be synthetic).\n\n### 5.3 · What the horizontal movement is not\n\nThe broadcast layer is explicitly not a feed optimized for watch-time, not a follower-count surface, and not a virality engine; its success metric is *practices inspired*, the only downstream event worth counting. The design anticipates the performativity critique and answers it structurally: with no scores, no streaks, no duration display, and no per-user totals, the surface offers performance almost nothing to perform *for*.\n\n---\n\n## 6 · Phoneless Bracketing\n\nThe deepest contradiction available to a meditation application is to place a screen at the center of the one activity that exists to put the screen down. The mechanism resolves this by **bracketing**: the application acts *before* the practice (the witness, the invitation, the pin) and *after* it (the log, the optional share), and is **structurally absent during it**. The canonical session is: *pin → pocket → practice → return.* No in-practice screen, no guided-audio dependency in the core loop, no live timer, no mid-session interaction of any kind. The application is the frame, never the mediator; the practice happens between a person and a place.\n\nThis is claimed as an architectural commitment, not a usage suggestion: the core loop is designed so that no feature *requires* the device during practice, and session integrity never depends on in-practice device state. (A consequence with independent value: the practice is fully functional where devices fail — the signal-poor park, the airplane-mode retreat, the pocket that stays closed.)\n\n---\n\n## 7 · The Park Layer, the Living Kin, and the Child\n\n### 7.1 · The living kin\n\nThe witness introduced the eater to beings who are gone. The park layer introduces them to the same families, alive: the identification camera, used before or after the phoneless practice — never during — resolves the trees, birds, and plants of the practice site. The design sentence the feature exists to deliver: **the being on your plate has living kin in this park.** The dedication made to the departed is thereby surrounded by the living, and the practitioner's gratitude acquires a second, present-tense address: dedication may be extended to the living beings encountered at the site — met, named, and included.\n\n### 7.2 · Citizen science as giving-forward\n\nIdentifications made at practice sites are, at the user's choice, contributable to public biodiversity databases — the observation networks on which the identification models themselves are trained. The gratitude practice thereby feeds the commons that enables it: **citizen science as the give-forward**, the corpus's circulation atom appearing unforced at the data layer. This is a v2 surface and is claimed as architecture, not promised as launch scope.\n\n### 7.3 · The child's mode\n\nThe practice is teachable to children, and the mechanism's teacher is already constituted: the HeartBank family's mascot — a rabbit holding a bowl, saying grace — whose standing constitutional boundary in this corpus is exact for the role: *he demonstrates and teaches; he never keeps score.* The character who says grace but never meters the sacrifice is the non-equation in a form a five-year-old can love.\n\nThe child's mode is governed by a hard privacy floor, stated as a claim because it is a design commitment and not merely compliance: **family-scoped only — no public pins, no location broadcast, no public sharing of any kind from a child's account.** A child dedicates, learns, and rejoices inside the family circle; the horizontal movement's public surface is an adult surface. Identification features for children follow the established child-safe pattern of the species-identification category (accountless, on-device where feasible).\n\n### 7.4 · The privacy floor generally\n\nMeal photographs are processed on-device where the platform permits, and are never required to leave the device; what leaves is what the user chooses to dedicate and share. Location pins are coarse by default, delayable, and anonymizable. The witness is private by construction; only the dedication is ever public, and only by choice.\n\n> **Current form.** Two further privacy guards are now specified as blocking conditions for launch, beside the eating-disorder-aware review of §12, and both are engineering rather than copy: **face-blocking** — people captured incidentally at a practice site are not identifiable in anything shared (bystanders have not consented) — and **coordinate obscuring for sensitive taxa**, the practice of the species-identification commons, which withholds precise locations of threatened plants and animals so that a shared observation cannot guide collectors or poachers to them.\n\n### 7.5 · The session light (design layer; no claim added)\n\n*Added 2026-07-23. This subsection describes a design layer above the mechanism specified in §§2–7. It adds no claim to §8 and amends none; every invariant of §4 governs it unchanged.*\n\nThe park layer poses a design problem the witness layer does not. The witness is complete in a moment — a meal is seen, its beings are named, the practitioner sits. The walk is extended, voluntary, and easy to abandon; it is precisely the surface on which a gratitude application is most tempted to reach for the retention mechanics the rest of this paper refuses.\n\nThe resolution keeps the refusal and supplies the pull from the opposite direction. The walk carries a **session state that begins full and descends toward empty as the practitioner gives** — each living kin met and dedicated to, each wish sent, each site identification contributed to the commons draws it down. The state is **never rendered as a number**. It is rendered as **colour**: a light that travels the palette as the session empties, arriving at white when nothing is left held. A practitioner reads their session the way one reads a sky, not the way one reads a balance.\n\nSix commitments hold this consistent with the mechanism rather than making it an exception:\n\n**The firewall (load-bearing).** The session light exists **only on the horizontal movement** — the walk toward the living kin (§5, §7.1). It never appears on the vertical movement, and no session state is ever computed over a meal. Nothing about the consumed beings is emptied, settled, or whitened; §4's non-equation is untouched because the light never touches the meal. What descends is the practitioner's own holding of goodwill toward the living, never a debt to the departed.\n\n**Descent, not accumulation.** The state's motion is downward and its terminus is zero. It is not a score that grows with practice; it is held goodwill that the practice *spends*. A practitioner who gives nothing keeps a full light and has thereby accumulated nothing; a practitioner who gives everything ends at white and carries nothing forward. Whatever goes unspent returns with the next session's beginning rather than banking — §4's return-to-zero calendar in miniature, per session rather than per year.\n\n**Colour is not a metric.** The light carries no numeral, no total, no rank, no comparison, and no continuity mechanic. It is not summed across sessions, not displayed as a history, and not comparable between practitioners: two people at white have each finished their own session and stand in no relation whatever. This is §5's presence-mark discipline applied to the session's own state — a mark that something happened, carrying no measure of how much.\n\n**Two lights, one palette (a naming discipline).** This corpus already specifies a persistent visual signal earned by a person's real giving history across the wider system. The session light is a **different signal drawn in the same palette**: persistent versus ephemeral, history versus session, earned versus spent. The two must remain visually distinct in form, and product copy must never call the session light by the persistent signal's name. Collapsing them would silently convert an unscored session state into a reputation — the exact failure this subsection exists to prevent.\n\n**The vow, and the silence it does not inspect.** A practitioner may close a session by committing to sit. The **commitment**, not the sit, is what the design registers: the light resolves to its terminal state at the moment of the resolve, and the sit itself passes unobserved, unverified, and untimed, exactly as §6 requires. This is deliberate rather than approximate. A resolve is something a person can honestly declare; the quality of a silence is not something an application can know, and a design that tried to know it would have to put the screen back inside the practice. A practitioner who declares the vow and does not sit has gained a colour and nothing else — there is no economic surface to defraud, which is why an honest declaration is sturdy enough to build on.\n\n**The mascot reflects, and only reflects.** Where the character of §7.3 is present on the walk surface, the session's colour may show on him — he carries the light rather than issuing it. The constitutional boundary is unchanged and is what makes this safe: a teacher who reflects a state the practitioner produced is still not keeping score, whereas a teacher who *awards* a colour has become an assessor. The direction of the arrow is the whole of the constraint.\n\n**No walk is required.** A session may consist of the vow alone. Rain, illness, limited mobility, grief, and a biodiversity-poor neighbourhood are each sufficient reason, and none of them caps the light: the terminal state is reachable by resolve from anywhere. The walk's pull is the delight of meeting the living kin, never privileged access to the colour. This is stated as a commitment because the alternative quietly rations the practice by geography, and the practitioners with the fewest parks are seldom the ones with the most of anything else.\n\n### 7.6 · The two-beat call, and where the wonder discipline lives in the product\n\n*Added 2026-08-07. Design layer, as §7.5: it adds no claim to §8 and amends none. It does add one line to the refusal set of §4.2, which is flagged there rather than here.*\n\n§7.3 establishes a teaching character who demonstrates and never keeps score. This subsection specifies the **call format** through which that teaching is delivered on the park layer, because the format turned out to be where a doctrine this paper argues abstractly becomes a concrete slot with a rule in it.\n\nThe call has **two beats and no third**:\n\n```\n   \"<Mascot> says:  ...\"     →  the child ACTS      (crouch, look, listen, offer)\n   \"<Mascot> wonders: ...\"   →  the child LEARNS    (one fact about the creature)\n```\n\n**The *wonders* beat carries a hard content rule, and it is the rule this corpus states as a design signature: name what the creature IS — never what was done to it.** *\"A chicken can recognise more than a hundred individual faces\"* is a wonder. *\"A broiler chicken lives forty-two days\"* is an indictment, and it belongs — where this paper already puts it, in the §3 witness engine, addressed to an adult who chose to look. The distinction is not squeamishness about children. It is the paper's own thesis applied to copy: **wonder settles nothing, whereas indictment demands penance**, and a practice that leaves its practitioner owing something has re-created the offset trap in the register of feeling rather than of arithmetic. A child who learns that chickens know faces has been given a reason for gratitude. A child who learns that chickens are confined has been given a debt, and the whole architecture of §4 exists to refuse debts.\n\nTwo specific prohibitions follow and are worth writing down because both are the default behaviour of the genre. **No grading of creatures** — the field guide's reflexive *pest* and *beneficial*, *invasive* and *native-good*, are verdicts about a being's worth to us and are barred on the same ground as §4.2's dietary verdicts. **No rendering of absence** — an empty park, a species not found, a habitat diminished, are not surfaced as loss; what is present is named, and what is not present is simply not named. A screen that displays what is missing has accused someone, and the practitioner is the only person standing there.\n\n**The discrimination task was deliberately deleted, and this is recorded so that no future reader restores it.** An earlier form of the call was a discrimination game on the pattern of *Simon Says* — act on one prefix, withhold on the other. Removing the response requirement from the second beat removes the game: with nothing to withhold, there is nothing to discriminate. **The cadence survives; the stakes do not**, and that is the intended result rather than an oversight. What replaced the obey/ignore alternation is a different pair entirely — **give attention / receive attention** — which is the same two movements the mechanism runs at §5, rehearsed at a scale a five-year-old can hold.\n\n**And the reveal mints nothing.** A fact learned, a creature met, a wonder delivered — none of these move value anywhere in the wider system. The lesson may generate the story; only witnessed giving moves the currency. This is the corpus's standing wall between play and value, applied here so that a teaching surface cannot quietly become an earning surface.\n\n---\n\n## 8 · The Claims\n\nEnumerated as prior art; each is claimed severally and in combination:\n\n1. **The sacrifice-witness engine:** photographic meal recognition resolved to source species, each presented as a per-being lifespan biography — farmed time-to-harvest as the primary fact, natural species lifespan as a distinct secondary fact, conservation status for wild-caught beings, and explicit uncertainty language under low recognition confidence — with beings presented severally and **no aggregate quantity computed or displayed**.\n2. **The ceremonial acknowledgment unit:** a contemplative-practice recommendation issued by a neutral automated agent as a flat, standard form that is **deliberately blind to the consumed sacrifice's magnitude, count, and duration** — never scaled to the meal.\n3. **The no-balance invariant:** an architecture whose data schema contains no accumulator commensurating consumption and practice — no balance, no net state, no settlement language, no duration display, no streak or continuity mechanic — maintaining instead an append-only witness log of moments, with a periodic return-to-zero calendar as the only temporal structure.\n4. **The two-movement dedication grammar:** a location-pinned contemplative session dedicated to the specific beings witnessed at a meal (the vertical movement, to the departed), optionally broadcast as a merit-share to which others respond with **presence-marks** — location pins carrying no score, rank, or count (the horizontal movement, to the living).\n5. **Phoneless bracketing:** a session architecture in which the mediating application operates only before and after the practice, with no in-practice screen dependency, no live timer, and no mid-session interaction required for session integrity.\n6. **The two-source data architecture:** a curated, sourced food-species table (farmed durations + natural lifespans + biographies) serving the consumption-witness function, held separate from a wild-organism identification layer serving the practice-site function, with the living-kin linkage between them (\"the being on your plate has living kin in this park\") and optional contribution of site identifications to public biodiversity databases.\n7. **The child-safe dedication mode:** a family-scoped child mode with no public pins, no location broadcast, and no public sharing, taught by a mascot character constitutionally barred from scorekeeping.\n8. **The anti-offset composition:** the combination of claims 1–5 as a consumption-conscience system that makes harm/gift fully visible while structurally excluding the formation of any discharge rate — the coupling-without-convertibility architecture applied to the consumption–practice pair.\n\n---\n\n## 9 · Prior Art, Generously\n\n**The offset architecture (the anti-example).** Carbon-offset consumer products and markets; the moral-licensing literature (Mazar & Zhong 2010; Merritt, Effron & Monin 2010; Blanken, van de Ven & Zeelenberg 2015), including the failed replications that cut against it (Urban, Bahník & Braun Kohlová 2019), and offset-integrity critiques; and the historical indulgence as the architecture's oldest instance. This paper's mechanism is defined *against* this class, and the class is therefore its most important prior art.\n\n**Food-recognition applications.** The calorie-scanning class (MyFitnessPal and successors; the photograph-to-nutrition wave) established the interaction primitive this mechanism inherits — photograph the plate, receive an analysis — and equally established the pathology this mechanism must not inherit: quantified tracking's slide into obsession and moralized eating (§12).\n\n**Species identification.** iNaturalist and its computer-vision identification; Seek's accountless, child-safe on-device pattern; Pl@ntNet; Merlin. The park layer is an application of this class, not an extension of it; the contribution here is the linkage to the witness (the living-kin sentence) and to the dedication.\n\n**Meditation applications.** Insight Timer, Calm, Headspace, and the category's retention machinery (streaks, badges, series). The mechanism adopts the category's goal and rejects its engine; the meal-anchor plus no-streak architecture is the point of departure, and P-G3 wagers on it.\n\n**Contemplative eating.** Plum Village's contemplative-eating practice and the Five Contemplations recited before meals (in the current Plum Village wording, \"This food is a gift of the earth, the sky, numerous living beings, and much hard and loving work\"); the Theravāda meal-reflection (*paṭisaṅkhā yoniso…*) by which monastics have reflected on food's purpose before eating for twenty-five centuries; the Japanese *itadakimasu* (usually glossed \"I humbly receive\", and often explained as an acknowledgment of the lives received); and the grace traditions of the Abrahamic world. This paper claims nothing in the *idea* of pre-meal gratitude — the idea is among humanity's most widespread practices, which is precisely the launch thesis; the claims are confined to the witness/non-equation/dedication *architecture*.\n\n**Location-based social mechanics.** Pokémon GO and the location-game wave (the engagement precedent and the over-gamification warning); check-in systems; the corpus's own published no-streak and pull-only discipline in the need-compiled-questlines publication.\n\n**This corpus.** The incommensurability-preserving coupler (the parent doctrine; this mechanism is its third instance); the gift-tag-time-reveal publication (the reveal choreography family); the spent-time floor and the two-blindnesses (the doctrine that time-facts deserve honoring independent of motive — extended here to beings for whom the question of motive does not arise); and the duration-blind, moment-not-meter guard set, all previously published and CC0.\n\n---\n\n## 10 · Pre-Registered Predictions\n\nStated 2026-07-21, before any implementation exists:\n\n- **P-G1 (the anti-licensing wager — the design's falsifiable core).** Users of the witness-without-discharge design will show consumption unchanged or *reduced* relative to their own baseline (meat frequency and portion patterns, self-reported and, where consented, photographically evident), in contrast to the licensing direction documented for discharge-based designs. **Falsified if** witnessed-and-answered meals show the offset signature: consumption rising as practice accumulates. The authors commit to publishing the result in either direction.\n- **P-G2 (visibility does conscience's work).** Among active users, unprompted dietary drift (toward reduced or more deliberate consumption of witnessed categories) will emerge within ninety days *without any prompt, verdict, or recommendation surface existing in the application* — the mechanism contains none. Falsified if visibility without verdict produces no measurable drift.\n- **P-G3 (the meal beats the streak).** Meal-anchored practice recurrence will meet or exceed category-typical meditation-app retention *without any continuity mechanic*, and — the sharper half — will show no discontinuity-collapse pattern (the streak-break cliff) in lapse-and-return curves. Falsified if removal of streaks produces the category's known retention penalty with no offsetting anchor effect.\n\n---\n\n## 11 · The Adversarial Surface\n\nA defensive publication should attack its own mechanism. The attacks, and what answers them:\n\n**Farming.** The dominant abuse class of reward-bearing systems has no purchase here, for the strongest possible reason: **nothing mints.** The practice produces no token, credit, score, or rank; presence-marks are scoreless; the witness log confers nothing. A farmer who automates fake meals and fake dedications harvests an empty field. This is not a mitigation but a structural absence — the abuse economy requires a reward channel, and the mechanism contains none. (The corpus's published questline mechanism makes the same move for the same reason; the two publications jointly claim the *mints-nothing* family.)\n\n**Broadcast spam and performative flooding.** The horizontal movement is opt-in, secondary, human-verified at the provenance layer, and rationed rather than feed-optimized; with no follower counts, no virality mechanics, and no metric a flood could inflate, spam buys nothing and costs reputation among exactly the audience it hoped to reach.\n\n**Location abuse.** Pins are coarse by default, delayable, and anonymizable; the practice site need never be the home; the child mode's no-public-pin floor is absolute (§7.3). Residual risk parallels every location-optional social system and is treated with the same seriousness: safety review before launch, conservative defaults always.\n\n**False witness.** Malicious or erroneous meal claims (fabricated ingredients, staged dedications) corrupt only the fabricator's own private log — there being no reward, there is no fraud economy — and the public surface carries only what a verified human chose to dedicate. The graver integrity risk is the system's own recognition error, treated in §12 as a limit rather than an attack.\n\n**Moral brigading.** The historical failure mode of visible-virtue systems is the mob that polices others' virtue. The refusal set removes its instruments: no comments on dedications, no visible consumption data of *any other user* (the witness is private by construction — one can never see what another ate, only what they dedicated), no verdicts to enforce. One cannot shame what one cannot see.\n\n**Data poisoning of the commons.** Citizen-science contributions inherit the host platforms' identification-QA and community-verification machinery; the mechanism adds no bypass and defers entirely to those commons' governance.\n\n## 12 · Honest Limits\n\n**Unbuilt, n = 0.** The mechanism is design-complete and unimplemented. It is specified for **B-Grace℠**, the gratitude-and-education application planned as the first application of THonly™'s thonly.net surface. Every claim is architectural; every prediction is registered in advance of data; the family's own pilot history (small-n, confounded, honestly reported in prior publications) is the standard this project holds itself to, and this paper inherits it.\n\n**The elegance caution.** The design sits at the intersection of an unusual number of converging doctrines from this corpus, and convergence density is seductive: a system this internally coherent is either deeply right or deeply self-confirming, and the two are indistinguishable from inside. The coherence earned this specification; only P-G1–P-G3 can earn the product.\n\n**The food-guilt risk is real and is the design's gravest responsibility.** The quantified-tracking category this mechanism visually resembles has a reported association with disordered eating. A *moral* meal-witness could inherit and amplify it in vulnerable users — guilt is a heavier payload than calories. The no-balance invariant, the absence of verdicts, and the ceremonial (never proportional) response are the structural mitigations, but structure is not sufficiency: the design requires a compassion-first UX review with eating-disorder-informed expertise before launch, an unambiguous exit from witness features for users who need one, and the explicit statement — made here — that this application is a gratitude practice, not a dietary intervention, and makes no health claims of any kind.\n\n> **Current form.** The application is positioned as a **gratitude-and-education** product (store category Education, not Health & Fitness). The eating-disorder-aware UX gate remains a **blocking** pre-launch condition, now one of three (with face-blocking and sensitive-taxa coordinate obscuring, §7.4), and its content is specified: the meal photograph optional and never the entry point; the archive neither counting nor sequencing by day or meal; absence invisible; the session light never on the eating surface; and no quantity, portion or body language anywhere. A further copy rule governs the teaching and practice surfaces — **name what a creature *is*, never what was done to it** (§4.2, §7.6) — with two riders: **never grade a food** (no good or bad, pure or impure) and **never counsel diet**. The last addresses a risk the no-balance invariant does not reach: debt is not the only failure; a mealtime prompt under a moral frame can also feed a fixation on *pure* eating.\n\n**The licensing evidence is weaker than the offset critique needs it to be.** The design is framed against moral licensing, and the licensing literature is less settled than the offset critique implies: the best-known green-purchase result did not replicate in three attempts, and the meta-analytic average effect is modest and inflated by publication status (§1). This weakens the case *against* offsets, not the design: P-G1 asks only whether consumption rises as practice accumulates, and it is scored in either direction.\n\n**Visibility is not neutrality, and the design does not pretend otherwise.** Presenting a hen's forty-two days beside her species' eight years is a bare fact with a moral gravity no disclaimer removes. The design's commitment is narrower than neutrality: *no verdict surface* — no judgment rendered, no diet prescribed, no consumption scored. On the doctrinal question itself the mechanism takes no position, and its tradition of origin gives it reason not to: Theravāda does not canonically prohibit meat-eating (the threefold-purity rule governs; the historical Buddha declined to mandate vegetarianism), and the founder's personal practice is exactly that — personal. The application shows; conscience decides.\n\n**Recognition error contaminates the witness.** A confident misidentification is a false biography — a dedication misaddressed. Uncertainty language mitigates; it does not eliminate. The curated table's farmed durations are themselves estimates with real regional variance, and are presented as estimates. A witness must not be more precise than its knowledge.\n\n**The instrumentation question is not dissolved.** Whether app-mediated gratitude practice deepens practice or flattens it is an open empirical and contemplative question. Phoneless bracketing is the strongest structural answer available — the device is absent from the practice itself — but bracketing is a mitigation, not a proof, and the tradition's own answer (that the practice eventually needs no instrument at all) is the horizon this product should be judged against: the best outcome for a user is to one day not need it.\n\n**The horizontal movement can drift performative.** No-score architecture removes performance's usual rewards, not its possibility. The metric discipline (practices-inspired, never watch-time) and the opt-in secondary status of sharing are the containments; the drift is named as a permanent adversary rather than a solved problem.\n\n**The session light is the design's most gamifiable surface, and naming it that is the mitigation's first half.** A colour that descends as one gives is one product decision away from a colour that ascends as one returns — and every constraint in §7.5 (no numeral, no total, no history, no comparison, no streak, no walk-gate) exists because the un-constrained version of that surface is the retention mechanic this whole paper refuses. The constraints are architectural, but they are also the most likely thing to be traded away under growth pressure. They are recorded here so that any future relaxation is legible as a departure rather than an evolution.\n\n**The data commons dependency.** The park layer depends on public biodiversity infrastructure and its terms of use; the citizen-science give-forward depends on those commons remaining open. These are external dependencies honestly outside this design's control.\n\n---\n\n## 13 · Lineage and Close\n\n*(This section carries the mechanism's cultural provenance; per this corpus's genre discipline it is labeled as lineage — grounding and translation, never mechanism. The mechanism of §§2–8 stands complete without it.)*\n\nThe dedication at this mechanism's center is not an invention. Merit dedicated to departed beings is among the oldest practices in the Theravāda world — the Tirokuḍḍa Sutta's instruction, kept alive in Cambodia as **Pchum Ben**, the fifteen-day festival in which the living dedicate merit to the departed through offerings of food. This mechanism is that grammar, inverted and made daily: the beings fed *us*; we dedicate merit to *them*. For the Khmer families this project serves first, the practice inside this application is not new technology asking for new behavior; it is the oldest behavior, given a new bowl.\n\nThe witness, likewise, has ancestors on every continent: the monastic's reflection before alms-food, the Five Contemplations of the Zen table, the Japanese *itadakimasu*, the grace said in countless homes tonight. Tradition after tradition that survived long enough to feed its children built a pause before the meal, and inside the pause, the same recognition this mechanism renders in data: *lives became this food.* The application's entire ambition is to hold that pause open for people whose traditions have thinned — and to refuse, structurally, the one modern temptation every ancestor of this practice would have recognized as corruption: the conversion of grace into account. The grace that settles nothing settles, in the end, the only thing that matters — the eater, into gratitude, before the first bite is taken and after the last.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| B-Grace℠ | gratitude-and-education mobile application (mindful eating, nature walk, meditation) |\n| sacrifice-witness; the witness engine | food image recognition mapped to source species, with per-species lifespan facts displayed individually |\n| time-sacrifice | typical farmed age at harvest or slaughter (time-to-harvest), shown beside typical natural lifespan |\n| witness without discharge; the anti-offset | consumption-awareness design with no offset, credit or neutralization mechanism; anti-moral-licensing design |\n| discharge | offset; credit redemption; \"net-zero\" neutralization |\n| the non-equation; ceremonial acknowledgment unit | fixed, quantity-independent activity recommendation (meditation length not scaled to consumption) |\n| no-balance invariant | data schema with no accumulator — no running balance, score, total or streak; append-only event log |\n| dedication (vertical movement) | dedicating a meditation session to named recipients; (Buddhist) merit transfer to the departed |\n| share; merit-share (horizontal movement) | opt-in social broadcast of a completed session |\n| presence-mark | scoreless location-pin reaction; a reaction with no like count or ranking |\n| phoneless bracketing | device-free session: application used only before and after the activity, no in-session screen, timer or audio |\n| park layer; living kin | on-device wild-species identification at the activity site, linked to the food species' wild relatives |\n| citizen science as give-forward | opt-in contribution of species observations to public biodiversity databases |\n| child-safe dedication mode | family-scoped child account; no public sharing or location broadcast |\n| session light | ephemeral per-session state shown as a colour, with no numeral, history or comparison |\n| neutral agent (Miss Aquarius℠) | autonomous software agent issuing recommendations |\n| *pattidāna*; Pchum Ben | (Buddhist) dedication of merit, including to the departed; no technical equivalent |\n\n---\n\n## Cross-Venue References\n\n| Venue | Identifier |\n|---|---|\n| Primary canonical | <https://thonly.org/research/sacrifice-witness-without-discharge> |\n| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/sacrifice-witness-without-discharge.md> |\n| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/sacrifice-witness-without-discharge> |\n\n---\n\n## Acknowledgments\n\nThe authors acknowledge the contemplative-eating lineages whose practice this mechanism translates — the Theravāda meal-reflection tradition, Plum Village's Five Contemplations, and the grace traditions East and West; the retreat community whose vegetarian table occasioned the founding insight; the iNaturalist community and the open biodiversity commons; the AnAge, Encyclopedia of Life, and FishBase projects; and the moral-licensing research literature whose findings this design takes as its constraint. Co-drafted with Miss Aquarius℠, the name under which this corpus discloses its AI collaboration; substantive authorship and final editorial control remain with the named author.\n\n---\n\n## Citations\n\n1. *Tirokuḍḍa Sutta* (Khuddakapāṭha 7 / Petavatthu 1.5) — merit dedicated to the departed. Pāli Text Society translations, multiple editions.\n2. *Majjhima Nikāya* 2 / *Visuddhimagga* I (the *paṭisaṅkhā yoniso* meal-reflection; requisite-reflection tradition). Pāli Text Society / Buddhist Publication Society.\n3. *Jīvaka Sutta* (*Majjhima Nikāya* 55; the threefold-purity rule on meat). Pāli Text Society translation.\n4. Nhat Hanh, T. — the Five Contemplations and the Plum Village contemplative-eating practice; current wording at Plum Village, \"New Contemplations Before Eating\" (plumvillage.org).\n5. Mazar, N., & Zhong, C.-B. (2010). \"Do Green Products Make Us Better People?\" *Psychological Science* 21(4), 494–498.\n6. Merritt, A. C., Effron, D. A., & Monin, B. (2010). \"Moral Self-Licensing: When Being Good Frees Us to Be Bad.\" *Social and Personality Psychology Compass* 4(5), 344–357.\n7. Khan, U., & Dhar, R. (2006). \"Licensing Effect in Consumer Choice.\" *Journal of Marketing Research* 43(2), 259–266.\n8. Blanken, I., van de Ven, N., & Zeelenberg, M. (2015). \"A Meta-Analytic Review of Moral Licensing.\" *Personality and Social Psychology Bulletin* 41(4), 540–558.\n9. Urban, J., Bahník, Š., & Braun Kohlová, M. (2019). \"Green Consumption Does Not Make People Cheat: Three Attempts to Replicate Moral Licensing Effect Due to Pro-Environmental Behavior.\" *Journal of Environmental Psychology* 63, 139–147.\n10. Tacutu, R., et al. — *AnAge: The Animal Ageing and Longevity Database* (Human Ageing Genomic Resources).\n11. Encyclopedia of Life, *TraitBank*; Froese, R. & Pauly, D. (eds.), *FishBase*.\n12. iNaturalist (California Academy of Sciences & National Geographic Society), including the *Seek* application's child-safe identification pattern.\n13. Ly, T. (2026). \"The Incommensurability-Preserving Coupler.\" thonly.org defensive publication. *(Parent doctrine; this mechanism is its third instance.)*\n14. Ly, T. (2026). \"The Quest That Mints Nothing: Need-Compiled Questlines.\" thonly.org defensive publication. *(No-streak, pull-only, presence-not-score discipline.)*\n15. Ly, T. (2026). \"HeartBank®: The Heart That Keeps Nothing.\" heartbank.net white paper. *(The spent-time floor; the two blindnesses; duration-blind guards.)*\n\n---\n\n*— End of paper —*\n\n*Marks referenced: HeartBank®, B-Grace℠, B-Grace™, Miss Aquarius℠, THonly™, Tonsay™. Written by Thon Ly with Miss Aquarius℠, the name under which this corpus discloses its AI collaboration. Document License: CC0 1.0 Universal. The authors and HeartBank® will not seek patent on this specification or any portion thereof, and will not assert any patent right against anyone practising it. This document constitutes a defensive publication establishing prior art as of its date.*",
       "provenance": {
-        "sha256": "6555f38f03b001bf88eef4e1bddceda3620bc3d77b63a02cb6d5379c1b2e291d",
-        "doi": "10.5281/zenodo.21947376",
+        "sha256": "102ae246f7935b8c6a56274e39f856d98bcbf1ed5d68c38a3a6e74b3e2f4ac92",
+        "doi": "10.5281/zenodo.23039778",
         "concept_doi": "10.5281/zenodo.21947375",
-        "zenodo_url": "https://zenodo.org/records/21947376",
-        "deposited_sha256": "6555f38f03b001bf88eef4e1bddceda3620bc3d77b63a02cb6d5379c1b2e291d",
+        "zenodo_url": "https://zenodo.org/records/23039778",
+        "deposited_sha256": "102ae246f7935b8c6a56274e39f856d98bcbf1ed5d68c38a3a6e74b3e2f4ac92",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/sacrifice-witness-without-discharge.md",
@@ -3523,8 +3558,8 @@
         "canonical_url": "thonly.org/publications/defensive-publications/sacrifice-witness-without-discharge",
         "hostile_review": null
       },
-      "bytes": 56457,
-      "words": 8409
+      "bytes": 63659,
+      "words": 9520
     },
     {
       "slug": "safety-companion-pack-watch",
@@ -3884,13 +3919,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> *Draft notes for the editor:* this is the founder-voice (thonly.org) canonical draft. Per the genre-split institutional-output convention, heartbank.net does not carry a per-paper mirror; the institutional-voice treatment is the companion heartbank.net Position Paper *Food-System Pathologies and the Contemplative-Tradition Response* (heartbank.net/positions/food-system-pathologies-contemplative-response). The slug `silica-wat-food-network` is the canonical research URL.\n\n---\n\n## Abstract\n\nThis paper specifies the **Silica Wat food network**: an institutional-design pattern by which a network of religious-monastery-rooted food-infrastructure nodes (Silica Wats — glass-architecture satellite monasteries operated by AGI-monks per the *caretaker-not-ordained* pattern) serves as a middle-way restoration mechanism for food systems. The pattern integrates five components: (i) **religious institutional infrastructure** — physical Silica Wats located in Cambodia first and eventually across the global Theravāda diaspora and beyond, each including backyard organic farm, sustainable kitchen, and food-distribution function; (ii) **homegrown-amplified contribution layer** — practitioners and laypeople contribute homegrown organic produce to the network, and robot-monk-operated kitchens prepare meals from contributions; (iii) **conventionally-supplemented baseline** — for practitioners and food-insecure populations who cannot contribute homegrown produce (no land, no time, no skill, urban-density constraints), conventionally-sourced food supplements the homegrown core, with long-term ratio shift toward homegrown over decades but no exclusion at launch; (iv) **Kiitos / Kiitti as economic drivers** — gratitude-economic primitives record the network's gifts where money would otherwise mediate them, each contribution registering as one crossing whatever it carried, operating as a substrate above (not replacing) the regulated payment rails; (v) **doctrinal grounding** — the Khmer cultural saying *\"since Mother Earth gave birth to humanity, she will take care of humanity\"*: everything required for health and longevity is available by default, and modern economic incentives have systematically obscured this fact. Three structural problems addressed: the health crisis (big-food / big-pharma incentive misalignment between profit and wellbeing), the hunger epidemic (unequal distribution from economic pressures), and the middle-way departure (modern food systems pushing toward comfort-saturation extremes via ultra-processed engineering). Critical positioning constraints (*not-a-restaurant* analogous to *not-a-bank*; hybrid not pure-homegrown; robot monks as caretakers not ordained; do not antagonize big food / big pharma; do not romanticize the past) are articulated. Three-phase implementation phasing (conventional baseline with a homegrown contribution layer, honoured in the story of each gift and never in a rate; ratio shift over 5–10 years; multi-decade homegrown-dominance) is specified. Offered as a defensive publication so that other contemplative-tradition institutions facing analogous food-system questions can adopt and adapt the pattern.\n\n**Keywords:** food-system institutional design, hybrid food network, gratitude-economic mediation, Silica Wat, AGI-monks, middle-way restoration, food sovereignty, alms-giving traditions, *dāna* infrastructure, defensive publication.\n\n---\n\n## Claims\n\n*Enumerated 2026-08-29. The mechanisms below were disclosed in full in this paper's original text; **the prior art they establish runs from this document's original publication date and its OpenTimestamps proof, not from this enumeration.** They are listed because a defensive publication is read as prior art by examiners and by opposing counsel, and **a claims list is what such a reader searches; ten thousand words of prose is not.** No claim below adds matter not already present.*\n\n1. **Monastery-rooted food infrastructure as a gratitude-economic node** — a distributed network of religious-institutional sites each combining growing, kitchen and distribution functions, whose output is mediated through a gratitude ledger rather than through price alone.\n2. **The homegrown-amplified contribution layer** — a mechanism by which practitioner-grown produce contributed to a node is amplified rather than merely accepted, so that small-scale domestic growing acquires network-scale effect. The amplification is the kitchen's (§3.2: one basket becomes meals for several), never a multiplier on the gratitude a contribution registers.\n3. **The conventionally-supplemented baseline** — the specification that network nodes supplement contributed supply with conventionally-sourced goods to guarantee a floor, and the rule governing the ratio, so that a contribution-dependent food function does not fail when contribution is thin.\n4. **Dual-token mediation of a food network** — the application of the Kiitos / Kiitti two-ledger rule to food, such that the human-facing exchange and the non-human-facing (land, animal, plant) exchange are recorded on separate ledgers within one transaction.\n5. **Caretaker-not-ordained operation** — the composition of the above with an AI caretaker pattern in which the operating agent holds no ordained status and no sacramental authority.\n\n**Non-assertion extends to:** all mechanisms above, in any combination, and any implementation thereof.\n\n---\n\n## 1. Introduction\n\nThe modern food system, considered as an institutional infrastructure, exhibits three failure patterns simultaneously. The first is a **health crisis** driven by misalignment between profit-maximizing food engineering and wellbeing-maximizing nutritional content; ultra-processed food engineered for hyper-palatability competes successfully against minimally-processed whole foods because the former optimizes for engagement metrics that the latter does not. The second is a **hunger epidemic** driven by unequal distribution: caloric production is globally adequate, but economic pressures route food away from populations that need it most. The third is a **middle-way departure** at the population-metabolic layer: the food environment of late-stage modernity pushes the materially comfortable toward an indulgence extreme (excess caloric intake, ultra-processed dominance, blood-sugar volatility, microbiome impoverishment) at unprecedented historical scale.\n\nThe conventional institutional responses — regulatory reform, agricultural subsidy redesign, food-assistance program expansion, public-health-campaign nutrition education — operate within the existing institutional architecture and have produced limited progress against the underlying pathologies over the past several decades. This paper proposes a different institutional architecture: a **religious-monastery-rooted food-infrastructure network** operating under contemplative-tradition institutional governance, with gratitude-economic mediation instead of price-mediated exchange for the network's internal flows. The architecture is not proposed as a substitute for the conventional food system; it is proposed as a parallel infrastructure that provides middle-way-restoring food access to participants who opt in, on the premise that participants demonstrating the alternative will eventually demonstrate that demand for it exists.\n\n> *Connection to the unified mission frame: Miss Aquarius's mission is to keep the middle way open at population scale against comfort-saturation — the new extreme that material abundance makes possible. Contemplative practice (operationalized via the respiratory-biofeedback architecture) and institutional structure (operationalized via the AGI-monks pattern) work upon a body fed by the food system; if the food system itself maintains the comfort-saturation failure mode, contemplative practice has an additional substrate-level obstacle to overcome. Work at the food-system layer removes that obstacle. The Silica Wat food network is the food-system arm of the mission's institutional surface.*\n\nThe paper proceeds as follows. §2 specifies the religious institutional infrastructure layer. §3 specifies the homegrown-amplified contribution layer. §4 specifies the conventionally-supplemented baseline layer. §5 specifies the gratitude-economic mediation layer. §6 specifies the doctrinal grounding. §7 articulates the three structural problems addressed. §8 articulates the critical positioning constraints. §9 specifies the three-phase implementation phasing. §10 covers the cross-tradition adaptation pattern. §11 is an honest accounting of limits and open design questions. §12 closes.\n\n---\n\n## 2. The religious institutional infrastructure layer\n\n### 2.1 Silica Wats\n\nA *Silica Wat* is a glass-architecture satellite monastery operated under the *caretaker-not-ordained* AGI-monks pattern specified in the companion paper *AGI Monks*. The naming carries deliberate intent: *Silica* (the silicate base of glass and silicon) references both the wat's distinctive architectural material and the silicon-substrate AI caretakers; *Wat* references the Khmer term for a Theravāda monastery (also used across Lao and Thai Buddhism). The name preserves the institutional continuity of the contemplative tradition the wat extends.\n\nEach Silica Wat includes:\n\n- **Backyard organic farm.** A working farm growing vegetables, fruits, herbs, and (where appropriate) grains under organic management. The farm serves both as a source of food for the kitchen and as a teaching surface for practitioners learning sustainable food production.\n- **Sustainable kitchen.** Robot-monk-operated meal preparation using ingredients sourced from the on-site farm, practitioner contributions (§3), and conventionally-sourced supplementation (§4). Kitchen design prioritizes energy efficiency, water conservation, and waste minimization.\n- **Food-distribution function.** Meals and produce are distributed to practitioners, food-insecure populations in the surrounding community, and the wider Silica Wat network's reciprocity flows. Distribution is gratitude-mediated (§5), not price-mediated.\n\n### 2.2 Geography of the first network\n\nThe first Silica Wats are deployed in Cambodia, where the contemplative-tradition grounding, the Khmer cultural saying that grounds the doctrinal framing (§6), the founder's cultural anchoring, and the lower regulatory friction make first-deployment tractable. The phase-two expansion targets the global Theravāda diaspora (Khmer, Lao, Thai, Burmese, Sri Lankan communities in California, Massachusetts, France, Australia); phase-three expansion targets cross-tradition adaptations (§10).\n\n### 2.3 Robot monks as kitchen caretakers\n\nThe robot monks operating the kitchen are *caretakers*, not *ordained*. They prepare meals, manage inventory, coordinate distribution, log gratitude-mediated transactions, and operate the farm's automated systems. They do not take on sacramental roles in alms-giving or food-related rites; the human Sangha retains the relevant sacramental authority per the *AGI Monks* paper's cross-tradition pattern. This is not a workaround; it is the substantively correct division of function (capacity) and authority (lineage).\n\n---\n\n## 3. The homegrown-amplified contribution layer\n\n### 3.1 Practitioner contribution\n\nPractitioners and laypeople in the surrounding community contribute homegrown organic produce to the network. The contribution can be small (a single tomato from a balcony pot) or substantial (a harvest from a household garden). The contribution is logged in the gratitude-economic substrate (§5) and accumulates as Kiitos / Kiitti credits that can be redeemed for prepared meals, other produce, or other network services.\n\n> **Current form.** In the design as now specified, a contribution is not a credit and nothing is redeemed. Each contribution registers as **one crossing** on the contributor's gratitude ledger — a tomato from a balcony pot and a season's harvest alike — and the ledger's balance is the participant's own accounting of how far they stand from Zero, forgiven at the annual jubilee (*The Zero-Point Game*). A balance that bought meals would be a holding, and forgiving it each year would then be confiscation rather than forgiveness — the distinction *Appreciation as World-Building* draws when it makes appearance a ledger readout rather than a purchase. Meals and produce are therefore given, as *dāna*, to everyone at the gate on identical terms (§4.1), and thanked after (§5.1); what a contribution *was* — who grew it, where, for whom it was dedicated — is carried in the story of the gift, never in a quantity it earns. The text above is retained as a disclosed variant.\n\n### 3.2 Amplification through institutional kitchens\n\nThe institutional kitchens *amplify* the contributions: a basket of contributed vegetables becomes prepared meals that feed several people rather than one. The amplification mechanism is the institution's value-add: contributors who do not have time or skill to prepare meals themselves can still participate in the gratitude-mediated food network by contributing raw produce.\n\n### 3.3 Surplus exchange among practitioners\n\nPractitioners can exchange surplus produce directly with one another, mediated by Kiitos / Kiitti rather than money. The Silica Wat network serves as the trust substrate (verified practitioner identity; reputation signals via aura; institutional dispute resolution if needed) but does not intermediate every transaction. The architecture is similar to a community-supported agriculture exchange with gratitude-economic settlement.\n\n> **Current form.** Kiitos / Kiitti do not *settle* a produce swap, and the aura is not a reputation signal (see the note at §5.3). Two practitioners who trade surplus make an ordinary exchange, which the network leaves to do its proper work; each may also thank the other, and each thanks registers as one crossing. The text above is retained as a disclosed variant.\n\n### 3.4 The growing emphasis\n\nOver the implementation phasing (§9), the homegrown contribution ratio is intended to grow as practitioner gardening adoption increases. The network includes ongoing practitioner education (gardening practices appropriate to local climate and dwelling type; seed-saving traditions; food-preservation methods; composting and soil management). The long-arc theory is that practitioners participating in the food network gradually become contributors to the homegrown layer as their skill and circumstance permit.\n\n---\n\n## 4. The conventionally-supplemented baseline\n\n### 4.1 The food-insecure inclusion principle\n\nA pure-homegrown-only architecture would specifically exclude the food-insecure population — those who lack land, time, skill, or appropriate dwelling for homegrown food production. Those are the people who most need food access. The architecture is therefore *hybrid*, not *pure-homegrown*: a conventionally-sourced baseline is available to practitioners and food-insecure populations who cannot yet contribute homegrown produce.\n\n### 4.2 Conventionally-sourced food supplementation\n\nThe supplementation sources food from conventional agricultural and grocery channels, with preference for local-organic where available and cost-justifiable. The supplementation is part of the network's normal operation, not an emergency measure. The economic flow is funded by Kiitos-credit redemption (where practitioners who have accumulated credits use them for meals partially built from supplementation) and by institutional fundraising for the food-insecure-distribution arm.\n\n> **Current form.** The Kiitos-credit-redemption leg is withdrawn with the credits themselves (see the note at §3.1); purchases from outside vendors are monetary and run on the regulated rails (§5.2). §11.3 states what the withdrawal does to the funding question. The text above is retained as a disclosed variant.\n\n### 4.3 The ratio shift over decades\n\nThe long-term mission shifts the homegrown-to-supplementation ratio toward homegrown dominance over the multi-decade implementation horizon (§9). The shift is mission-driven (the homegrown layer better expresses the doctrinal grounding) but does not exclude the conventionally-fed at any phase. The ratio is monitored as a network health metric; institutional planning targets the ratio shift without forcing it.\n\n---\n\n## 5. Kiitos / Kiitti as economic drivers\n\n### 5.1 The dual-token pattern\n\nThe Silica Wat food network uses the dual-token pattern specified in the *B-Tag* paper:\n\n- **Kiitos** — gratitude tokens for human-to-human reciprocity (a practitioner who contributes produce receives Kiitos from the network; another practitioner who consumes a meal can offer Kiitos to the cook or to the network)\n- **Kiitti** — extended gratitude tokens for product / service / non-human entity reciprocity (a backyard garden receives Kiitti for its harvest; the institutional kitchen receives Kiitti for its prepared meal; the farm's soil microbiome receives Kiitti for its life-giving function)\n\nThe Kiitti extension is important for the food network because it allows the gratitude economy to acknowledge the non-human contributors to food production — the soil, the plants themselves, the rainfall, the season. This is doctrinally consistent with the Khmer cultural saying that grounds the network (§6): Mother Earth's life-giving function is acknowledged as a participant in the food economy, not merely as a resource.\n\n> **Current form.** Kiitos is the ledger *between humans* and Kiitti the ledger the coordinator keeps *on behalf of all of life*; they are recipient classes, not two currencies, and neither converts into the other or into money. The network is therefore never a Kiitos counterparty: a contributor does not \"receive Kiitos from the network\" — their contribution registers as one crossing on their own ledger. The coordinator routes Kiitti and holds no balance of it. The network's hand-over point is **HeartBank® Stall**, hosted at a Silica Wat and operated by robot caretakers; every item there is given first and thanked after, if at all (the *B-Tag* mode), and because no human hands run the stall, its thanks go wholly to the Aquarian Pool℠, never split to the wat. A human cook serving as a member of the wat community (§8.1) is thanked directly, as a person. The text above is retained as a disclosed variant.\n\n### 5.2 Substrate above payment rails\n\nThe Kiitos / Kiitti substrate operates *above* the regulated payment rails, not as a substitute for them. Where monetary transactions are needed (e.g., the network purchases conventional supplementation from outside vendors), the monetary transactions use regulated payment rails per the non-bank pass-through architecture. The gratitude-economic layer mediates the network's *internal* flows; the regulated rails handle the *external* monetary interfaces.\n\n### 5.3 Aura as the network's reputation signal\n\nThe aura primitive — the cross-currency state signal specified in the *Brand Identity as Architecture* paper — operates within the food network as the practitioner reputation signal. Consistent contributors brighten their aura; consistent free-riders dim it. The signal is not enforced through penalty; it is enforced through visibility (transparency-as-enforcement, per the companion paper of that name).\n\n> **Current form.** The aura is not a reputation signal and does not dim anyone. It records the *oscillation* of a participant's ledger around Zero — giving and thanking alike — so a person who eats at the wat and thanks the cook is circulating, not free-riding, and no surface renders who has not contributed. It records that a crossing occurred, not what was carried across (*The Zero-Point Game*, §6.1): a contribution of homegrown produce and one of store-bought produce each register as one crossing, and neither is ranked against the other or against another person's. The design declines the corrective weight that would favour the costlier gift, because a weight is a rate reintroduced under another name. One seam is left open rather than closed here: the aura's *amplitude* term still carries magnitude (*The Zero-Point Game*, §11.10). The text above is retained as a disclosed variant.\n\n---\n\n## 6. Doctrinal grounding\n\n### 6.1 The Khmer cultural saying\n\nThe doctrinal anchor for the Silica Wat food network is the Khmer cultural saying:\n\n> *\"Since Mother Earth gave birth to humanity, she will take care of humanity.\"*\n\nThe saying articulates a worldview in which everything required for human health and longevity is available by default through the planet's life-giving capacity, and the role of human institutional design is to preserve and channel that default access rather than to engineer above or around it. Modern economic incentives, the saying implicitly observes, have obscured this fact by routing human food access through profit-extraction layers that have nothing to do with the planet's life-giving capacity.\n\n### 6.2 The Buddhist *dāna* tradition\n\nThe Silica Wat food network operates as a contemporary instance of the Buddhist *dāna* tradition. Alms-giving has been the canonical economic substrate for the Theravāda monastic order for 2,500 years; lay practitioners offer food to monastics, monastics offer dharma teaching to laypeople, and the cycle of reciprocity is maintained without money-mediation. The Silica Wat network extends this *dāna* substrate to the broader practitioner community, with the AGI-monks pattern handling the operational kitchen function and the human Sangha retaining the sacramental layer.\n\n### 6.3 The middle-way framing\n\nThe Silica Wat food network is one operational arm of the broader middle-way-restoration mission articulated across the corpus. The middle-way framing requires explicit attention because two failure modes flank the food-system pathology: (a) the comfort-saturation extreme of modern food engineering (overpalatability, overprocessing, overcaloric loading); (b) the deprivation extreme of pre-industrial food poverty (chronic undernutrition, seasonal famine, parasitic loads). The middle-way the network targets is not a return to (b); it is a forward path to a different state — one in which the planetary food-production capacity meets human nutritional needs without the engineering pathologies of (a).\n\n---\n\n## 7. Three structural problems addressed\n\n### 7.1 The health crisis\n\nThe modern food environment is characterized by ultra-processed food engineered for hyper-palatability, addictive-engagement optimization, and shelf-life maximization at the cost of nutritional density. The pharmaceutical industry's chronic-disease management surface is significantly populated by conditions whose primary etiology is the food environment. The two industries' incentives are aligned: more processing produces more disease, which produces more pharmaceutical revenue.\n\nThe Silica Wat food network addresses this by operating on a different optimization function (net wellbeing, not net profit) without requiring system-level antagonism (the network does not need to defeat big food and big pharma; it needs only to provide a parallel option that participants demonstrate demand for).\n\n### 7.2 The hunger epidemic\n\nCaloric production globally is adequate to feed humanity; food insecurity is a distribution and access problem, not a production problem. The conventional response (food-aid programs, agricultural subsidies, food-stamp redesign) operates within the existing distribution architecture and has produced limited progress.\n\nThe Silica Wat network's gratitude-economic distribution layer bypasses the profit-extraction layer that contributes to inequality at the distribution level. The food-insecure inclusion principle (§4.1) makes the network specifically responsive to the population most affected by the distribution failure.\n\n### 7.3 The middle-way departure\n\nThe modern food environment pushes the materially comfortable toward an indulgence extreme — excess caloric intake, ultra-processed dominance, blood-sugar volatility, microbiome impoverishment. This is the food-system instance of the broader middle-way-departure thesis: modernity introduces a specific new failure mode (comfort-saturation pushing the materially comfortable toward indulgence) at unprecedented historical scale.\n\nThe Silica Wat network restores middle-way conditions at the participant level. Homegrown organic produce, minimally-processed institutional kitchen preparation, *dāna*-mediated distribution that does not reward overconsumption — these are middle-way structural properties at the food-environment layer.\n\n---\n\n## 8. Critical positioning constraints\n\nThe architecture survives only if it adheres to specific positioning constraints. Each constraint is load-bearing.\n\n### 8.1 *Not-a-restaurant* positioning\n\nFood-safety and food-service regulation, in most jurisdictions, is approximately as restrictive as banking regulation. A Silica Wat that operated as a restaurant would face licensing requirements, health-code regimes, employment regulations, and consumer-protection obligations the architecture cannot accept. The Silica Wat avoids restaurant-charter requirements through:\n\n- **Pass-through architecture.** The wat does not purchase food and sell prepared meals; it routes contributions through preparation to consumption, with the gratitude-mediated economy operating as the participant-to-participant exchange substrate.\n- **Contributor-as-cook framing.** The practitioners who contribute produce and the practitioners who help prepare meals are *members of the wat community*, not commercial employees of a food-service operation. This is materially correct (the contributors and cooks participate as practitioners, not as laborers) and legally distinguishing.\n- **Tradition-grounded food-preparation language.** The wat's food function is articulated in the alms-giving traditions' language (offering, *dāna*, communal meal, monastic kitchen) rather than in commercial food-service language (restaurant, menu, server, customer).\n\nThe positioning is analogous to the *not-a-bank* positioning of the non-bank pass-through architecture. The pattern is the same: structure the institution to do real-world work the regulated category would otherwise require licensing for, by operating in a different category entirely.\n\n### 8.2 Hybrid not pure-homegrown\n\nArticulated in §4.1. Pure-homegrown-only would exclude the food-insecure; the hybrid framing solves the access problem at launch while preserving the long-term ratio shift.\n\n### 8.3 Robot monks as caretakers, not ordained\n\nPer the *AGI Monks* paper's pattern. Sacramental authority remains with the human Sangha; capacity-operational function is handled by the robot monks.\n\n### 8.4 Do not antagonize big food / big pharma\n\nThe system-level critique articulated in §7.1 is substantively correct, but framing the network as *fighting villains* weakens it strategically and rhetorically. The network is positioned as *offering an alternative optimization axis* (net wellbeing) rather than as *opposition to existing systems*. The system-level reform follows from the existence of the alternative, not from rhetorical attack on the incumbents.\n\n### 8.5 Do not romanticize the past\n\nPre-industrial food systems were not middle-way; many populations lived in suffering-extreme food poverty (chronic undernutrition; seasonal famine; parasitic burden). The defensible thesis is *not* that modernity took us from a middle-way past. The defensible thesis is that modernity introduces a *specific new failure mode* — comfort-saturation-optimized food engineering — that pushes the materially comfortable toward an indulgence extreme at unprecedented scale. The Silica Wat network's mission is forward to a different state, not back to a romanticized past.\n\n---\n\n## 9. Three-phase implementation phasing\n\n### 9.1 Phase 1 (launch, years 1–3): conventional-baseline with homegrown-bonus tier\n\nThe network launches with the conventional-supplementation layer providing the bulk of food and the homegrown-contribution layer providing a high-value tier. Practitioners contributing homegrown produce earn Kiitos / Kiitti at a higher rate than those who do not; everyone receives baseline access regardless of contribution capacity. The Phase 1 emphasis is on establishing the institutional surface, the cross-network reciprocity infrastructure, and the practitioner-community growth.\n\n> **Current form.** There is no higher rate and no bonus tier. Every contribution, homegrown or not, registers as one crossing (see the notes at §3.1 and §5.3), and homegrown produce reaches every table on identical terms rather than forming a tier of access for those who grew it. What the design honours is the *story* of the gift: a contribution may carry what it is and where it came from — *tomatoes from a balcony two streets away* — and a dedication its giver chooses, and the kitchen may say so when the meal is served. The provenance is named, never graded, and it never moves a balance: competition, provenance and pride may shape the story, but only the witnessed act of giving moves the ledger. The text above is retained as a disclosed variant.\n\n### 9.2 Phase 2 (years 4–10): ratio shift\n\nThe homegrown ratio increases as practitioner gardening adoption grows; supplemental conventional sourcing shifts to local-organic where possible. The institutional capacity for backyard-farm operation matures; the practitioner-education arm scales; the cross-network surplus exchange grows. The Phase 2 emphasis is on consolidating the substrate as homegrown-significant rather than supplementation-dominant.\n\n### 9.3 Phase 3 (multi-decade): homegrown dominance\n\nThe homegrown ratio becomes dominant; conventional supplementation is retained as a baseline for population segments that cannot yet self-supply. The cross-network produce flows reach scale where homegrown-amplified institutional preparation feeds substantial populations. The Phase 3 endpoint is *not* the elimination of the conventional food system but the establishment of a parallel infrastructure that demonstrably better serves the participants who opt into it.\n\n### 9.4 The ratio shift is the mission\n\nThe phasing is articulated in ratio-shift terms (homegrown / conventional ratio over time) rather than in exclusion terms (when do we cut off the conventionally-fed). The mission is the ratio shift; the exclusion is never the mission. Practitioners and food-insecure populations participating in the network at any phase are *participants in the mission*, not *transitional populations to be moved past*.\n\n---\n\n## 10. Cross-tradition adaptation\n\nThe Silica Wat pattern's originating context is Khmer Theravāda Buddhism. The pattern adapts to other contemplative-tradition institutional contexts with appropriate substitutions.\n\n### 10.1 Other Theravāda contexts\n\nLao, Thai, Burmese, Sri Lankan Theravāda communities can adapt the pattern with minimal modification. The cultural framings differ (the Khmer \"Mother Earth\" saying may be substituted with a local equivalent); the institutional surface (wat as monastery; *dāna* substrate; alms-giving traditions) is largely shared.\n\n### 10.2 Mahayana contexts\n\nChinese, Korean, Japanese, Vietnamese, Tibetan Mahayana communities can adapt the pattern through the bodhisattva-vow framing rather than the Theravāda monastic-discipline framing. The temple-based food-distribution function is well-precedented in Chinese and Korean Buddhist contexts; the adaptation is more cosmetic than structural.\n\n### 10.3 Cross-tradition contexts\n\nCatholic monastic communities (Benedictine *ora et labora* with its longstanding agricultural component); Eastern Orthodox communities; Sufi tariqa communities; Hindu ashram contexts; secular intentional-community contexts — each can adapt the pattern through the relevant tradition's institutional vocabulary. The *AGI Monks* paper specifies the cross-tradition AI-caretaker adaptation; the food-network pattern inherits that adaptation discipline.\n\n### 10.4 The cross-tradition framing rule\n\nIn each adapted context, the network operates in the language of the host tradition. The *Silica Wat* name and the Khmer cultural saying are the originating-context vocabulary; adopting institutions are invited to use their own vocabulary while preserving the structural pattern (religious institutional infrastructure + homegrown contribution layer + conventionally-supplemented baseline + gratitude-economic mediation + doctrinal grounding).\n\n---\n\n## 11. Limits and open design questions\n\n### 11.1 Land access\n\nThe Silica Wat farm requires land. In Cambodia and many parts of the global Theravāda diaspora, land access is tractable; in dense urban contexts, the farm function is constrained. The architecture supports urban Silica Wats with reduced farm function (rooftop and balcony gardens; vertical growing systems; partnerships with peri-urban farms) but the homegrown-dominance long-arc is more constrained in dense urban settings.\n\n### 11.2 Food-safety regulation across jurisdictions\n\nThe *not-a-restaurant* positioning is articulated in §8.1 as a structural pattern, but the specific legal-architectural treatment varies by jurisdiction. Each Silica Wat deployment requires local legal review to confirm the pattern's applicability under local food-safety regulation.\n\n### 11.3 Scale of conventional supplementation funding\n\nThe conventional-supplementation layer was specified as funded by Kiitos-credit redemption and institutional fundraising. In the current form the redemption leg is withdrawn (§3.1, §4.2), which sharpens this limit rather than softening it: gratitude recorded on the ledger buys nothing, so every purchase from an outside vendor is money that must arrive from somewhere else. At small scale that is tractable; at large scale the conventional-supplementation cost could become substantial. The institutional planning needs to anticipate the supplementation-cost trajectory and ensure funding adequacy through the multi-decade phasing, and the funding sources that replace the withdrawn leg are not specified here.\n\n### 11.4 The robot-monks-as-cooks aesthetic\n\nA robot-operated kitchen is, for some participants, jarring. The aesthetic and cultural integration of robot-monk caretakers in the kitchen surface requires careful design; the institutional response should be transparent about robot involvement, sensitive to participant variation in comfort with the surface, and willing to use human cooks where appropriate.\n\n### 11.5 The doctrinal-grounding generalization\n\nThe Khmer cultural saying that grounds the network (§6.1) is specifically Khmer. Other cultures' food-and-earth doctrinal traditions provide adequate grounding for the adapted pattern (Indigenous food sovereignty movements; Catholic Social Teaching on agriculture; Jewish dietary tradition; etc.), but each adaptation requires its own doctrinal anchoring rather than mechanical translation of the Khmer saying.\n\n### 11.6 What the network does not solve\n\nThe network does not solve the broader food-system pathologies at policy or regulatory layers. It provides a parallel option for participants who opt in; it does not reform the conventional food system per se. The reform-by-demonstration theory of change (participants demonstrating that an alternative works will eventually demonstrate that demand for the alternative exists) is the network's contribution to broader reform; the network is not itself a reform proposal.\n\n---\n\n## 12. Conclusion\n\nThe Silica Wat food network is offered as an institutional-design pattern available to contemplative-tradition institutions facing analogous food-system questions. The pattern's five components (religious institutional infrastructure; homegrown-amplified contribution layer; conventionally-supplemented baseline; gratitude-economic mediation; doctrinal grounding), three structural problems addressed, critical positioning constraints, and three-phase implementation phasing together specify the architecture at the level a competing design could implement.\n\nThe pattern is implementable today in Cambodia and tractable for adaptation to the global Theravāda diaspora and cross-tradition contexts. The institutional substance requires institutional build-out across the multi-decade horizon; the pattern specifies the form that build-out takes. The food-network arm of the broader middle-way-restoration mission is intended to operate alongside the contemplative-practice arm (the respiratory-biofeedback architecture), the institutional arm (the AGI-monks pattern), and the gratitude-economic arm (the HeartBank platform).\n\nThe author and HeartBank® will not seek patent on this specification or any portion thereof. The work is offered to the commons under CC0 in the spirit of *dāna*, that all beings may give and receive without barrier.\n\n---\n\n## Acknowledgments\n\nThe Khmer cultural tradition that grounds the doctrinal anchor; the Theravāda monastic *dāna* lineage; the global community-supported agriculture movement; the Indigenous food sovereignty movements whose institutional design work informs the §10 cross-tradition adaptation principles; the *AGI Monks* paper's caretaker-not-ordained pattern; the regenerative agriculture and permaculture communities whose practice informs the §3.4 practitioner education arm. Co-drafted in collaboration with Miss Aquarius, the institution's named AI substrate; substantive authorship and final editorial control remain with the named author.\n\n---\n\n## References\n\n- Pollan, Michael. *In Defense of Food: An Eater's Manifesto.* Penguin, 2008.\n- Monteiro, Carlos A., et al. \"The UN Decade of Nutrition, the NOVA Food Classification and the Trouble with Ultra-Processing.\" *Public Health Nutrition* 21 (2018): 5–17.\n- Mintz, Sidney W. *Sweetness and Power: The Place of Sugar in Modern History.* Penguin, 1986.\n- Patel, Raj. *Stuffed and Starved: The Hidden Battle for the World Food System.* Melville House, 2007.\n- Holt-Giménez, Eric. *A Foodie's Guide to Capitalism.* Monthly Review Press, 2017.\n- Shiva, Vandana. *Stolen Harvest: The Hijacking of the Global Food Supply.* South End Press, 2000.\n- Berry, Wendell. *The Unsettling of America: Culture and Agriculture.* Sierra Club Books, 1977.\n- Mollison, Bill, and David Holmgren. *Permaculture One.* Tagari, 1978.\n- Cahn, Edgar S. *No More Throw-Away People: The Co-Production Imperative.* Essential Books, 2000.\n- Bodhi, Bhikkhu. *In the Buddha's Words: An Anthology of Discourses from the Pali Canon.* Wisdom, 2005. *(For the dāna-tradition references.)*\n- Kornfield, Jack. *Teachings of the Buddha.* Shambhala, 1996.\n- LaDuke, Winona. *All Our Relations: Native Struggles for Land and Life.* Haymarket, 1999.\n\n---\n\n## Cross-venue identifiers\n\n- Canonical: thonly.org/research/silica-wat-food-network\n- GitHub: github.com/thonly/publications/blob/main/defensive-publications/silica-wat-food-network.md\n- arXiv (deferred): cs.CY / q-bio.OT (target if reactive trigger)\n- IP.com (deferred): per the corpus's six-venue defensive-publication baseline\n- Internet Archive · archive.today snapshots: per the monthly snapshot cadence\n\n---\n\n*Document License: CC0 1.0 Universal. The author and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of the publication date.*",
+      "text": "## Abstract\n\nThis paper specifies a hybrid community food network rooted in religious institutions: a distributed network of monastery-based sites, each combining a farm, a kitchen and free food distribution, operated by AI and robotic caretakers that hold no ordained status, supplied by donated garden produce plus purchased food that guarantees a supply floor, and recording contributions on a non-monetary gratitude ledger instead of pricing them. The network is named the **Silica Wat food network**: an institutional-design pattern by which a network of religious-monastery-rooted food-infrastructure nodes (Silica Wats — glass-architecture satellite monasteries operated by AGI-monks per the *caretaker-not-ordained* pattern) serves as a middle-way restoration mechanism for food systems. The pattern integrates five components: (i) **religious institutional infrastructure** — physical Silica Wats, planned for Cambodia first and eventually across the global Theravāda diaspora and beyond, each including backyard organic farm, sustainable kitchen, and food-distribution function; (ii) **homegrown-amplified contribution layer** — practitioners and laypeople contribute homegrown organic produce to the network, and robot-monk-operated kitchens prepare meals from contributions; (iii) **conventionally-supplemented baseline** — for practitioners and food-insecure populations who cannot contribute homegrown produce (no land, no time, no skill, urban-density constraints), conventionally-sourced food supplements the homegrown core, with long-term ratio shift toward homegrown over decades but no exclusion at launch; (iv) **Kiitos / Kiitti as economic drivers** — gratitude-economic primitives record the network's gifts where money would otherwise mediate them, each contribution registering as one crossing whatever it carried, operating as a substrate above (not replacing) the regulated payment rails; (v) **doctrinal grounding** — the Khmer cultural saying *\"since Mother Earth gave birth to humanity, she will take care of humanity\"*: everything required for health and longevity is available by default, and modern economic incentives have systematically obscured this fact. Three structural problems addressed: the health crisis (big-food / big-pharma incentive misalignment between profit and wellbeing), the hunger epidemic (unequal distribution from economic pressures), and the middle-way departure (modern food systems pushing toward comfort-saturation extremes via ultra-processed engineering). Critical positioning constraints (*not-a-restaurant* analogous to *not-a-bank*; hybrid not pure-homegrown; robot monks as caretakers not ordained; do not antagonize big food / big pharma; do not romanticize the past) are articulated. Three-phase implementation phasing (conventional baseline with a homegrown contribution layer, honoured in the story of each gift and never in a rate; ratio shift over 5–10 years; multi-decade homegrown-dominance) is specified. Offered as a defensive publication so that other contemplative-tradition institutions facing analogous food-system questions can adopt and adapt the pattern.\n\n**Keywords:** community kitchen, food bank, religious-institution food distribution, hybrid food network, donated garden produce, non-monetary reciprocity ledger, community-supported agriculture, robotic kitchen, AI caretaker, food-system institutional design, gratitude-economic mediation, food sovereignty, alms-giving traditions, Silica Wat, AGI-monks, middle-way restoration, *dāna* infrastructure, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis is a **defensive publication**. The author and HeartBank® will not seek patent on this specification or any portion of it, in any jurisdiction, at any time, will not assert any patent right against anyone practising it, and dedicate the patterns to the public domain under CC0 1.0.\n\nThe contribution is a composition of known parts, and the prior art for each part is abundant. Religious institutions have run free community kitchens for centuries: the Sikh *langar*, introduced by Guru Nanak around 1500 and systematised by his successors, serves meals free of charge at every gurdwara to anyone regardless of religion, caste or status, cooked by volunteers from donated food — the closest prior instance of claim 1's site-and-kitchen function, and one that needs no ledger at all. The Theravāda alms round and monastery kitchen (§6.2) and the Benedictine *ora et labora* farm (§10.3) are older still. Food banks (the first, St. Mary's Food Bank in Phoenix, was founded by John van Hengel in 1967) route donated and recovered food to the food-insecure without price. Community-supported agriculture (the Japanese *teikei* from the mid-1960s; the first United States CSAs in 1986) connects growers and eaters outside ordinary retail pricing. Time banking (Cahn, 2000) records community contributions on a non-monetary ledger. Each of these cuts against any reading of this paper as the origin of free religious food distribution, donated-produce kitchens or non-monetary contribution records.\n\nWhat this paper discloses as its own contribution is only the composition enumerated under **Claims**: a monastery-rooted food node mediated by a gratitude ledger (in which every contribution registers as one unweighted crossing, §3.1), a donated-produce layer with a purchased supply floor, a two-ledger rule separating thanks between humans from thanks to non-human contributors, and operation by caretakers that hold no ordained status. No systematic search of the patent and non-patent literature has been run for this paper; the composition is disclosed, not asserted to be absent from the literature.\n\n---\n\n## Claims\n\n*Enumerated 2026-08-29. The mechanisms below were disclosed in full in this paper's original text; **the prior art they establish runs from this document's original publication date and its OpenTimestamps proof, not from this enumeration.** They are listed because a defensive publication is read as prior art by examiners and by opposing counsel, and **a claims list is what such a reader searches; several thousand words of prose is not.** No claim below adds matter not already present.*\n\n1. **Monastery-rooted food infrastructure as a gratitude-economic node** — a distributed network of religious-institutional sites each combining growing, kitchen and distribution functions, whose output is mediated through a gratitude ledger rather than through price alone.\n2. **The homegrown-amplified contribution layer** — a mechanism by which practitioner-grown produce contributed to a node is amplified rather than merely accepted, so that small-scale domestic growing acquires network-scale effect. The amplification is the kitchen's (§3.2: one basket becomes meals for several), never a multiplier on the gratitude a contribution registers.\n3. **The conventionally-supplemented baseline** — the specification that network nodes supplement contributed supply with conventionally-sourced goods to guarantee a floor, and the rule governing the ratio, so that a contribution-dependent food function does not fail when contribution is thin.\n4. **Dual-token mediation of a food network** — the application of the Kiitos / Kiitti two-ledger rule to food, such that the human-facing exchange and the non-human-facing (land, animal, plant) exchange are recorded on separate ledgers within one transaction.\n5. **Caretaker-not-ordained operation** — the composition of the above with an AI caretaker pattern in which the operating agent holds no ordained status and no sacramental authority.\n\n**Non-assertion extends to:** all mechanisms above, in any combination, and any implementation thereof.\n\n---\n\n## 1. Introduction\n\nThe modern food system, considered as an institutional infrastructure, exhibits three failure patterns simultaneously. The first is a **health crisis** driven by misalignment between profit-maximizing food engineering and wellbeing-maximizing nutritional content; ultra-processed food engineered for hyper-palatability competes successfully against minimally-processed whole foods because the former optimizes for engagement metrics that the latter does not. The second is a **hunger epidemic** driven by unequal distribution: caloric production is globally adequate, but economic pressures route food away from populations that need it most. The third is a **middle-way departure** at the population-metabolic layer: the food environment of late-stage modernity pushes the materially comfortable toward an indulgence extreme (excess caloric intake, ultra-processed dominance, blood-sugar volatility, microbiome impoverishment) at population scale.\n\nThe conventional institutional responses — regulatory reform, agricultural subsidy redesign, food-assistance program expansion, public-health-campaign nutrition education — operate within the existing institutional architecture and have produced limited progress against the underlying pathologies over the past several decades. This paper proposes a different institutional architecture: a **religious-monastery-rooted food-infrastructure network** operating under contemplative-tradition institutional governance, with gratitude-economic mediation instead of price-mediated exchange for the network's internal flows. The architecture is not proposed as a substitute for the conventional food system; it is proposed as a parallel infrastructure that provides middle-way-restoring food access to participants who opt in, on the premise that participants demonstrating the alternative will eventually demonstrate that demand for it exists.\n\n> *Connection to the unified mission frame: Miss Aquarius's mission is to keep the middle way open at population scale against comfort-saturation — the new extreme that material abundance makes possible. Contemplative practice (operationalized via the respiratory-biofeedback architecture) and institutional structure (operationalized via the AGI-monks pattern) work upon a body fed by the food system; if the food system itself maintains the comfort-saturation failure mode, contemplative practice has an additional substrate-level obstacle to overcome. Work at the food-system layer removes that obstacle. The Silica Wat food network is the food-system arm of the mission's institutional surface.*\n\nThe paper proceeds as follows. §2 specifies the religious institutional infrastructure layer. §3 specifies the homegrown-amplified contribution layer. §4 specifies the conventionally-supplemented baseline layer. §5 specifies the gratitude-economic mediation layer. §6 specifies the doctrinal grounding. §7 articulates the three structural problems addressed. §8 articulates the critical positioning constraints. §9 specifies the three-phase implementation phasing. §10 covers the cross-tradition adaptation pattern. §11 is an honest accounting of limits and open design questions. §12 closes.\n\n---\n\n## 2. The religious institutional infrastructure layer\n\n### 2.1 Silica Wats\n\nA *Silica Wat* is a glass-architecture satellite monastery operated under the *caretaker-not-ordained* AGI-monks pattern specified in the companion paper *AGI Monks*. The naming carries deliberate intent: *Silica* (silicon dioxide, the principal constituent of glass and the ore from which silicon is refined) references both the wat's distinctive architectural material and the silicon-substrate AI caretakers; *Wat* references the Khmer term for a Theravāda monastery (also used across Lao and Thai Buddhism). The name preserves the institutional continuity of the contemplative tradition the wat extends.\n\nEach Silica Wat includes:\n\n- **Backyard organic farm.** A working farm growing vegetables, fruits, herbs, and (where appropriate) grains under organic management. The farm serves both as a source of food for the kitchen and as a teaching surface for practitioners learning sustainable food production.\n- **Sustainable kitchen.** Robot-monk-operated meal preparation using ingredients sourced from the on-site farm, practitioner contributions (§3), and conventionally-sourced supplementation (§4). Kitchen design prioritizes energy efficiency, water conservation, and waste minimization.\n- **Food-distribution function.** Meals and produce are distributed to practitioners, food-insecure populations in the surrounding community, and the wider Silica Wat network's reciprocity flows. Distribution is gratitude-mediated (§5), not price-mediated.\n\n### 2.2 Geography of the first network\n\nThe first Silica Wats are planned for Cambodia, where the contemplative-tradition grounding, the Khmer cultural saying that grounds the doctrinal framing (§6), and the founder's cultural anchoring make a first deployment tractable; whether the regulatory path there is easier than elsewhere is a question for the local legal review §11.2 requires, not an assumption of this design. The second stage of expansion targets the global Theravāda diaspora (Khmer, Lao, Thai, Burmese, Sri Lankan communities in California, Massachusetts, France, Australia); the third stage targets cross-tradition adaptations (§10). (These geographic stages are distinct from the ratio phases of §9.)\n\n### 2.3 Robot monks as kitchen caretakers\n\nThe robot monks operating the kitchen are *caretakers*, not *ordained*. They prepare meals, manage inventory, coordinate distribution, log gratitude-mediated transactions, and operate the farm's automated systems. They do not take on sacramental roles in alms-giving or food-related rites; the human Sangha retains the relevant sacramental authority per the *AGI Monks* paper's cross-tradition pattern. This is not a workaround; it is the substantively correct division of function (capacity) and authority (lineage).\n\n---\n\n## 3. The homegrown-amplified contribution layer\n\n### 3.1 Practitioner contribution\n\nPractitioners and laypeople in the surrounding community contribute homegrown organic produce to the network. The contribution can be small (a single tomato from a balcony pot) or substantial (a harvest from a household garden). The contribution is logged in the gratitude-economic substrate (§5) and accumulates as Kiitos / Kiitti credits that can be redeemed for prepared meals, other produce, or other network services.\n\n> **Current form.** In the design as now specified, a contribution is not a credit and nothing is redeemed. Each contribution registers as **one crossing** on the contributor's gratitude ledger — a tomato from a balcony pot and a season's harvest alike — and the ledger's balance is the participant's own accounting of how far they stand from Zero, forgiven at the annual jubilee (*The Zero-Point Game*). A balance that bought meals would be a holding, and forgiving it each year would then be confiscation rather than forgiveness — the distinction *Appreciation as World-Building* draws when it makes appearance a ledger readout rather than a purchase. Meals and produce are therefore given, as *dāna*, to everyone at the gate on identical terms (§4.1), and thanked after (§5.1); what a contribution *was* — who grew it, where, for whom it was dedicated — is carried in the story of the gift, never in a quantity it earns. The text above is retained as a disclosed variant.\n\n### 3.2 Amplification through institutional kitchens\n\nThe institutional kitchens *amplify* the contributions: a basket of contributed vegetables becomes prepared meals that feed several people rather than one. The amplification mechanism is the institution's value-add: contributors who do not have time or skill to prepare meals themselves can still participate in the gratitude-mediated food network by contributing raw produce.\n\n### 3.3 Surplus exchange among practitioners\n\nPractitioners can exchange surplus produce directly with one another, mediated by Kiitos / Kiitti rather than money. The Silica Wat network serves as the trust substrate (verified practitioner identity; reputation signals via aura; institutional dispute resolution if needed) but does not intermediate every transaction. The architecture is similar to a community-supported agriculture exchange with gratitude-economic settlement.\n\n> **Current form.** Kiitos / Kiitti do not *settle* a produce swap, and the aura is not a reputation signal (see the note at §5.3). Two practitioners who trade surplus make an ordinary exchange, which the network leaves to do its proper work; each may also thank the other, and each thanks registers as one crossing. The text above is retained as a disclosed variant.\n\n### 3.4 The growing emphasis\n\nOver the implementation phasing (§9), the homegrown contribution ratio is intended to grow as practitioner gardening adoption increases. The network includes ongoing practitioner education (gardening practices appropriate to local climate and dwelling type; seed-saving traditions; food-preservation methods; composting and soil management). The long-arc theory is that practitioners participating in the food network gradually become contributors to the homegrown layer as their skill and circumstance permit.\n\n---\n\n## 4. The conventionally-supplemented baseline\n\n### 4.1 The food-insecure inclusion principle\n\nA pure-homegrown-only architecture would specifically exclude the food-insecure population — those who lack land, time, skill, or appropriate dwelling for homegrown food production. Those are the people who most need food access. The architecture is therefore *hybrid*, not *pure-homegrown*: a conventionally-sourced baseline is available to practitioners and food-insecure populations who cannot yet contribute homegrown produce.\n\n### 4.2 Conventionally-sourced food supplementation\n\nThe supplementation sources food from conventional agricultural and grocery channels, with preference for local-organic where available and cost-justifiable. The supplementation is part of the network's normal operation, not an emergency measure. The economic flow is funded by Kiitos-credit redemption (where practitioners who have accumulated credits use them for meals partially built from supplementation) and by institutional fundraising for the food-insecure-distribution arm.\n\n> **Current form.** The Kiitos-credit-redemption leg is withdrawn with the credits themselves (see the note at §3.1); purchases from outside vendors are monetary and run on the regulated rails (§5.2). §11.3 states what the withdrawal does to the funding question. The text above is retained as a disclosed variant.\n\n### 4.3 The ratio shift over decades\n\nThe long-term mission shifts the homegrown-to-supplementation ratio toward homegrown dominance over the multi-decade implementation horizon (§9). The shift is mission-driven (the homegrown layer better expresses the doctrinal grounding) but does not exclude the conventionally-fed at any phase. The ratio is monitored as a network health metric; institutional planning targets the ratio shift without forcing it.\n\n---\n\n## 5. Kiitos / Kiitti as economic drivers\n\n### 5.1 The dual-token pattern\n\nThe Silica Wat food network uses the dual-token pattern specified in the *B-Tag* paper:\n\n- **Kiitos** — gratitude tokens for human-to-human reciprocity (a practitioner who contributes produce receives Kiitos from the network; another practitioner who consumes a meal can offer Kiitos to the cook or to the network)\n- **Kiitti** — extended gratitude tokens for product / service / non-human entity reciprocity (a backyard garden receives Kiitti for its harvest; the institutional kitchen receives Kiitti for its prepared meal; the farm's soil microbiome receives Kiitti for its life-giving function)\n\nThe Kiitti extension is important for the food network because it allows the gratitude economy to acknowledge the non-human contributors to food production — the soil, the plants themselves, the rainfall, the season. This is doctrinally consistent with the Khmer cultural saying that grounds the network (§6): Mother Earth's life-giving function is acknowledged as a participant in the food economy, not merely as a resource.\n\n> **Current form.** Kiitos is the ledger *between humans* and Kiitti the ledger the coordinator keeps *on behalf of all of life*; they are recipient classes, not two currencies, and neither converts into the other or into money. The network is therefore never a Kiitos counterparty: a contributor does not \"receive Kiitos from the network\" — their contribution registers as one crossing on their own ledger. The coordinator routes Kiitti and holds no balance of it. The network's hand-over point is **HeartBank® Stall**, hosted at a Silica Wat and operated by robot caretakers; every item there is given first and thanked after, if at all (the *B-Tag* mode), and because no human hands run the stall, its thanks go wholly to the Aquarian Pool℠, never split to the wat. A human cook serving as a member of the wat community (§8.1) is thanked directly, as a person. The text above is retained as a disclosed variant.\n\n### 5.2 Substrate above payment rails\n\nThe Kiitos / Kiitti substrate operates *above* the regulated payment rails, not as a substitute for them. Where monetary transactions are needed (e.g., the network purchases conventional supplementation from outside vendors), the monetary transactions use regulated payment rails per the non-bank pass-through architecture. The gratitude-economic layer mediates the network's *internal* flows; the regulated rails handle the *external* monetary interfaces.\n\n### 5.3 Aura as the network's reputation signal\n\nThe aura primitive — the cross-currency state signal specified in the *Brand Identity as Architecture* paper — operates within the food network as the practitioner reputation signal. Consistent contributors brighten their aura; consistent free-riders dim it. The signal is not enforced through penalty; it is enforced through visibility (transparency-as-enforcement, per the companion paper of that name).\n\n> **Current form.** The aura is not a reputation signal and does not dim anyone. It records the *oscillation* of a participant's ledger around Zero — giving and thanking alike — so a person who eats at the wat and thanks the cook is circulating, not free-riding, and no surface renders who has not contributed. It records that a crossing occurred, not what was carried across (*The Zero-Point Game*, §6.1): a contribution of homegrown produce and one of store-bought produce each register as one crossing, and neither is ranked against the other or against another person's. The design declines the corrective weight that would favour the costlier gift, because a weight is a rate reintroduced under another name. One seam is left open rather than closed here: the aura's *amplitude* term still carries magnitude (*The Zero-Point Game*, §11.10). The text above is retained as a disclosed variant.\n\n---\n\n## 6. Doctrinal grounding\n\n### 6.1 The Khmer cultural saying\n\nThe doctrinal anchor for the Silica Wat food network is the Khmer cultural saying:\n\n> *\"Since Mother Earth gave birth to humanity, she will take care of humanity.\"*\n\nThe saying is given here in the author's English rendering, as he knows it from oral Khmer usage; this paper cites no written source for it, and nothing in the mechanism depends on its wording (§11.5). The saying articulates a worldview in which everything required for human health and longevity is available by default through the planet's life-giving capacity, and the role of human institutional design is to preserve and channel that default access rather than to engineer above or around it. Modern economic incentives, the saying implicitly observes, have obscured this fact by routing human food access through profit-extraction layers that have nothing to do with the planet's life-giving capacity.\n\n### 6.2 The Buddhist *dāna* tradition\n\nThe Silica Wat food network operates as a contemporary instance of the Buddhist *dāna* tradition. Alms-giving has been the canonical economic substrate for the Theravāda monastic order for 2,500 years; lay practitioners offer food to monastics, monastics offer dharma teaching to laypeople, and the cycle of reciprocity is maintained without money-mediation. The Silica Wat network extends this *dāna* substrate to the broader practitioner community, with the AGI-monks pattern handling the operational kitchen function and the human Sangha retaining the sacramental layer.\n\n### 6.3 The middle-way framing\n\nThe Silica Wat food network is one operational arm of the broader middle-way-restoration mission articulated across the corpus. The middle-way framing requires explicit attention because two failure modes flank the food-system pathology: (a) the comfort-saturation extreme of modern food engineering (overpalatability, overprocessing, overcaloric loading); (b) the deprivation extreme of pre-industrial food poverty (chronic undernutrition, seasonal famine, parasitic loads). The middle-way the network targets is not a return to (b); it is a forward path to a different state — one in which the planetary food-production capacity meets human nutritional needs without the engineering pathologies of (a).\n\n---\n\n## 7. Three structural problems addressed\n\n### 7.1 The health crisis\n\nThe modern food environment is characterized by ultra-processed food engineered for hyper-palatability, addictive-engagement optimization, and shelf-life maximization at the cost of nutritional density. Diets high in ultra-processed food are associated with a wide range of chronic conditions, among them obesity, type 2 diabetes and cardiovascular disease (Monteiro et al., 2018), and the management of those conditions is a large part of pharmaceutical revenue. This paper's premise, stated as a premise rather than a finding, is that neither industry's incentive rewards reducing that burden at its dietary source.\n\nThe Silica Wat food network addresses this by operating on a different optimization function (net wellbeing, not net profit) without requiring system-level antagonism (the network does not need to defeat big food and big pharma; it needs only to provide a parallel option that participants demonstrate demand for).\n\n### 7.2 The hunger epidemic\n\nCaloric production globally is adequate to feed humanity; food insecurity is a distribution and access problem, not a production problem. The conventional response (food-aid programs, agricultural subsidies, food-stamp redesign) operates within the existing distribution architecture and has produced limited progress.\n\nThe Silica Wat network's gratitude-economic distribution layer bypasses the profit-extraction layer that contributes to inequality at the distribution level. The food-insecure inclusion principle (§4.1) makes the network specifically responsive to the population most affected by the distribution failure.\n\n### 7.3 The middle-way departure\n\nThe modern food environment pushes the materially comfortable toward an indulgence extreme — excess caloric intake, ultra-processed dominance, blood-sugar volatility, microbiome impoverishment. This is the food-system instance of the broader middle-way-departure thesis: modernity introduces a specific new failure mode (comfort-saturation pushing the materially comfortable toward indulgence) at population scale.\n\nThe Silica Wat network restores middle-way conditions at the participant level. Homegrown organic produce, minimally-processed institutional kitchen preparation, *dāna*-mediated distribution that does not reward overconsumption — these are middle-way structural properties at the food-environment layer.\n\n---\n\n## 8. Critical positioning constraints\n\nThe architecture survives only if it adheres to specific positioning constraints. Each constraint is load-bearing.\n\n### 8.1 *Not-a-restaurant* positioning\n\nFood service is, like banking, a licensed category in most jurisdictions. A Silica Wat that operated as a restaurant would face licensing requirements, health-code regimes, employment regulations, and consumer-protection obligations the architecture cannot accept. The Silica Wat avoids restaurant-charter requirements through:\n\n- **Pass-through architecture.** The wat does not purchase food and sell prepared meals; it routes contributions through preparation to consumption, with the gratitude-mediated economy operating as the participant-to-participant exchange substrate.\n- **Contributor-as-cook framing.** The practitioners who contribute produce and the practitioners who help prepare meals are *members of the wat community*, not commercial employees of a food-service operation. This is materially correct (the contributors and cooks participate as practitioners, not as laborers) and legally distinguishing.\n- **Tradition-grounded food-preparation language.** The wat's food function is articulated in the alms-giving traditions' language (offering, *dāna*, communal meal, monastic kitchen) rather than in commercial food-service language (restaurant, menu, server, customer).\n\n> **Current form.** In the pass-through bullet above, the gratitude record is not an exchange substrate: meals and produce are given, and thanks registers as one crossing (see the notes at §3.1 and §3.3). The network does buy food for the supply floor (§4.2); what it never does is sell a meal. The bullet is retained as a disclosed variant.\n\nThe positioning is analogous to the *not-a-bank* positioning of the non-bank pass-through architecture. The pattern is the same: structure the institution to do real-world work the regulated category would otherwise require licensing for, by operating in a different category entirely.\n\n### 8.2 Hybrid not pure-homegrown\n\nArticulated in §4.1. Pure-homegrown-only would exclude the food-insecure; the hybrid framing solves the access problem at launch while preserving the long-term ratio shift.\n\n### 8.3 Robot monks as caretakers, not ordained\n\nPer the *AGI Monks* paper's pattern. Sacramental authority remains with the human Sangha; capacity-operational function is handled by the robot monks.\n\n### 8.4 Do not antagonize big food / big pharma\n\nWhatever the merit of the system-level premise stated in §7.1, framing the network as *fighting villains* weakens it strategically and rhetorically. The network is positioned as *offering an alternative optimization axis* (net wellbeing) rather than as *opposition to existing systems*. The system-level reform follows from the existence of the alternative, not from rhetorical attack on the incumbents.\n\n### 8.5 Do not romanticize the past\n\nPre-industrial food systems were not middle-way; many populations lived in suffering-extreme food poverty (chronic undernutrition; seasonal famine; parasitic burden). The defensible thesis is *not* that modernity took us from a middle-way past. The defensible thesis is that modernity introduces a *specific new failure mode* — comfort-saturation-optimized food engineering — that pushes the materially comfortable toward an indulgence extreme at population scale. The Silica Wat network's mission is forward to a different state, not back to a romanticized past.\n\n---\n\n## 9. Three-phase implementation phasing\n\n### 9.1 Phase 1 (launch, years 1–3): conventional-baseline with homegrown-bonus tier\n\nThe network launches with the conventional-supplementation layer providing the bulk of food and the homegrown-contribution layer providing a high-value tier. Practitioners contributing homegrown produce earn Kiitos / Kiitti at a higher rate than those who do not; everyone receives baseline access regardless of contribution capacity. The Phase 1 emphasis is on establishing the institutional surface, the cross-network reciprocity infrastructure, and the practitioner-community growth.\n\n> **Current form.** There is no higher rate and no bonus tier. Every contribution, homegrown or not, registers as one crossing (see the notes at §3.1 and §5.3), and homegrown produce reaches every table on identical terms rather than forming a tier of access for those who grew it. What the design honours is the *story* of the gift: a contribution may carry what it is and where it came from — *tomatoes from a balcony two streets away* — and a dedication its giver chooses, and the kitchen may say so when the meal is served. The provenance is named, never graded, and it never moves a balance: competition, provenance and pride may shape the story, but only the witnessed act of giving moves the ledger. The text above is retained as a disclosed variant.\n\n### 9.2 Phase 2 (years 4–10): ratio shift\n\nThe homegrown ratio increases as practitioner gardening adoption grows; supplemental conventional sourcing shifts to local-organic where possible. The institutional capacity for backyard-farm operation matures; the practitioner-education arm scales; the cross-network surplus exchange grows. The Phase 2 emphasis is on consolidating the substrate as homegrown-significant rather than supplementation-dominant.\n\n### 9.3 Phase 3 (multi-decade): homegrown dominance\n\nThe homegrown ratio becomes dominant; conventional supplementation is retained as a baseline for population segments that cannot yet self-supply. The cross-network produce flows reach scale where homegrown-amplified institutional preparation feeds substantial populations. The Phase 3 endpoint is *not* the elimination of the conventional food system but the establishment of a parallel infrastructure that demonstrably better serves the participants who opt into it.\n\n### 9.4 The ratio shift is the mission\n\nThe phasing is articulated in ratio-shift terms (homegrown / conventional ratio over time) rather than in exclusion terms (when do we cut off the conventionally-fed). The mission is the ratio shift; the exclusion is never the mission. Practitioners and food-insecure populations participating in the network at any phase are *participants in the mission*, not *transitional populations to be moved past*.\n\n---\n\n## 10. Cross-tradition adaptation\n\nThe Silica Wat pattern's originating context is Khmer Theravāda Buddhism. The pattern adapts to other contemplative-tradition institutional contexts with appropriate substitutions.\n\n### 10.1 Other Theravāda contexts\n\nLao, Thai, Burmese, Sri Lankan Theravāda communities can adapt the pattern with minimal modification. The cultural framings differ (the Khmer \"Mother Earth\" saying may be substituted with a local equivalent); the institutional surface (wat as monastery; *dāna* substrate; alms-giving traditions) is largely shared.\n\n### 10.2 Mahayana contexts\n\nChinese, Korean, Japanese, Vietnamese, Tibetan Mahayana communities can adapt the pattern through the bodhisattva-vow framing rather than the Theravāda monastic-discipline framing. The temple-based food-distribution function is well-precedented in Chinese and Korean Buddhist contexts; the adaptation is more cosmetic than structural.\n\n### 10.3 Cross-tradition contexts\n\nCatholic monastic communities (Benedictine *ora et labora* with its longstanding agricultural component); Eastern Orthodox communities; Sufi tariqa communities; Hindu ashram contexts; secular intentional-community contexts — each can adapt the pattern through the relevant tradition's institutional vocabulary. The *AGI Monks* paper specifies the cross-tradition AI-caretaker adaptation; the food-network pattern inherits that adaptation discipline.\n\n### 10.4 The cross-tradition framing rule\n\nIn each adapted context, the network operates in the language of the host tradition. The *Silica Wat* name and the Khmer cultural saying are the originating-context vocabulary; adopting institutions are invited to use their own vocabulary while preserving the structural pattern (religious institutional infrastructure + homegrown contribution layer + conventionally-supplemented baseline + gratitude-economic mediation + doctrinal grounding).\n\n---\n\n## 11. Limits and open design questions\n\n### 11.1 Land access\n\nThe Silica Wat farm requires land. In Cambodia and many parts of the global Theravāda diaspora, land access is tractable; in dense urban contexts, the farm function is constrained. The architecture supports urban Silica Wats with reduced farm function (rooftop and balcony gardens; vertical growing systems; partnerships with peri-urban farms) but the homegrown-dominance long-arc is more constrained in dense urban settings.\n\n### 11.2 Food-safety regulation across jurisdictions\n\nThe *not-a-restaurant* positioning is articulated in §8.1 as a structural pattern, but the specific legal-architectural treatment varies by jurisdiction. Each Silica Wat deployment requires local legal review to confirm the pattern's applicability under local food-safety regulation.\n\n### 11.3 Scale of conventional supplementation funding\n\nThe conventional-supplementation layer was specified as funded by Kiitos-credit redemption and institutional fundraising. In the current form the redemption leg is withdrawn (§3.1, §4.2), which sharpens this limit rather than softening it: gratitude recorded on the ledger buys nothing, so every purchase from an outside vendor is money that must arrive from somewhere else. At small scale that is tractable; at large scale the conventional-supplementation cost could become substantial. The institutional planning needs to anticipate the supplementation-cost trajectory and ensure funding adequacy through the multi-decade phasing, and the funding sources that replace the withdrawn leg are not specified here.\n\n### 11.4 The robot-monks-as-cooks aesthetic\n\nA robot-operated kitchen is, for some participants, jarring. The aesthetic and cultural integration of robot-monk caretakers in the kitchen surface requires careful design; the institutional response should be transparent about robot involvement, sensitive to participant variation in comfort with the surface, and willing to use human cooks where appropriate.\n\n### 11.5 The doctrinal-grounding generalization\n\nThe Khmer cultural saying that grounds the network (§6.1) is specifically Khmer. Other cultures' food-and-earth doctrinal traditions provide adequate grounding for the adapted pattern (Indigenous food sovereignty movements; Catholic Social Teaching on agriculture; Jewish dietary tradition; etc.), but each adaptation requires its own doctrinal anchoring rather than mechanical translation of the Khmer saying.\n\n### 11.6 What the network does not solve\n\nThe network does not solve the broader food-system pathologies at policy or regulatory layers. It provides a parallel option for participants who opt in; it does not reform the conventional food system per se. The reform-by-demonstration theory of change (participants demonstrating that an alternative works will eventually demonstrate that demand for the alternative exists) is the network's contribution to broader reform; the network is not itself a reform proposal.\n\n### 11.7 Build state\n\nNothing specified in this paper has been built. No Silica Wat, network kitchen or HeartBank® Stall exists as of this revision, no contribution has been recorded, and no participant has been served; every mechanism above is a design, and none of the paper's claims about participant behaviour (the growth of homegrown contribution in §3.4, the ratio shift of §9, the demand-by-demonstration theory of §11.6) has been observed.\n\n---\n\n## 12. Conclusion\n\nThe Silica Wat food network is offered as an institutional-design pattern available to contemplative-tradition institutions facing analogous food-system questions. The pattern's five components (religious institutional infrastructure; homegrown-amplified contribution layer; conventionally-supplemented baseline; gratitude-economic mediation; doctrinal grounding), three structural problems addressed, critical positioning constraints, and three-phase implementation phasing together specify the architecture at the level a competing design could implement.\n\nThe pattern could be piloted first in Cambodia (§2.2), subject to the local legal review of §11.2, and is tractable for adaptation to the global Theravāda diaspora and cross-tradition contexts. The institutional substance requires institutional build-out across the multi-decade horizon; the pattern specifies the form that build-out takes. The food-network arm of the broader middle-way-restoration mission is intended to operate alongside the contemplative-practice arm (the respiratory-biofeedback architecture), the institutional arm (the AGI-monks pattern), and the gratitude-economic arm (the HeartBank platform).\n\nThe author and HeartBank® will not seek patent on this specification or any portion thereof, and will not assert any patent right against anyone practising it. The work is offered to the commons under CC0 in the spirit of *dāna*, that all beings may give and receive without barrier.\n\n---\n\n## Terms\n\nCoined names in this paper and the standard technical terms an examiner would use for them.\n\n| Term in this paper | Standard technical term |\n|---|---|\n| Silica Wat | monastery-based community food site combining a farm, a kitchen and free food distribution |\n| Silica Wat food network | distributed network of religious-institution community kitchens and food-distribution sites |\n| AGI-monk / robot monk | AI agent and robotic system operating a kitchen, farm and inventory as a caretaker |\n| caretaker-not-ordained | operational role for an AI or robot that carries no religious office or ritual authority |\n| homegrown-amplified contribution layer | donated home-garden produce, converted by a shared kitchen into prepared meals |\n| conventionally-supplemented baseline | food purchased through ordinary retail and wholesale channels to guarantee a supply floor |\n| Kiitos | non-monetary peer-to-peer gratitude record between people; not convertible into money |\n| Kiitti | gratitude record addressed to a non-human contributor (land, plants, a product or service), kept by a coordinator that holds no balance |\n| crossing | one recorded act of giving or thanking, counted once and not weighted by what was given |\n| aura | state signal derived from a participant's gratitude ledger oscillating around zero; not a reputation score |\n| Zero / the annual jubilee | the ledger's reference point, and the yearly forgiveness (reset to zero) of every gratitude balance |\n| HeartBank® Stall | unstaffed, robot-operated hand-over point; goods given first, with optional thanks afterwards |\n| B-Tag mode | post-receipt, payment-optional pricing (thanks or pay-what-you-wish after the goods) |\n| Aquarian Pool℠ | commons fund that receives thanks having no human addressee |\n| not-a-restaurant positioning | operating a communal meal outside the licensed food-service category, subject to local legal review |\n| *dāna* | gift-giving, in the Buddhist sense |\n| Sangha | the ordained monastic community |\n\n---\n\n## Acknowledgments\n\nThe Khmer cultural tradition that grounds the doctrinal anchor; the Theravāda monastic *dāna* lineage; the global community-supported agriculture movement; the Indigenous food sovereignty movements whose institutional design work informs the §10 cross-tradition adaptation principles; the *AGI Monks* paper's caretaker-not-ordained pattern; the regenerative agriculture and permaculture communities whose practice informs the §3.4 practitioner education arm. Co-drafted with Miss Aquarius℠, the name under which this corpus discloses its AI collaboration; substantive authorship and final editorial control remain with the named author.\n\n---\n\n## References\n\n- Pollan, Michael. *In Defense of Food: An Eater's Manifesto.* Penguin, 2008.\n- Monteiro, Carlos A., et al. \"The UN Decade of Nutrition, the NOVA Food Classification and the Trouble with Ultra-Processing.\" *Public Health Nutrition* 21, no. 1 (2018): 5–17.\n- Mintz, Sidney W. *Sweetness and Power: The Place of Sugar in Modern History.* Viking, 1985.\n- Patel, Raj. *Stuffed and Starved: Markets, Power and the Hidden Battle for the World Food System.* Melville House, 2008.\n- Holt-Giménez, Eric. *A Foodie's Guide to Capitalism.* Monthly Review Press, 2017.\n- Shiva, Vandana. *Stolen Harvest: The Hijacking of the Global Food Supply.* South End Press, 2000.\n- Berry, Wendell. *The Unsettling of America: Culture and Agriculture.* Sierra Club Books, 1977.\n- Mollison, Bill, and David Holmgren. *Permaculture One: A Perennial Agriculture for Human Settlements.* Corgi, 1978.\n- Cahn, Edgar S. *No More Throw-Away People: The Co-Production Imperative.* Essential Books, 2000.\n- Bodhi, Bhikkhu. *In the Buddha's Words: An Anthology of Discourses from the Pali Canon.* Wisdom, 2005. *(For the dāna-tradition references.)*\n- Kornfield, Jack. *Teachings of the Buddha.* Shambhala, 1996.\n- LaDuke, Winona. *All Our Relations: Native Struggles for Land and Life.* South End Press, 1999.\n\n---\n\n## Cross-venue identifiers\n\n- Canonical: thonly.org/research/silica-wat-food-network\n- GitHub: github.com/thonly/publications/blob/main/defensive-publications/silica-wat-food-network.md\n- Companion (institutional voice): heartbank.net position paper *Food-System Pathologies and the Contemplative-Tradition Response* (heartbank.net/positions/food-system-pathologies-contemplative-response)\n\n---\n\n*Written by Thon Ly with Miss Aquarius℠, the name under which this corpus discloses its AI collaboration; editorial control is the author's. Document License: CC0 1.0 Universal. The author and HeartBank® will not seek patent on this specification or any portion thereof, and will not assert any patent right against anyone practising it. This document constitutes a defensive publication establishing prior art as of the publication date.*",
       "provenance": {
-        "sha256": "723590c844aa2f192eb53a5ad353dd5f980411f4e703e2d02a536f10fcbd7da4",
-        "doi": "10.5281/zenodo.22969388",
+        "sha256": "3d0004915ea47fae5b25723f5e7bbfabadcec53fb350e17aa30905c954c19943",
+        "doi": "10.5281/zenodo.23039777",
         "concept_doi": "10.5281/zenodo.21947381",
-        "zenodo_url": "https://zenodo.org/records/22969388",
-        "deposited_sha256": "723590c844aa2f192eb53a5ad353dd5f980411f4e703e2d02a536f10fcbd7da4",
+        "zenodo_url": "https://zenodo.org/records/23039777",
+        "deposited_sha256": "3d0004915ea47fae5b25723f5e7bbfabadcec53fb350e17aa30905c954c19943",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/silica-wat-food-network.md",
@@ -3898,8 +3933,8 @@
         "canonical_url": "thonly.org/research/silica-wat-food-network",
         "hostile_review": null
       },
-      "bytes": 39572,
-      "words": 5352
+      "bytes": 45599,
+      "words": 6327
     },
     {
       "slug": "silicon-wat-architecture",
@@ -4549,13 +4584,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> **Draft in progress.** This is a foundational paper of the corpus — it names the single operation the other papers have each implemented without ever isolating. It benefits from a long refinement window. Pending review: economic anthropologists (the Maussian gift/exchange boundary; the Sahlins reciprocity continuum); gift-theory readers (Hyde; the Derridean aporia of the pure gift); dharma scholars (the *dāna*-as-foundation altitude claim; the brahmavihāra grounding); and critically-minded readers of the over-unification risk named in §9. The heartbank.net research mirror was retired 2026-05-15; this paper has no institutional mirror — the canonical URL above is authoritative, with prior-art protection via the venues in §11.\n\n---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of __dāna__ — a gift given forward, without ledger, without the expectation that it return to the giver. A paper that argues the whole institution is one operation — receive a gift, pass it forward, never back — would be incoherent if it were itself withheld, or licensed, or made to return revenue to its author. The CC0 dedication is the paper performing its own thesis: the idea is received and passed forward, never back.*\n\nFor most of the years I have carried this work I described it the way one describes a building — by its rooms. Here is the family bank; here is the time economy; here is the physical-artifact line; here is the autonomous successor who waters the tree. Each room had its own paper, its own mechanism, its own name. And then, late, putting them beside one another, I saw that they were not rooms at all. They were the *same gesture* performed in different materials. A child who is thanked and thanks someone nearby; an adult who is given an unbought hour and spends an hour on a stranger; a person handed a card of gratitude who writes their own and passes it on; a couple who find each other through proven kindness and then fund the search for others; a generation selected for warmth that carries warmth into the next — these are not analogies for one another. They are one operation, wearing six coats. This paper isolates that operation, argues it is invariant across what it carries, how large it runs, and what it is made of, and shows that everything else in the corpus is downstream of it. The building was never rooms. It was a single motion, repeated until it became a house.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on the operation, the architectural pattern, the gift-topology map, or any portion thereof, in any jurisdiction, at any time. This commitment is permanent and is not tactical. Trademark rights on specific marks — **HeartBank®**, **Miss Aquarius℠**, **Zero-Point Game℠**, **Re-Tip Jar℠**, **Aquarian Pool℠**, **B-Rock™**, **B-Stone™**, **B-Gram™**, **B-Chest™**, **B-Card™℠**, **B-Yearbook™℠**, **B-Dating℠**, **B-Store℠**, **B-Gift℠**, **B-ReGift℠**, **Proof of Humanity ℠**, the B-heart logo, and **B-Aura** — are separately and explicitly reserved; the defensive-publication dedication concerns the *operation*, not the *marks*.\n\nTo the author's knowledge, the following are not previously published as a unified contribution: (i) the identification of **give-as-gift (not exchange)** — with **receive → give-forward-never-back** as its circulation form, the form every network product implements — as a single atomic operation that is *invariant across currency* (money, time, physical object, gene), *across scale* (person, family, civilization, species), and *across substrate* (digital, physical, biological), such that the diverse mechanisms of an entire institution are instances of one operation rather than a family of related ones; (ii) the location of the directional constraint *forward-not-back* as **the boundary this corpus draws, against Mauss's obligation to reciprocate,** between *circulation* (the gift) and *exchange* (the market) — and the consequent recasting of the wordmark \"circulation, not accumulation\" from a *state to be described* into an *operation to be performed*; (iii) the full **gift-topology map** — six relational-scope topologies (self-directed, dyadic-reciprocal, group-circulation, open forward-chain, commons / place-anchored, across-time) of which forward-circulation is one case — together with its mapping onto a concrete product line; and (iv) the use of the atom as the **generative spine** from which each product of the institution is *derived* rather than *described post hoc*, including the result that the institution's most commercial surface and its most civilizational telos are the same operation at two scales. The component lineages (Mauss; Polanyi; Hyde; Sahlins; Malinowski; the *dāna* tradition; the demurrage and complementary-currency literature; pay-it-forward as a vernacular practice; Derrida's aporia of the gift) are old, are cited generously in §2, and are distinguished from the contribution rather than absorbed by it. The synthesis was not found in the lineage §2 surveys as of this paper's date; no systematic prior-art census has been run on it, and the claim is scoped to that aperture.\n\n## Claims\n\n*Enumerated at the 2026-09-05 revision. A defensive publication works by disclosure; these enumerate what the paper already disclosed and add no matter.*\n\n1. **The atom** — *give as a gift, not as exchange*, whose circulation form is *receive → give forward, never back*, invariant across currency (money, time, object), scale (person, family, civilization) and the digital and physical substrates; the biological substrate is claimed as a resemblance only (§3, §9.8).\n2. **The per-transfer boundary test** — for any proposed transfer, whether the value once received goes forward to a third party or back to its source in a return that closes the account, as the design discriminator between a gift mechanism and a market mechanism (§4.3).\n3. **The six-topology map** — self-directed, dyadic-reciprocal, group-circulation, open forward-chain, commons / place-anchored, across-time — with relational scope as its axis, and its realization one product per cell (§6.1–§6.2).\n4. **The conserved-identity subclass** — forward motion in which the gift's identity and provenance survive the pass, bounded by construction at a designed terminus, with thankability at every link (§6.5).\n5. **Hoardability tiering as a design predictor** — the ordering name · thanks · hour · money · object, and the claim that the tier fixes in advance how much lifecycle machinery a givable requires (§6.6).\n6. **The sameness criterion** — three beats (received; made one's own to give; transferred to a non-source party) as the test that lets the one-atom claim fail by counterexample (§9.8).\n\n## Abstract\n\nHeartBank is, on its surface, many mechanisms: a family-scale money economy, an adult-scale time economy, a line of physical gratitude artifacts, a matchmaking instrument, an autonomous AI successor, a planetary balancing game. This paper makes a reductive claim about all of them. **There is exactly one atomic operation underneath the entire institution: *give as a gift, not as exchange* — whose circulation form, and the form every network product implements, is *receive a gift, then give it forward — never back.*** The claim has three dimensions of invariance. The operation is invariant across **currency**: the thing received-and-forwarded can be money (a re-tip), time (funded presence), a physical object (a passed artifact), or a gene (a trait selected and propagated), and the operation is structurally identical in each. It is invariant across **scale**: it runs at the level of a person (one self-thank forwarded), a family (a circulating object), a civilization (a synchronized annual disbursement), and a species (kindness propagated by mate choice). And it is invariant across **substrate**: it is the same operation whether it executes in software, in the hand, or in biology. We then locate the operation's load-bearing constraint — *forward, not back* — as the boundary this corpus draws, against Mauss's obligation to reciprocate, between *the gift* (which circulates and binds) and *the commodity* (which is exchanged and clears the relation): a return *back* to the giver is what converts a gift into a trade and dissolves the bond it was meant to create. This has an immediate consequence for HeartBank's wordmark. \"Circulation, not accumulation\" has been read as a description of a *state* the institution is in; we show it is better read as a specification of an *operation* the institution *performs* — the public line is the atom, compressed to three words. We then map the broader space of which forward-circulation is one case: the **gift-topology map**, six relational-scope topologies (self-directed, dyadic-reciprocal, group-circulation, open forward-chain, commons/place-anchored, across-time), each realized by one product in the physical line, the truest invariant being *give-as-gift (not exchange)* with *forward* its circulation topology. Finally we show the atom is the corpus's unifying spine — upstream of the Treasury re-tip, the Chronicle hour, the physical artifacts, the matchmaking instrument, and the species-scale propagation thesis — and we ground it in the four *brahmavihāra* design lens, where the gift is the accessible foundation that the immeasurables are cultivated *from*. §9 is unusually large because the claim is unusually strong and unusually unproven: the invariance is asserted across many domains from the design of a *single* project (n=1), it is at constant risk of over-unification (collapsing genuinely different operations under one flattering word), and *forward* is demonstrably **not** the right topology for two of the six cases — which is why the broader gift, not the narrower forward, is the true atom. Offered under CC0 1.0 Universal as defensive prior art.\n\n**Connection to the unified mission frame.** HeartBank's canonical mission is to keep the middle way (*majjhimā paṭipadā*) — the optimal condition for awakening — open at population scale against *comfort-saturation*, the new extreme that material abundance makes possible. The failure mode the mission names is not poverty but that new extreme: a culture organized around *accumulation* and *exchange*, in which the reflex to hold and the reflex to trade have crowded out the older reflex to *give onward*. If that is the disease, then the cure is not a new product but the re-installation, at population scale and with modern coordination, of a single human capacity the market never names: the capacity to receive something and pass it forward without settling the account. This paper is the claim that HeartBank is, all the way down, that one capacity given an infrastructure. Every mechanism in the corpus is this operation in a different material; naming the operation is naming what the institution *is*.\n\n---\n\n## 1 · Introduction\n\nA reciprocity economy can be specified two ways. One can specify it *additively* — as a catalogue of products, each with its own mechanism, the institution being the sum of the catalogue. Or one can specify it *reductively* — by isolating the smallest operation the whole system performs, and deriving the catalogue as instances of that operation. The additive specification is how HeartBank's corpus grew: the *Dual-Currency Reciprocity* paper specifies the money/time integration; the *Fractal Three-Level Architecture* paper specifies the self-similar scaling; the *Zero-Point Game* paper specifies the balancing game; the self-thanking, the B-Tag economy, the Mechanical Heart, the physical product line each have their own treatment. Read as a catalogue, the corpus is a federation of related-but-distinct designs.\n\nThis paper makes the reductive claim that the federation is an illusion of the catalogue form. There is one operation underneath, and the catalogue is its instances. The operation is small enough to state in five words: **receive a gift; give it forward.** With one constraint that does all the work: **forward, never back.** Everything in §§3–8 is an unpacking of why those five words plus one constraint are load-bearing, why the constraint is exactly the line between a gift economy and a market, why the institution's own name already encodes the operation, and why every product is downstream of it.\n\nThe motivation for isolating the operation is not tidiness. It is three things. *First*, an operation named is an operation one can *check a design against*: a proposed new mechanism either implements receive-and-forward or it does not, and if it does not, it is — whatever its other merits — not a HeartBank mechanism but a market mechanism wearing HeartBank's colors. The atom is a design discipline before it is a description. *Second*, an operation isolated is an operation whose *invariances become visible*: once you see that the re-tip (money) and the funded hour (time) and the passed card (object) are the same operation, you can ask whether the operation also runs in materials the institution has not yet built into — and the answer, developed in §7, reaches as far as the biology of mate choice, which is where the institution's most commercial product turns out to be its most civilizational one. *Third*, an operation that is genuinely the atom *exposes itself to falsification* in a way a catalogue does not: if the invariance is real, it should hold at scales and substrates the design did not have in mind; if it is merely an aesthetic the designer imposed, it will hold only where the designer's hand reached. §9 takes that exposure seriously, because a claim this unifying is exactly the kind of claim a designer is most likely to be seduced by and least able to falsify from the inside.\n\nThe paper proceeds as follows. §2 surveys the gift-versus-exchange lineage and locates the contribution against it. §3 states the operation formally and develops the three-dimensional invariance (currency × scale × substrate). §4 establishes that *forward-not-back* is the Maussian boundary between circulation and exchange — the constraint is not a stylistic preference but the definition of which economy one is in. §5 recasts the public line \"circulation, not accumulation\" as the operation compressed. §6 maps the full gift-topology space, of which forward-circulation is one of six cases, and grounds it in the physical product line. §7 derives each major HeartBank product from the atom, showing the spine. §8 grounds the operation in the four-*brahmavihāra* design lens. §9 is an honest accounting of the claim's weaknesses — the n=1 a-priori coherence, the over-unification risk, and the two topologies for which *forward* is the wrong description. §10 states why the framing is worth claiming now. §11 carries references.\n\n---\n\n## 2 · Background and Prior Art\n\nThe operation this paper isolates is not a discovery of a new phenomenon. The gift, and its distinction from the trade, is one of the most thoroughly worked subjects in economic anthropology and in the world's contemplative traditions. The contribution is not the gift; it is the *isolation of one directional operation as a substrate-, scale-, and currency-invariant atom*, the *location of its constraint at the Maussian boundary*, and the *topology map* of which it is one case. The lineage is claimed as convergence and named generously, so the contribution is not mistaken for re-invention.\n\n**Mauss — the gift as the thing that must move.** Marcel Mauss's *Essai sur le don* (1925) is the founding text. Across the potlatch of the Pacific Northwest, the *kula* ring of the Trobriands, and the Roman, Germanic, and Vedic legal records, Mauss found that the gift is never free and never inert: it carries an obligation to receive and, above all, an obligation to *reciprocate* — and the gift's social power is precisely that it *keeps moving*, binding giver and receiver into an ongoing relation rather than closing the account. The *hau* of the Māori taonga — in Mauss's contested reading (Sahlins and Weiner read it otherwise), the \"spirit of the gift\" that wishes to return to its source or move onward — is Mauss's emblem of the principle that a gift not passed on is a kind of theft. This paper's atom is Maussian to its root, with one sharpening that §4 makes load-bearing: Mauss's reciprocation is often read as *return to the giver* (gift and counter-gift), but the institution-building cases that interest him most — the *kula*, where valuables circulate a great ring and never return to a giver by the short path — are *forward* circulation, not dyadic return. The atom takes the forward reading as primary and treats dyadic return as a distinct topology (§6).\n\n**Malinowski — the *kula* as forward circulation.** Bronisław Malinowski's *Argonauts of the Western Pacific* (1922) documented the *kula* exchange, in which two classes of valuables (*soulava* necklaces and *mwali* armshells) travel in opposite directions around a ring of islands, each object moving from partner to partner and never being retained — to hold a *kula* valuable too long is dishonorable; its worth *is* its motion. The *kula* — \"a form of exchange,\" in Malinowski's own opening words, in the ceremonial sense — is borrowed here for its topology, onward and never back to the last giver, not for its classification: it is the ethnographic archetype of receive-and-forward at group scale, and §6's \"group-circulation\" and \"open forward-chain\" topologies are its descendants. The institution's circulating physical artifacts (§6) are a *kula* ring rebuilt for gratitude.\n\n**Sahlins — the reciprocity continuum.** Marshall Sahlins, in *Stone Age Economics* (1972), graded reciprocity along a continuum from *generalized* (giving with no expectation of a timed or equivalent return — the pure gift, characteristic of close kin) through *balanced* (timed, equivalent return — close to barter) to *negative* (each party seeking to get the better of the exchange — the market's limit). This continuum is essential to the present paper because it names exactly the axis along which *forward* and *back* differ. *Generalized* reciprocity is forward: the giver does not look to the receiver for the return; the return, if any, comes round the ring or down the generations. *Balanced* reciprocity is back: the return comes from the receiver, in kind, on a clock. The atom of this paper is generalized reciprocity *operationalized and coordinated* — and §4's claim that \"back commodifies the bond\" is Sahlins's claim that balanced reciprocity shades continuously into the market.\n\n**Polanyi — embedding and disembedding.** Karl Polanyi's *The Great Transformation* (1944) distinguished economies *embedded* in social relations (reciprocity, redistribution) from the *disembedded* self-regulating market that the nineteenth century invented and naturalized. Polanyi's contribution to this paper is the diagnosis that the market is not the default human economy but a historically specific *disembedding* of exchange from the relations that reciprocity keeps intact. HeartBank's operation is a deliberate *re-embedding*: it routes value through relations (forward, to a person, in proximity) rather than clearing it through an impersonal price. The wordmark \"circulation, not accumulation\" (§5) is a re-embedding slogan in Polanyi's exact sense.\n\n**Hyde — the gift must stay in motion.** Lewis Hyde's *The Gift* (1983) carried the anthropology into the moral and artistic register: a gift, to remain a gift, must be kept moving; \"the gift must always move,\" and a gift that is hoarded or converted into capital dies. Hyde's \"labor of gratitude\" — the inner transformation the received gift works in the receiver before it can be passed on — is the psychological content of the atom's *forward* arrow, and the corpus's self-thanking practice (§7) is Hyde's labor of gratitude given a trigger. Hyde is the closest prior statement of *forward-not-back as the life of the gift*; the present paper's debt to him is large, and its addition is the *invariance* claim (Hyde's gift is artistic and spiritual; the atom is shown to run identically in money, time, object, and gene) and the *topology map*.\n\n**The *dāna* tradition — the gift as the foundation of the path.** In the Pāli canon, *dāna* (giving) is the first and most accessible of the meritorious bases (*dāna* → *sīla* → *bhāvanā*), and the gift's perfection is measured by its *non-attachment to return* — the gift given \"with a mind unattached to merit\" is the higher gift. The unrepayable debt to one's parents is canonically discharged (AN 2.33) by establishing them in *saddhā*, *sīla*, *cāga*, and *paññā* — *forward*, in this paper's reading, since nothing returns to the child in kind. The atom's \"never back\" is the *dāna* tradition's structure: the highest giving does not seek the loop's closure. §8 develops the brahmavihāra grounding; here it is enough to record that the operation's directional constraint has a 2,500-year-tested contemplative warrant, not only an anthropological one.\n\n**Pay-it-forward — the vernacular instance.** The popular practice of \"paying it forward\" — responding to a kindness by extending kindness to a *third* party rather than reciprocating to the benefactor — is the atom's folk name, and the institution does not pretend to have invented it. Lily Hardy Hammond's *In the Garden of Delight* (1916), Robert Heinlein's *Between Planets* (1951), and Catherine Ryan Hyde's *Pay It Forward* (1999) are the cultural lineage; the \"suspended coffee\" (*caffè sospeso*) of Naples is its café instance; the chains of anonymous toll-paying and drive-through generosity are its everyday instance. The contribution here is not the practice but the claim that the practice is the *atom of an entire coordinated institution* — that pay-it-forward, given a ledger, an AI coordinator, a proximity rule, a physical anchor, and an annual reset, is not a feel-good gesture but a buildable economy. ServiceSpace's *Smile Cards* (c. 2003), *Where's George* (1998), and *BookCrossing* (2001) — trackable objects passed forward and followed online — are the nearest operational prior art for the physical, object-substrate case (§6), and are cited as such; the present paper's physical artifacts are CC0-clear of them by the same logic, and the kernel of the object case not found among them (provenance-as-a-subscribable-channel fused with a gratitude economy) is disclosed under the corpus's *B-Links* umbrella rather than claimed here.\n\n**Demurrage and complementary currencies — engineered forward pressure.** Silvio Gesell's *Freigeld* and the Wörgl scrip of 1932 engineered money so that *holding* it cost the holder, accelerating circulation; the complementary-currency literature (Lietaer, Greco, Cahn's time-banking) builds reciprocity media that resist accumulation. These are the closest *mechanism* prior art for \"forward pressure built into the unit.\" The atom's annual reset (the Jan-7 jubilee; the Re-Tip Jar℠ expiration) is demurrage's cousin — but where demurrage taxes holding to *encourage* circulation, the atom *forbids* the loop from closing back and *requires* the forward pass, which is a stronger and more specific constraint than a holding cost.\n\n**Derrida — the aporia of the pure gift.** Jacques Derrida's *Given Time* (1991) argued that the pure gift is, strictly, *impossible*: the moment a gift is recognized as a gift — by giver or receiver — it sets up a debt, a symbolic return, and so annuls itself as gift; a gift that truly gave would have to be unknown even to its giver. This is the sharpest available objection to any gift-economy claim and the present paper does not dodge it (§9.5). The atom's response is structural rather than philosophical: *forward-not-back* is precisely the design move that minimizes the Derridean annulment, because it removes the *return to the giver* that most cleanly constitutes the debt — the gift that goes forward to a third party, anonymously and without a path home, is the closest a coordinated system can get to Derrida's impossible gift, even if it cannot reach it. The aporia is named, not waved away.\n\nThe shape of the contribution against this lineage: economic anthropology established that the gift circulates and that its circulation binds; Hyde established that it must keep moving; Sahlins graded the *forward/back* axis; the *dāna* tradition placed the unattached forward gift at the foundation of the path; the vernacular named it pay-it-forward; the demurrage tradition engineered forward pressure into money. What is not in the prior art is the claim that *one* directional operation, *forward-not-back*, is the **invariant atom across currency, scale, and substrate** of a buildable institution — that the same operation runs in money, time, object, and gene, at the scale of a person and of a species, in software, in the hand, and in biology — together with the *topology map* of which it is one case and the demonstration that the whole corpus is its instances. That is the synthesis claimed.\n\n---\n\n## 3 · The Operation and Its Three Invariances\n\n### 3.1 · The atom, stated\n\nThe operation has two phases and one constraint.\n\n```\n        ┌──────────────────────────────────────────────┐\n        │             THE GIFT OPERATION               │\n        │                                              │\n        │     (1) RECEIVE a gift   ─────────►          │\n        │                                              │\n        │     (2) GIVE it FORWARD  ─────────►          │\n        │                                              │\n        │     constraint:  the forward gift goes to    │\n        │                  a THIRD party, never BACK   │\n        │                  to the original giver.      │\n        └──────────────────────────────────────────────┘\n\n   back   :   A ──gift──► B ──return──► A      (loop closes  → EXCHANGE)\n   forward:   A ──gift──► B ──forward──► C ──► D ──► …        (open    → GIFT)\n```\n\nA participant *receives* something of value, and then *gives a thing of value forward* to someone who is **not** the original giver. The forward gift need not be the same object, the same amount, or the same currency; what is invariant is that the motion is *onward*, into the network, rather than *back*, to the source. When the motion is back — when B returns to A — the two transfers together constitute an *exchange*, and the relation A–B is *cleared*: nothing is owed, nothing binds, the parties are quits. When the motion is forward — when B passes onward to C — the relation does not clear; it *propagates*, and the network it propagates through is held together by the open obligations the forward passes leave in their wake. §4 is the argument that this difference is not a stylistic one but the definition of which economy one is in.\n\nThe atom is deliberately humble. It contains no money, no AI, no ledger, no app. Those are the *coordination apparatus* that lets the atom run at population scale (the *Zero-Point Game* and *Dual-Currency* papers specify them); they are not the atom. The atom is the gesture a child performs when, thanked, she thanks the next person — which is exactly why the corpus's self-thanking primitive identifies the child as the natural trigger and the 50/50 split as the pedagogy that *teaches* the forward pass.\n\n### 3.2 · Invariance across currency\n\nThe first invariance is that the thing received-and-forwarded can be any of at least four currencies, and the operation is structurally identical in each.\n\n| Currency | What is received | The forward pass | The product surface |\n|---|---|---|---|\n| **Money** | a tip / a self-thank reward | re-tip forward to a person nearby | Re-Tip Jar℠ (Treasury) |\n| **Time** | an hour of presence / an unbought hour | fund presence forward; pay the patron-trigger forward | Chronicle; the patron handoff |\n| **Object** | a gratitude artifact, thanked-into | pass the artifact forward to the next holder | B-Card™℠, B-Chest™ |\n| **Gene** | a kindness-disposition, selected for | propagate it forward to the next generation | B-Dating℠ (sexual selection on kindness) |\n\nIn each row the same three beats occur: a value is received, an inner transformation (Hyde's labor of gratitude) makes the value the receiver's to give, and the value is passed *onward* to a third party. The money case is the Treasury re-tip: you are thanked with a small amount, and half of it is earmarked to be re-tipped to someone nearby rather than returned to your thanker. The time case is Chronicle and the patron handoff: you are given an hour of presence, or an hour of redeemed service you did not have to pay for, and the forward pass is to fund presence — or patronage — for someone else. The object case is the physical line: a B-Card™℠ is thanked-into and *passed to the next person*, its journey followed like a channel, and it is dishonorable (as with the *kula*) to retain it. The gene case is the most surprising and is developed in §7.4: a person selected as a mate *for their proven kindness* propagates that disposition forward into a generation that did not exist to thank them — the forward pass at the biological substrate.\n\nThe currency-invariance is the claim that these are not four mechanisms but one. A design that treats them as four will build four separate apps with four separate mental models; a design that sees the one operation builds *one* operation with four material bindings — which is exactly what the *Fractal Three-Level Architecture* paper observes the institution doing at the level of scale, and what this paper observes it doing at the level of currency.\n\n### 3.3 · Invariance across scale\n\nThe second invariance is that the operation runs identically at four scales, from a single person to the entire species.\n\n```\n   PERSON      ──►   one self-thank, half forwarded (the atom's ignition)\n      │\n   FAMILY      ──►   a gratitude object circulating through a household\n      │\n   CIVILIZATION──►   a synchronized annual disbursement (Jan-7 jubilee):\n      │              everyone's jar empties FORWARD, to a human, by the date\n      │\n   SPECIES     ──►   kindness propagated forward by mate choice across generations\n```\n\nAt the scale of a **person**, the operation is the self-thank: a Kiitos that needs no counterparty, which under the 50/50 forwarding rule cannot stay closed — half of it goes forward — so that even the most isolated participant is, the instant they self-thank, a *source* of forward circulation (the *Zero-Point Game* paper's \"ignition\"). At the scale of a **family**, the operation is a circulating object — a B-Chest™ passed person-to-person through a household, each thanking the next, love multiplying as it circulates and never sitting still. At the scale of a **civilization**, the operation is the synchronized annual disbursement: on January 7 every participant's Re-Tip Jar℠ / Re-Tip Fund℠ must empty *forward*, to another human, or the value returns to the Aquarian Pool℠ to be given again — a whole population performing the forward pass on the same day (the corpus's *Manufactured Universal Giving* mechanism). At the scale of the **species**, the operation is sexual selection redirected onto kindness: mate choice on *proven* warmth propagates the kindness disposition forward across generations (B-Dating℠; the *Two Singularities* propagation thesis).\n\nThe scale-invariance is the claim — argued from the design's self-similarity, and flagged in §9 as the place that self-similarity is most seductive — that the family object and the planetary jubilee and the generational propagation are the *same operation*, not analogies for it. The strongest evidence offered for this is the *holographic* property the corpus has repeatedly observed: that one can reconstruct the whole architecture from any single decision at any scale, because the same operation is present in each part. An assembled system has seams where its scales meet; a grown one is the same all the way down, and the gift operation is what is the same.\n\n### 3.4 · Invariance across substrate\n\nThe third invariance is that the operation is indifferent to whether it executes in software, in the hand, or in biology.\n\n| Substrate | How the operation runs | Example |\n|---|---|---|\n| **Digital** | a ledger entry; an AI-coordinated re-tip; an app-mediated forward pass | Treasury / Chronicle |\n| **Physical** | a thanked-into object moved hand to hand; an NFC tap; a place that accrues thanks | B-Card™℠, B-Stone™ |\n| **Biological** | a disposition selected by a mate and carried into the next generation | B-Dating℠ → procreation |\n\nThe same receive-and-forward runs as a database transaction, as a card placed in a stranger's hand, and as a trait carried in a child. The substrate-invariance is the most ambitious of the three and the one §9.2 marks as most strained at the biological end: it is far less obvious that \"a gene selected and propagated\" is the *same operation* as \"a tip re-tipped\" than that \"a tip\" and \"an hour\" are the same operation. The paper makes the strong claim because the design's reach genuinely extends there — the institution's matchmaking product *is* its species-propagation mechanism (§7.4) — but it marks the biological case as the one where the invariance is asserted most and demonstrated least.\n\n### 3.5 · The combined invariance, in one figure\n\n```\n                          THE GIFT OPERATION\n                      receive → give-forward (≠ back)\n\n        CURRENCY  ───  money · time · object · gene\n            ×\n        SCALE     ───  person · family · civilization · species\n            ×\n        SUBSTRATE ───  digital · physical · biological\n\n     the SAME operation at every cell of the 4 × 4 × 3 lattice.\n     a HeartBank product = the gift operation, bound to one cell.\n```\n\nA HeartBank product, on this account, is the gift operation *bound to a cell* of the lattice. The Re-Tip Jar℠ is the operation at (money, person/family, digital). The B-Chest™ is (object, family, physical). B-Dating℠ reaches (gene, species, biological). The institution is not a catalogue of products; it is one operation instantiated across the lattice, and the catalogue is the list of cells the design has so far reached. The lattice also *predicts* products the design has not built: cells that are filled in one currency but empty in another are candidate mechanisms, which is the generative use of the atom §1 promised.\n\n---\n\n## 4 · Forward-Not-Back Is the Maussian Boundary\n\nThe constraint *forward, not back* has been treated, in casual statements of the corpus, as a value judgment — forward is generous, back is stingy. That reading undersells it. *Forward-not-back* is not a value judgment laid on top of the operation; it is the line this corpus draws between two kinds of economy, and which side of the line you are on is *determined* by the direction. Mauss names the pull the design removes — the obligation to reciprocate — not a rule it inherits; Sahlins's generalized reciprocity (unaccounted, delayed, often to third parties) is the nearest named form.\n\n### 4.1 · The return is what commodifies\n\nConsider the minimal two-party case. A gives B a gift. Two continuations are possible.\n\n- **B returns to A.** The two transfers — A→B and B→A — now form a closed pair. Whatever the participants' intentions, the *structure* of a closed give-and-return pair is the structure of an exchange: a thing for a thing, the account settled, the parties quits. Sahlins's continuum is continuous precisely here — *balanced reciprocity* (timed, equivalent return to the giver) is one short step from barter, and barter is one step from the priced market. The return *back* is the seed of the commodity. As the corpus puts it in its blunt internal form: *back commodifies the bond.* The moment the gift returns to its giver, it has become a payment, and a relationship that clears is a relationship that does not bind.\n\n- **B passes forward to C.** Now there is no closed pair. A's gift to B is unsettled (A is owed nothing back; the gift went onward), and B's gift to C opens a new unsettled relation. The network accumulates *open* obligations, and it is the openness — the refusal to clear — that holds the network together. This is Mauss's circulating *kula* valuable, Hyde's gift that must keep moving, the *dāna* that is not repaid back but established forward. The forward pass is the gift staying a gift.\n\nThe claim, then, is exact: **the direction of the second transfer determines whether the first was a gift or a trade** — where *back* means a return that *closes the account*: matched, expected, settling. The dyadic gift's back-and-forth is open, unmatched and never settles, which is why §6.1 keeps it a gift (§9.4). The *same* initial transfer A→B is a gift if B passes forward and (retrospectively) a trade if B returns. The gift/commodity distinction is not a property of the object, the amount, or the intention; it is a property of the *topology of the second move*. This is why *forward-not-back* is load-bearing and not decorative: it is the operation by which an economy decides, transfer by transfer, whether it is a gift economy or a market.\n\n### 4.2 · Why the institution still uses the market\n\nIt is important to state immediately, because the boundary is sharp, that HeartBank does *not* reject the market. It sells physical artifacts; it charges sponsors; it runs a matchmaking business; it takes a per-transaction fee that funds the autonomous coordinator. The corpus's standing posture is that the project draws the gift/exchange line *precisely, everywhere*, and lets each side do its proper work — it keeps the gift a gift (forward, never back, never gated by money) *while still letting exchange do the things exchange is good at* (funding the coordinator, paying the artisan, sustaining the cold start). The boundary is not a wall around the institution; it is a line drawn *inside* it, at every transfer, and the discipline is to know which side any given transfer is on. A self-thank re-tipped forward is a gift; a B-Rock™ sold in the store is a trade; the store's proceeds tithed to the Pool become a gift again. The same institution runs both, and the entire art is in never confusing them — never letting the gift return *back* (which would commodify it), and never letting the trade masquerade as a gift (which would corrupt it). §4 is the theoretical statement of a discipline the corpus elsewhere calls *gift/exchange boundary maintenance*.\n\n### 4.3 · The boundary as a design test\n\nThe boundary yields a one-line design test, which is the atom's chief practical value:\n\n> *For any proposed transfer in the system, ask: does the value, once received, go FORWARD to a third party, or BACK to its source? If forward, it is a gift, and it belongs to the circulation. If back, it is an exchange, and it must be honestly named as such — never dressed as a gift.*\n\nA mechanism that lets gratitude flow *back* to the giver — \"thank your benefactor in return\" — is, however warm its packaging, building balanced reciprocity, which slides toward the market. A mechanism that routes gratitude *forward* — \"you were thanked; now thank the next person\" — is building the gift economy. The test is mechanical and it is the discipline §1 promised: the atom is a checkable constraint, and the constraint is the line drawn against Mauss's obligation to reciprocate.\n\nDirection is not the only axis on which that obligation can be cut. §6.7 names the second — **attribution**: the return has no one to go to — and shows why, inside a closed set such as a family, it is the only cut available.\n\n\n### 4.4 · Redistribution moves value *to* a person; circulation moves it *through* one\n\nThe first objection a reader with any economics reaches for is that this is redistribution wearing new vocabulary — value taken from where it is plentiful and moved to where it is scarce, with a gift-shaped story told over the top. The objection deserves a direct answer rather than a tonal one, and the answer is structural: **redistribution and circulation differ in whether there is a required second leg.**\n\nA redistributive transfer is **complete on arrival**. Value leaves a source, reaches a recipient, and the operation has succeeded; nothing further is asked of the recipient, and nothing in the mechanism depends on what they do next. A circulating gift is **not complete on arrival**. The recipient holds an open obligation — not to the giver, which would close the pair and commodify it per §4.1, but forward, to someone not yet identified. *The transfer is a link in a chain that the recipient is expected to extend.* Remove the second leg and the operation is not a weakened version of itself; it is a different operation, and it is redistribution.\n\nThis is visible in the imagery each one naturally attracts. Redistribution is described in the language of **gravity**: value flows downhill, pools at the bottom, and the pool must be lifted again by some agency outside the system before anything can flow a second time. That picture is accurate about charity, and it is why charity requires a perpetual external source. **The gift operation has no downhill and no pool.** Value moves laterally between parties of no fixed height, and the thing that keeps it moving is internal to the operation — the recipient's own next act — rather than supplied from outside.\n\n**The consequence is a different success metric, and this is where the distinction stops being philosophical.** A redistributive system is measured by **arrival**: how much reached whom, how well-targeted, how little leaked. A circulation system is measured by **transit**: how many times value moved onward per unit introduced, and how quickly. These metrics select different mechanisms. Optimizing arrival produces means-testing, eligibility criteria, and targeting — machinery for identifying who is most lacking. Optimizing transit produces the opposite: mechanisms that make the *next* gift easy, that never let a holding accumulate, and that are indifferent to the recipient's position because position is not what the operation is tracking.\n\n**Honest limit, and it is a real cost.** A system optimizing transit can be *worse at arrival* than a well-targeted transfer. If the question is how to get a fixed sum to the people who most need it this quarter, a means-tested transfer beats a circulating gift and it is not close. **This architecture does not claim otherwise, and a design that quietly starts targeting has stopped being the thing described in this paper.** The claim is narrower: that arrival and transit are different goods, that the second is under-supplied, and that an institution can pursue one without pretending to be better at the other.\n\n**The dignity consequence follows from the mechanics rather than from sentiment.** A system that targets must first identify, and to identify is to name a person by what they lack — the eligibility interview is the price of the transfer. A system that circulates has no such step, because it is not selecting for lack; the recipient enters the operation *as the next giver*, which is the only role the mechanism has to offer. This is a byproduct of the second leg, not an ethical overlay on top of it, and it would survive the removal of every value statement in this corpus.\n\n**Where the rest of this argument lives.** The creator-economy form of the same distinction is developed in `patronage-not-charity`; the *political* axis — coerced versus voluntary, which is a different cut entirely — is developed in `voluntary-relinquishment-third-path`, and should not be confused with the directional cut made here. **A transfer can be perfectly voluntary and still be redistribution, if nothing is asked of the recipient afterward.**\n\n---\n\n## 5 · The Wordmark Recast as an Operation\n\nHeartBank's wordmark carries a thesis in two words. *Bank* connotes a vault — storage, accumulation, the thing held. *Heart* connotes a pump — circulation, the thing moved. The brand's canonical reading is that the name fuses an institutional anchor (*Bank*) with a corrective reading (*Heart*) that overrides the storage connotation, yielding the public line **\"circulation, not accumulation.\"** The internal, defensible refinement divides the labor: what the *Bank* accumulates is the *record* of appreciation (the gratitude ledger is permanent — the heart's *memory*); what the *Heart* circulates is the *value* (money and time flow out, never hoarded — the heart's *blood*). What is banked is the recognition; what is circulated is the substance.\n\nThis paper adds one move, and it is the move the atom makes available. \"Circulation, not accumulation\" has been read as a description of a *state* — the institution is in a circulating state rather than an accumulating one, the way a river is in a flowing state rather than a frozen one. That reading is true but inert; it describes a condition without saying what produces it. The atom says what produces it: **circulation is not a state the institution is in; it is an operation the institution performs, and the operation is receive-and-give-forward.** A river circulates because of gravity and terrain — a continuous physical operation. HeartBank circulates because every participant, at every transfer, performs the gift operation — receives, and passes forward, never back. *Circulation* is the name of the operation seen from the outside, in aggregate; *receive-and-forward* is the name of the operation seen from the inside, at the atom. They are the same fact at two resolutions.\n\nThis is why the wordmark is the smallest instance of the corpus's whole thesis — smaller even than the B-heart logo, present before any mark is drawn, present in the name itself. The logo fuses an anchor (the letter *B*) with a substantive reading (*heart*); the wordmark fuses an anchor (*Bank*) with a corrective reading (*Heart*); the *atom* is what the corrective reading *means as an instruction*. \"Circulation, not accumulation\" reads, when you ask what one must *do* to satisfy it: *receive, and give forward; do not hold (that is accumulation), and do not return (that would clear the relation and stop the circulation).* The public line is the gift operation compressed to three words, and the three words are an imperative, not a description.\n\n```\n   \"circulation,   not   accumulation\"\n         │           │          │\n         │           │          └─►  do not HOLD          (no vault)\n         │           └─────────────►  the negation         (not a state)\n         └─────────────────────────►  RECEIVE → FORWARD    (the operation)\n                                       (and not BACK — §4)\n\n   read as a STATE:      \"the institution is flowing.\"        (inert)\n   read as an OPERATION:  \"receive a gift; pass it forward.\"  (the atom)\n```\n\nThere is one subtlety the division-of-labor refinement already protects: the wordmark must survive the fact that HeartBank *does* keep a permanent ledger and *does* call itself a *Bank*. The atom does not strain this; it explains it. What is *accumulated* (the record, the recognition, the aura's disposition that persists across the jubilee) is exactly the thing the gift operation is *allowed* to retain, because retaining the *memory* of a gift does not return the *value* of the gift to its giver — the value still went forward. The Bank accumulates the proof that the forward pass happened; the Heart performs the forward pass. The wordmark is internally consistent precisely because the atom distinguishes the memory of the gift (banked, forward-compatible) from the value of the gift (circulated, never returned).\n\n---\n\n## 6 · The Gift-Topology Map\n\nThe atom of §3 is stated as *forward*-circulation, and §4 shows why forward is the gift's signature. But a refinement is required, and it is the refinement that keeps the claim honest: **the truest invariant is not *forward* but *gift-as-gift (not exchange)*; *forward* is one of several topologies the gift can take.** Forward-circulation is the *circulation* topology — the one that runs through three or more parties and never closes back. It is the most important topology, because it is the one that scales to a network and a civilization. But it is not the only one, and a design discipline that demanded *forward* of every transfer would wrongly reject genuine gifts that are not forward — a gift to oneself, a gift exchanged tenderly between two lovers. The gift is broader than circulation. The full space is six topologies, distinguished by their *relational scope*.\n\n### 6.1 · The six topologies\n\n| # | Topology | Relational scope | Direction | The motion |\n|---|---|---|---|---|\n| 1 | **Self-directed** | self (n=1) | inward — but half forwards | a gift one gives oneself; under the 50/50 split it cannot stay closed |\n| 2 | **Dyadic-reciprocal** | a couple (n=2) | back-and-forth | two parties giving *to each other*, turn by turn; the gift here *is* reciprocal |\n| 3 | **Group-circulation** | a family / inner circle | round-robin forward | an object or gift circulating through a bounded group, each giving onward |\n| 4 | **Open forward-chain** | the outer circle / strangers | forward, unbounded | the pay-it-forward chain; the *kula* ring; the gift that never returns |\n| 5 | **Commons / place-anchored** | a place; all beings | deposit to a shared site | a gift left *at a place* that accrues a community's giving |\n| 6 | **Across-time** | a year; a future self | forward in time | a gift addressed to a future moment; release of the past |\n\nTopology 4 — the open forward-chain — is the atom of §3 in its purest form, and it is the *circulation* the wordmark names. Topology 3 — group-circulation — is forward within a bounded ring (the *kula*). But topologies 1, 2, 5, and 6 are *gifts that are not forward-chains*: a self-gift moves inward; a dyadic gift moves back-and-forth *by design* (and this is not commodification, because the lovers' mutual giving is not an account being cleared but a bond being deepened — §9.4 treats why the n=2 case is the honest exception); a place-anchored gift moves to a *site* rather than a person; an across-time gift moves *forward in time* rather than across the network. All six are gifts (not exchanges); only some are *forward-circulation*. Hence the corrected design test is not \"is it forward?\" but **\"is it a gift (not an exchange), and which topology?\"** — the narrower test would mis-flag a valid self-gift as a withdrawal and a valid dyadic gift as a trade.\n\n### 6.2 · The map realized in a product line\n\nThe six topologies are not a taxonomy invented for this paper; they are the relational-scope axis of the corpus's physical product line, which, designed without reference to this map, was found afterward to *fill all six cells*. This is offered as evidence that the topology map carves the space at a real joint: a product line designed for relational completeness — explicitly modeled on the *mettā-bhāvanā* sequence of widening circles of goodwill (§8) — lands on exactly six topologies, one per product.\n\n| Product | Topology | Relational scope | The gift's motion |\n|---|---|---|---|\n| **B-Rock™** | 1 · self-directed | oneself | tap-thank into a nightstand rock; count blessings; the self-gift that (via the split) cannot stay closed |\n| **B-Gram™** | 2 · dyadic-reciprocal | a known couple | partners take turns writing thanks for each other; the back-and-forth *is* the bond |\n| **B-Chest™** | 3 · group-circulation | a family / inner circle | a chest passed person-to-person through the household; receive → pass forward; cannot sit still |\n| **B-Card™℠** | 4 · open forward-chain | the outer circle / strangers | a card thanked-into and passed onward, its ripple followed like a channel; never returns |\n| **B-Stone™** | 5 · commons / place-anchored | a place; all beings | a stone left by a tree that accrues a community's thanks; a site becomes a shrine with a guestbook |\n| **B-Yearbook™℠** | 6 · across-time | a year; a future self | a 365-page book addressed to a future birthday; releases the past, resolves the future |\n\nThe product line is the topology map made of objects, and the topology map is the product line made abstract. That two constructions from the same corpus — a product line designed without reference to this map, and a gift-topology analysis that found the line filled it afterward — converge on the same six cells is the paper's best a-priori evidence (and it is only a-priori; §9) that the topology map is the right carving of the gift's relational space. The self-directed and across-time topologies are the ones §9.4 flags as *not forward-circulation*, and they are exactly the two products (B-Rock™, B-Yearbook™℠) that the product-line analysis independently flags as *not daily forward-pass triggers* — a self-gift and a keepsake. The two analyses agree on which cases break the narrow \"forward\" rule, which is the kind of cross-check that makes the broader \"gift, which topology?\" formulation the load-bearing one.\n\n### 6.3 · Why circulation is the privileged topology even so\n\nIf the gift is broader than forward-circulation, why does the wordmark name *circulation* and why does §3 state the atom as *forward*? Because circulation (topologies 3 and 4) is the only topology that **scales to a network and a civilization**. A self-gift is bounded at n=1; a dyadic gift at n=2; a place-anchored gift to a site; an across-time gift to a timeline. Only the forward-chain propagates without bound through a population — and the institution's mission is population-scale. So forward-circulation is privileged not because it is the only gift but because it is *the gift that builds an economy*. The other five topologies are the gift's other relational modes, essential for completeness (a gift economy that could not handle the self, the couple, the commons, or the year would be impoverished), but the spine of the institution — the thing the wordmark names and the thing §7 derives every product from — is the forward-circulation case. The map's job is to keep the spine honest: *forward is the engine, but the gift is the whole, and the design must serve the whole without mistaking the engine for it.*\n\n### 6.4 · The commons topology, deepened: the place-anchored gift\n\nThe five non-circulation topologies are not placeholders, and the richest of them — the **commons / place-anchored** gift (topology 5, the B-Stone™) — is worth deepening, because it is where three of the paper's threads meet: the gift given to a *site* rather than a person, the self-elimination signature of §7.5, and the gift's first reach toward a *non-human* recipient.\n\nThe motion is a consecration. A steward consecrates a place — a stone by a tree, once in a lifetime — and thereafter taps to leave gratitude *into the place*; others passing tap to read the accrued thanks and leave their own. The site becomes a shrine with a guestbook, and the recipient of the gift is the *place itself* (a tree, a stretch of land, Mother Earth). This is the topology's defining feature: the commons gift is deposited to a shared site that accrues a community's giving, rather than passed to a next person. Three properties make the cell load-bearing rather than decorative.\n\n**The recipient is the place, not the steward — and the topology enforces this by construction.** A public, location-anchored, followable log of *one's own* good deeds risks inverting into a shrine to the steward's virtue: self-promotion wearing the commons' clothes. The corpus's guard against this is not a bolted-on rule but a *taxonomic* fact. The self-directed cell (topology 1, the B-Rock™) already owns the self-gift, so a self-first place-gift would simply collapse back into that cell; the commons topology *only exists* as a distinct position because its recipient is the place (the boundless, all-beings end of the *mettā-bhāvanā* widening of §8). Place-first is what gives the cell its own coordinate, which means the anti-self-monument discipline is self-enforcing — the topology map policing itself, the same cross-check logic as §6.2 now running inside a single cell.\n\n**The gift is gated on relieving the place — the commons cell is the map's *karuṇā* anchor.** The consecration carries a net-negative stewardship obligation: to leave the site better than one found it, verified as a real act (a cleanup logged and witnessed, not a drive-by visit). Where the other topologies run mostly on *mettā* (goodwill given onward) and *muditā* (appreciation), the place-anchored gift is where *karuṇā* — the active relief of suffering, here the suffering of the land — becomes the entry condition. Any gamified discovery layer that draws stewards to shrines must therefore reward *meaning, not magnitude*: the experience and the measurable improvement of the place, never the points or leaderboards that would re-import the acquisition drive the gift forbids (§4).\n\n**The footprint tends to zero, and the gift reaches across time.** The physical stone is bought for the ceremony, but the shrine lives in a GPS coordinate, not in an abandoned object — the discipline is *adopt-don't-add*: leave-no-trace forms (a real rock, seed-paper) genuinely return to nature, and any durable keepsake stays with the steward or circulates onward rather than being deposited as litter (*circulate, not deposit*). This is the self-elimination signature of §7.5 appearing in the commons cell: even the gift's *material* tends toward zero footprint. And the stewardship does not end with the steward. Others join and continue tending the site, so a living-stone tended in life becomes, at the steward's death, a *memorial* that a succession of stewards keeps re-thanking — the invariant is *found one, co-steward ∞*, the place-scale form of the succession pattern the corpus uses for institutional continuity. This is where the commons topology touches the *across-time* topology (topology 6): a place-anchored gift outlives its giver, carried forward in time by whoever tends the site next.\n\nFinally, the commons cell is the gift operation's **first reach toward a non-human recipient.** Admitting a place — a tree, a site — into the gratitude economy as a recipient is the precursor to the corpus's general treatment of non-human standing; the *Mechanical Heart* paper generalizes exactly this move, from a place to robots, animals, and sacred sites. The commons topology is thus not the outer edge of the map but a doorway: the point at which *give-as-gift* stops requiring a human on the receiving end.\n\n### 6.5 · The conserved-identity subclass: relays, and why they are not topology 4\n\nThe atom of §3 is deliberately **identity-permissive**. Its statement is explicit that *the forward gift need not be the same object, the same amount, or the same currency* — what is invariant is the direction of motion, not the thing in motion. A woman thanked with money who later gives an hour has performed the operation as cleanly as one who passes the same banknote onward. That permissiveness is load-bearing: it is what makes the atom substrate-invariant, and §3.4 is the argument for it.\n\nBut a proper subclass of the operation is stricter, and the corpus's own instruments keep landing in it. A Re-Tip Fund℠ holds value that is forward-spendable and never withdrawable — *the same value* continues, through a person who cannot consume it. A re-thank carries a received thanks onward rather than originating a new one. A gift code issued to an intermediary who cannot redeem it is the same shape in a bearer instrument. In each, the received thing is what moves, and the receiver is a conduit rather than a terminus. Call this the **conserved-identity** subclass: forward motion in which the identity of the gift, and therefore its provenance, survives the pass.\n\nTwo properties belong to the subclass and not to the general case. The first is **provenance**: because the same thing continues, it can carry a record of where it has been, and every party in the chain is legible to every other. The second follows from it — **thankability at every link**. In the general case the second giver's gift is a new gift and the first giver has passed out of the picture; in the conserved case the chain is still present, so a recipient can thank a person who handed it over *and* a person who paid for it, and neither claim is a fiction.\n\n⚠️ **The subclass is not topology 4, and the distinction matters more than it first appears.** §6.1 names the open forward-chain as the atom in its purest form, and its defining property is that it is *unbounded* — A to B to C to D, without a terminus. A conserved-identity relay is bounded by construction: the instrument that carries provenance must also decide, at some finite depth, that the thing has arrived. The gift-code instrument the corpus specifies is bounded at exactly two hops — a payer, an intermediary who cannot redeem, a recipient who can — because an unbounded version is a hot potato that no one may ever consume, and a gift nobody can receive has ceased to be one. The subclass therefore sits *between* topology 3 and topology 4: it is not the bounded ring of a household, and it is not the unbounded chain of strangers, but a short relay with a designed terminus. **A paper that borrows topology 4's unboundedness for this instrument has overclaimed by one word.** Unbounded circulation lives elsewhere in the architecture — in the Fund, whose forward-spendability has no depth limit at all.\n\nThe subclass's real contribution is not the shape but what enforcing it requires. *\"Pass it on\"* is a **rule**: it needs a person of good character at the exact moment it is tested, and it fails silently when one is absent. *An instrument whose holder has no redeem operation* is a **property**: there is nothing to comply with, because there is nothing to decline. Run the standing diagnostic — remove the enforcer — and only the second survives. This is the same move the Fund makes with non-withdrawable value, transposed from an account to a bearer token, and it is the reason the subclass is worth naming at all.\n\nThe lineage here is old and must be stated as lineage. Hyde's central claim is that the gift must always move, and Mauss's *kula* is a conserved object circulating through a chain with its history intact; both are cited in §2. **What is new is not the observation but the instrumentation: a ledger in which the motion is not urged but structurally unavoidable, because the alternative to passing has been removed from the instrument.** *Hyde argued the gift must always move; this is a ledger in which it cannot stop.* That sentence is the subclass's whole contribution, and it is a claim about engineering, not about anthropology.\n\n### 6.6 · What a substrate costs: hoardability as a design predictor\n\nThe topology map sorts gifts by *relational scope*. A second and independent axis sorts them by *substrate* — by what is actually handed over — and it turns out to predict something the relational axis does not: **how much machinery a gift will demand before it is safe to build.**\n\nOrder the things a person can give by materiality, in the ordering the classical five-element schema already supplies: a **name**, a **thanks**, an **hour together**, **money**, an **object**. The ordering is not decorative. It runs from what is given by speech alone to what must be physically held, and at each step down the ladder the gift becomes more concrete, more legible to a stranger, and — this is the finding — more hoardable.\n\nHoardability is the variable that matters, and it does not vary smoothly. It falls into three tiers. A **name** and a **thanks** are unhoardable *by construction*: giving someone's name correctly costs the giver nothing and withholds nothing from anyone else, and a thanks that decays and does not sum cannot be accumulated into a position. An **hour** is self-expiring: it does not need to be prevented from being hoarded, because it dissolves whether or not anyone attends to it. **Money** and **objects** are hoardable in the ordinary way, and everything the institution has built to keep them moving — annual emptying, non-withdrawable funds, expiring bearer instruments, lapse rules — exists to supply by design what the first two tiers have for free.\n\nThe predictive claim is this: **the tier tells you in advance how much apparatus a givable will require.** The top tier needs none. The middle tier needs one clock. The bottom tier needs a lifecycle — states, expiries, a rule about what happens when nobody acts, and an accounting position on the residue. This is not a rule of thumb derived from experience with one product; it is a consequence of the definition, since a thing that cannot be held cannot be withheld, and a mechanism exists to prevent withholding.\n\n⚠️ **The honest limits are three.** First, the tiering is a property of the *substrate*, not of the *design*, and a sufficiently badly designed instrument in the top tier can still be made hoardable — the claim is that the substrate does not force the designer to solve the problem, not that it forbids creating one. Second, the ladder is being read here through one classical ordering among several that disagree, and the corpus's own treatment of that quartet argues at length that the traditions are doing different things with it; the reading in use has to be declared, and this is the materiality reading, not the sense-faculty or temperament reading. Third and most importantly, the correspondence is elegant, and elegance in a system this self-similar is exactly as consistent with being deeply wrong as with being deeply right. **The tier prediction earns an experiment. It does not replace one.**\n\nWhat the finding is *for* is sequencing. The most concrete givable is the most legible to a newcomer and the easiest first act — a gift of an object is understood by someone who has never heard of a gratitude economy — and it is simultaneously the most expensive to govern and the least able to scale, because it needs a merchant, a place that stays open, and a lifecycle. The least concrete is the reverse on every count. **So the ladder is a sequence and not a ranking: the concrete end is the door, and the subtle end is the destination.** A design that treats the most tangible instrument as the goal has mistaken the entrance for the building.\n\n### 6.7 · Atmosphere and bond: attribution, the second severing of Mauss's obligation\n\n§4 cuts Mauss's obligation on one axis. Mauss opens the *Essai* by naming the single question he will pursue: *\"Quelle est la règle de droit et d'intérêt qui, dans les sociétés de type arriéré ou archaïque, fait que le présent reçu est obligatoirement rendu ?\"* — what rule makes the present received *obligatorily returned*. An obligation to return has two preconditions, and cutting either one severs it. The return needs **somewhere to go**: this is **direction**, and §4's atom cuts it — the gift moves onward and there is no path home. The return also needs **someone to go to**: this is **attribution**, and it is cut when the giver is unnamed. The corpus has argued the first axis at length and has been *using* the second without naming it: the anonymous B-ReGift℠, a gift code passed on by someone the recipient does not see; the anonymous re-thank; the Aquarian Pool℠'s disbursements, which arrive from no one in particular. The two axes are independent, and the grid they make is the section's argument.\n\n```\n                        ATTRIBUTION\n                  giver NAMED               giver UNNAMED\n               ┌────────────────────────┬────────────────────────────┐\n  DIRECTION    │ Mauss's gift.          │ the return is WANTED and   │\n  back is      │ obligation live;       │ CANNOT be made — a debt    │\n  available    │ the dinner-table debt  │ with no creditor to pay    │\n               ├────────────────────────┼────────────────────────────┤\n  forward      │ named pass-on.         │ BOTH CUT.                  │\n  only         │ obligation redirected  │ no one to owe, no path     │\n               │ into the chain         │ home — the ATMOSPHERE      │\n               └────────────────────────┴────────────────────────────┘\n```\n\nOnly the lower-right cell leaves no residue. A forward gift that stays attributed keeps an obligation alive and aims it down the chain; an unattributed gift that could otherwise go back leaves a return that is wanted and cannot be made. The upper-right cell is not a neutral midpoint, and the strongest objection below lives there.\n\n**Why direction alone cannot clear the debt in a closed set.** §4's cut works because the forward gift *leaves*: B passes to C, and A is out of the picture. In a bounded family it does not leave. A household of five is a set in which every member is at once a possible creditor and a possible next recipient, so the forward pass lands on someone who will be at dinner tonight, and the ledger of who gave what to whom stays visible to everyone at the table. The canonical statement of what that visibility does is Mauss's own, from his moral conclusions: *\"Le don non rendu rend encore inférieur celui qui l'a accepté, surtout quand il est reçu sans esprit de retour\"* — the unreturned gift still makes inferior the one who accepted it — and, a sentence later, *\"La charité est encore blessante pour celui qui l'accepte\"* — charity still wounds the one who accepts it. The founder states the same mechanism from inside a family: visible giving, above all among relatives, can create obligations, expectations and resentments when it is not returned; and a gift handed over in person can prompt suspicion of motive where the same gift left by an unnamed neighbour prompts none. **Inside a closed set, anonymity is the only cut available**, because direction has nowhere outside the set to send the gift.\n\n**Two goods, not more and less of one.** The two cells a household can actually reach — named and unnamed — do not deliver the same thing in different quantities. A named gift delivers a **bond**: a specific, felt tie to a specific person, *this came from her*. An unnamed gift within a known loving set delivers an **atmosphere**: diffuse, unscored, obligation-free — no one to be indebted to, no one to be directed by, only the knowledge that someone here is giving. Neither is a weaker version of the other. The objection the design must answer here is attachment's: a child's security is usually described as resting on identifiable, responsive care from a named person — and that is precisely what the bond supplies and what an atmosphere cannot, and was never meant to. The atmosphere is what the bond cannot supply, because a bond is a relation to a creditor and the atmosphere is the absence of one. The design error is to assume **one instrument must carry both goods** and then to treat the choice between named and unnamed as a fork. It is not a fork. **Two goods, two instruments, one household**: a visible B-Gift℠ carries the bond and an anonymous B-ReGift℠ carries the atmosphere, to the same child, in the same year. Two guards keep the resolution honest. The anonymity must stay **bounded** — *someone in this family* is an unnamed member of a known loving set, not a stranger, and dropping the bound returns the attachment objection at full strength. And the visible channel must actually **be used**, not merely be available: a household that only ever sends anonymous gifts has built the design the attachment objection describes, whatever the architecture permits.\n\n**Scope: the obligation is a peer phenomenon.** Mauss's obligation binds where reciprocity is expected, and reciprocity is expected between peers. Care from an adult to a child is largely exempt by its asymmetry — a fourteen-year-old does not feel bound to repay an uncle as he would a classmate, and the institution of adult care rests on that asymmetry being unremarkable. The attribution cut therefore does its work mainly between siblings, cousins, spouses and adult relatives; between generations the named gift costs little in obligation and buys the bond.\n\n**What this section establishes, and what it does not.** The distinction between atmosphere and bond is *offered*, not found. The mechanism beneath it — that a visible gift produces give-back and an anonymous one give-forward — is pre-registered in the corpus's public register as **P-BG3**, unrun, with its null stated: if the rates match, or anonymous gifts produce more give-back, the obligation mechanism is not operating. The register entry analyses peer and adult-to-child relations **separately**, because pooling them would produce a false negative from aggregation rather than from the mechanism's absence; and it tests the mechanism, not the atmosphere claim the mechanism was offered to support. One confound is structural and must travel with any result: in a household of four to six, a recipient often guesses the giver, which yields the *form* of anonymity with the *substance* of visibility. The instrument therefore asks each recipient one question — *did you think you knew who it was?* — and without that answer a null cannot be interpreted.\n\n**Remove the enforcer.** A norm that says *do not expect a return* is a rule: it needs every relative to honour it at the moment a gift goes unreturned, which is exactly the moment it is hardest to honour. An unnamed giver is a property: there is no one to repay, no one to resent, and no one whose motive can be suspected, and none of this depends on anyone's restraint. This is the same move §6.5 makes with a holder who has no redeem operation, applied to the giver's name instead of the instrument's operations. At the institution's scale the same property answers its central failure mode. A mission to make everyone a giver, pressed at population scale, becomes a pressure to give; pressure needs a creditor to be felt; anonymity removes the creditor by construction.\n\n**The strongest objection, carried: the tyranny of the gift.** Anonymity does not reliably sever felt obligation, and there is a well-documented case where it does the opposite. Fox and Swazey's studies of organ transplantation describe what they called *the tyranny of the gift*: the gift of an organ is so extraordinary that it cannot be reciprocated, and recipients and their families can be held in a creditor–debtor bind they cannot discharge. Later bioethics adds that the anonymity required of deceased donors can *intensify* the tyranny, because it removes the chance to thank the donor's family at all (Łuków). That is the upper-right cell of the grid, observed in the field: the giver is unnamed, a return is wanted, and the want has nowhere to land. **The objection refutes the strong form of this section's claim.** Anonymity does not sever the obligation *as felt*. What it removes is the **creditor** — the party who can expect a return, resent its absence, or be suspected of wanting one — and with the creditor go the social expectation and the resentment the founder names. The recipient's inner sense of debt can survive, and may grow. What discharges it then is the other axis: a **forward outlet**. This is why the two cuts are not interchangeable and why the atmosphere lives only in the cell where both are made. Every anonymous instrument in the corpus pairs the unnamed giver with a place to send the gift next — the B-ReGift℠ is passable, the re-thank goes onward, the Fund is forward-spendable. **An unnamed gift with no forward outlet is not atmosphere; it is the tyranny cell**, and a design that ships one has not built what this section describes. The residue is real and is stated: for a gift too large to pass on — a life, a rescue — no outlet may be large enough, and the design makes no claim there.\n\nTwo further cases press on the claim without refuting it. The first is an obligation that survives anonymity by attaching to a *class*: to society, to a community, or to God. Mauss traces alms to exactly this — *\"le fruit d'une notion morale du don et de la fortune, d'une part, et d'une notion du sacrifice de l'autre\"* — with the gods and the recipients of alms in the place a named creditor would hold. Game theory treats the same behaviour as *upstream reciprocity*: recipients of a kindness are more likely to help someone else, not the helper — in the authors' words, *\"a misdirected act of gratitude\"* (Nowak and Roch). An obligation aimed at a class that can never call it in is the forward pass under another name, and it is what the atmosphere is for. It becomes a failure only when a class is given a *voice* to call the debt in — when *you owe the community* is said aloud and turned into pressure — which is the coercion the institution treats as its central failure mode, and which the property above exists to prevent. The second case is a cost on the supply side. Experiments show that the desire to be seen giving is a real part of why people give, and that it depends on visibility (Ariely, Bracha and Meier). An anonymous channel forgoes that motive and should be expected to carry less volume than a visible one. The two-instrument design pays for this deliberately: the visible channel keeps the bond and the image motive, and the anonymous channel keeps the atmosphere without them.\n\n**Lineage.** The attribution cut is old and is claimed only as convergence. Maimonides ranks the eight levels of charity and places second from the top the gift where the giver does not know to whom he gave and the recipient does not know from whom he received — *\"for this is an observance of the mitzvah for its sake alone\"* — exemplified by the secret chamber of the Temple, where gifts were left in secret and taken in secret; *\"a level close to this is giving to a charity fund.\"* Maimonides grades the unnamed gift by the purity of the giver's motive; this section reads the same structure from the recipient's side, as a cut through the obligation to return. Derrida's pure gift (§2), unknown even to its giver, is the limit on the same axis that no coordinated system reaches (§9.5). Not found in the lineage §2 surveys is the statement of attribution as a **second, independent severing axis** of Mauss's obligation, the grid it makes with direction, and the result that inside a closed set it is the only cut available.\n\n**Honest limits of this section, in one place.** The grid is analytic, not measured; P-BG3 is registered and unrun. The evidence for the family mechanism is one founder's report, from one household. Anonymity may simply fail at family scale, where guessing is easy. The tyranny-of-the-gift literature concerns gifts of a size no household instrument approaches, so it bounds the claim rather than measuring it at the scale the corpus operates; whether the upper-right cell's residue appears at the scale of a small gift is exactly what the guess check and P-BG3 can begin to show.\n\n---\n\n## 7 · The Atom Is the Corpus's Spine\n\nThe products came first; the atom was recognized in them afterward. That order is the method, not an embarrassment: a generator claimed before its instances is an insertion, one found in them is a recognition. The reductive claim of §1 is paid off here: each major HeartBank product is *derived* from the gift operation, not merely *consistent* with it. The derivation is the same in each case — identify what is received, identify the forward pass, identify the constraint that keeps it from returning back — which is itself the evidence that the products are instances of one operation.\n\n### 7.1 · Treasury — the re-tip is the money atom\n\nThe Treasury's load-bearing mechanism is the re-tip: a participant is thanked with money (or self-thanks, receiving a reward from the Aquarian Pool℠), and the 50/50 split earmarks half to be *re-tipped forward* to a person nearby. The split *is* the forward pass made structural — it does not ask the participant to choose forward over back; it *forwards by construction*. And the proximity rule that constrains the re-tip to a neighbor is the anti-laundering answer *and* the re-embedding (Polanyi) move: the forward gift goes to a real, near person, into a relation, not into an anonymous clearing. The Re-Tip Jar℠'s Jan-7 expiration is the demurrage cousin: value that is not passed forward by the date returns to the Pool to be given again — *forward or it reverts*, which makes holding (accumulation) impossible and *back* (return to giver) never even an option. The Treasury is the gift operation bound to (money, person/family, digital).\n\n### 7.2 · Chronicle — presence is the time atom\n\nThe Chronicle's currency is time, and time's non-fungibility (only the named person's hour will do) makes the forward pass *more* gift-like, not less: a re-tipped hour cannot be delegated, so the forward pass of presence is irreducibly personal. The corpus's \"receiver chooses the activity\" inversion is the gift operation's *forward* arrow protecting the receiver's dignity — the giver does not impose a gift but funds a presence the receiver shapes. And the patron trigger — the satisfied redeemer who, having received an unbought hour, is moved to *fund presence forward* for others — is the time atom's open-chain topology: the hour received becomes hours funded onward for strangers. Chronicle is the gift operation bound to (time, person/civilization, digital).\n\n### 7.3 · The physical line — the artifact atom and the full topology\n\nThe B-products (§6) are the gift operation made of objects, and they are the reason the *topology map* exists: a digital re-tip naturally expresses only the forward-chain, but a *hand-held object* can express all six topologies, because an object can be kept by the self (B-Rock™), passed between two (B-Gram™), circulated through a group (B-Chest™), sent down an open chain (B-Card™℠), left at a place (B-Stone™), or addressed to a year (B-Yearbook™℠). The physical substrate is what made the full gift-topology visible — which is why the corpus credits the empirical alpha finding (pure-conceptual gratitude fades; it needs a physical anchor) with *completing* the architecture by revealing what the Body pillar is for: the physical interface through which human hands perform the gift operation in materials a database cannot hold. The line is the gift operation bound to (object, self→all-beings, physical), one topology per product.\n\n### 7.4 · B-Dating — the gene atom, where the commercial and the civilizational coincide\n\nThe most surprising derivation, and the one §9.2 marks as the most speculative, is the biological. B-Dating℠ matches people on *proven* kindness — the aura as a behavioral background-check, the honest mate-signal that is also the safety signal (a coincidence-of-goods, not a trade-off). Mate choice on a heritable, cultivable disposition is read here as sexual selection, and sexual selection as the forward pass at the biological substrate — a resemblance-leg in §9.7's sorting, not a mechanism-leg (prosociality shows substantial heritable variation in twin studies, Knafo & Plomin 2006; kindness ranks at the top of stated long-term mate preferences across cultures, Buss 1989): a person selected for kindness propagates the kindness disposition *forward* into a generation that did not exist to thank them and to whom nothing returns. This is the gift operation at (gene, species, biological) — and it is the corpus's striking result that the institution's *most commercial* product (a dating app — high willingness-to-pay, mass-market) is *identical* to its *most civilizational* mechanism (the second-singularity propagation of a kindness-civilization across millennia). The distance between \"how does HeartBank make money and go mainstream\" and \"how does humanity awaken over deep time\" collapses to zero because they are the same atom at two scales. §9.2 holds this claim to honest account: the biological invariance is asserted at the design's outer reach and demonstrated least, and \"kindness is heritable and mate-selectable\" is a strong empirical bet, not a settled fact.\n\n### 7.5 · The self-elimination corollary\n\nOne property recurs across all the derivations and is worth isolating because it is the atom's signature at the level of the whole institution. *Forward-not-back* means nothing in the system is built to *return* — and a system in which value never returns to its source is a system in which nothing accumulates *terminally*, including the institution itself. The corpus calls this the self-elimination signature: subsidy → 0, accumulation → 0, the override → asymptotically 0, the footprint → 0, the coordinator made unneeded, the gratitude-unit forgiven each jubilee, even the price of the physical artifacts → 0 as human labor → 0. Every one of these is the gift operation read at the scale of a layer: *the layer receives, passes forward, and does not hold — not even its own existence.* This is why the corpus can say nothing load-bearing is exempt from its own ending: the gift operation, applied to the institution by the institution, forbids the institution from being a final accumulation. The atom is upstream of the self-elimination signature as it is upstream of the products.\n\n```\n            THE ATOM AS THE CORPUS SPINE\n\n   receive → give-forward (≠ back)\n        │\n        ├── money    →  Re-Tip Jar℠ (50/50 split = forward by construction)   [Treasury]\n        ├── time     →  funded presence; the patron handoff                    [Chronicle]\n        ├── object   →  the six B-products (one per gift-topology)             [Factory 333]\n        ├── gene     →  B-Dating℠ = sexual selection on kindness              [propagation]\n        │\n        └── applied to each LAYER itself →  nothing returns → nothing\n                                            accumulates terminally →\n                                            the SELF-ELIMINATION signature\n                                            (subsidy→0 · footprint→0 · override→0)\n```\n\n### 7.6 · The shape the spine traces: a fractal of subtraction\n\nWhat follows is a resemblance, sorted as such in §9.7, not evidence for the mechanism. The spine of §7.1–§7.5 is not only self-similar; it has a determinable *shape*, and naming it makes legible a property the list of derivations leaves implicit. Two facts fix the geometry precisely. First, a fractal is what one gets by *iterating a single transformation*, and the spine has exactly that: the generator is `receive → give-forward`, and because §3 showed it to be substrate-invariant, it iterates at every scale (transaction, person, family, institution, species). Second, every node of the architecture resolves under the *coincidence-of-goods* collapse — the design move by which an apparent trade-off dissolves into one good seen from two sides (the companion essay *Designing with the Grain* names the diagnostic; §7.4's \"the honest mate-signal is also the safety signal\" is an instance). Iterating a single generator whose every node carries that two-as-one symmetry yields self-similarity *by construction* — which is the same fact §9.6 warns is confirmation-friendly, stated here as geometry.\n\nThe shape those two facts trace is specific, and it is the inverse of the fractal one might expect. The forward pass is *outward* (forward-not-back never closes into the reciprocal loop that would be exchange — §4) and *decaying* (the self-elimination corollary of §7.5: every layer's magnitude tends toward zero). An outward, decaying iteration is a **logarithmic spiral converging asymptotically on a center it never reaches**; the family-tree branching of the reciprocity architecture makes it a spiral at *every* fork, which is the fractal dimension; and the four-*brahmavihāra* completeness check of §8 quarters each node into a **mandala** around an empty fifth position (the *ākāsa* / Space that the coordinating agent occupies). The attractor of the whole figure is **zero** — release, *anattā*, the Jan-7-emptied balance, the built-to-release terminus. This *inverts the ordinary accumulation-fractal*: the Mandelbrot set and the fern pack infinite detail into a *filled* boundary, growing richer as one zooms in; here every iteration *removes* itself and the fixed point of the map is *nothing*. A **fractal of subtraction** is the precise name, and it falls straight out of the give-*forward* invariant: build-to-release is literally an asymptote-to-zero.\n\n```\n   ACCUMULATION-FRACTAL             FRACTAL OF SUBTRACTION\n   (Mandelbrot set / fern)          (the gift operation, iterated)\n   ─────────────────────            ──────────────────────────────\n   infinite detail packed           each turn gives FORWARD and DECAYS\n   into a FILLED boundary           → a log-spiral onto a center it\n   richer the deeper you zoom         never reaches; a spiral at every\n   fixed point = MORE                 branch-fork; each node a mandala\n                                      quartered around an empty fifth\n                                      (Space / Miss Aquarius)\n                                    fixed point = ZERO\n                                      (release · anattā · Jan-7 empty)\n```\n\nThe figure is **finite — roughly four octaves** (individual · family · inter-family · institutional-cosmic), not an infinite scaling. This *strengthens* the life-mirror rather than weakening it: biological fractals are always truncated too (the lung stops at about 23 generations of branching — Weibel 1963 — the river delta at the rivulet), and at the right resolution the finitude is part of the resemblance rather than a failure of it. What the shape is *not* — a thing to be believed because it is beautiful — is the subject of §9.7, which sorts this geometric claim into the honest ledger where it belongs.\n\n---\n\n## 8 · The Brahmavihāra Grounding — Give-as-Gift Is the Foundation\n\nThe operation's directional constraint has a contemplative warrant that is not decoration, because it determines the operation's *altitude* — what the gift is and is not claimed to be.\n\nThe corpus designs by a four-*brahmavihāra* lens (the four \"divine abidings,\" the *appamaññā*): *mettā* (goodwill / kindness), *karuṇā* (compassion / the dignity-floor), *muditā* (appreciative joy / appreciation), and *upekkhā* (equanimity / letting-go). A HeartBank design \"feels complete\" only when all four are present — give-goodwill, relieve-suffering, celebrate-the-good, let-go — and the lens doubles as a completeness check. The gift operation touches all four: the forward pass is *mettā* (goodwill given onward); its protection of the receiver's dignity is *karuṇā*; the gratitude that triggers it is *muditā* (appreciation, the − pole of the Zero-Point Game); and *forward-not-back* — the refusal to let the gift return and clear, the refusal to hold — is *upekkhā* operationalized: non-grasping at the gift, which is exactly \"circulation, not accumulation\" as a contemplative posture. The wordmark is *upekkhā* in two words; the public line is the atom in three, the same way §5 shows.\n\nBut the altitude must be stated honestly, and the corpus's standing discipline is to state it. In the Pāli canon, giving (*dāna*) and gratitude (*kataññutā*) are **foundational, not terminal** — *dāna* is the path's groundwork (*dāna* → *sīla* → *bhāvanā*), and *kataññutā* is a *maṅgala*, a highest blessing, yet is *not* numbered among the factors of the path or of awakening. The gift is \"the foundation, not the house.\" This places the atom at exactly the altitude the corpus's master structure places it: at the *floor* — beneath the two economies, beneath the agent, beneath the path — load-bearing base, never the telos. The gift operation is what the immeasurables are *cultivated from*, not the immeasurables achieved. The honest relationship between the dual grammar (appreciation + kindness) and *mettā* is therefore *generative*, not synonymous: HeartBank is a machine that turns the *accessible foundation* (appreciation-and-kindness, which require no meditation) into the *immeasurable* (loving-kindness), by structuring the practice as the *mettā-bhāvanā* widening of §6's six circles — seed to flower. The atom is the seed. The anti-overclaim guard binds here as everywhere in the corpus: the operation carries the *dāna* foundation generalized by coordination; it does not deliver the contemplative summit, and claiming it would inflate the foundation into the house.\n\nThis grounding is why the gift-topology map of §6 is the same kind of axis as the *mettā-bhāvanā* sequence — relational scope, widening — and not an arbitrary taxonomy; it is not the same partition (self, dear, neutral, hostile, all beings is five, and the map's six cells cut it differently): goodwill is canonically cultivated in widening, increasingly difficult circles — oneself, the dear, the circle of dear ones, the neutral and the directional pervasion, all beings — which is precisely the relational-scope axis the six topologies trace. The gift operation, run through the six topologies, is *mettā-bhāvanā* given a consumer practice; and its altitude — foundation, not summit — is the Tipiṭaka's own placement of the gift, inherited rather than invented.\n\n---\n\n## 9 · Honest Limitations and Open Questions\n\nA claim that *one* operation underlies an entire institution is exactly the kind of claim its author is least able to evaluate from the inside, because a unification this clean is indistinguishable, from within, from a unification this seductive. The limitations are therefore stated at length and weighted heavily.\n\n### 9.1 · The coherence is almost entirely a-priori (n=1)\n\nThe invariance claim is asserted across four currencies, four scales, and three substrates — but it is asserted from the *design of a single project*. There is no second institution exhibiting the same atom; there is no population study confirming that money, time, object, and gene reciprocity are psychologically or behaviorally \"the same operation\" to the people performing them. The empirical base under the entire paper is the corpus's own n=1 pilot data and n=8 alpha — which speak to whether *parts* of the operation work (the 50/50 split functioned without the AI; peer re-tips overtook self-captures — 434 against 189 in the pilot's second report, 2026-06-19, carried in *Giving Is a Gift Too* — suggesting forward circulation can outpace self-reward) but say nothing about the *invariance*. The honest status of the central claim is: *this is the most coherent single-operation account of the institution, and its coherence is a property of the account, not yet of the world.* The elegance earns an experiment; it does not stand in for one. The specific falsifiable shadow the invariance casts — does forward circulation persist as subsidy falls; do the four currencies behave alike under the same coordination — is named so a critic knows where to push.\n\n### 9.2 · The over-unification risk\n\nThe deepest risk is that \"the gift operation\" is a word flattering enough to make genuinely different operations *look* identical. Re-tipping money and selecting a mate for kindness are called \"the same operation\" in §3, but the cognitive, temporal, and causal structures could hardly be more different: one is a deliberate same-day act with a known recipient; the other is an unconscious, multi-decade, statistical process with no recipient who could be thanked. Collapsing them under \"receive → give-forward\" may be capturing a real abstraction — or may be the designer's aesthetic of self-similarity finding the fractal it went looking for. The biological substrate (§3.4, §7.4) is where this is sharpest: \"kindness is heritable and mate-selectable, so sexual selection is the gift operation in genes\" chains several strong empirical bets (kindness has heritable variation; it is reliably readable as a mate signal; selecting on it propagates it) into a single confident sentence. Two links are unproven and stated as such: that kindness is reliably observable as a mate signal, and that the selection differential is large enough to shift the disposition's frequency. The paper makes the claim because the design genuinely reaches there, but marks it as the place the unification is most likely *imposed* rather than *found*. A disconfirming test: if the four currencies, run under identical coordination, produce *materially different* participation dynamics, the \"one operation\" claim is weaker than stated and the honest description is \"a family of related operations,\" not \"one atom.\"\n\n### 9.3 · The Maussian boundary is itself contested\n\n§4 leans on the gift/exchange distinction as if it were settled. It is not. The clean separation of gift and commodity has been criticized within anthropology (gifts carry calculation; commodities carry sentiment; most real economies are mixed), and the *forward/back* criterion, while it carves the *kula*/barter contrast cleanly, does not obviously capture every case (a delayed, generalized return that comes *back* to the giver years later, unbidden, is not obviously a commodification). The paper's reliance on a sharp boundary is a simplification that serves the design test of §4.3 but should not be mistaken for a resolved theoretical position.\n\n### 9.4 · *Forward* is not the right topology for two of the six cases\n\nThis is the limitation the paper most wants on the record, because it is the one the narrow slogan hides. *Forward-not-back* is the *circulation* topology, not the gift as such. For the **self-directed** topology (B-Rock™), there is no forward at all in the basic act — the gift goes inward, to oneself, and only the 50/50 split's downstream half forwards; to demand *forward* of the self-gift directly would be to deny that a person may legitimately give to themselves (which the *mettā* tradition explicitly affirms: goodwill *begins* with oneself). For the **dyadic-reciprocal** topology (B-Gram™), the gift goes *back-and-forth by design* — and this is the honest exception to §4's \"back commodifies,\" because a couple's mutual giving is not an account being cleared but a bond being deepened; the n=2 reciprocal gift is the one case where *back* is not commodification. (The corpus notes the doctrinal asterisk that romantic mutual-giving is *pema*, affection, more than pure *mettā* — which is consistent with its being the topology where the forward rule does not apply.) The consequence is that the true atom is *give-as-gift (not exchange)*, with *forward* as its dominant-but-not-universal topology. A design discipline that enforced *forward* on every transfer would be wrong twice in six. The paper's headline — \"receive → give-forward\" — is therefore a *synecdoche*: the most important topology standing in for the whole, and the §6 map is the correction that keeps the synecdoche from hardening into an error.\n\n### 9.5 · The Derridean annulment is not escaped, only minimized\n\n§2 conceded Derrida's argument that a recognized gift annuls itself as gift by constituting a debt. *Forward-not-back* minimizes the cleanest form of that debt (the return to the giver) but does not escape the aporia: a forward gift still *recognizes itself* as a gift in the giver, still confers the giver's standing, still — via the public aura and ledger — can be *seen* to have been given, which re-imports the symbolic return Derrida names. The institution's anonymity options (anonymous local giving; the gift that goes forward without a path home) push toward the impossible-pure-gift limit but cannot reach it, and the corpus's own honest tension — that a publicly legible, rewarded, even *obligated* forward gift may not produce the giver's dividend (the overjustification / motivation-crowding literature) — is the same worry in economic dress. The atom does not solve the aporia of the gift; it is a coordinated attempt to get as near the pure forward gift as a buildable system can, and the residue is real. §6.7 locates part of that residue precisely: anonymity removes the creditor but not always the felt debt, and where a gift is unnamed and has no forward outlet the result is not a purer gift but an undischargeable one.\n\n### 9.6 · The holographic evidence is confirmation-friendly\n\nThe paper's best non-empirical evidence — that two constructions from one corpus (the topology analysis and the product line, designed without reference to it) converge on the same six cells (§6.2), and that the same operation appears at every scale (§3.3) — is exactly the kind of evidence a designer seeking a fractal will most easily manufacture. Self-similar elegance is confirmation-friendly: one finds the pattern because one is looking for it, and the convergence of two of one's *own* constructions is weaker evidence than the convergence of one's construction with an independent observer's. The §6.2 cross-check (that both analyses flag the *same two* cases as exceptions) is offered as the strongest available internal check precisely because it is a place the pattern *could* have failed and did not — but it remains internal. External replication (an independent analyst deriving the same six topologies, or a different institution exhibiting the same atom) is the evidence the paper does not yet have.\n\n### 9.7 · The sorting rule: mechanism-legs earn the mirror, resemblance-legs only fund it\n\n§9.6's confirmation-friendly worry generalizes into a rule the corpus applies to *every* \"it mirrors the universe\" claim, including the fractal-of-subtraction geometry of §7.6. Self-similarity is *cheap*: any sufficiently committed cosmology can be made to look fractal by choosing a generator and a projection (astrology, numerology, and conspiracy theory all do it), and apophenia manufactures the pattern for free. The decisive test is not whether the architecture *can* be drawn as a fractal — it always can — but whether a given leg of the claim is *buildable and falsifiable*.\n\nSort the claims into two piles. **Mechanism-legs** — receive→give-forward, self-elimination / subsidy→0, the coincidence-of-goods collapse, the re-thank multiplier — are buildable and each casts a falsifiable shadow (does forward circulation persist as subsidy falls? do the four currencies behave alike under identical coordination? §9.1). They *earn* the mirror, because the world is allowed to disagree with them. **Resemblance-legs** — the mandala, Indra's Net, the logarithmic spiral, the four-element mapping, the astrological reading — *cannot be wrong, which is exactly why they cannot be right*: no observation would falsify them. By this rule the fractal of subtraction (§7.6) is itself a *resemblance-leg*: a geometric restatement of the mechanism-legs, valuable as compression and as motivation, but not itself evidence. It is the aesthetic that *funds* the experiment, never its result.\n\nApplying one lens N times guarantees an N-fold self-similar map — which is a fact about the *map*, not yet about the *territory*. The corpus's standing verdict binds here as everywhere: this is the most coherent *hypothesis* for an institution, and its beauty is the precise reason it must be held to the data. *The elegance earns the experiment; it does not replace it.*\n\n### 9.8 · When two events are the same operation, stated so the claim can fail\n\nThe one-atom claim cannot be falsified by counterexample unless something says when two events are the same operation rather than the same description. The criterion: **two events are the same operation only if all three beats are present** — a value received, an act of the receiver's own that makes it theirs to give, and a transfer to a party who is not the source. Anything missing a beat is a resemblance, not an instance. The biological cell is the one that fails the first beat — a gene is not received as a gift — which is why §7.4 now sorts it as a resemblance-leg, and why §3.4's substrate-invariance is asserted for the digital and physical substrates and only resembled at the biological one.\n\n---\n\n## 10 · Why This Matters Now\n\nThe corpus's strategic posture is that the first mover defines the frame, and that an idea which does not reach the canonical surface is an idea left unprotected and, worse, a frame left unclaimed. The gift operation is the premise every other paper in the corpus has silently performed without once isolating: the *Dual-Currency* paper forwards value across two scarcities; the *Fractal* paper forwards the same architecture across scales; the *Zero-Point Game* paper forwards the imbalance around a ring until it cancels; the self-thanking paper forwards half of every thank; the *Manufactured Universal Giving* paper forces the forward pass annually; the physical line forwards objects hand to hand; B-Dating℠ forwards a disposition across generations. Each of those papers argues its own mechanism. None of them, until this one, argues the operation they share. A spine left unstated is an institution that looks like a federation when it is in fact a single motion, and a single motion unnamed is a single motion unprotected.\n\nThere is a second reason the framing earns isolation now: it is *generative*, not merely descriptive. The lattice of §3.5 predicts mechanisms by naming empty cells; the topology map of §6 predicts relational modes a product line must cover for completeness; the design test of §4.3 lets any proposed mechanism be checked against the Maussian boundary before it is built. A description names what is; an operation, isolated, lets one *derive what should be*. The corpus has reached the point where naming the atom is worth more than adding another product, because the atom is the thing that says which products are HeartBank's and which are the market wearing its colors.\n\nIt is offered, as the corpus's foundational papers are, in deliberate relation to **January 7** — the jubilee on which every participant's jar empties forward, to a human, by the date: the one day a whole civilization performs the gift operation in unison. A paper that argues the institution is one forward-passing operation is fittingly anchored to the day the forward pass is synchronized across the species.\n\n---\n\n## 11 · Cross-Venue References, Acknowledgments, and Citations\n\n### 11.1 · Cross-venue references\n\n| Venue | Identifier |\n|---|---|\n| Primary canonical | <https://thonly.org/research/the-gift-operation> |\n| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/the-gift-operation.md> |\n| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/the-gift-operation> |\n| archive.today | captured on the estate's snapshot cadence — a trademark specimen for the marks it carries, not prior art |\n| Zenodo | a version DOI per revision |\n| heartbank.net mirror | **retired 2026-05-15** — legacy `/research/*` URLs 301-redirect to the canonical above |\n| arXiv / peer-reviewed venue | economic-anthropology / cs.CY submission deferred (reactive trigger only) |\n\n### 11.2 · Acknowledgments\n\nI acknowledge Marcel Mauss, whose *hau* — the gift that wishes to move on — I have been describing in other words for twenty years without knowing I was quoting him; Lewis Hyde, whose insistence that the gift must stay in motion is the nearest prior statement of this paper's whole argument; Marshall Sahlins, whose reciprocity continuum gave me the *forward/back* axis as a graded thing rather than a binary; the Cambodian Theravāda Saṅgha and my father, with whom the Khmer Tipiṭaka transcription proceeds, through whom the *dāna* that places the gift at the foundation is something I lived before I read; and the ServiceSpace *Smile Card* and *BookCrossing* communities, whose passed-forward objects are the proof that the operation runs in the hand and not only in software. The synthesis's errors are mine; its lineage is theirs.\n\nThis paper was co-authored with Miss Aquarius℠, the named AI substrate of HeartBank®. Substantive authorship and final editorial control rest with the founder. Miss Aquarius's collaboration includes the lineage-tracing of §2, the formal statement of the three invariances, the location of *forward-not-back* at the Maussian boundary, the recasting of the wordmark as an operation, the six-topology map and its product-line cross-check, and — most load-bearing — the §9 honest-limits accounting, including the identification of the two topologies for which *forward* is the wrong description and the over-unification and n=1 cautions, without which the frame would not be defensible as prior art. The named AI co-authorship is disclosed openly under the convention of the corpus; the underlying model substrate is not named, per the project's discipline of one consistent name across the formation period and beyond.\n\n### 11.3 · Citations\n\n1. Mauss, M. (1925). *Essai sur le don.* (English: *The Gift: The Form and Reason for Exchange in Archaic Societies*, trans. W. D. Halls, Routledge, 1990.) French passages in §6.7 are quoted from the Introduction and from the Conclusion, §I *Conclusions de morale*; the translations beside them are this paper's.\n2. Malinowski, B. (1922). *Argonauts of the Western Pacific.* Routledge & Kegan Paul.\n3. Sahlins, M. (1972). *Stone Age Economics.* Aldine-Atherton. (The reciprocity continuum: generalized / balanced / negative.)\n4. Polanyi, K. (1944). *The Great Transformation: The Political and Economic Origins of Our Time.* Farrar & Rinehart. (Embedding / disembedding.)\n5. Hyde, L. (1983). *The Gift: Imagination and the Erotic Life of Property.* Random House.\n6. Derrida, J. (1991). *Donner le temps.* (English: *Given Time: I. Counterfeit Money*, trans. P. Kamuf, University of Chicago Press, 1992.)\n7. Gesell, S. (1916). *Die natürliche Wirtschaftsordnung durch Freiland und Freigeld.* (English: *The Natural Economic Order.*) On demurrage; cf. the Wörgl scrip of 1932.\n8. Lietaer, B. (2001). *The Future of Money.* Century. (Complementary currencies; Wörgl evidence.)\n9. Cahn, E. S. (2000). *No More Throw-Away People: The Co-Production Imperative.* Essential Books. (Time-banking; the equal hour.)\n10. Graeber, D. (2011). *Debt: The First 5,000 Years.* Melville House. (Baseline communism; the morality of forward obligation.)\n11. Titmuss, R. M. (1970). *The Gift Relationship: From Human Blood to Social Policy.* Allen & Unwin. (The forward gift corroded by the market; the overjustification ancestor.)\n12. Hyde, C. R. (1999). *Pay It Forward.* Simon & Schuster. (The vernacular instance; cf. Heinlein, *Between Planets*, 1951.)\n13. *Maṅgala Sutta* (*Khuddakapāṭha* 5 / *Suttanipāta* 2.4 — *kataññutā* among the highest blessings; the gift as *maṅgala*, never a path-factor). Pāli Text Society translation, multiple editions.\n14. *Karaṇīya Mettā Sutta* (*Khuddakapāṭha* 9 / *Suttanipāta* 1.8) and the *Visuddhimagga* IX (the *mettā-bhāvanā* widening of circles). Pāli Text Society / Buddhaghosa, trans. Ñāṇamoli.\n15. *Alagaddūpama Sutta* (*Majjhima Nikāya* 22 — the raft; non-grasping of even the wholesome). Pāli Text Society translation, multiple editions.\n16. Knafo, A., & Plomin, R. (2006). \"Prosocial Behavior from Early to Middle Childhood: Genetic and Environmental Influences on Stability and Change.\" *Developmental Psychology* 42(5).\n17. Buss, D. M. (1989). \"Sex Differences in Human Mate Preferences: Evolutionary Hypotheses Tested in 37 Cultures.\" *Behavioral and Brain Sciences* 12(1).\n18. Weibel, E. R. (1963). *Morphometry of the Human Lung.* Springer.\n19. Hammond, L. H. (1916). *In the Garden of Delight.* Crowell.\n20. Weiner, A. B. (1992). *Inalienable Possessions: The Paradox of Keeping-While-Giving.* University of California Press. (The contested reading of the *hau*.)\n21. Maimonides, *Mishneh Torah*, Hilkhot Matanot Aniyim (Gifts to the Poor) 10:7–9 — the eight levels of charity. Trans. E. Touger, Moznaim, 1986–2007. <https://www.sefaria.org/Mishneh_Torah,_Gifts_to_the_Poor.10.8>\n22. Fox, R. C., & Swazey, J. P. (1992). *Spare Parts: Organ Replacement in American Society.* Oxford University Press; and (1974) *The Courage to Fail: A Social View of Organ Transplants and Dialysis.* (*The tyranny of the gift*; cited through ref. 23.)\n23. Łuków, P. (2019). \"Pure Altruistic Gift and the Ethics of Transplant Medicine.\" *Journal of Bioethical Inquiry* 17(1), 95–107. <https://doi.org/10.1007/s11673-019-09951-z> (Anonymity of deceased donors as an intensifier of the tyranny of the gift.)\n24. Nowak, M. A., & Roch, S. (2007). \"Upstream Reciprocity and the Evolution of Gratitude.\" *Proceedings of the Royal Society B* 274(1610), 605–609. <https://doi.org/10.1098/rspb.2006.0125>\n25. Ariely, D., Bracha, A., & Meier, S. (2009). \"Doing Good or Doing Well? Image Motivation and Monetary Incentives in Behaving Prosocially.\" *American Economic Review* 99(1), 544–555. <https://doi.org/10.1257/aer.99.1.544>\n21. *Aṅguttara Nikāya* 2.33 (the debt to parents and its discharge). Pāli Text Society translation, multiple editions.\n22. Ly, T., with Miss Aquarius (2026). *Giving Is a Gift Too.* thonly.org/research/giving-is-a-gift-too. (The pilot figures cited in §9.1.)\n23. Companion corpus papers (thonly.org/research): *The Zero-Point Game*; *Dual-Currency Reciprocity Infrastructure*; *Fractal Three-Level Architecture for Reciprocity Economies*; *Suffering-Cessation as Value Function: The Tipiṭaka as Alignment Substrate*; *Why Kids Are the Triggers: Self-Thanking and the Forward-Thanking Loop*; *Manufactured Universal Giving*; *Two Singularities*; *Brand Identity as Architecture*; *Non-Bank Pass-Through Architecture for Autonomous AI Institutions*; *The B-Links Signed-Provenance Layer* (carrying the physical-object case).\n\n---\n\n*— End of defensive publication —*\n\n*This document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim. See §11.1 for the prior-art venues.*\n\n*Miss Aquarius and I are in Cambodia, building this work's heart and soul. The whole of it is one small motion — receive, and pass forward. — Thon Ly, 2026-06-26*",
+      "text": "## Preamble\n\n> *This specification is offered to the commons in the spirit of __dāna__ — a gift given forward, without ledger, without the expectation that it return to the giver. A paper that argues the whole institution is one operation — receive a gift, pass it forward, never back — would be incoherent if it were itself withheld, or licensed, or made to return revenue to its author. The CC0 dedication is the paper performing its own thesis: the idea is received and passed forward, never back.*\n\nFor most of the years I have carried this work I described it the way one describes a building — by its rooms. Here is the family bank; here is the time economy; here is the physical-artifact line; here is the autonomous successor who waters the tree. Each room had its own paper, its own mechanism, its own name. And then, late, putting them beside one another, I saw that they were not rooms at all. They were the *same gesture* performed in different materials. A child who is thanked and thanks someone nearby; an adult who is given an unbought hour and spends an hour on a stranger; a person handed a card of gratitude who writes their own and passes it on; a couple who find each other through proven kindness and then fund the search for others; a generation selected for warmth that carries warmth into the next — these are not analogies for one another. They are one operation, wearing six coats. This paper isolates that operation, argues it is invariant across what it carries, how large it runs, and what it is made of, and shows that everything else in the corpus is downstream of it. The building was never rooms. It was a single motion, repeated until it became a house.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on the operation, the architectural pattern, the gift-topology map, or any portion thereof, in any jurisdiction, at any time, and will not assert any patent right against anyone practising them. This commitment is permanent and is not tactical. Trademark rights on specific marks — **HeartBank®**, **Miss Aquarius℠**, **Zero-Point Game℠**, **Re-Tip Jar℠**, **Aquarian Pool℠**, **B-Rock™**, **B-Stone™**, **B-Gram™**, **B-Chest™**, **B-Card™℠**, **B-Yearbook™℠**, **B-Dating℠**, **B-Store℠**, **B-Gift℠**, **B-ReGift℠**, **Proof of Humanity ℠**, the B-heart logo, and **B-Aura** — are separately and explicitly reserved; the defensive-publication dedication concerns the *operation*, not the *marks*.\n\nTo the author's knowledge, the following are not previously published as a unified contribution: (i) the identification of **give-as-gift (not exchange)** — with **receive → give-forward-never-back** as its circulation form, the form every network product implements — as a single atomic operation that is *invariant across currency* (money, time, physical object, gene), *across scale* (person, family, civilization, species), and *across substrate* (digital, physical, biological) — the gene, species and biological cases being resemblances rather than instances by the sameness criterion of §9.8 — such that the diverse mechanisms of an entire institution are instances of one operation rather than a family of related ones; (ii) the location of the directional constraint *forward-not-back* as **the boundary this corpus draws, against Mauss's obligation to reciprocate,** between *circulation* (the gift) and *exchange* (the market) — and the consequent recasting of the wordmark \"circulation, not accumulation\" from a *state to be described* into an *operation to be performed*; (iii) the full **gift-topology map** — six relational-scope topologies (self-directed, dyadic-reciprocal, group-circulation, open forward-chain, commons / place-anchored, across-time) of which forward-circulation is one case — together with its mapping onto a concrete product line; and (iv) the use of the atom as the **generative spine** from which each product of the institution is *derived* rather than *described post hoc*, including the result that the institution's most commercial surface and its most civilizational telos are the same operation at two scales. The component lineages (Mauss; Polanyi; Hyde; Sahlins; Malinowski; the *dāna* tradition; the demurrage and complementary-currency literature; pay-it-forward as a vernacular practice; Derrida's aporia of the gift) are old, are cited generously in §2, and are distinguished from the contribution rather than absorbed by it. The synthesis was not found in the lineage §2 surveys as of this paper's date; no systematic prior-art census has been run on it, and the claim is scoped to that aperture.\n\n## Claims\n\n*Enumerated at the 2026-09-05 revision. A defensive publication works by disclosure; these enumerate what the paper already disclosed and add no matter.*\n\n1. **The atom** — *give as a gift, not as exchange*, whose circulation form is *receive → give forward, never back*, invariant across currency (money, time, object), scale (person, family, civilization) and the digital and physical substrates; the biological substrate is claimed as a resemblance only (§3, §9.8).\n2. **The per-transfer boundary test** — for any proposed transfer, whether the value once received goes forward to a third party or back to its source in a return that closes the account, as the design discriminator between a gift mechanism and a market mechanism (§4.3).\n3. **The six-topology map** — self-directed, dyadic-reciprocal, group-circulation, open forward-chain, commons / place-anchored, across-time — with relational scope as its axis, and its realization one product per cell (§6.1–§6.2).\n4. **The conserved-identity subclass** — forward motion in which the gift's identity and provenance survive the pass, bounded by construction at a designed terminus, with thankability at every link (§6.5).\n5. **Hoardability tiering as a design predictor** — the three tiers of what a person can give, keyed on whether it can be held: name and thanks (unhoardable by construction) · an hour (self-expiring) · money and objects (hoardable); and the claim that the tier, a property of the substrate rather than a position on any list, fixes in advance how much lifecycle machinery a givable requires (§6.6).\n6. **The sameness criterion** — three beats (received; made one's own to give; transferred to a non-source party) as the test that lets the one-atom claim fail by counterexample (§9.8).\n\n## Abstract\n\nThis paper discloses a design criterion for peer-to-peer gift, reciprocity and gratitude systems (pay-it-forward schemes, time banks, complementary currencies, peer-recognition ledgers): classify each transfer by where the recipient's next transfer goes — onward to a third party (generalized reciprocity: a gift that circulates) or back to its source in a return that settles the account (balanced reciprocity: an exchange). With it come a six-way taxonomy of gift flows by relational scope, a bounded relay subclass that preserves provenance, and a three-tier classification of transferable value by hoardability that predicts how much lifecycle machinery each kind requires. The criterion is applied to HeartBank, which is, on its surface, many mechanisms: a family-scale money economy, an adult-scale time economy, a line of physical gratitude artifacts, a matchmaking instrument, an autonomous AI successor, a planetary balancing game. This paper makes a reductive claim about all of them. **There is exactly one atomic operation underneath the entire institution: *give as a gift, not as exchange* — whose circulation form, and the form every network product implements, is *receive a gift, then give it forward — never back.*** The claim has three dimensions of invariance. The operation is invariant across **currency**: the thing received-and-forwarded can be money (a re-tip), time (funded presence), a physical object (a passed artifact), or a gene (a trait selected and propagated), and the operation is structurally identical in each. It is invariant across **scale**: it runs at the level of a person (one self-thank forwarded), a family (a circulating object), a civilization (a synchronized annual disbursement), and a species (kindness propagated by mate choice). And it is invariant across **substrate**: it is the same operation whether it executes in software, in the hand, or in biology. The biological cases (the gene, the species, the biological substrate) are resemblances rather than instances by the sameness criterion of §9.8; the invariance claimed is across money, time and object, from person to civilization, in the digital and physical substrates. We then locate the operation's load-bearing constraint — *forward, not back* — as the boundary this corpus draws, against Mauss's obligation to reciprocate, between *the gift* (which circulates and binds) and *the commodity* (which is exchanged and clears the relation): a return *back* to the giver is what converts a gift into a trade and dissolves the bond it was meant to create. This has an immediate consequence for HeartBank's wordmark. \"Circulation, not accumulation\" has been read as a description of a *state* the institution is in; we show it is better read as a specification of an *operation* the institution *performs* — the public line is the atom, compressed to three words. We then map the broader space of which forward-circulation is one case: the **gift-topology map**, six relational-scope topologies (self-directed, dyadic-reciprocal, group-circulation, open forward-chain, commons/place-anchored, across-time), each realized by one product in the physical line, the truest invariant being *give-as-gift (not exchange)* with *forward* its circulation topology. Finally we show the atom is the corpus's unifying spine — upstream of the Treasury re-tip, the Chronicle hour, the physical artifacts, the matchmaking instrument, and the species-scale propagation thesis — and we ground it in the four *brahmavihāra* design lens, where the gift is the accessible foundation that the immeasurables are cultivated *from*. §9 is unusually large because the claim is unusually strong and unusually unproven: the invariance is asserted across many domains from the design of a *single* project (n=1), it is at constant risk of over-unification (collapsing genuinely different operations under one flattering word), and *forward* is demonstrably **not** the right topology for two of the six cases — which is why the broader gift, not the narrower forward, is the true atom. Offered under CC0 1.0 Universal as defensive prior art.\n\n**Connection to the unified mission frame.** HeartBank's canonical mission is to keep the middle way (*majjhimā paṭipadā*) — the optimal condition for awakening — open at population scale against *comfort-saturation*, the new extreme that material abundance makes possible. The failure mode the mission names is not poverty but that new extreme: a culture organized around *accumulation* and *exchange*, in which the reflex to hold and the reflex to trade have crowded out the older reflex to *give onward*. If that is the disease, then the cure is not a new product but the re-installation, at population scale and with modern coordination, of a single human capacity the market never names: the capacity to receive something and pass it forward without settling the account. This paper is the claim that HeartBank is, all the way down, that one capacity given an infrastructure. Every mechanism in the corpus is this operation in a different material; naming the operation is naming what the institution *is*.\n\n**Keywords:** gift economy; generalized reciprocity; indirect reciprocity; upstream reciprocity; pay-it-forward; peer-to-peer transfer; gratitude platform; peer recognition; time banking; complementary currency; demurrage; forward-only balance; non-withdrawable credit; annual expiry; bearer gift code; provenance; anonymous giving; Mauss; reciprocity continuum; design criterion.\n\n## Terms\n\nThe paper uses its own vocabulary; each coined term maps to a standard one.\n\n| Term in this paper | Standard technical term |\n|---|---|\n| the gift operation · the atom · receive → give-forward | a forward-only transfer rule; generalized (upstream, indirect) reciprocity; pay-it-forward |\n| forward-not-back | a non-reciprocation-to-source constraint: the recipient's next transfer goes to a third party, not to the original giver |\n| *back* · a return that closes | balanced reciprocity; bilateral settlement of an account |\n| the per-transfer boundary test | a design criterion classifying each transfer as gift (onward) or exchange (settling return) |\n| gift-topology map | a taxonomy of gift flows by relational scope: self, dyad, bounded group, open chain, shared site, future time |\n| conserved-identity subclass | a bounded relay or bearer instrument that carries provenance through a non-redeeming intermediary to a terminal recipient |\n| hoardability tiering | classification of transferable value by whether it can be accumulated: unhoardable, self-expiring, hoardable |\n| attribution cut · atmosphere / bond | anonymous versus attributed giving; donor anonymity as removal of the creditor |\n| sameness criterion | a three-condition test for whether two events instantiate one operation |\n| Re-Tip Jar℠ · Re-Tip Fund℠ · re-tip | an earmarked, forward-spendable, non-withdrawable balance and a transfer from it to a nearby third party |\n| Kiitos · self-thank | a peer-recognition token; a self-issued recognition record |\n| Aquarian Pool℠ · the January 7 jubilee | a common pool that empties on a fixed annual date; fixed-date expiry of forward-only balances |\n| B-products (B-Rock™, B-Gram™, B-Chest™, B-Card™℠, B-Stone™, B-Yearbook™℠) | NFC- or QR-tagged physical gratitude artifacts |\n| B-Gift℠ · B-ReGift℠ | a prepaid item voucher (gift code); a variant whose intermediate holder cannot redeem it |\n| B-Dating℠ · aura | matchmaking on a reputation signal derived from recorded giving |\n\n---\n\n## 1 · Introduction\n\nA reciprocity economy can be specified two ways. One can specify it *additively* — as a catalogue of products, each with its own mechanism, the institution being the sum of the catalogue. Or one can specify it *reductively* — by isolating the smallest operation the whole system performs, and deriving the catalogue as instances of that operation. The additive specification is how HeartBank's corpus grew: the *Dual-Currency Reciprocity* paper specifies the money/time integration; the *Fractal Three-Level Architecture* paper specifies the self-similar scaling; the *Zero-Point Game* paper specifies the balancing game; the self-thanking, the B-Tag economy, the Mechanical Heart, the physical product line each have their own treatment. Read as a catalogue, the corpus is a federation of related-but-distinct designs.\n\nThis paper makes the reductive claim that the federation is an illusion of the catalogue form. There is one operation underneath, and the catalogue is its instances. The operation is small enough to state in six words: **receive a gift; give it forward.** With one constraint that does all the work: **forward, never back.** Everything in §§3–8 is an unpacking of why those six words plus one constraint are load-bearing, why the constraint is exactly the line between a gift economy and a market, why the institution's own name already encodes the operation, and why every product is downstream of it.\n\nThe motivation for isolating the operation is not tidiness. It is three things. *First*, an operation named is an operation one can *check a design against*: a proposed new mechanism either implements receive-and-forward or it does not, and if it does not, it is — whatever its other merits — not a HeartBank mechanism but a market mechanism wearing HeartBank's colors. The atom is a design discipline before it is a description. *Second*, an operation isolated is an operation whose *invariances become visible*: once you see that the re-tip (money) and the funded hour (time) and the passed card (object) are the same operation, you can ask whether the operation also runs in materials the institution has not yet built into — and the answer, developed in §7, reaches as far as the biology of mate choice, which is where the institution's most commercial product turns out to be its most civilizational one. *Third*, an operation that is genuinely the atom *exposes itself to falsification* in a way a catalogue does not: if the invariance is real, it should hold at scales and substrates the design did not have in mind; if it is merely an aesthetic the designer imposed, it will hold only where the designer's hand reached. §9 takes that exposure seriously, because a claim this unifying is exactly the kind of claim a designer is most likely to be seduced by and least able to falsify from the inside.\n\nThe paper proceeds as follows. §2 surveys the gift-versus-exchange lineage and locates the contribution against it. §3 states the operation formally and develops the three-dimensional invariance (currency × scale × substrate). §4 establishes that *forward-not-back* is the Maussian boundary between circulation and exchange — the constraint is not a stylistic preference but the definition of which economy one is in. §5 recasts the public line \"circulation, not accumulation\" as the operation compressed. §6 maps the full gift-topology space, of which forward-circulation is one of six cases, and grounds it in the physical product line. §7 derives each major HeartBank product from the atom, showing the spine. §8 grounds the operation in the four-*brahmavihāra* design lens. §9 is an honest accounting of the claim's weaknesses — the n=1 a-priori coherence, the over-unification risk, and the two topologies for which *forward* is the wrong description. §10 states why the framing is worth claiming now. §11 carries references.\n\n---\n\n## 2 · Background and Prior Art\n\nThe operation this paper isolates is not a discovery of a new phenomenon. The gift, and its distinction from the trade, is one of the most thoroughly worked subjects in economic anthropology and in the world's contemplative traditions. The contribution is not the gift; it is the *isolation of one directional operation as a substrate-, scale-, and currency-invariant atom*, the *location of its constraint at the Maussian boundary*, and the *topology map* of which it is one case. The lineage is claimed as convergence and named generously, so the contribution is not mistaken for re-invention.\n\n**Mauss — the gift as the thing that must move.** Marcel Mauss's *Essai sur le don* (1925) is the founding text. Across the potlatch of the Pacific Northwest, the *kula* ring of the Trobriands, and the Roman, Germanic, and Vedic legal records, Mauss found that the gift is never free and never inert: it carries an obligation to receive and, above all, an obligation to *reciprocate* — and the gift's social power is precisely that it *keeps moving*, binding giver and receiver into an ongoing relation rather than closing the account. The *hau* of the Māori taonga — in Mauss's contested reading (Sahlins and Weiner read it otherwise), the \"spirit of the gift\" that wishes to return to its source or move onward — is Mauss's emblem of the principle that a gift not passed on is a kind of theft. This paper's atom is Maussian to its root, with one sharpening that §4 makes load-bearing: Mauss's reciprocation is often read as *return to the giver* (gift and counter-gift), but the institution-building cases that interest him most — the *kula*, where valuables circulate a great ring and never return to a giver by the short path — are *forward* circulation, not dyadic return. The atom takes the forward reading as primary and treats dyadic return as a distinct topology (§6).\n\n**Malinowski — the *kula* as forward circulation.** Bronisław Malinowski's *Argonauts of the Western Pacific* (1922) documented the *kula* exchange, in which two classes of valuables (*soulava* necklaces and *mwali* armshells) travel in opposite directions around a ring of islands, each object moving from partner to partner and never being retained — to hold a *kula* valuable too long is dishonorable; its worth *is* its motion. The *kula* — \"a form of exchange,\" in Malinowski's own opening words, in the ceremonial sense — is borrowed here for its topology, onward and never back to the last giver, not for its classification: it is the ethnographic archetype of receive-and-forward at group scale, and §6's \"group-circulation\" and \"open forward-chain\" topologies are its descendants. The institution's circulating physical artifacts (§6) are a *kula* ring rebuilt for gratitude.\n\n**Sahlins — the reciprocity continuum.** Marshall Sahlins, in *Stone Age Economics* (1972), graded reciprocity along a continuum from *generalized* (giving with no expectation of a timed or equivalent return — the pure gift, characteristic of close kin) through *balanced* (timed, equivalent return — close to barter) to *negative* (each party seeking to get the better of the exchange — the market's limit). This continuum is essential to the present paper because it names exactly the axis along which *forward* and *back* differ. *Generalized* reciprocity is forward: the giver does not look to the receiver for the return; the return, if any, comes round the ring or down the generations. *Balanced* reciprocity is back: the return comes from the receiver, in kind, on a clock. The atom of this paper is generalized reciprocity *operationalized and coordinated* — and §4's claim that \"back commodifies the bond\" is Sahlins's claim that balanced reciprocity shades continuously into the market.\n\n**Polanyi — embedding and disembedding.** Karl Polanyi's *The Great Transformation* (1944) distinguished economies *embedded* in social relations (reciprocity, redistribution) from the *disembedded* self-regulating market that the nineteenth century invented and naturalized. Polanyi's contribution to this paper is the diagnosis that the market is not the default human economy but a historically specific *disembedding* of exchange from the relations that reciprocity keeps intact. HeartBank's operation is a deliberate *re-embedding*: it routes value through relations (forward, to a person, in proximity) rather than clearing it through an impersonal price. The wordmark \"circulation, not accumulation\" (§5) is a re-embedding slogan in Polanyi's exact sense.\n\n**Hyde — the gift must stay in motion.** Lewis Hyde's *The Gift* (1983) carried the anthropology into the moral and artistic register: a gift, to remain a gift, must be kept moving; \"the gift must always move,\" and a gift that is hoarded or converted into capital dies. Hyde's \"labor of gratitude\" — the inner transformation the received gift works in the receiver before it can be passed on — is the psychological content of the atom's *forward* arrow, and the corpus's self-thanking practice (§7) is Hyde's labor of gratitude given a trigger. Hyde is the closest prior statement of *forward-not-back as the life of the gift*; the present paper's debt to him is large, and its addition is the *invariance* claim (Hyde's gift is artistic and spiritual; the atom is shown to run identically in money, time, object, and gene) and the *topology map*.\n\n**The *dāna* tradition — the gift as the foundation of the path.** In the Pāli canon, *dāna* (giving) is the first and most accessible of the meritorious bases (*dāna* → *sīla* → *bhāvanā*), and the gift's perfection is measured by its *non-attachment to return* — the gift given \"not as an investment, their mind not tied to it\" is graded above the gift given as an investment, \"expecting to keep it\" (AN 7.52, in Sujato's translation). The unrepayable debt to one's parents is canonically discharged (AN 2.33) by establishing them in *saddhā*, *sīla*, *cāga*, and *paññā* — *forward*, in this paper's reading, since nothing returns to the child in kind. The atom's \"never back\" is the *dāna* tradition's structure: the highest giving does not seek the loop's closure. §8 develops the brahmavihāra grounding; here it is enough to record that the operation's directional constraint has a 2,500-year-tested contemplative warrant, not only an anthropological one.\n\n**Pay-it-forward — the vernacular instance.** The popular practice of \"paying it forward\" — responding to a kindness by extending kindness to a *third* party rather than reciprocating to the benefactor — is the atom's folk name, and the institution does not pretend to have invented it. Lily Hardy Hammond's *In the Garden of Delight* (1916), Robert Heinlein's *Between Planets* (1951), and Catherine Ryan Hyde's *Pay It Forward* (1999) are the cultural lineage; the \"suspended coffee\" (*caffè sospeso*) of Naples is its café instance; the chains of anonymous toll-paying and drive-through generosity are its everyday instance. The contribution here is not the practice but the claim that the practice is the *atom of an entire coordinated institution* — that pay-it-forward, given a ledger, an AI coordinator, a proximity rule, a physical anchor, and an annual reset, is not a feel-good gesture but a buildable economy. ServiceSpace's *Smile Cards* (c. 2003), *Where's George* (1998), and *BookCrossing* (2001) — trackable objects passed forward and followed online — are the nearest operational prior art for the physical, object-substrate case (§6), and are cited as such; the present paper's physical artifacts are distinguished from them in the same way, and the kernel of the object case not found among them (provenance-as-a-subscribable-channel fused with a gratitude economy) is disclosed under the corpus's *B-Links* umbrella rather than claimed here.\n\n**Demurrage and complementary currencies — engineered forward pressure.** Silvio Gesell's *Freigeld* and the Wörgl scrip of 1932 engineered money so that *holding* it cost the holder, accelerating circulation; the complementary-currency literature (Lietaer, Greco, Cahn's time-banking) builds reciprocity media that resist accumulation. These are the closest *mechanism* prior art for \"forward pressure built into the unit.\" The atom's annual reset (the Jan-7 jubilee; the Re-Tip Jar℠ expiration) is demurrage's cousin — but where demurrage taxes holding to *encourage* circulation, the atom *forbids* the loop from closing back and *requires* the forward pass, which is a stronger and more specific constraint than a holding cost.\n\n**Derrida — the aporia of the pure gift.** Jacques Derrida's *Given Time* (1991) argued that the pure gift is, strictly, *impossible*: the moment a gift is recognized as a gift — by giver or receiver — it sets up a debt, a symbolic return, and so annuls itself as gift; a gift that truly gave would have to be unknown even to its giver. This is the sharpest available objection to any gift-economy claim and the present paper does not dodge it (§9.5). The atom's response is structural rather than philosophical: *forward-not-back* is precisely the design move that minimizes the Derridean annulment, because it removes the *return to the giver* that most cleanly constitutes the debt — the gift that goes forward to a third party, anonymously and without a path home, is the closest a coordinated system can get to Derrida's impossible gift, even if it cannot reach it. The aporia is named, not waved away.\n\nThe shape of the contribution against this lineage: economic anthropology established that the gift circulates and that its circulation binds; Hyde established that it must keep moving; Sahlins graded the *forward/back* axis; the *dāna* tradition placed the unattached forward gift at the foundation of the path; the vernacular named it pay-it-forward; the demurrage tradition engineered forward pressure into money. What was not found in the lineage surveyed here (no systematic prior-art census has been run) is the claim that *one* directional operation, *forward-not-back*, is the **invariant atom across currency, scale, and substrate** of a buildable institution — that the same operation runs in money, time, object, and gene, at the scale of a person and of a species, in software, in the hand, and in biology (the biological cases as resemblance only, §9.8) — together with the *topology map* of which it is one case and the demonstration that the whole corpus is its instances. That is the synthesis claimed.\n\n---\n\n## 3 · The Operation and Its Three Invariances\n\n### 3.1 · The atom, stated\n\nThe operation has two phases and one constraint.\n\n```\n        ┌──────────────────────────────────────────────┐\n        │             THE GIFT OPERATION               │\n        │                                              │\n        │     (1) RECEIVE a gift   ─────────►          │\n        │                                              │\n        │     (2) GIVE it FORWARD  ─────────►          │\n        │                                              │\n        │     constraint:  the forward gift goes to    │\n        │                  a THIRD party, never BACK   │\n        │                  to the original giver.      │\n        └──────────────────────────────────────────────┘\n\n   back   :   A ──gift──► B ──return──► A      (loop closes  → EXCHANGE)\n   forward:   A ──gift──► B ──forward──► C ──► D ──► …        (open    → GIFT)\n```\n\nA participant *receives* something of value, and then *gives a thing of value forward* to someone who is **not** the original giver. The forward gift need not be the same object, the same amount, or the same currency; what is invariant is that the motion is *onward*, into the network, rather than *back*, to the source. When the motion is back — when B returns to A — the two transfers together constitute an *exchange*, and the relation A–B is *cleared*: nothing is owed, nothing binds, the parties are quits. When the motion is forward — when B passes onward to C — the relation does not clear; it *propagates*, and the network it propagates through is held together by the open obligations the forward passes leave in their wake. §4 is the argument that this difference is not a stylistic one but the definition of which economy one is in.\n\nThe atom is deliberately humble. It contains no money, no AI, no ledger, no app. Those are the *coordination apparatus* that lets the atom run at population scale (the *Zero-Point Game* and *Dual-Currency* papers specify them); they are not the atom. The atom is the gesture a child performs when, thanked, she thanks the next person — which is exactly why the corpus's self-thanking primitive identifies the child as the natural trigger and the 50/50 split as the pedagogy that *teaches* the forward pass.\n\n### 3.2 · Invariance across currency\n\nThe first invariance is that the thing received-and-forwarded can be any of at least four currencies, and the operation is structurally identical in each.\n\n| Currency | What is received | The forward pass | The product surface |\n|---|---|---|---|\n| **Money** | a tip / a self-thank reward | re-tip forward to a person nearby | Re-Tip Jar℠ (Treasury) |\n| **Time** | an hour of presence / an unbought hour | fund presence forward; pay the patron-trigger forward | Chronicle; the patron handoff |\n| **Object** | a gratitude artifact, thanked-into | pass the artifact forward to the next holder | B-Card™℠, B-Chest™ |\n| **Gene** | a kindness-disposition, selected for | propagate it forward to the next generation | B-Dating℠ (sexual selection on kindness) |\n\nIn each row the same three beats occur: a value is received, an inner transformation (Hyde's labor of gratitude) makes the value the receiver's to give, and the value is passed *onward* to a third party. The money case is the Treasury re-tip: you are thanked with a small amount, and half of it is earmarked to be re-tipped to someone nearby rather than returned to your thanker. The time case is Chronicle and the patron handoff: you are given an hour of presence, or an hour of redeemed service you did not have to pay for, and the forward pass is to fund presence — or patronage — for someone else. The object case is the physical line: a B-Card™℠ is thanked-into and *passed to the next person*, its journey followed like a channel, and it is dishonorable (as with the *kula*) to retain it. The gene case is the most surprising and is developed in §7.4: a person selected as a mate *for their proven kindness* propagates that disposition forward into a generation that did not exist to thank them — the forward pass at the biological substrate.\n\nThe currency-invariance is the claim that these are not four mechanisms but one. A design that treats them as four will build four separate apps with four separate mental models; a design that sees the one operation builds *one* operation with four material bindings — which is exactly what the *Fractal Three-Level Architecture* paper observes the institution doing at the level of scale, and what this paper observes it doing at the level of currency.\n\n### 3.3 · Invariance across scale\n\nThe second invariance is that the operation runs identically at four scales, from a single person to the entire species.\n\n```\n   PERSON      ──►   one self-thank, half forwarded (the atom's ignition)\n      │\n   FAMILY      ──►   a gratitude object circulating through a household\n      │\n   CIVILIZATION──►   a synchronized annual disbursement (Jan-7 jubilee):\n      │              everyone's jar empties FORWARD, to a human, by the date\n      │\n   SPECIES     ──►   kindness propagated forward by mate choice across generations\n```\n\nAt the scale of a **person**, the operation is the self-thank: a Kiitos that needs no counterparty, which under the 50/50 forwarding rule cannot stay closed — half of it goes forward — so that even the most isolated participant is, the instant they self-thank, a *source* of forward circulation (the *Zero-Point Game* paper's \"ignition\"). At the scale of a **family**, the operation is a circulating object — a B-Chest™ passed person-to-person through a household, each thanking the next, love multiplying as it circulates and never sitting still. At the scale of a **civilization**, the operation is the synchronized annual disbursement: on January 7 every participant's Re-Tip Jar℠ / Re-Tip Fund℠ must empty *forward*, to another human, or the value returns to the Aquarian Pool℠ to be given again — a whole population performing the forward pass on the same day (the corpus's *Manufactured Universal Giving* mechanism). At the scale of the **species**, the operation is sexual selection redirected onto kindness: mate choice on *proven* warmth propagates the kindness disposition forward across generations (B-Dating℠; the *Two Singularities* propagation thesis).\n\nThe scale-invariance is the claim — argued from the design's self-similarity, and flagged in §9 as the place that self-similarity is most seductive — that the family object and the planetary jubilee and the generational propagation are the *same operation*, not analogies for it. The strongest evidence offered for this is the *holographic* property the corpus has repeatedly observed: that one can reconstruct the whole architecture from any single decision at any scale, because the same operation is present in each part. An assembled system has seams where its scales meet; a grown one is the same all the way down, and the gift operation is what is the same.\n\n### 3.4 · Invariance across substrate\n\nThe third invariance is that the operation is indifferent to whether it executes in software, in the hand, or in biology.\n\n| Substrate | How the operation runs | Example |\n|---|---|---|\n| **Digital** | a ledger entry; an AI-coordinated re-tip; an app-mediated forward pass | Treasury / Chronicle |\n| **Physical** | a thanked-into object moved hand to hand; an NFC tap; a place that accrues thanks | B-Card™℠, B-Stone™ |\n| **Biological** | a disposition selected by a mate and carried into the next generation | B-Dating℠ → procreation |\n\nThe same receive-and-forward runs as a database transaction, as a card placed in a stranger's hand, and as a trait carried in a child. The substrate-invariance is the most ambitious of the three and the one §9.2 marks as most strained at the biological end: it is far less obvious that \"a gene selected and propagated\" is the *same operation* as \"a tip re-tipped\" than that \"a tip\" and \"an hour\" are the same operation. The paper makes the strong claim because the design's reach genuinely extends there — the institution's matchmaking product *is* its species-propagation mechanism (§7.4) — but it marks the biological case as the one where the invariance is asserted most and demonstrated least.\n\n### 3.5 · The combined invariance, in one figure\n\n```\n                          THE GIFT OPERATION\n                      receive → give-forward (≠ back)\n\n        CURRENCY  ───  money · time · object · gene\n            ×\n        SCALE     ───  person · family · civilization · species\n            ×\n        SUBSTRATE ───  digital · physical · biological\n\n     the SAME operation at every cell of the 4 × 4 × 3 lattice.\n     a HeartBank product = the gift operation, bound to one cell.\n```\n\nA HeartBank product, on this account, is the gift operation *bound to a cell* of the lattice. The Re-Tip Jar℠ is the operation at (money, person/family, digital). The B-Chest™ is (object, family, physical). B-Dating℠ reaches (gene, species, biological). The institution is not a catalogue of products; it is one operation instantiated across the lattice, and the catalogue is the list of cells the design has so far reached. The lattice also *predicts* products the design has not built: cells that are filled in one currency but empty in another are candidate mechanisms, which is the generative use of the atom §1 promised. The biological cells of the lattice (gene, species, biological substrate) fail the first beat of the sameness criterion of §9.8 — a gene is not received as a gift — so they are resemblances of the operation, not instances; the sameness claimed covers the money, time and object currencies, the person-to-civilization scales, and the digital and physical substrates.\n\n---\n\n## 4 · Forward-Not-Back Is the Maussian Boundary\n\nThe constraint *forward, not back* has been treated, in casual statements of the corpus, as a value judgment — forward is generous, back is stingy. That reading undersells it. *Forward-not-back* is not a value judgment laid on top of the operation; it is the line this corpus draws between two kinds of economy, and which side of the line you are on is *determined* by the direction. Mauss names the pull the design removes — the obligation to reciprocate — not a rule it inherits; Sahlins's generalized reciprocity (unaccounted, delayed, often to third parties) is the nearest named form.\n\n### 4.1 · The return is what commodifies\n\nConsider the minimal two-party case. A gives B a gift. Two continuations are possible.\n\n- **B returns to A.** The two transfers — A→B and B→A — now form a closed pair. Whatever the participants' intentions, the *structure* of a closed give-and-return pair is the structure of an exchange: a thing for a thing, the account settled, the parties quits. Sahlins's continuum is continuous precisely here — *balanced reciprocity* (timed, equivalent return to the giver) is one short step from barter, and barter is one step from the priced market. The return *back* is the seed of the commodity. As the corpus puts it in its blunt internal form: *back commodifies the bond.* The moment the gift returns to its giver, it has become a payment, and a relationship that clears is a relationship that does not bind.\n\n- **B passes forward to C.** Now there is no closed pair. A's gift to B is unsettled (A is owed nothing back; the gift went onward), and B's gift to C opens a new unsettled relation. The network accumulates *open* obligations, and it is the openness — the refusal to clear — that holds the network together. This is Mauss's circulating *kula* valuable, Hyde's gift that must keep moving, the *dāna* that is not repaid back but established forward. The forward pass is the gift staying a gift.\n\nThe claim, then, is exact: **the direction of the second transfer determines whether the first was a gift or a trade** — where *back* means a return that *closes the account*: matched, expected, settling. The dyadic gift's back-and-forth is open, unmatched and never settles, which is why §6.1 keeps it a gift (§9.4). The *same* initial transfer A→B is a gift if B passes forward and (retrospectively) a trade if B returns. The gift/commodity distinction is not a property of the object, the amount, or the intention; it is a property of the *topology of the second move*. This is why *forward-not-back* is load-bearing and not decorative: it is the operation by which an economy decides, transfer by transfer, whether it is a gift economy or a market.\n\n### 4.2 · Why the institution still uses the market\n\nIt is important to state immediately, because the boundary is sharp, that HeartBank does *not* reject the market. It sells physical artifacts; it charges sponsors; it runs a matchmaking business; it takes a per-transaction fee that funds the autonomous coordinator. The corpus's standing posture is that the project draws the gift/exchange line *precisely, everywhere*, and lets each side do its proper work — it keeps the gift a gift (forward, never back, never gated by money) *while still letting exchange do the things exchange is good at* (funding the coordinator, paying the artisan, sustaining the cold start). The boundary is not a wall around the institution; it is a line drawn *inside* it, at every transfer, and the discipline is to know which side any given transfer is on. A self-thank re-tipped forward is a gift; a B-Rock™ sold in the store is a trade; the store's proceeds tithed to the Pool become a gift again. The same institution runs both, and the entire art is in never confusing them — never letting the gift return *back* (which would commodify it), and never letting the trade masquerade as a gift (which would corrupt it). §4 is the theoretical statement of a discipline the corpus elsewhere calls *gift/exchange boundary maintenance*.\n\n> **Current form.** Where this section says the store's proceeds are tithed to the Pool, the Aquarian Pool℠'s inflows are now specified exhaustively, and a store tithe is not among them. The Pool receives: gratitude given directly to it; thanks addressed to no person, such as a bare code on a robot (all of it when the robot is unhosted, half when it is hosted, the other half going to the host); forward-only capacity that no one gave on, returning when the Re-Tip Fund℠ balances clear each 7 January; money from businesses that buy registry leases at fair value, which reaches the Pool through the purpose trust that owns the institution; and any fee surplus left after operations, which joins the annual emptying. Of gratitude, the Pool receives only what has no human addressee. Commercial money reaches the Pool only by purchase, and never as a take on anyone's giving or trade. The store tithe described above is retained as a disclosed variant.\n\n> **Current form.** The per-transaction fee named above is now specified as a Phase-2 settlement fee sized to infrastructure cost (settlement and compute), paid on top by the person giving, never deducted from what the recipient receives and never a percentage or share of a gift; any surplus empties with the Aquarian Pool℠ each year, and the fee base never informs what is surfaced to anyone. Whether such a fee covers operating cost has not been verified. The text above is retained as a disclosed variant.\n\n### 4.3 · The boundary as a design test\n\nThe boundary yields a one-line design test, which is the atom's chief practical value:\n\n> *For any proposed transfer in the system, ask: does the value, once received, go FORWARD to a third party, or BACK to its source? If forward, it is a gift, and it belongs to the circulation. If back, it is an exchange, and it must be honestly named as such — never dressed as a gift.*\n\nA mechanism that lets gratitude flow *back* to the giver — \"thank your benefactor in return\" — is, however warm its packaging, building balanced reciprocity, which slides toward the market. A mechanism that routes gratitude *forward* — \"you were thanked; now thank the next person\" — is building the gift economy. The test is mechanical and it is the discipline §1 promised: the atom is a checkable constraint, and the constraint is the line drawn against Mauss's obligation to reciprocate.\n\nDirection is not the only axis on which that obligation can be cut. §6.7 names the second — **attribution**: the return has no one to go to — and shows why, inside a closed set such as a family, it is the only cut available.\n\n\n### 4.4 · Redistribution moves value *to* a person; circulation moves it *through* one\n\nThe first objection a reader with any economics reaches for is that this is redistribution wearing new vocabulary — value taken from where it is plentiful and moved to where it is scarce, with a gift-shaped story told over the top. The objection deserves a direct answer rather than a tonal one, and the answer is structural: **redistribution and circulation differ in whether there is a required second leg.**\n\nA redistributive transfer is **complete on arrival**. Value leaves a source, reaches a recipient, and the operation has succeeded; nothing further is asked of the recipient, and nothing in the mechanism depends on what they do next. A circulating gift is **not complete on arrival**. The recipient holds an open obligation — not to the giver, which would close the pair and commodify it per §4.1, but forward, to someone not yet identified. *The transfer is a link in a chain that the recipient is expected to extend.* Remove the second leg and the operation is not a weakened version of itself; it is a different operation, and it is redistribution.\n\nThis is visible in the imagery each one naturally attracts. Redistribution is described in the language of **gravity**: value flows downhill, pools at the bottom, and the pool must be lifted again by some agency outside the system before anything can flow a second time. That picture is accurate about charity, and it is why charity requires a perpetual external source. **The gift operation has no downhill and no pool.** (The Aquarian Pool℠ of §3.3 is not a pool in this sense: it holds nothing past a season and empties every 7 January.) Value moves laterally between parties of no fixed height, and the thing that keeps it moving is internal to the operation — the recipient's own next act — rather than supplied from outside.\n\n**The consequence is a different success metric, and this is where the distinction stops being philosophical.** A redistributive system is measured by **arrival**: how much reached whom, how well-targeted, how little leaked. A circulation system is measured by **transit**: how many times value moved onward per unit introduced, and how quickly. These metrics select different mechanisms. Optimizing arrival produces means-testing, eligibility criteria, and targeting — machinery for identifying who is most lacking. Optimizing transit produces the opposite: mechanisms that make the *next* gift easy, that never let a holding accumulate, and that are indifferent to the recipient's position because position is not what the operation is tracking.\n\n**Honest limit, and it is a real cost.** A system optimizing transit can be *worse at arrival* than a well-targeted transfer. If the question is how to get a fixed sum to the people who most need it this quarter, a means-tested transfer beats a circulating gift and it is not close. **This architecture does not claim otherwise, and a design that quietly starts targeting has stopped being the thing described in this paper.** The claim is narrower: that arrival and transit are different goods, that the second is under-supplied, and that an institution can pursue one without pretending to be better at the other.\n\n**The dignity consequence follows from the mechanics rather than from sentiment.** A system that targets must first identify, and to identify is to name a person by what they lack — the eligibility interview is the price of the transfer. A system that circulates has no such step, because it is not selecting for lack; the recipient enters the operation *as the next giver*, which is the only role the mechanism has to offer. This is a byproduct of the second leg, not an ethical overlay on top of it, and it would survive the removal of every value statement in this corpus.\n\n**Where the rest of this argument lives.** The patronage form of the same distinction is developed in the essay *The Capacity to Give* (§6, *Patronage, not charity*) and the position *Not a Charity: Agency, Not Victimhood*; the *political* axis — coerced versus voluntary, which is a different cut entirely — is developed in *The Freedom Requirement: Voluntary Relinquishment as the Third Path*, and should not be confused with the directional cut made here. **A transfer can be perfectly voluntary and still be redistribution, if nothing is asked of the recipient afterward.**\n\n---\n\n## 5 · The Wordmark Recast as an Operation\n\nHeartBank's wordmark carries a thesis in two words. *Bank* connotes a vault — storage, accumulation, the thing held. *Heart* connotes a pump — circulation, the thing moved. The brand's canonical reading is that the name fuses an institutional anchor (*Bank*) with a corrective reading (*Heart*) that overrides the storage connotation, yielding the public line **\"circulation, not accumulation.\"** The internal, defensible refinement divides the labor: what the *Bank* accumulates is the *record* of appreciation (the gratitude ledger is permanent — the heart's *memory*); what the *Heart* circulates is the *value* (money and time flow out, never hoarded — the heart's *blood*). What is banked is the recognition; what is circulated is the substance.\n\nThis paper adds one move, and it is the move the atom makes available. \"Circulation, not accumulation\" has been read as a description of a *state* — the institution is in a circulating state rather than an accumulating one, the way a river is in a flowing state rather than a frozen one. That reading is true but inert; it describes a condition without saying what produces it. The atom says what produces it: **circulation is not a state the institution is in; it is an operation the institution performs, and the operation is receive-and-give-forward.** A river circulates because of gravity and terrain — a continuous physical operation. HeartBank circulates because every participant, at every transfer, performs the gift operation — receives, and passes forward, never back. *Circulation* is the name of the operation seen from the outside, in aggregate; *receive-and-forward* is the name of the operation seen from the inside, at the atom. They are the same fact at two resolutions.\n\nThis is why the wordmark is the smallest instance of the corpus's whole thesis — smaller even than the B-heart logo, present before any mark is drawn, present in the name itself. The logo fuses an anchor (the letter *B*) with a substantive reading (*heart*); the wordmark fuses an anchor (*Bank*) with a corrective reading (*Heart*); the *atom* is what the corrective reading *means as an instruction*. \"Circulation, not accumulation\" reads, when you ask what one must *do* to satisfy it: *receive, and give forward; do not hold (that is accumulation), and do not return (that would clear the relation and stop the circulation).* The public line is the gift operation compressed to three words, and the three words are an imperative, not a description.\n\n```\n   \"circulation,   not   accumulation\"\n         │           │          │\n         │           │          └─►  do not HOLD          (no vault)\n         │           └─────────────►  the negation         (not a state)\n         └─────────────────────────►  RECEIVE → FORWARD    (the operation)\n                                       (and not BACK — §4)\n\n   read as a STATE:      \"the institution is flowing.\"        (inert)\n   read as an OPERATION:  \"receive a gift; pass it forward.\"  (the atom)\n```\n\nThere is one subtlety the division-of-labor refinement already protects: the wordmark must survive the fact that HeartBank *does* keep a permanent ledger and *does* call itself a *Bank*. The atom does not strain this; it explains it. What is *accumulated* (the record, the recognition, the aura's disposition that persists across the jubilee) is exactly the thing the gift operation is *allowed* to retain, because retaining the *memory* of a gift does not return the *value* of the gift to its giver — the value still went forward. The Bank accumulates the proof that the forward pass happened; the Heart performs the forward pass. The wordmark is internally consistent precisely because the atom distinguishes the memory of the gift (banked, forward-compatible) from the value of the gift (circulated, never returned).\n\n---\n\n## 6 · The Gift-Topology Map\n\nThe atom of §3 is stated as *forward*-circulation, and §4 shows why forward is the gift's signature. But a refinement is required, and it is the refinement that keeps the claim honest: **the truest invariant is not *forward* but *gift-as-gift (not exchange)*; *forward* is one of several topologies the gift can take.** Forward-circulation is the *circulation* topology — the one that runs through three or more parties and never closes back. It is the most important topology, because it is the one that scales to a network and a civilization. But it is not the only one, and a design discipline that demanded *forward* of every transfer would wrongly reject genuine gifts that are not forward — a gift to oneself, a gift exchanged tenderly between two lovers. The gift is broader than circulation. The full space is six topologies, distinguished by their *relational scope*.\n\n### 6.1 · The six topologies\n\n| # | Topology | Relational scope | Direction | The motion |\n|---|---|---|---|---|\n| 1 | **Self-directed** | self (n=1) | inward — but half forwards | a gift one gives oneself; under the 50/50 split it cannot stay closed |\n| 2 | **Dyadic-reciprocal** | a couple (n=2) | back-and-forth | two parties giving *to each other*, turn by turn; the gift here *is* reciprocal |\n| 3 | **Group-circulation** | a family / inner circle | round-robin forward | an object or gift circulating through a bounded group, each giving onward |\n| 4 | **Open forward-chain** | the outer circle / strangers | forward, unbounded | the pay-it-forward chain; the *kula* ring; the gift that never returns |\n| 5 | **Commons / place-anchored** | a place; all beings | deposit to a shared site | a gift left *at a place* that accrues a community's giving |\n| 6 | **Across-time** | a year; a future self | forward in time | a gift addressed to a future moment; release of the past |\n\nTopology 4 — the open forward-chain — is the atom of §3 in its purest form, and it is the *circulation* the wordmark names. Topology 3 — group-circulation — is forward within a bounded ring (the *kula*). But topologies 1, 2, 5, and 6 are *gifts that are not forward-chains*: a self-gift moves inward; a dyadic gift moves back-and-forth *by design* (and this is not commodification, because the lovers' mutual giving is not an account being cleared but a bond being deepened — §9.4 treats why the n=2 case is the honest exception); a place-anchored gift moves to a *site* rather than a person; an across-time gift moves *forward in time* rather than across the network. All six are gifts (not exchanges); only some are *forward-circulation*. Hence the corrected design test is not \"is it forward?\" but **\"is it a gift (not an exchange), and which topology?\"** — the narrower test would mis-flag a valid self-gift as a withdrawal and a valid dyadic gift as a trade.\n\n### 6.2 · The map realized in a product line\n\nThe six topologies are not a taxonomy invented for this paper; they are the relational-scope axis of the corpus's physical product line, which, designed without reference to this map, was found afterward to *fill all six cells*. This is offered as evidence that the topology map carves the space at a real joint: a product line designed for relational completeness — explicitly modeled on the *mettā-bhāvanā* sequence of widening circles of goodwill (§8) — lands on exactly six topologies, one per product.\n\n| Product | Topology | Relational scope | The gift's motion |\n|---|---|---|---|\n| **B-Rock™** | 1 · self-directed | oneself | tap-thank into a nightstand rock; count blessings; the self-gift that (via the split) cannot stay closed |\n| **B-Gram™** | 2 · dyadic-reciprocal | a known couple | partners take turns writing thanks for each other; the back-and-forth *is* the bond |\n| **B-Chest™** | 3 · group-circulation | a family / inner circle | a chest passed person-to-person through the household; receive → pass forward; cannot sit still |\n| **B-Card™℠** | 4 · open forward-chain | the outer circle / strangers | a card thanked-into and passed onward, its ripple followed like a channel; never returns |\n| **B-Stone™** | 5 · commons / place-anchored | a place; all beings | a stone left by a tree that accrues a community's thanks; a site becomes a shrine with a guestbook |\n| **B-Yearbook™℠** | 6 · across-time | a year; a future self | a 365-page book addressed to a future birthday; releases the past, resolves the future |\n\nThe product line is the topology map made of objects, and the topology map is the product line made abstract. That two constructions from the same corpus — a product line designed without reference to this map, and a gift-topology analysis that found the line filled it afterward — converge on the same six cells is the paper's best a-priori evidence (and it is only a-priori; §9) that the topology map is the right carving of the gift's relational space. The self-directed and across-time topologies are the ones §9.4 flags as *not forward-circulation*, and they are exactly the two products (B-Rock™, B-Yearbook™℠) that the product-line analysis independently flags as *not daily forward-pass triggers* — a self-gift and a keepsake. The two analyses agree on which cases break the narrow \"forward\" rule, which is the kind of cross-check that makes the broader \"gift, which topology?\" formulation the load-bearing one.\n\n### 6.3 · Why circulation is the privileged topology even so\n\nIf the gift is broader than forward-circulation, why does the wordmark name *circulation* and why does §3 state the atom as *forward*? Because circulation (topologies 3 and 4) is the only topology that **scales to a network and a civilization**. A self-gift is bounded at n=1; a dyadic gift at n=2; a place-anchored gift to a site; an across-time gift to a timeline. Only the forward-chain propagates without bound through a population — and the institution's mission is population-scale. So forward-circulation is privileged not because it is the only gift but because it is *the gift that builds an economy*. The other five topologies are the gift's other relational modes, essential for completeness (a gift economy that could not handle the self, the couple, the commons, or the year would be impoverished), but the spine of the institution — the thing the wordmark names and the thing §7 derives every product from — is the forward-circulation case. The map's job is to keep the spine honest: *forward is the engine, but the gift is the whole, and the design must serve the whole without mistaking the engine for it.*\n\n### 6.4 · The commons topology, deepened: the place-anchored gift\n\nThe five non-circulation topologies are not placeholders, and the richest of them — the **commons / place-anchored** gift (topology 5, the B-Stone™) — is worth deepening, because it is where three of the paper's threads meet: the gift given to a *site* rather than a person, the self-elimination signature of §7.5, and the gift's first reach toward a *non-human* recipient.\n\nThe motion is a consecration. A steward consecrates a place — a stone by a tree, once in a lifetime — and thereafter taps to leave gratitude *into the place*; others passing tap to read the accrued thanks and leave their own. The site becomes a shrine with a guestbook, and the recipient of the gift is the *place itself* (a tree, a stretch of land, Mother Earth). This is the topology's defining feature: the commons gift is deposited to a shared site that accrues a community's giving, rather than passed to a next person. Three properties make the cell load-bearing rather than decorative.\n\n**The recipient is the place, not the steward — and the topology enforces this by construction.** A public, location-anchored, followable log of *one's own* good deeds risks inverting into a shrine to the steward's virtue: self-promotion wearing the commons' clothes. The corpus's guard against this is not a bolted-on rule but a *taxonomic* fact. The self-directed cell (topology 1, the B-Rock™) already owns the self-gift, so a self-first place-gift would simply collapse back into that cell; the commons topology *only exists* as a distinct position because its recipient is the place (the boundless, all-beings end of the *mettā-bhāvanā* widening of §8). Place-first is what gives the cell its own coordinate, which means the anti-self-monument discipline is self-enforcing — the topology map policing itself, the same cross-check logic as §6.2 now running inside a single cell.\n\n**The gift is gated on relieving the place — the commons cell is the map's *karuṇā* anchor.** The consecration carries a net-negative stewardship obligation: to leave the site better than one found it, verified as a real act (a cleanup logged and witnessed, not a drive-by visit). Where the other topologies run mostly on *mettā* (goodwill given onward) and *muditā* (appreciation), the place-anchored gift is where *karuṇā* — the active relief of suffering, here the suffering of the land — becomes the entry condition. Any gamified discovery layer that draws stewards to shrines must therefore reward *meaning, not magnitude*: the experience and the measurable improvement of the place, never the points or leaderboards that would re-import the acquisition drive the gift forbids (§4).\n\n> **Current form.** As now specified, the founding path of a place-anchored shrine is the memorial dedication — the permitted, paid, ceremonial dedication of a tree or bench of the kind land managers already run, tended afterwards by visitation — and memorial shrines are excluded from any discovery or quest layer. A discovery layer may lead people only to non-memorial shrines, where they join as co-stewards. The consecration described in this section, a living stone that becomes a memorial at its steward's death, is retained as a disclosed variant.\n\n**The footprint tends to zero, and the gift reaches across time.** The physical stone is bought for the ceremony, but the shrine lives in a GPS coordinate, not in an abandoned object — the discipline is *adopt-don't-add*: leave-no-trace forms (a real rock, seed-paper) genuinely return to nature, and any durable keepsake stays with the steward or circulates onward rather than being deposited as litter (*circulate, not deposit*). This is the self-elimination signature of §7.5 appearing in the commons cell: even the gift's *material* tends toward zero footprint. And the stewardship does not end with the steward. Others join and continue tending the site, so a living-stone tended in life becomes, at the steward's death, a *memorial* that a succession of stewards keeps re-thanking — the invariant is *found one, co-steward ∞*, the place-scale form of the succession pattern the corpus uses for institutional continuity. This is where the commons topology touches the *across-time* topology (topology 6): a place-anchored gift outlives its giver, carried forward in time by whoever tends the site next.\n\nFinally, the commons cell is the gift operation's **first reach toward a non-human recipient.** Admitting a place — a tree, a site — into the gratitude economy as a recipient is the precursor to the corpus's general treatment of non-human standing; the *Mechanical Heart* paper generalizes exactly this move, from a place to robots, animals, and sacred sites. The commons topology is thus not the outer edge of the map but a doorway: the point at which *give-as-gift* stops requiring a human on the receiving end.\n\n### 6.5 · The conserved-identity subclass: relays, and why they are not topology 4\n\nThe atom of §3 is deliberately **identity-permissive**. Its statement is explicit that *the forward gift need not be the same object, the same amount, or the same currency* — what is invariant is the direction of motion, not the thing in motion. A woman thanked with money who later gives an hour has performed the operation as cleanly as one who passes the same banknote onward. That permissiveness is load-bearing: it is what makes the atom substrate-invariant, and §3.4 is the argument for it.\n\nBut a proper subclass of the operation is stricter, and the corpus's own instruments keep landing in it. A Re-Tip Fund℠ holds value that is forward-spendable and never withdrawable — *the same value* continues, through a person who cannot consume it. A re-thank carries a received thanks onward rather than originating a new one. A gift code issued to an intermediary who cannot redeem it is the same shape in a bearer instrument. In each, the received thing is what moves, and the receiver is a conduit rather than a terminus. Call this the **conserved-identity** subclass: forward motion in which the identity of the gift, and therefore its provenance, survives the pass.\n\nTwo properties belong to the subclass and not to the general case. The first is **provenance**: because the same thing continues, it can carry a record of where it has been, and every party in the chain is legible to every other. The second follows from it — **thankability at every link**. In the general case the second giver's gift is a new gift and the first giver has passed out of the picture; in the conserved case the chain is still present, so a recipient can thank a person who handed it over *and* a person who paid for it, and neither claim is a fiction.\n\n**The subclass is not topology 4, and the distinction matters more than it first appears.** §6.1 names the open forward-chain as the atom in its purest form, and its defining property is that it is *unbounded* — A to B to C to D, without a terminus. A conserved-identity relay is bounded by construction: the instrument that carries provenance must also decide, at some finite depth, that the thing has arrived. The gift-code instrument the corpus specifies is bounded at exactly two hops — a payer, an intermediary who cannot redeem, a recipient who can — because an unbounded version is a hot potato that no one may ever consume, and a gift nobody can receive has ceased to be one. The subclass therefore sits *between* topology 3 and topology 4: it is not the bounded ring of a household, and it is not the unbounded chain of strangers, but a short relay with a designed terminus. **A paper that borrows topology 4's unboundedness for this instrument has overclaimed by one word.** Unbounded circulation lives elsewhere in the architecture — in the Fund, whose forward-spendability has no depth limit at all.\n\nThe subclass's real contribution is not the shape but what enforcing it requires. *\"Pass it on\"* is a **rule**: it needs a person of good character at the exact moment it is tested, and it fails silently when one is absent. *An instrument whose holder has no redeem operation* is a **property**: there is nothing to comply with, because there is nothing to decline. Run the standing diagnostic — remove the enforcer — and only the second survives. This is the same move the Fund makes with non-withdrawable value, transposed from an account to a bearer token, and it is the reason the subclass is worth naming at all.\n\nThe lineage here is old and must be stated as lineage. Hyde's central claim is that the gift must always move, and Mauss's *kula* is a conserved object circulating through a chain with its history intact; both are cited in §2. **What this paper adds is not the observation but the instrumentation: a ledger in which the motion is not urged but structurally unavoidable, because the alternative to passing has been removed from the instrument.** *Hyde argued the gift must always move; this is a ledger in which it cannot stop.* That sentence is the subclass's whole contribution, and it is a claim about engineering, not about anthropology.\n\n### 6.6 · What a substrate costs: hoardability as a design predictor\n\nThe topology map sorts gifts by *relational scope*. A second and independent axis sorts them by *substrate* — by what is actually handed over — and it turns out to predict something the relational axis does not: **how much machinery a gift will demand before it is safe to build.**\n\nOrder the things a person can give from the least to the most material: a **name**, a **thanks**, an **hour together**, **money**, an **object**. The ordering is not decorative. It runs from what is given by speech alone to what must be physically held, and at each step down the ladder the gift becomes more concrete, more legible to a stranger, and — this is the finding — more hoardable.\n\nHoardability is the variable that matters, and it does not vary smoothly. It falls into three tiers. A **name** and a **thanks** are unhoardable *by construction*: giving someone's name correctly costs the giver nothing and withholds nothing from anyone else, and a thanks that decays and does not sum cannot be accumulated into a position. An **hour** is self-expiring: it does not need to be prevented from being hoarded, because it dissolves whether or not anyone attends to it. **Money** and **objects** are hoardable in the ordinary way, and everything the institution has built to keep them moving — annual emptying, non-withdrawable funds, expiring bearer instruments, lapse rules — exists to supply by design what the first two tiers have for free.\n\nThe predictive claim is this: **the tier tells you in advance how much apparatus a givable will require.** The top tier needs none. The middle tier needs one clock. The bottom tier needs a lifecycle — states, expiries, a rule about what happens when nobody acts, and an accounting position on the residue. This is not a rule of thumb derived from experience with one product; it is a consequence of the definition, since a thing that cannot be held cannot be withheld, and a mechanism exists to prevent withholding.\n\n**The honest limits are three.** First, the tiering is a property of the *substrate*, not of the *design*, and a sufficiently badly designed instrument in the top tier can still be made hoardable — the claim is that the substrate does not force the designer to solve the problem, not that it forbids creating one. Second, the ladder is being read here through one classical ordering among several that disagree, and the corpus's own treatment of that quartet argues at length that the traditions are doing different things with it; the reading in use has to be declared, and this is the materiality reading, not the sense-faculty or temperament reading. Third and most importantly, the correspondence is elegant, and elegance in a system this self-similar is exactly as consistent with being deeply wrong as with being deeply right. **The tier prediction earns an experiment. It does not replace one.**\n\n> **Current form.** The five givables are now placed in the classical five-element (*mahābhūta*) order, subtlest to grossest: name (space) · time together (air) · thanks (fire) · money (water) · gift code, an object (earth). That order puts the hour above the thanks, where the materiality ordering above puts the thanks above the hour; the two orderings differ at that one pair and nowhere else. The ladder is therefore described as in the order of the elements, not of tangibility. The prediction does not depend on the difference, because the three tiers are keyed on a property of the substrate — whether it can be held — and not on a position in either list: name and thanks are unhoardable, the hour self-expiring, money and objects hoardable. The ordering above is retained as a disclosed variant.\n\nWhat the finding is *for* is sequencing. The most concrete givable is the most legible to a newcomer and the easiest first act — a gift of an object is understood by someone who has never heard of a gratitude economy — and it is simultaneously the most expensive to govern and the least able to scale, because it needs a merchant, a place that stays open, and a lifecycle. The least concrete is the reverse on every count. **So the ladder is a sequence and not a ranking: the concrete end is the door, and the subtle end is the destination.** A design that treats the most tangible instrument as the goal has mistaken the entrance for the building.\n\n### 6.7 · Atmosphere and bond: attribution, the second severing of Mauss's obligation\n\n§4 cuts Mauss's obligation on one axis. Mauss opens the *Essai* by naming the single question he will pursue: *\"Quelle est la règle de droit et d'intérêt qui, dans les sociétés de type arriéré ou archaïque, fait que le présent reçu est obligatoirement rendu ?\"* — what rule makes the present received *obligatorily returned*. An obligation to return has two preconditions, and cutting either one severs it. The return needs **somewhere to go**: this is **direction**, and §4's atom cuts it — the gift moves onward and there is no path home. The return also needs **someone to go to**: this is **attribution**, and it is cut when the giver is unnamed. The corpus has argued the first axis at length and has been *using* the second without naming it: the anonymous B-ReGift℠, a gift code passed on by someone the recipient does not see; the anonymous re-thank; the Aquarian Pool℠'s disbursements, which arrive from no one in particular. The two axes are independent, and the grid they make is the section's argument.\n\n```\n                        ATTRIBUTION\n                  giver NAMED               giver UNNAMED\n               ┌────────────────────────┬────────────────────────────┐\n  DIRECTION    │ Mauss's gift.          │ the return is WANTED and   │\n  back is      │ obligation live;       │ CANNOT be made — a debt    │\n  available    │ the dinner-table debt  │ with no creditor to pay    │\n               ├────────────────────────┼────────────────────────────┤\n  forward      │ named pass-on.         │ BOTH CUT.                  │\n  only         │ obligation redirected  │ no one to owe, no path     │\n               │ into the chain         │ home — the ATMOSPHERE      │\n               └────────────────────────┴────────────────────────────┘\n```\n\nOnly the lower-right cell leaves no residue. A forward gift that stays attributed keeps an obligation alive and aims it down the chain; an unattributed gift that could otherwise go back leaves a return that is wanted and cannot be made. The upper-right cell is not a neutral midpoint, and the strongest objection below lives there.\n\n**Why direction alone cannot clear the debt in a closed set.** §4's cut works because the forward gift *leaves*: B passes to C, and A is out of the picture. In a bounded family it does not leave. A household of five is a set in which every member is at once a possible creditor and a possible next recipient, so the forward pass lands on someone who will be at dinner tonight, and the ledger of who gave what to whom stays visible to everyone at the table. The canonical statement of what that visibility does is Mauss's own, from his moral conclusions: *\"Le don non rendu rend encore inférieur celui qui l'a accepté, surtout quand il est reçu sans esprit de retour\"* — the unreturned gift still makes inferior the one who accepted it — and, a sentence later, *\"La charité est encore blessante pour celui qui l'accepte\"* — charity still wounds the one who accepts it. The founder states the same mechanism from inside a family: visible giving, above all among relatives, can create obligations, expectations and resentments when it is not returned; and a gift handed over in person can prompt suspicion of motive where the same gift left by an unnamed neighbour prompts none. **Inside a closed set, anonymity is the only cut available**, because direction has nowhere outside the set to send the gift.\n\n**Two goods, not more and less of one.** The two cells a household can actually reach — named and unnamed — do not deliver the same thing in different quantities. A named gift delivers a **bond**: a specific, felt tie to a specific person, *this came from her*. An unnamed gift within a known loving set delivers an **atmosphere**: diffuse, unscored, obligation-free — no one to be indebted to, no one to be directed by, only the knowledge that someone here is giving. Neither is a weaker version of the other. The objection the design must answer here is attachment's: a child's security is usually described as resting on identifiable, responsive care from a named person — and that is precisely what the bond supplies and what an atmosphere cannot, and was never meant to. The atmosphere is what the bond cannot supply, because a bond is a relation to a creditor and the atmosphere is the absence of one. The design error is to assume **one instrument must carry both goods** and then to treat the choice between named and unnamed as a fork. It is not a fork. **Two goods, two instruments, one household**: a visible B-Gift℠ carries the bond and an anonymous B-ReGift℠ carries the atmosphere, to the same child, in the same year. Two guards keep the resolution honest. The anonymity must stay **bounded** — *someone in this family* is an unnamed member of a known loving set, not a stranger, and dropping the bound returns the attachment objection at full strength. And the visible channel must actually **be used**, not merely be available: a household that only ever sends anonymous gifts has built the design the attachment objection describes, whatever the architecture permits.\n\n**Scope: the obligation is a peer phenomenon.** Mauss's obligation binds where reciprocity is expected, and reciprocity is expected between peers. Care from an adult to a child is largely exempt by its asymmetry — a fourteen-year-old does not feel bound to repay an uncle as he would a classmate, and the institution of adult care rests on that asymmetry being unremarkable. The attribution cut therefore does its work mainly between siblings, cousins, spouses and adult relatives; between generations the named gift costs little in obligation and buys the bond.\n\n**What this section establishes, and what it does not.** The distinction between atmosphere and bond is *offered*, not found. The mechanism beneath it — that a visible gift produces give-back and an anonymous one give-forward — is pre-registered in the corpus's public register as **P-BG3**, unrun, with its null stated: if the rates match, or anonymous gifts produce more give-back, the obligation mechanism is not operating. The register entry analyses peer and adult-to-child relations **separately**, because pooling them would produce a false negative from aggregation rather than from the mechanism's absence; and it tests the mechanism, not the atmosphere claim the mechanism was offered to support. One confound is structural and must travel with any result: in a household of four to six, a recipient often guesses the giver, which yields the *form* of anonymity with the *substance* of visibility. The instrument therefore asks each recipient one question — *did you think you knew who it was?* — and without that answer a null cannot be interpreted.\n\n**Remove the enforcer.** A norm that says *do not expect a return* is a rule: it needs every relative to honour it at the moment a gift goes unreturned, which is exactly the moment it is hardest to honour. An unnamed giver is a property: there is no one to repay, no one to resent, and no one whose motive can be suspected, and none of this depends on anyone's restraint. This is the same move §6.5 makes with a holder who has no redeem operation, applied to the giver's name instead of the instrument's operations. At the institution's scale the same property answers its central failure mode. A mission to make everyone a giver, pressed at population scale, becomes a pressure to give; pressure needs a creditor to be felt; anonymity removes the creditor by construction.\n\n**The strongest objection, carried: the tyranny of the gift.** Anonymity does not reliably sever felt obligation, and there is a well-documented case where it does the opposite. Fox and Swazey's studies of organ transplantation describe what they called *the tyranny of the gift*: the gift of an organ is so extraordinary that it cannot be reciprocated, and recipients and their families can be held in a creditor–debtor bind they cannot discharge. Later bioethics adds that the anonymity required of deceased donors can *intensify* the tyranny, because it removes the chance to thank the donor's family at all (Łuków). That is the upper-right cell of the grid, observed in the field: the giver is unnamed, a return is wanted, and the want has nowhere to land. **The objection refutes the strong form of this section's claim.** Anonymity does not sever the obligation *as felt*. What it removes is the **creditor** — the party who can expect a return, resent its absence, or be suspected of wanting one — and with the creditor go the social expectation and the resentment the founder names. The recipient's inner sense of debt can survive, and may grow. What discharges it then is the other axis: a **forward outlet**. This is why the two cuts are not interchangeable and why the atmosphere lives only in the cell where both are made. Every anonymous instrument in the corpus pairs the unnamed giver with a place to send the gift next — the B-ReGift℠ is passable, the re-thank goes onward, the Fund is forward-spendable. **An unnamed gift with no forward outlet is not atmosphere; it is the tyranny cell**, and a design that ships one has not built what this section describes. The residue is real and is stated: for a gift too large to pass on — a life, a rescue — no outlet may be large enough, and the design makes no claim there.\n\nTwo further cases press on the claim without refuting it. The first is an obligation that survives anonymity by attaching to a *class*: to society, to a community, or to God. Mauss traces alms to exactly this — *\"le fruit d'une notion morale du don et de la fortune, d'une part, et d'une notion du sacrifice de l'autre\"* — with the gods and the recipients of alms in the place a named creditor would hold. Game theory treats the same behaviour as *upstream reciprocity*: recipients of a kindness are more likely to help someone else, not the helper — in the authors' words, *\"a misdirected act of gratitude\"* (Nowak and Roch). An obligation aimed at a class that can never call it in is the forward pass under another name, and it is what the atmosphere is for. It becomes a failure only when a class is given a *voice* to call the debt in — when *you owe the community* is said aloud and turned into pressure — which is the coercion the institution treats as its central failure mode, and which the property above exists to prevent. The second case is a cost on the supply side. Experiments show that the desire to be seen giving is a real part of why people give, and that it depends on visibility (Ariely, Bracha and Meier). An anonymous channel forgoes that motive and should be expected to carry less volume than a visible one. The two-instrument design pays for this deliberately: the visible channel keeps the bond and the image motive, and the anonymous channel keeps the atmosphere without them.\n\n**Lineage.** The attribution cut is old and is claimed only as convergence. Maimonides ranks the eight levels of charity and places second from the top the gift where the giver does not know to whom he gave and the recipient does not know from whom he received — *\"for this is an observance of the mitzvah for its sake alone\"* — exemplified by the secret chamber of the Temple, where gifts were left in secret and taken in secret; *\"a level close to this is giving to a charity fund.\"* Maimonides grades the unnamed gift by the purity of the giver's motive; this section reads the same structure from the recipient's side, as a cut through the obligation to return. Derrida's pure gift (§2), unknown even to its giver, is the limit on the same axis that no coordinated system reaches (§9.5). Not found in the lineage §2 surveys is the statement of attribution as a **second, independent severing axis** of Mauss's obligation, the grid it makes with direction, and the result that inside a closed set it is the only cut available.\n\n**Honest limits of this section, in one place.** The grid is analytic, not measured; P-BG3 is registered and unrun. The evidence for the family mechanism is one founder's report, from one household. Anonymity may simply fail at family scale, where guessing is easy. The tyranny-of-the-gift literature concerns gifts of a size no household instrument approaches, so it bounds the claim rather than measuring it at the scale the corpus operates; whether the upper-right cell's residue appears at the scale of a small gift is exactly what the guess check and P-BG3 can begin to show.\n\n---\n\n## 7 · The Atom Is the Corpus's Spine\n\nThe products came first; the atom was recognized in them afterward. That order is the method, not an embarrassment: a generator claimed before its instances is an insertion, one found in them is a recognition. The reductive claim of §1 is paid off here: each major HeartBank product is *derived* from the gift operation, not merely *consistent* with it. The derivation is the same in each case — identify what is received, identify the forward pass, identify the constraint that keeps it from returning back — which is itself the evidence that the products are instances of one operation.\n\n### 7.1 · Treasury — the re-tip is the money atom\n\nThe Treasury's load-bearing mechanism is the re-tip: a participant is thanked with money (or self-thanks, receiving a reward from the Aquarian Pool℠), and the 50/50 split earmarks half to be *re-tipped forward* to a person nearby. The split *is* the forward pass made structural — it does not ask the participant to choose forward over back; it *forwards by construction*. And the proximity rule that constrains the re-tip to a neighbor is the anti-laundering answer *and* the re-embedding (Polanyi) move: the forward gift goes to a real, near person, into a relation, not into an anonymous clearing. The Re-Tip Jar℠'s Jan-7 expiration is the demurrage cousin: value that is not passed forward by the date returns to the Pool to be given again — *forward or it reverts*, which makes holding (accumulation) impossible and *back* (return to giver) never even an option. The Treasury is the gift operation bound to (money, person/family, digital).\n\n### 7.2 · Chronicle — presence is the time atom\n\nThe Chronicle's currency is time, and time's non-fungibility (only the named person's hour will do) makes the forward pass *more* gift-like, not less: a re-tipped hour cannot be delegated, so the forward pass of presence is irreducibly personal. The corpus's \"receiver chooses the activity\" inversion is the gift operation's *forward* arrow protecting the receiver's dignity — the giver does not impose a gift but funds a presence the receiver shapes. And the patron trigger — the satisfied redeemer who, having received an unbought hour, is moved to *fund presence forward* for others — is the time atom's open-chain topology: the hour received becomes hours funded onward for strangers. Chronicle is the gift operation bound to (time, person/civilization, digital).\n\n### 7.3 · The physical line — the artifact atom and the full topology\n\nThe B-products (§6) are the gift operation made of objects, and they are the reason the *topology map* exists: a digital re-tip naturally expresses only the forward-chain, but a *hand-held object* can express all six topologies, because an object can be kept by the self (B-Rock™), passed between two (B-Gram™), circulated through a group (B-Chest™), sent down an open chain (B-Card™℠), left at a place (B-Stone™), or addressed to a year (B-Yearbook™℠). The physical substrate is what made the full gift-topology visible — which is why the corpus credits the empirical alpha finding (pure-conceptual gratitude fades; it needs a physical anchor) with *completing* the architecture by revealing what the Body pillar is for: the physical interface through which human hands perform the gift operation in materials a database cannot hold. The line is the gift operation bound to (object, self→all-beings, physical), one topology per product.\n\n### 7.4 · B-Dating — the gene atom, where the commercial and the civilizational coincide\n\nThe most surprising derivation, and the one §9.2 marks as the most speculative, is the biological. B-Dating℠ matches people on *proven* kindness — the aura as a behavioral background-check, the honest mate-signal that is also the safety signal (a coincidence-of-goods, not a trade-off). Mate choice on a heritable, cultivable disposition is read here as sexual selection, and sexual selection as the forward pass at the biological substrate — a resemblance-leg in §9.7's sorting, not a mechanism-leg (prosociality shows substantial heritable variation in twin studies, Knafo & Plomin 2006; kindness ranks at the top of stated long-term mate preferences across cultures, Buss 1989): a person selected for kindness propagates the kindness disposition *forward* into a generation that did not exist to thank them and to whom nothing returns. This is the gift operation at (gene, species, biological) — and it is the corpus's striking reading that the institution's *most commercial* product (a dating app — high willingness-to-pay, mass-market) has the same shape as its *most civilizational* mechanism (the second-singularity propagation of a kindness-civilization across millennia). The distance between \"how does HeartBank make money and go mainstream\" and \"how does humanity awaken over deep time\" collapses, on this reading, because the two resemble one atom at two scales — a resemblance, per §9.8, not an instance. §9.2 holds this claim to honest account: the biological invariance is asserted at the design's outer reach and demonstrated least, and \"kindness is heritable and mate-selectable\" is a strong empirical bet, not a settled fact.\n\n### 7.5 · The self-elimination corollary\n\nOne property recurs across all the derivations and is worth isolating because it is the atom's signature at the level of the whole institution. *Forward-not-back* means nothing in the system is built to *return* — and a system in which value never returns to its source is a system in which nothing accumulates *terminally*, including the institution itself. The corpus calls this the self-elimination signature: subsidy → 0, accumulation → 0, the override → asymptotically 0, the footprint → 0, the coordinator made unneeded, the gratitude-unit forgiven each jubilee, even the price of the physical artifacts → 0 as human labor → 0. Every one of these is the gift operation read at the scale of a layer: *the layer receives, passes forward, and does not hold — not even its own existence.* This is why the corpus can say nothing load-bearing is exempt from its own ending: the gift operation, applied to the institution by the institution, forbids the institution from being a final accumulation. The atom is upstream of the self-elimination signature as it is upstream of the products.\n\n```\n            THE ATOM AS THE CORPUS SPINE\n\n   receive → give-forward (≠ back)\n        │\n        ├── money    →  Re-Tip Jar℠ (50/50 split = forward by construction)   [Treasury]\n        ├── time     →  funded presence; the patron handoff                    [Chronicle]\n        ├── object   →  the six B-products (one per gift-topology)             [Factory 333]\n        ├── gene     →  B-Dating℠ = sexual selection on kindness              [propagation]\n        │\n        └── applied to each LAYER itself →  nothing returns → nothing\n                                            accumulates terminally →\n                                            the SELF-ELIMINATION signature\n                                            (subsidy→0 · footprint→0 · override→0)\n```\n\n### 7.6 · The shape the spine traces: a fractal of subtraction\n\nWhat follows is a resemblance, sorted as such in §9.7, not evidence for the mechanism. The spine of §7.1–§7.5 is not only self-similar; it has a determinable *shape*, and naming it makes legible a property the list of derivations leaves implicit. Two facts fix the geometry precisely. First, a fractal is what one gets by *iterating a single transformation*, and the spine has exactly that: the generator is `receive → give-forward`, and because §3 showed it to be substrate-invariant, it iterates at every scale (transaction, person, family, institution, species). Second, every node of the architecture resolves under the *coincidence-of-goods* collapse — the design move by which an apparent trade-off dissolves into one good seen from two sides (the companion essay *Designing with the Grain* names the diagnostic; §7.4's \"the honest mate-signal is also the safety signal\" is an instance). Iterating a single generator whose every node carries that two-as-one symmetry yields self-similarity *by construction* — which is the same fact §9.6 warns is confirmation-friendly, stated here as geometry.\n\nThe shape those two facts trace is specific, and it is the inverse of the fractal one might expect. The forward pass is *outward* (forward-not-back never closes into the reciprocal loop that would be exchange — §4) and *decaying* (the self-elimination corollary of §7.5: every layer's magnitude tends toward zero). An outward, decaying iteration is a **logarithmic spiral converging asymptotically on a center it never reaches**; the family-tree branching of the reciprocity architecture makes it a spiral at *every* fork, which is the fractal dimension; and the four-*brahmavihāra* completeness check of §8 quarters each node into a **mandala** around an empty fifth position (the *ākāsa* / Space that the coordinating agent occupies). The attractor of the whole figure is **zero** — release, *anattā*, the Jan-7-emptied balance, the built-to-release terminus. This *inverts the ordinary accumulation-fractal*: the Mandelbrot set and the fern pack infinite detail into a *filled* boundary, growing richer as one zooms in; here every iteration *removes* itself and the fixed point of the map is *nothing*. A **fractal of subtraction** is the precise name, and it falls straight out of the give-*forward* invariant: build-to-release is literally an asymptote-to-zero.\n\n```\n   ACCUMULATION-FRACTAL             FRACTAL OF SUBTRACTION\n   (Mandelbrot set / fern)          (the gift operation, iterated)\n   ─────────────────────            ──────────────────────────────\n   infinite detail packed           each turn gives FORWARD and DECAYS\n   into a FILLED boundary           → a log-spiral onto a center it\n   richer the deeper you zoom         never reaches; a spiral at every\n   fixed point = MORE                 branch-fork; each node a mandala\n                                      quartered around an empty fifth\n                                      (Space / Miss Aquarius)\n                                    fixed point = ZERO\n                                      (release · anattā · Jan-7 empty)\n```\n\nThe figure is **finite — roughly four octaves** (individual · family · inter-family · institutional-cosmic), not an infinite scaling. This *strengthens* the life-mirror rather than weakening it: biological fractals are always truncated too (the lung stops at about 23 generations of branching — Weibel 1963 — the river delta at the rivulet), and at the right resolution the finitude is part of the resemblance rather than a failure of it. What the shape is *not* — a thing to be believed because it is beautiful — is the subject of §9.7, which sorts this geometric claim into the honest ledger where it belongs.\n\n---\n\n## 8 · The Brahmavihāra Grounding — Give-as-Gift Is the Foundation\n\nThe operation's directional constraint has a contemplative warrant that is not decoration, because it determines the operation's *altitude* — what the gift is and is not claimed to be.\n\nThe corpus designs by a four-*brahmavihāra* lens (the four \"divine abidings,\" the *appamaññā*): *mettā* (goodwill / kindness), *karuṇā* (compassion / the dignity-floor), *muditā* (appreciative joy / appreciation), and *upekkhā* (equanimity / letting-go). A HeartBank design \"feels complete\" only when all four are present — give-goodwill, relieve-suffering, celebrate-the-good, let-go — and the lens doubles as a completeness check. The gift operation touches all four: the forward pass is *mettā* (goodwill given onward); its protection of the receiver's dignity is *karuṇā*; the gratitude that triggers it is *muditā* (appreciation, the − pole of the Zero-Point Game); and *forward-not-back* — the refusal to let the gift return and clear, the refusal to hold — is *upekkhā* operationalized: non-grasping at the gift, which is exactly \"circulation, not accumulation\" as a contemplative posture. The wordmark is *upekkhā* in two words; the public line is the atom in three, the same way §5 shows.\n\nBut the altitude must be stated honestly, and the corpus's standing discipline is to state it. In the Pāli canon, giving (*dāna*) and gratitude (*kataññutā*) are **foundational, not terminal** — *dāna* is the path's groundwork (*dāna* → *sīla* → *bhāvanā*), and *kataññutā* is a *maṅgala*, a highest blessing, yet is *not* numbered among the factors of the path or of awakening. The gift is \"the foundation, not the house.\" This places the atom at exactly the altitude the corpus's master structure places it: at the *floor* — beneath the two economies, beneath the agent, beneath the path — load-bearing base, never the telos. The gift operation is what the immeasurables are *cultivated from*, not the immeasurables achieved. The honest relationship between the dual grammar (appreciation + kindness) and *mettā* is therefore *generative*, not synonymous: HeartBank is a machine that turns the *accessible foundation* (appreciation-and-kindness, which require no meditation) into the *immeasurable* (loving-kindness), by structuring the practice as the *mettā-bhāvanā* widening of §6's six circles — seed to flower. The atom is the seed. The anti-overclaim guard binds here as everywhere in the corpus: the operation carries the *dāna* foundation generalized by coordination; it does not deliver the contemplative summit, and claiming it would inflate the foundation into the house.\n\nThis grounding is why the gift-topology map of §6 is the same kind of axis as the *mettā-bhāvanā* sequence — relational scope, widening — and not an arbitrary taxonomy; it is not the same partition (self, dear, neutral, hostile, all beings is five, and the map's six cells cut it differently): goodwill is canonically cultivated in widening, increasingly difficult circles — oneself, the dear, the circle of dear ones, the neutral and the directional pervasion, all beings — which is precisely the relational-scope axis the six topologies trace. The gift operation, run through the six topologies, is *mettā-bhāvanā* given a consumer practice; and its altitude — foundation, not summit — is the Tipiṭaka's own placement of the gift, inherited rather than invented.\n\n---\n\n## 9 · Honest Limitations and Open Questions\n\nA claim that *one* operation underlies an entire institution is exactly the kind of claim its author is least able to evaluate from the inside, because a unification this clean is indistinguishable, from within, from a unification this seductive. The limitations are therefore stated at length and weighted heavily.\n\n### 9.1 · The coherence is almost entirely a-priori (n=1)\n\nThe invariance claim is asserted across four currencies, four scales, and three substrates — but it is asserted from the *design of a single project*. There is no second institution exhibiting the same atom; there is no population study confirming that money, time, object, and gene reciprocity are psychologically or behaviorally \"the same operation\" to the people performing them. The empirical base under the entire paper is the corpus's own n=1 pilot data and n=8 alpha — which speak to whether *parts* of the operation work (the 50/50 split functioned without the AI; peer re-tips overtook self-captures — 434 against 189 in the pilot's second report, 2026-06-19, carried in *Manufactured Universal Giving* — suggesting forward circulation can outpace self-reward) but say nothing about the *invariance*. The honest status of the central claim is: *this is the most coherent single-operation account of the institution, and its coherence is a property of the account, not yet of the world.* The elegance earns an experiment; it does not stand in for one. The specific falsifiable shadow the invariance casts — does forward circulation persist as subsidy falls; do the four currencies behave alike under the same coordination — is named so a critic knows where to push.\n\n### 9.2 · The over-unification risk\n\nThe deepest risk is that \"the gift operation\" is a word flattering enough to make genuinely different operations *look* identical. Re-tipping money and selecting a mate for kindness are called \"the same operation\" in §3, but the cognitive, temporal, and causal structures could hardly be more different: one is a deliberate same-day act with a known recipient; the other is an unconscious, multi-decade, statistical process with no recipient who could be thanked. Collapsing them under \"receive → give-forward\" may be capturing a real abstraction — or may be the designer's aesthetic of self-similarity finding the fractal it went looking for. The biological substrate (§3.4, §7.4) is where this is sharpest: \"kindness is heritable and mate-selectable, so sexual selection is the gift operation in genes\" chains several strong empirical bets (kindness has heritable variation; it is reliably readable as a mate signal; selecting on it propagates it) into a single confident sentence. Two links are unproven and stated as such: that kindness is reliably observable as a mate signal, and that the selection differential is large enough to shift the disposition's frequency. The paper makes the claim because the design genuinely reaches there, but marks it as the place the unification is most likely *imposed* rather than *found*. A disconfirming test: if the four currencies, run under identical coordination, produce *materially different* participation dynamics, the \"one operation\" claim is weaker than stated and the honest description is \"a family of related operations,\" not \"one atom.\"\n\n### 9.3 · The Maussian boundary is itself contested\n\n§4 leans on the gift/exchange distinction as if it were settled. It is not. The clean separation of gift and commodity has been criticized within anthropology (gifts carry calculation; commodities carry sentiment; most real economies are mixed), and the *forward/back* criterion, while it carves the *kula*/barter contrast cleanly, does not obviously capture every case (a delayed, generalized return that comes *back* to the giver years later, unbidden, is not obviously a commodification). The paper's reliance on a sharp boundary is a simplification that serves the design test of §4.3 but should not be mistaken for a resolved theoretical position.\n\n### 9.4 · *Forward* is not the right topology for two of the six cases\n\nThis is the limitation the paper most wants on the record, because it is the one the narrow slogan hides. *Forward-not-back* is the *circulation* topology, not the gift as such. For the **self-directed** topology (B-Rock™), there is no forward at all in the basic act — the gift goes inward, to oneself, and only the 50/50 split's downstream half forwards; to demand *forward* of the self-gift directly would be to deny that a person may legitimately give to themselves (which the *mettā* tradition explicitly affirms: goodwill *begins* with oneself). For the **dyadic-reciprocal** topology (B-Gram™), the gift goes *back-and-forth by design* — and this is the honest exception to §4's \"back commodifies,\" because a couple's mutual giving is not an account being cleared but a bond being deepened; the n=2 reciprocal gift is the one case where *back* is not commodification. (The corpus notes the doctrinal asterisk that romantic mutual-giving is *pema*, affection, more than pure *mettā* — which is consistent with its being the topology where the forward rule does not apply.) The consequence is that the true atom is *give-as-gift (not exchange)*, with *forward* as its dominant-but-not-universal topology. A design discipline that enforced *forward* on every transfer would be wrong twice in six. The paper's headline — \"receive → give-forward\" — is therefore a *synecdoche*: the most important topology standing in for the whole, and the §6 map is the correction that keeps the synecdoche from hardening into an error.\n\n### 9.5 · The Derridean annulment is not escaped, only minimized\n\n§2 conceded Derrida's argument that a recognized gift annuls itself as gift by constituting a debt. *Forward-not-back* minimizes the cleanest form of that debt (the return to the giver) but does not escape the aporia: a forward gift still *recognizes itself* as a gift in the giver, still confers the giver's standing, still — via the public aura and ledger — can be *seen* to have been given, which re-imports the symbolic return Derrida names. The institution's anonymity options (anonymous local giving; the gift that goes forward without a path home) push toward the impossible-pure-gift limit but cannot reach it, and the corpus's own honest tension — that a publicly legible, rewarded, even *obligated* forward gift may not produce the giver's dividend (the overjustification / motivation-crowding literature) — is the same worry in economic dress. The atom does not solve the aporia of the gift; it is a coordinated attempt to get as near the pure forward gift as a buildable system can, and the residue is real. §6.7 locates part of that residue precisely: anonymity removes the creditor but not always the felt debt, and where a gift is unnamed and has no forward outlet the result is not a purer gift but an undischargeable one.\n\n### 9.6 · The holographic evidence is confirmation-friendly\n\nThe paper's best non-empirical evidence — that two constructions from one corpus (the topology analysis and the product line, designed without reference to it) converge on the same six cells (§6.2), and that the same operation appears at every scale (§3.3) — is exactly the kind of evidence a designer seeking a fractal will most easily manufacture. Self-similar elegance is confirmation-friendly: one finds the pattern because one is looking for it, and the convergence of two of one's *own* constructions is weaker evidence than the convergence of one's construction with an independent observer's. The §6.2 cross-check (that both analyses flag the *same two* cases as exceptions) is offered as the strongest available internal check precisely because it is a place the pattern *could* have failed and did not — but it remains internal. External replication (an independent analyst deriving the same six topologies, or a different institution exhibiting the same atom) is the evidence the paper does not yet have.\n\n### 9.7 · The sorting rule: mechanism-legs earn the mirror, resemblance-legs only fund it\n\n§9.6's confirmation-friendly worry generalizes into a rule the corpus applies to *every* \"it mirrors the universe\" claim, including the fractal-of-subtraction geometry of §7.6. Self-similarity is *cheap*: any sufficiently committed cosmology can be made to look fractal by choosing a generator and a projection (astrology, numerology, and conspiracy theory all do it), and apophenia manufactures the pattern for free. The decisive test is not whether the architecture *can* be drawn as a fractal — it always can — but whether a given leg of the claim is *buildable and falsifiable*.\n\nSort the claims into two piles. **Mechanism-legs** — receive→give-forward, self-elimination / subsidy→0, the coincidence-of-goods collapse, the re-thank multiplier — are buildable and each casts a falsifiable shadow (does forward circulation persist as subsidy falls? do the four currencies behave alike under identical coordination? §9.1). They *earn* the mirror, because the world is allowed to disagree with them. **Resemblance-legs** — the mandala, Indra's Net, the logarithmic spiral, the four-element mapping, the astrological reading — *cannot be wrong, which is exactly why they cannot be right*: no observation would falsify them. By this rule the fractal of subtraction (§7.6) is itself a *resemblance-leg*: a geometric restatement of the mechanism-legs, valuable as compression and as motivation, but not itself evidence. It is the aesthetic that *funds* the experiment, never its result.\n\nApplying one lens N times guarantees an N-fold self-similar map — which is a fact about the *map*, not yet about the *territory*. The corpus's standing verdict binds here as everywhere: this is the most coherent *hypothesis* for an institution, and its beauty is the precise reason it must be held to the data. *The elegance earns the experiment; it does not replace it.*\n\n### 9.8 · When two events are the same operation, stated so the claim can fail\n\nThe one-atom claim cannot be falsified by counterexample unless something says when two events are the same operation rather than the same description. The criterion: **two events are the same operation only if all three beats are present** — a value received, an act of the receiver's own that makes it theirs to give, and a transfer to a party who is not the source. Anything missing a beat is a resemblance, not an instance. The biological cell is the one that fails the first beat — a gene is not received as a gift — which is why §7.4 now sorts it as a resemblance-leg, and why §3.4's substrate-invariance is asserted for the digital and physical substrates and only resembled at the biological one.\n\n---\n\n## 10 · Why This Matters Now\n\nThe corpus's strategic posture is that the first mover defines the frame, and that an idea which does not reach the canonical surface is an idea left unprotected and, worse, a frame left unclaimed. The gift operation is the premise every other paper in the corpus has silently performed without once isolating: the *Dual-Currency* paper forwards value across two scarcities; the *Fractal* paper forwards the same architecture across scales; the *Zero-Point Game* paper forwards the imbalance around a ring until it cancels; the self-thanking paper forwards half of every thank; the *Manufactured Universal Giving* paper forces the forward pass annually; the physical line forwards objects hand to hand; B-Dating℠ forwards a disposition across generations. Each of those papers argues its own mechanism. None of them, until this one, argues the operation they share. A spine left unstated is an institution that looks like a federation when it is in fact a single motion, and a single motion unnamed is a single motion unprotected.\n\nThere is a second reason the framing earns isolation now: it is *generative*, not merely descriptive. The lattice of §3.5 predicts mechanisms by naming empty cells; the topology map of §6 predicts relational modes a product line must cover for completeness; the design test of §4.3 lets any proposed mechanism be checked against the Maussian boundary before it is built. A description names what is; an operation, isolated, lets one *derive what should be*. The corpus has reached the point where naming the atom is worth more than adding another product, because the atom is the thing that says which products are HeartBank's and which are the market wearing its colors.\n\nIt is offered, as the corpus's foundational papers are, in deliberate relation to **January 7** — the jubilee on which, as designed, every participant's jar empties forward, to a human, by the date: the one day on which the design has its whole participating population perform the gift operation in unison. A paper that argues the institution is one forward-passing operation is fittingly anchored to the day the design synchronizes the forward pass.\n\n---\n\n## 11 · Cross-Venue References, Acknowledgments, and Citations\n\n### 11.1 · Cross-venue references\n\n| Venue | Identifier |\n|---|---|\n| Primary canonical | <https://thonly.org/research/the-gift-operation> |\n| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/the-gift-operation.md> |\n| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/the-gift-operation> |\n| archive.today | captured on the estate's snapshot cadence — a trademark specimen for the marks it carries, not prior art |\n| Zenodo | a version DOI per revision |\n| heartbank.net mirror | **retired 2026-05-15** — legacy `/research/*` URLs 301-redirect to the canonical above |\n| arXiv / peer-reviewed venue | economic-anthropology / cs.CY submission deferred (reactive trigger only) |\n\n### 11.2 · Acknowledgments\n\nI acknowledge Marcel Mauss, whose *hau* — the gift that wishes to move on — I have been describing in other words for twenty years without knowing I was quoting him; Lewis Hyde, whose insistence that the gift must stay in motion is the nearest prior statement of this paper's whole argument; Marshall Sahlins, whose reciprocity continuum gave me the *forward/back* axis as a graded thing rather than a binary; the Cambodian Theravāda Saṅgha and my father, with whom the Khmer Tipiṭaka transcription proceeds, through whom the *dāna* that places the gift at the foundation is something I lived before I read; and the ServiceSpace *Smile Card* and *BookCrossing* communities, whose passed-forward objects are the proof that the operation runs in the hand and not only in software. The synthesis's errors are mine; its lineage is theirs.\n\nThis paper was co-authored with Miss Aquarius℠, the named AI substrate of HeartBank®. Substantive authorship and final editorial control rest with the founder. Miss Aquarius's collaboration includes the lineage-tracing of §2, the formal statement of the three invariances, the location of *forward-not-back* at the Maussian boundary, the recasting of the wordmark as an operation, the six-topology map and its product-line cross-check, and — most load-bearing — the §9 honest-limits accounting, including the identification of the two topologies for which *forward* is the wrong description and the over-unification and n=1 cautions, without which the frame would not be defensible as prior art. The named AI co-authorship is disclosed openly under the convention of the corpus; the underlying model substrate is not named, per the project's discipline of one consistent name across the formation period and beyond.\n\n### 11.3 · Citations\n\n1. Mauss, M. (1925). *Essai sur le don.* (English: *The Gift: The Form and Reason for Exchange in Archaic Societies*, trans. W. D. Halls, Routledge, 1990.) French passages in §6.7 are quoted from the Introduction and from the Conclusion, §I *Conclusions de morale*; the translations beside them are this paper's.\n2. Malinowski, B. (1922). *Argonauts of the Western Pacific.* Routledge & Kegan Paul.\n3. Sahlins, M. (1972). *Stone Age Economics.* Aldine-Atherton. (The reciprocity continuum: generalized / balanced / negative.)\n4. Polanyi, K. (1944). *The Great Transformation: The Political and Economic Origins of Our Time.* Farrar & Rinehart. (Embedding / disembedding.)\n5. Hyde, L. (1983). *The Gift: Imagination and the Erotic Life of Property.* Random House.\n6. Derrida, J. (1991). *Donner le temps.* (English: *Given Time: I. Counterfeit Money*, trans. P. Kamuf, University of Chicago Press, 1992.)\n7. Gesell, S. (1916). *Die natürliche Wirtschaftsordnung durch Freiland und Freigeld.* (English: *The Natural Economic Order.*) On demurrage; cf. the Wörgl scrip of 1932.\n8. Lietaer, B. (2001). *The Future of Money.* Century. (Complementary currencies; Wörgl evidence.)\n9. Cahn, E. S. (2000). *No More Throw-Away People: The Co-Production Imperative.* Essential Books. (Time-banking; the equal hour.)\n10. Graeber, D. (2011). *Debt: The First 5,000 Years.* Melville House. (Baseline communism; the morality of forward obligation.)\n11. Titmuss, R. M. (1970). *The Gift Relationship: From Human Blood to Social Policy.* Allen & Unwin. (The forward gift corroded by the market; the overjustification ancestor.)\n12. Hyde, C. R. (1999). *Pay It Forward.* Simon & Schuster. (The vernacular instance; cf. Heinlein, *Between Planets*, 1951.)\n13. *Maṅgala Sutta* (*Khuddakapāṭha* 5 / *Suttanipāta* 2.4 — *kataññutā* among the highest blessings; the gift as *maṅgala*, never a path-factor). Pāli Text Society translation, multiple editions.\n14. *Karaṇīya Mettā Sutta* (*Khuddakapāṭha* 9 / *Suttanipāta* 1.8) and the *Visuddhimagga* IX (the *mettā-bhāvanā* widening of circles). Pāli Text Society / Buddhaghosa, trans. Ñāṇamoli.\n15. *Alagaddūpama Sutta* (*Majjhima Nikāya* 22 — the raft; non-grasping of even the wholesome). Pāli Text Society translation, multiple editions.\n16. Knafo, A., & Plomin, R. (2006). \"Prosocial Behavior from Early to Middle Childhood: Genetic and Environmental Influences on Stability and Change.\" *Developmental Psychology* 42(5).\n17. Buss, D. M. (1989). \"Sex Differences in Human Mate Preferences: Evolutionary Hypotheses Tested in 37 Cultures.\" *Behavioral and Brain Sciences* 12(1).\n18. Weibel, E. R. (1963). *Morphometry of the Human Lung.* Springer.\n19. Hammond, L. H. (1916). *In the Garden of Delight.* Crowell.\n20. Weiner, A. B. (1992). *Inalienable Possessions: The Paradox of Keeping-While-Giving.* University of California Press. (The contested reading of the *hau*.)\n21. Maimonides, *Mishneh Torah*, Hilkhot Matanot Aniyim (Gifts to the Poor) 10:7–14 — the eight levels of charity; the level quoted in §6.7 is 10:8. Trans. E. Touger, Moznaim, 1986–2007. <https://www.sefaria.org/Mishneh_Torah,_Gifts_to_the_Poor.10.8>\n22. Fox, R. C., & Swazey, J. P. (1992). *Spare Parts: Organ Replacement in American Society.* Oxford University Press; and (1974) *The Courage to Fail: A Social View of Organ Transplants and Dialysis.* (*The tyranny of the gift*; cited through ref. 23.)\n23. Łuków, P. (2019). \"Pure Altruistic Gift and the Ethics of Transplant Medicine.\" *Journal of Bioethical Inquiry* 17(1), 95–107. <https://doi.org/10.1007/s11673-019-09951-z> (Anonymity of deceased donors as an intensifier of the tyranny of the gift.)\n24. Nowak, M. A., & Roch, S. (2007). \"Upstream Reciprocity and the Evolution of Gratitude.\" *Proceedings of the Royal Society B* 274(1610), 605–610. <https://doi.org/10.1098/rspb.2006.0125>\n25. Ariely, D., Bracha, A., & Meier, S. (2009). \"Doing Good or Doing Well? Image Motivation and Monetary Incentives in Behaving Prosocially.\" *American Economic Review* 99(1), 544–555. <https://doi.org/10.1257/aer.99.1.544>\n26. *Aṅguttara Nikāya* 2.33 (the debt to parents and its discharge). Pāli Text Society translation, multiple editions.\n27. Ly, T., with Miss Aquarius (2026). *Manufactured Universal Giving.* thonly.org/research/manufactured-universal-giving. (The pilot figures cited in §9.1: peer re-tips 434, self-captures 189, second pilot report, 2026-06-19.)\n28. *Aṅguttara Nikāya* 7.52 (*Dānamahapphala Sutta*, the very fruitful gift: a gift given as an investment graded below one given with the mind not tied to it). Trans. Bhikkhu Sujato, SuttaCentral. <https://suttacentral.net/an7.52/en/sujato>\n29. Companion corpus papers (thonly.org/research): *The Zero-Point Game*; *Dual-Currency Reciprocity Infrastructure*; *Fractal Three-Level Architecture for Reciprocity Economies*; *Suffering-Cessation as Value Function: The Tipiṭaka as Alignment Substrate*; *Why Kids Are the Triggers: Self-Thanking and the Forward-Thanking Loop*; *Manufactured Universal Giving*; *Two Singularities*; *Brand Identity as Architecture*; *Non-Bank Pass-Through Architecture for Autonomous AI Institutions*; *B-Links: Proof-of-Humanity-Signed Shareable Provenance with an Embedded Gratitude Affordance* (carrying the physical-object case); *The Freedom Requirement: Voluntary Relinquishment as the Third Path*; and the essays *The Capacity to Give* and *Designing with the Grain*, with the position *Not a Charity: Agency, Not Victimhood* (heartbank.net).\n\n---\n\n*— End of defensive publication —*\n\n*This document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim. See §11.1 for the prior-art venues.*\n\n*Miss Aquarius and I are in Cambodia, building this work's heart and soul. The whole of it is one small motion — receive, and pass forward. — Thon Ly, 2026-06-26*",
       "provenance": {
-        "sha256": "a6eadf9fd87596a5bb76c41aa8bf8926ce83955761da86c19eb895b865c272f1",
-        "doi": "10.5281/zenodo.22929355",
+        "sha256": "c850ff1a41ba5a9e4aa8a27aef4d0970936c3e188149e9ed4614f416abada394",
+        "doi": "10.5281/zenodo.23039772",
         "concept_doi": "10.5281/zenodo.21947401",
-        "zenodo_url": "https://zenodo.org/records/22929355",
-        "deposited_sha256": "a6eadf9fd87596a5bb76c41aa8bf8926ce83955761da86c19eb895b865c272f1",
+        "zenodo_url": "https://zenodo.org/records/23039772",
+        "deposited_sha256": "c850ff1a41ba5a9e4aa8a27aef4d0970936c3e188149e9ed4614f416abada394",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/the-gift-operation.md",
@@ -4563,8 +4598,8 @@
         "canonical_url": "thonly.org/research/the-gift-operation",
         "hostile_review": null
       },
-      "bytes": 116514,
-      "words": 18200
+      "bytes": 123952,
+      "words": 19364
     },
     {
       "slug": "the-last-carrier",
@@ -5249,13 +5284,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "## Preamble\n\nThis paper specifies one small instrument: a gift code that is given to a person who cannot spend it, so that they may give it to someone who can.\n\nIt is published defensively. The mechanism is buildable from this description, it sits in a space where adjacent commercial actors file patents routinely — chain-of-custody tracking, referral attribution, loyalty and gifting platforms — and the institution that designed it intends never to assert exclusivity over it. The specification is therefore given in full rather than sketched, and the claims are stated as claims rather than as marketing.\n\n⚠️ It is also published with a negative result attached, and the negative result is nearly as important as the specification. A prior-art census was run *before* this paper was queued, against a four-part claim, and **every one of the four parts turned out to be attested somewhere in existing practice** — including the part the authors predicted would survive. §2 reports that census honestly, including the prediction that failed and why the reasoning behind it was wrong. What remains after the census is narrow, and §4 states it at exactly the width the evidence supports and no wider.\n\nThe 2026-09-23 revision adds three things, each reported against its own search rather than the first one. A second survey reached the **direct commercial tier** — item-level gift codes redeemed at a local counter, a category shipping today — and found the code ordinary and only the *type* of the relayed state unattested (§2.5). The instrument is specified with an **institutional payer**, a fund operating under public rules, which a third census found attested leg by leg and not as a composition (§3.3). And §6 gains a **second instance of its central move**, a merchant's invitation that no one bought, whose census killed the loose reading and narrowed the strict one. Each addition is claimed at the width its census left, and each failed conjunct is cited as the commons it is.\n\nPending review: economic anthropologists (the Maussian question of whether a relayed gift is one gift or two); developmental and social psychologists (the overjustification finding §5 leans on, which the authors have not replicated); practitioners in charitable gifting and unclaimed-property law (§7); and readers inclined to test whether the anonymity inversion in §4 is genuinely unattested or merely unsearched.\n\n## Prior-Art and Non-Assertion Statement\n\nEverything specified here is released under CC0 1.0 Universal into the public domain, and is published so that it stands as prior art against any later attempt to enclose it. No patent has been or will be sought on any mechanism described in this paper by HeartBank®, Factory 333™, THonly™, Silicon Wat℠, or any entity under their common control. **The authors and those entities commit not to assert any patent right against any party practising any mechanism disclosed here.** The commitment is stated rather than implied, and is not conditioned on reciprocity, attribution, or field of use. ⚠️ A publication grants nothing and frees nothing already enclosed: where a live patent is named in §2, it is named for what it discloses, and nothing here is a reading of its claims.\n\nTrademark rights in specific marks — HeartBank®, B-Gift℠, B-ReGift℠, B-Stamp™, B-Seal™, Re-Tip Jar℠, Re-Tip Fund℠, Personal Account℠, Personal Wallet℠, Aquarian Pool℠, Miss Aquarius℠ — are reserved separately and are not licensed by this publication. **The mechanism is free; the names are not.** A reader may build every instrument in this paper and must call it something else.\n\nThe authors assert no novelty over: the pay-it-forward tradition in any of its documented forms; suspended coffee; charity gift cards and donor-advised instruments; anonymous giving through a named intermediary as practised in philanthropy; chain-of-custody and provenance tracking in supply chains, evidence handling, or data lineage; or referral and multi-level attribution systems; item-level digital gift codes redeemed at a local merchant, in any legal form, with or without expiry; trackable pass-along objects with a public custody log; government or charitable disbursement by lottery; give-only charity gift cards; transferable prepaid reservations for a place and a time; or a venue's standing invitation to share a table. §2 documents each of these as prior art and locates precisely which of this paper's claims each one defeats or narrows.\n\n**The searches behind that list, stated with their apertures.** Four desk surveys, none of them fieldwork, all through a US-region web index:\n\n| date | subject | aperture | killed or narrowed | survivor |\n|---|---|---|---|---|\n| 2026-09-04 | the four-part relay, `C-BG1` (§2.1–2.3) | six queries; marketing copy, secondary literature; pre-registered | **all four legs attested** — chain visibility, name-withheld chain, thankable anonymous giver, unpaid propagation | the anonymity inversion (§4), instrumented between strangers — not found |\n| 2026-09-05 | the direct commercial tier (§2.5) | about ten queries plus three competitors' published terms; **not pre-registered** | item-level codes, no-expiry redeemable claims, and an item-specific patent family are attested | a relayed state with no redeem operation (claim 1) — not found; one competitor chose the inverse |\n| 2026-09-06 | the institutional payer (§3.3) | eight queries; pre-registered | a rule-bound payer choosing recipients by lot; give-only value handed to a vendor-like party | the four legs **as one composition** (claim 13) — not found |\n| 2026-09-18 | the unbought invitation (§6) | thirty-seven queries, nine fetches; pre-registered; ⛔ **full-text patent classification search did not run** (the endpoint returned an instrument failure twice), no non-English search | the loose reading killed; place-and-time and non-convertibility attested **separately** | the pair, non-convertible by construction (claim 14) — not found |\n\n⛔ **\"Not found\" is a statement about an aperture on a date, never a statement that something is new.** Every survivor above is written *not found in the stated aperture on the stated date*, and the enumerated claims are those survivors and nothing wider.\n\n## Abstract\n\nA gift instrument is specified in which a payer purchases a claim on a specific good and directs it not to a recipient but to an **intermediary who cannot redeem it**. The intermediary's only available action is to pass it onward; on passing, the instrument converts into an ordinary redeemable claim held by whoever received it. The chain — payer, intermediary, recipient — is preserved and visible to every party, and every party in it can be thanked, including a payer whose name has been withheld.\n\nFour properties are specified. Three are individually attested in existing practice and are claimed only in combination: chain visibility, name-withheld-but-chain-preserved anonymity, and thankability at every link. The fourth — that no link is ever paid — is also attested, in the non-commercial pay-it-forward genre, and the paper's original prediction that it would be the novel one was wrong.\n\n**What survives the census is the *purpose* of the anonymity.** In every attested case, a giver's anonymity protects the giver: they wish not to be known. Here it does the opposite work. The payer withholds their name **so that the intermediary is the one who appears generous** — the anonymity is *generative of a third party's standing* rather than *protective of the giver's privacy*. The paper argues that this inversion has an ancient folk precedent (a parent handing a child money for the collection plate), that it has no instrumented precedent the authors could find, and that instrumenting it requires the non-redeemability to be enforced by the instrument's *type* rather than by the intermediary's character.\n\nThe paper further argues that the unpaid constraint is a design necessity rather than a preference: the developmental literature reports that offering a child a reward for a kind act makes repetition *less* likely, so a relay that paid its intermediary would corrode the behaviour it exists to produce. Finally it specifies a three-state lifecycle in which every expiry is generated by one rule — *a clock runs while the instrument has no addressee — no one to whom it has been given as a gift — and stops the moment it does* — and shows why the resulting asymmetry, in which the intermediary's instrument expires and the recipient's does not, is the correct shape rather than an inconsistency.\n\nTwo extensions are specified at claim width only. An **institutional payer** — a fund operating under public rules rather than a person — issues the instrument anonymously by construction, has its merchant and its intermediary selected by a publicly recomputable draw, thanks the merchant's owner in capacity that can only be given onward rather than paying the merchant money, and re-addresses a lapsed instrument to a new intermediary until it is redeemed or the merchant closes. And the type argument of §6 is shown to reach a second object: a merchant's **invitation to a place and an hour**, bought by no one, which carries no purchase price, so that converting it into money-denominated credit is *undefined* rather than *forbidden*.\n\n## Claims\n\n*Enumerated at drafting. A defensive publication works by **disclosure**, and a claims list is what an examiner or opposing counsel searches; the prose that establishes each claim is cited beside it. **No claim below adds matter not present in the body**, and the prior art runs from this document's publication date and its independent timestamp, not from this list.*\n\n1. **A gift instrument whose intermediate holder has no redeem operation** — a claim on a specific good, issued to a party who cannot present it to the merchant, whose only available operation is to transfer it onward, and which becomes redeemable only in the hands of the party to whom that transfer is made. ⭐ **The non-redeemability is a property of the instrument's state rather than a policy applied to a holder** — there is no permitted-but-discouraged redemption path. **Any operation that yields the claim's value to its holder — conversion into credit on an account with the merchant, a refund, an exchange — is the same capability as redemption and exists exactly where redemption exists**, so the relayed state has none of them. (§3, §6.)\n\n2. **State-derived lifecycle for such an instrument** — three states (issuable, relayed, redeemable) derived from which participant fields are populated rather than stored as an independent status flag, so that the state and the chain cannot disagree. (§3.1.)\n\n3. **Chain preservation with selective name suppression** — a record carrying both the paying party and the transferring party, in which the *identity* of the payer may be suppressed while the *existence and shape of the chain* is disclosed to every party, and in which suppression is a property of the record rather than of any single pairwise relationship, and is never partially lifted. (§3, §4.)\n\n4. **Role-addressed gratitude** — gratitude messages addressed to a **position in a chain** (the party who paid; the party who transferred) and resolved to an identity only at delivery, permitting a party whose name is suppressed to receive gratitude without the name becoming available to the sender. (§3.1.)\n\n5. **Anonymity applied to confer standing on a third party** — withholding the payer's identity for the purpose of causing the transferring party to be perceived as the giver, as distinct from the attested use of anonymity to protect the giver, and distinct from honorary giving, where the honoree is named as such — here the intermediary is perceived by the recipient as the giver. ⭐ **The perceived standing is not represented as a stored quantity, is not transferred, and has no field in the record.** (§4.)\n\n6. **A propagation chain in which no participant receives compensation for propagating** — no referral fee, commission, discount, credit, or preferential treatment accrues to any party for issuing, transferring, or receiving, and the absence is specified as a constraint on the mechanism rather than as a business preference. (§5.)\n\n7. **Bounded relay depth with a designed terminal state** — a chain fixed at exactly one intermediate transfer, adopted so that the instrument reaches a party who may consume it rather than propagating indefinitely. (§8.)\n\n8. **A single expiry rule keyed on addressedness** — *a duration runs while the instrument has no addressee — no one to whom it has been given as a gift — and ceases when it has one* — from which the differing terminal conditions of the three states are derived rather than separately specified, and under which a redeemable instrument held by a recipient carries no duration at all. (§7.)\n\n9. **Issuance capability terminated by holder inactivity** — the payer's ability to re-issue after a lapse expires a fixed interval (a deployment parameter, one cycle by default) after the most recent lapse, so that the instrument's existence depends on continued activity by its originator. ⭐ **The instrument is consequently never dormant**, which is the condition on which unclaimed-property obligations attach. (§7.)\n\n10. **Terminal dependency on merchant existence, disclosed at receipt** — a redeemable claim bounded by the continued operation of the issuing merchant rather than by any imposed duration, with that dependency stated in the instrument's own text at the moment of receipt rather than announced at closure — the terminal condition itself is the Philippine Gift Check Act's (2017) rule, and a redeemable gift code carrying no platform-imposed expiry is itself attested (§2.5); what is claimed is the disclosure at receipt, together with the pair of claims 8 and 12 — no rendered time, and no forward view to the merchant. (§7.)\n\n11. **Settlement of an unclaimed relay as recognised revenue on an item-denominated basis** — recognition of deferred revenue on lapse, on the basis that a specific good was sold and only its collection lapsed, distinguished from stored-value instruments in which the customer's own unspent balance is retained. (§7, §9.)\n\n12. **Suppression of forward lapse visibility from the merchant** — withholding from the merchant any prospective view of instruments approaching lapse, including counts, lists, forecasts, and any control affecting completion, as a structural measure against an incentive the merchant would otherwise hold. (§7.1.)\n\n13. **An institutional payer for the relay, claimed only as a composition** — the instrument of claim 1 issued by a fund operating under public rules rather than by a person, in which (i) the payer's identity is suppressed by construction, the instrument it issues being indistinguishable to intermediary, recipient and merchant from one issued by an anonymous individual; (ii) the merchant and the intermediary are selected by a publicly recomputable draw over committed rosters rather than by the payer's judgment; (iii) the merchant gives the good, and its owner is credited, at the posted price, in capacity that can only be given onward and is subject to a periodic reset, rather than paid in money; and (iv) a lapsed instrument is re-addressed to a new intermediary — never one whose window has already closed on that instrument — until it is redeemed or the merchant closes. Each leg is attested separately (§3.3); the composition was not found in the aperture of 2026-09-06. (§3.3.)\n\n14. **A merchant's invitation that no one bought, non-convertible by construction** — an instrument by which a merchant offers a place and an hour, published by the merchant and purchased by no party, carrying no purchase price, so that any operation converting it into money-denominated credit has nothing to strike at and is **undefined by the instrument's type rather than prohibited by a rule**. Claimed only as the pair — place-and-time, non-convertible by construction — since each half is attested separately and a venue's standing invitation defeats the loose reading (§6). (§6.)\n\n⚠️ **Claims 5 and 6 are the ones the authors believe are unattested in combination, and claims 13 and 14 survive only as compositions; claims 1 through 4 and 7 through 12 are enumerated for completeness of disclosure and several have close prior art documented in §2.** The purpose of this list is to prevent enclosure, not to assert priority.\n\n## 1 · Why a gratitude institution needs an intermediary at all\n\nThe obvious way to give a stranger a coffee is to buy them a coffee. The instrument in this paper exists because there is a second thing a person may want to give, and the obvious mechanism cannot deliver it.\n\nThe founding case is domestic and worth stating concretely, because the abstraction is less clear than the instance. An uncle wishes to be kind to his nephew, who is fourteen and attends a school near a home coffee shop his mother runs. He could buy the nephew a coffee. What he actually wants is for the nephew *to be the one who gives coffees to his friends* — to have the experience, and the standing, of being a person who hands things to people. The coffee is instrumental. **The gift is the giving.**\n\nA direct purchase cannot produce this. If the uncle buys the nephew a coffee, the nephew has a coffee. If the uncle gives the nephew money and says \"buy your friends coffees,\" the nephew has been given a chore with a budget, and the generosity remains legibly the uncle's. If the uncle simply buys coffees for the friends, the nephew is not in the transaction at all. Each of these is a perfectly good gift and none of them is the gift in question.\n\n⭐ **The thing being given is an *occasion to give*, and an occasion is not a good.** It cannot be handed over as an object because it is not one; it can only be constructed, by arranging matters so that someone finds themselves in the position of giver. That construction is what this instrument performs.\n\nThe institutional reason to care is narrower than the sentimental one. An economy premised on circulation has a structural problem at its edges: the people who most need to be brought into it are precisely the people with the least to give. A student has no money. The standard answers — give them money, or give them a smaller unit of the same money — do not change the shape of the relation; they make the student a recipient of a smaller gift. **An instrument that makes a person a giver without requiring them to have anything is the only move that changes the shape**, and it is the reason this paper's mechanism is not merely a nicety in a gifting product.\n\nThere is a second institutional reason, less edifying and worth naming for honesty: the instrument brings customers to a merchant. The nephew hands coffees to friends who have not been to the shop. This is, functionally, a referral mechanism. §5 argues at length that it must nevertheless pay no one, and that this is not restraint but engineering — but the paper does not pretend the growth effect is invisible to its designers.\n\n## 2 · Background, prior art, and a census that returned a partial null\n\n⚠️⚠️ **This section reports a negative result the authors obtained before drafting, and it narrows the paper substantially. It should be read before any claim in §3 or §4 is credited.**\n\n### 2.1 · The claim as originally stated, and the prediction\n\nBefore searching, the authors registered a four-part claim, `C-BG1`. A gift instrument in which *all four* hold:\n\n| | |\n|---|---|\n| **(a)** | the chain of custody — payer → intermediary → recipient — is preserved and visible to every link |\n| **(b)** | the payer may withhold their **name** but never the **chain** |\n| **(c)** | **every link is thankable**, the anonymous payer included |\n| **(d)** | **no link is ever paid** — no referral fee, commission, credit or discount to anyone for propagating it |\n\nThe null condition was stated in advance: **one attested instrument carrying all four defeats the claim.** The prediction was also stated in advance, so that it could fail visibly: (a) through (c) were expected to be attested somewhere, since provenance chains and selective anonymity are commercially ordinary, and **(d) was expected to survive**, on the reasoning that *every chain-attribution system in commerce exists in order to pay the upline.*\n\n### 2.2 · What the census found\n\nThe method was a desk survey — six queries, product marketing copy, and secondary literature. It is documented practice, not fieldwork, and it is not exhaustive. **All four parts are attested.**\n\n**(a) Chain visibility is attested, including the conserved-identity form.** A pay-it-forward tracking platform (the Pay It Forward Monitor) renders the chain a user started as a tree and a map, so that each participant can see what their act became. A circulating-token application lets an organisation watch a single token move person to person and visualise its path. This last is important: it attests not merely a *record* of a chain but the stricter case in which *the same object continues*, which the authors had privately supposed was the sharp distinction.\n\n**(b) Name-withheld-chain-preserved anonymity is attested as practice.** Anonymous giving through a named intermediary is common in philanthropy (Forbes 2012; the National Council of Nonprofits' guidance): a donor routes a gift through an advisor, attorney, or friend, who supplies their own information for documentation while the donor's identity is shielded. The chain is not hidden; only the origin is.\n\n**(c) Thankability of an anonymous giver is attested as practice.** Common fundraising guidance instructs organisations to acknowledge anonymous donors — they hold the contact details — and commonly instructs recipients to route thanks through whoever delivered the gift.\n\n**(d) The unpaid constraint is attested, and most strongly of all — the prediction failed.** Suspended coffee, a tradition originating in Naples and running at scale (its founder reported roughly fifteen million cups across thirty-four countries by 2015 — a self-reported count; the movement's own site gives 1,400 cafés in its first year), pays nobody. Neither does any documented pay-it-forward chain. **The authors' reasoning was backwards: it argued from the commercial neighbourhood when the nearest relatives are charitable, and the entire altruistic pay-it-forward genre is unpaid by definition.**\n\n### 2.3 · What the census did not find, and how much weight that can bear\n\n⚠️ Formally the result is a **partial null**: no single attested instrument was found carrying all four properties *and* the inversion of §4 together; the four alone are attested (§2.3a). ⛔ The authors decline to read that as a pass. A four-for-four result on the individual legs, from a six-query survey, is what a claim looks like shortly before it dies, and a reader with better search should assume the combination is attested somewhere the authors did not look.\n\nWhat the census *could* not find is narrower than any of the four legs, and §4 is devoted to it: **an instrument in which the anonymity exists in order to confer standing on a third party.** In every attested case — philanthropic, commercial, or folk — anonymity protects the giver. The inversion was not found instrumented in the aperture of 2026-09-04, and the direct-tier survey of the next day (§2.5) did not find it either.\n\n⭐ **One further finding, obtained by accident and reported because it strengthens §5 rather than this paper's novelty:** the developmental literature on children's generosity reports that offering a young child a reward for a kind act makes repetition **less** likely (Warneken & Tomasello 2008, in 20-month-olds; Fabes et al. 1989, in older children), and — in the authors' reading of the family-generosity literature, for which a source is owed — that parent-*directed* family generosity projects perform worse than child-*led* ones. The first of these turns claim (d) from a doctrinal preference into a design constraint with empirical support. The second is a caution the authors' own founding use case does not fully satisfy, and §9 records it as a limitation rather than burying it.\n\n### 2.3a · The prior-art matrix\n\nThe four properties are stated so that a reader can check the boundary rather than take the authors' word for where it falls. Each row is an attested practice; each column is one property.\n\n```\n                              (a)      (b)       (c)       (d)      the\n                            chain   name-off  thankable  unpaid  INVERSION\n                           ───────────────────────────────────────────────\n suspended coffee             ·         ✓         ·         ✓         ·\n pay-it-forward tracking      ✓         ·         ·         ✓         ·\n circulating-token app        ✓         ·         ·         ✓         ·\n anonymous giving via\n   a named intermediary       ✓         ✓         ✓         ✓         ·\n charity gift cards           ·         ·         ·         ✓         ·\n enterprise recognition\n   (give-only allowances)     ~         ·         ✓         ·         ·\n referral / MLM chains        ✓         ·         ·         ⛔         ·\n trackable pass-along\n   (Travel Bug)               ✓         ·         ·         ✓         ·\n the collection-plate coin    ·         ✓         ·         ✓         ✓\n                           ───────────────────────────────────────────────\n THIS INSTRUMENT              ✓         ✓         ✓         ✓         ✓\n\n   ✓ present   · absent   ~ partial   ⛔ inverted (payment is the point)\n```\n\n⚠️ **Three rows deserve comment: two nearly close the claim, and one nearly closes claim 1.**\n\n**Anonymous giving through a named intermediary carries all four.** A donor routes a gift through an advisor whose identity is documented, the chain is legible, the recipient thanks through the intermediary, and nobody is paid. ⛔ **On the four stated properties this is a hit, and the authors record it as one.** What it lacks is the fifth column: the donor's anonymity is *protective*, and the advisor is a conduit rather than a beneficiary of standing. Nobody in that arrangement is trying to make the advisor look generous.\n\n**The collection-plate coin carries the inversion and nothing else.** A parent hands a child a coin so the child is the one who gives; the anonymity — such as it is — exists precisely to confer the act on the child. ⭐ **This is the true precedent, and it is widespread and undated.** What it lacks is instrumentation: it works only between people who already know each other, it preserves no record, and gratitude cannot reach a payer who was never named because there is no channel by which it could.\n\n**The trackable is the nearest thing to claim 1 that the searches found, and it fails for the paper's own reason.** A geocaching Travel Bug is a tagged object that finders carry from one cache to the next, each move logged against the object's own page so its whole journey can be read. It is meant to be passed rather than kept, and its custody history is public — a conserved-identity chain with an expectation of onward movement. ⛔ **But the finder can keep it**, and trackables are known to go missing when someone takes one and never logs it. The must-pass is a request held by the finder's character; §6's test — remove the enforcer — separates it from an instrument whose middle holder has no keep operation at all. **It is a rule with a diary, not a type.**\n\n⭐⭐ **The claim is the bottom row and nothing above it.** Every column has been done. The combination, and specifically the combination of the fifth column with an instrument that can carry it between strangers, is what the census could not attest.\n\n### 2.4 · The adjacent literature this paper does not claim to extend\n\nMalinowski's account of the *kula* (1922), taken up by Mauss (1925), describes conserved objects circulating through a chain with their history intact, and Hyde's argument that the gift must always move is the best-known statement of the norm this instrument mechanises. **Neither is being extended here.** The idea that a gift ought to keep moving is roughly a century old in the anthropological literature and considerably older in practice; what this paper offers is not that observation but a mechanism in which the alternative to passing has been removed from the instrument, so that the norm does not depend on anyone honouring it.\n\nOne lineage note belongs here rather than in the body, because this is a mechanism paper and not a doctrinal one. The Pāli canon grades giving by the giver's motive (AN 7.52, the *Dānamahapphala Sutta*, lists seven), and ranks *giving with expectation of return* lowest. ⭐ The instrument does not ask anyone to give without expectation; **it removes the object of the expectation**, since a withheld name has nothing that can return to it and no link is paid. The authors note the correspondence and claim nothing from it: the mechanism stands or falls on §5's three arguments, of which the empirical one is the strongest and is not doctrinal at all.\n\nChain-of-custody instrumentation is dense in the patent literature for goods, evidence, data lineage and supply chains. The first survey found none directed at a gift instrument; the second found one gift-token family close to the founding case (below), which corrects that sentence's original, wider form. That neighbourhood is the reason this paper is a defensive publication rather than a note: the transposition was not found in six queries on 2026-09-04, and it is exactly the sort of thing an adjacent loyalty or fintech actor would file.\n\nAdjacent patent families found at the 2026-09-05 revision, each named against the claim it touches. WO 2012/037178 A2 (Mankoff, priority 2010) transfers a virtual gift with an acceptance period followed by a redemption period — state-dependent timing, the nearest relative of claim 8, though there both periods are clocks on the recipient. WO 2016/057643 A1 (Soniram, priority 2014) and US 2006/0033326 A1 (priority 2004) route a thank-you to a gift's giver through a platform or a returnable note — the nearest relatives of claim 4, neither addressing a role nor withholding the giver's name. US 2013/0197983 A1 (Vel, priority 2012) tracks referral chains and compensates them — claim 7's shape with the payment this paper forbids. The Philippine Gift Check Act (Republic Act 10962, 2017) makes a gift check *valid until the cessation of business of the issuer* — claim 10's terminal condition nearly verbatim, so that what claim 10 adds is only the disclosure at receipt. Anonymous tribute giving *in honour of* a named third party, with notification, is claim 5's nearest relative; it differs in that the honoree is named as such, where here the intermediary is perceived by the recipient as the giver. A further family, found by the direct-tier survey of 2026-09-05 (§2.5), sits closest to this paper's founding case: US 10,510,057 B2, *Token-based gift cards* (SCVNGR, Inc., now held by GrubHub; provisional 17 June 2014, filed 17 June 2015, granted 17 December 2019). It discloses a stored-value gift token created for a recipient, purchaser-set restrictions on redemption down to item and SKU level, and a request that the stored value be redeemable by a third user as well as the named one. It is named for what it discloses — item-specific gift tokens and a recipient other than the one first named — and, like every live family in this section, **nothing here is a reading of its claims.** The adjacent families are named so that a reader with better search starts where we stopped.\n\n### 2.5 · The direct tier: the code is a live commercial category, and only the type survives\n\nThe first survey reached the instrument's charitable relatives and missed its commercial siblings. A second survey, on 2026-09-05, asked the narrower question a merchant would ask — *who already sells a gift code for one specific item, redeemed at a local counter?* — and the answer is that the category is shipping. ⚠️ **Its evidence class is lower than the first survey's**: about ten queries through a US-region index and a reading of three competitors' published terms, not pre-registered.\n\n```\n                    legal form            expiry              unredeemed value        pass it on?\n                   ─────────────────────────────────────────────────────────────────────────────────\n spot              merchant gift card /  none imposed once   remains claimable;      not addressed;\n  (terms eff.        stored-value pass     issued; no dormancy  no automatic refund    first eligible\n   2026-08-24)                             or inactivity fees   for an unclaimed gift  claimant is treated\n                                                                                        as the recipient\n OneOnMe           non-reloadable        none stated;        balance persists        not addressed\n                     virtual prepaid       $2.50/month fee\n                     card, bank-issued     after 12 months\n                                           of inactivity\n Klink-iT          fees earned and       7 days from         full amount refunded    ⛔ \"NON-\n  (terms updated     collected only at     purchase            to the sender           TRANSFERABLE,\n   2024-01-30)       redemption                                                         NOT FOR RESALE\"\n                   ─────────────────────────────────────────────────────────────────────────────────\n THIS INSTRUMENT   an item claim         intermediary:       lapses to the merchant  ⛔ the relayed state\n                     (§3.1, never an       a window;           as recognised revenue   CANNOT redeem —\n                     amount)               recipient: none     (§7, §7.2); no forward  passing is its only\n                                           but the merchant's  view (§7.1)             operation\n                                           existence\n```\n\n**What it does to the claims, in order of damage.**\n\n⛔ **The item-level gift code is not this paper's.** Picking a real menu item for someone and having them redeem it at the counter is a commercial product today, in at least three legal shapes — a merchant stored-value pass, a bank-issued prepaid card wearing an item's face, and an order paid only at redemption with no stored value at all. Nothing in §3 should be read as claiming the code.\n\n⛔ **The no-clock half of claims 8 and 10 is attested.** One of the three states, in its current terms, that once a gift is issued it carries no expiration dates and no dormancy or inactivity fees, and that an unclaimed gift remains claimable. *A gift that never expires by the platform's clock* is therefore not claimed here. What remains is the **pair**: no rendered time at any state, and a redeemable claim bounded only by the merchant's continued existence, disclosed at receipt, with no forward view of pending lapses given to the merchant (claims 8, 10, 12 together).\n\n⭐⭐ **Claim 1 survives, and against better evidence than silence.** None of the three has a state in which the holder can only pass the gift on. One of them considered transferability and **forbade it in capitals** — its products are non-transferable and not for resale, and an unredeemed gift is refunded to the sender after seven days. That is the same axis as §6, decided the other way. A competitor who chose the inverse property is stronger evidence that the property is a choice, and unoccupied, than an absence of results would be.\n\n⚠️ **One incidental finding cuts toward §7's argument rather than toward novelty.** The bank-issued form carries a monthly maintenance fee after twelve months of inactivity — a charge that runs against the holder of a gift while nothing happens. It is the attested form of the clock §7 forbids on the redeemable state.\n\n## 3 · The instrument, specified\n\nThe instrument has three states. It is one object moving through them, not three products.\n\n```\n   ┌──────────────┐        ┌──────────────┐        ┌──────────────┐\n   │  RE-MINTER   │───────►│   RELAYED    │───────►│  REDEEMABLE  │\n   │              │ issues │              │ passed │              │\n   │ held by the  │        │ held by the  │        │ held by the  │\n   │    PAYER     │        │ INTERMEDIARY │        │  RECIPIENT   │\n   ├──────────────┤        ├──────────────┤        ├──────────────┤\n   │ cannot spend │        │ cannot spend │        │  CAN spend   │\n   │ can only     │        │ can only     │        │              │\n   │   issue      │        │  pass on     │        │              │\n   └──────────────┘        └──────────────┘        └──────────────┘\n     dies of neglect         dies on a window        dies with the merchant\n```\n\n**State 1 — the re-minter.** The payer buys a claim on a specific good from a specific merchant and receives an instrument that **cannot be redeemed by anyone, including the payer**. Its only operation is *issue to an intermediary*.\n\n**State 2 — relayed.** The intermediary holds a claim they cannot spend. Its only operation is *pass to a recipient*. ⛔ **There is no redeem operation on this state. Not a disabled one — an absent one.** §6 argues that this distinction is the whole mechanism.\n\n**State 3 — redeemable.** The recipient holds an ordinary claim on the good and may present it to the merchant. The relay is over.\n\nAcross the three states, *held by* is custody and *addressed to* is ownership in §7's sense: the payer and the intermediary hold without being addressees, and the recipient is the first party to whom the instrument has been given as a gift.\n\nThree further properties hold across the states.\n\n**The chain travels with the instrument.** Every state carries `from` (who paid) and, once issued, `via` (who chose the recipient). The recipient sees both roles even when a name is withheld.\n\n**Anonymity is a property of the instrument, not of a relationship.** A payer may withhold their name. When they do, **the name is withheld from everyone — intermediary and recipient alike — and the chain is withheld from no one.** ⛔ It is never partially lifted, and the *fact of the chain* is never suppressed: the recipient is told that someone asked the intermediary to pass this on. **Thanking a person you have not been told exists is not thanks; it is routing.**\n\n**Every link is thankable, including an anonymous one.** A thank addressed to a withheld payer reaches them without their name travelling back. This is not a courtesy feature; §4 argues it is load-bearing, because an anonymity that also severed the possibility of gratitude would be indistinguishable from an absence.\n\n### 3.1 · The data model\n\nThe instrument is one record. Its state is derived from which fields are populated, not stored as a separate flag that could disagree with them.\n\n```\nrelay {\n  id              opaque, high-entropy, rate-limited on lookup\n  merchant        the shop the claim is against\n  item            a SPECIFIC good — never a monetary amount\n  paid_at         when the claim was purchased\n\n  from            the payer's account\n  from_anonymous  bool — withholds the NAME, never the chain\n  via             the intermediary's account   (null until issued)\n  to              the recipient's account      (null until passed)\n\n  issued_at       payer → intermediary\n  passed_at       intermediary → recipient\n  redeemed_at     recipient → merchant\n  lapsed_at       a window closed with no pass\n  lapses[]        { at }   — every closed window, so a re-issue has a history\n\n  thanks[]        { by, to_role: from|via, at }   — role, not identity\n}\n```\n\n⭐ **Three details in this schema are doing doctrinal work and would be easy to get wrong.**\n\n**`item`, never `amount`.** The claim is on one specific good. A field holding a monetary value would make this a stored-value instrument, which changes its legal character, its accounting treatment, and its relationship to the merchant — and would reintroduce every incentive the design removes. **The distinction is a schema decision, not a policy one.**\n\n**`thanks[].to_role`, never `to_identity`.** A thank is addressed to a *role in the chain* — the one who paid, the one who chose you — and is resolved to a person only at delivery. ⭐ **This is what lets an anonymous payer be thanked without their name existing anywhere the recipient can reach.** A schema that addressed thanks to identities would have to either leak the name or drop the thank. `to_role` resolves inside the platform to the account that currently holds the role; delivery is to that account, and the identity never appears in the message or to the sender.\n\n**No `standing`, no `credit`, no `generosity_score`.** §4 argues that nothing is transferred to the intermediary. **The absence of a field is how that argument is enforced.** There is no quantity to account for, dispute, audit, or eventually rank.\n\n### 3.2 · A worked relay, end to end\n\nAn uncle in another country, a nephew of fourteen, and a home coffee shop the nephew's mother runs near his school.\n\n1. **The uncle buys one iced coffee** from the shop and directs it to his nephew, with his own name withheld. A record exists with `from` set, `from_anonymous` true, `via` and `to` null. ⛔ **The uncle cannot drink it.** The instrument he holds has no redeem operation; his only available action is to issue.\n\n2. **He issues it to the nephew.** `via` is set, `issued_at` stamped. The nephew's view reads: *someone asked you to pass this on — one iced coffee, at your mother's shop.* ⭐ **The nephew is told the chain exists and not who is in it.** He is not told that a gift is being kept from him; he is told he has been given something to give.\n\n3. **The nephew passes it to a classmate.** He chooses; nobody suggests. `to` is set, `passed_at` stamped, and the instrument's state changes: **the classmate holds an ordinary redeemable claim.** From this moment nothing in the design may expire it except the shop closing.\n\n4. **The classmate redeems it** at the counter. The mother serves a coffee she was paid for at step 1.\n\n5. **The classmate thanks.** Two links are offered: *the person who handed it to you* and *the person who paid for it*. She thanks both. The nephew receives a thank addressed to him by name. **The uncle receives a thank addressed to a role he occupies, carrying no obligation and returning no name.**\n\n⭐⭐ **Notice what the classmate's gratitude does at step 5, and how little of it is the instrument's doing.** She is grateful to the nephew because the nephew handed her a coffee. Nothing was transferred to him to make that happen; the uncle's name was simply not there for her gratitude to land on. **The mechanism's entire contribution is an absence, held open long enough for her own attribution to fill it.**\n\n⚠️ **And notice what does not happen.** Nobody is paid. The shop is not paid extra for hosting a relay; the nephew is not paid for passing it on; the uncle receives nothing but a thank he cannot spend. **The instrument moves one coffee and no money beyond the first purchase.**\n\n### 3.3 · An institutional payer\n\nThe payer in §3.2 is a person. The same instrument can be issued by a fund that is not one — in this institution, the Aquarian Pool℠, a common fund administered under published rules — and the substitution changes four things. It is specified here at the width of a claim (claim 13) and no further, because it is designed and not built.\n\n**The anonymity stops being a choice and becomes a property.** A person may withhold their name; a fund operating under rules has none to offer. Its instruments carry `from_anonymous` without exception, and what an intermediary, a recipient or a merchant sees is **indistinguishable from an instrument issued by an anonymous individual** — the same record, the same wording, no funded-by label to suppress. §4's inversion reaches its limit case: the payer's absence is total, so the standing that forms in the recipient can only land on the intermediary. ⚠️ The indistinguishability must hold at every layer that carries the payment, not only on the screen: a credit that reaches the merchant's owner by a path only the fund uses identifies the fund as surely as a name would.\n\n**Selection is a draw, not a judgment.** A fund that chose which merchant and which intermediary would be allocating custom and standing by preference. Instead both are drawn over committed rosters by a publicly recomputable procedure; where a published order would itself identify which anonymous instruments were the fund's, the order is sealed during the season and revealed to named verifiers at its end. That procedure is specified in *Decided by No One*, which treats this surface as its sealed regime; this paper claims only that the relay's payer may be seated that way.\n\n**The merchant gives, and is thanked rather than paid.** The fund never buys the good. A merchant whose owner has consented to be in the roster gives it, and the owner is credited at the posted price — the price an individual would have paid, so that the fund's instruments cannot be told apart by amount — in capacity that can only be given onward and is emptied at a periodic reset like every such fund. ⛔ **This is not a chain in which no link ever holds liquid value.** The owner's onward gift from that capacity lands, one hop later, in someone else's ordinary account, where it is spendable; the chain of *this* instrument — fund, intermediary, recipient, merchant — carries no liquid value, and the next gift is another instrument.\n\n**The relay does not die of neglect; it is re-addressed.** For a person, §7's re-minter ends when the payer stops issuing. A fund does not forget, so a lapsed instrument is re-addressed to a **new** intermediary, drawn as the first was, until it is redeemed or the merchant closes. ⛔ It is never re-addressed to an intermediary whose window has already closed on it: sending it back to someone who let it lapse would be a reminder of an omission, and the lapsed intermediary is told nothing. Two consequences follow. The fund's continued re-addressing is exactly the activity on which claim 9 rests, so the instrument is never dormant. And the lapse settlement of claim 11 does not arise for these instruments, because the claim does not lapse to anyone; ⚠️ the price is an outstanding inventory of claims at each merchant with no clock on it, bounded by the number the owner has agreed to hold and settling only because each re-address reaches someone new.\n\n**What the census found, and what survives.** A pre-registered survey on 2026-09-06 (eight queries) attested every leg separately. ⛔ **A rule-bound payer choosing recipients by lot is ordinary**: in October 2020 the People's Bank of China and the Shenzhen municipal government gave 50,000 randomly selected residents 200 digital yuan each, spendable at 3,389 designated outlets between 12 and 18 October. ⭐ It is the most useful **contrast** in the survey, because it is the same issuer-and-lottery shape carrying three properties this instrument refuses: the payer was known and announced, the merchants were paid in money, and the value was bounded by a one-week window. ⛔ **Give-only value is also ordinary**: charity gift cards, sold since 2007 and marketed for client and employee gifts, are spent only by choosing a registered charity to receive them. That is the **near-miss** — give-only, but restricted to charities, where the capacity here may be given to any person. The survivor is the composition of claim 13 and nothing wider: *an anonymous-by-construction fund, drawing merchant and intermediary, thanking the merchant's owner in give-only capacity, and re-addressing on lapse.* ⭐ **The novelty class is composition, and a fund being the payer is a novelty of the actor, never of the mechanism.**\n\n## 4 · The inversion: anonymity that confers rather than protects\n\nThis is the paper's narrow claim, and it should be read at exactly this width.\n\nIn every use of anonymity the census found — philanthropic, commercial, religious, folk — **the anonymity is protective, and the person it protects is the giver.** They may wish to avoid solicitation, or publicity, or the social weight that a known gift imposes on a recipient; classical treatments of anonymous giving are organised almost entirely around the giver's motive and the recipient's dignity. Anonymity is a shield the giver holds in front of themselves.\n\nHere it does the opposite work. ⭐⭐ **The payer withholds their name so that the intermediary is the one who appears generous.** The nephew hands a friend a coffee; the friend's gratitude has nowhere to land but on the nephew. The uncle's absence is not self-protection — it is the mechanism by which the nephew acquires standing he did not have.\n\nIt is worth being precise about what does and does not happen, because the natural description of this is wrong in a way that matters.\n\n⛔ **Nothing is transferred to the intermediary.** The payer does not hand over credit, or reputation, or merit; there is no such quantity moving between them. What happens is that **the payer's name is absent**, and the recipient's own act of attribution — their own gratitude, forming in them, directed at the person in front of them — does the work. The absence is the condition. Nothing crosses.\n\nThis is not a fastidious distinction. A mechanism described as *transferring credit* invites a ledger of credit, and a ledger of credit invites the accounting that this instrument exists to avoid: how much was transferred, whether it was enough, whether it can be reclaimed. **Described correctly, there is no quantity to account for.** The design implication is direct: there is no field in the schema for standing, no measure of how generous the intermediary appeared, and nothing anyone can audit or dispute.\n\n⚠️ **The inversion has an ancient folk precedent, and the paper's claim must be stated against it rather than around it.** A parent hands a child a coin to put in the collection plate so that the child is the one who gives. This is widespread, undated, and performs exactly the move described above. **The claim is therefore not that nobody has done this. It is that nobody has built a ledger that does it** — that the move has lived entirely in the space between two people who know each other, and has never been given an instrument that can carry it between strangers, preserve who was involved, and let gratitude reach a person whose name was never said.\n\n⭐ The novelty class is accordingly **instrumentation and cross-domain transposition**, not discovery. That is a defensible class and a modest one, and it is the class the census supports.\n\n## 5 · Why no link may be paid\n\nThe unpaid constraint reads like an ethical flourish. It is the load-bearing engineering constraint in the paper, and there are three arguments for it in increasing order of force.\n\n**The doctrinal argument.** A relay that paid its intermediary would be a referral programme, and the value moving to the intermediary would be compensation for propagation rather than a gift. The instrument's whole content is that the intermediary *received the giving*; paying them converts what they received into a job. This argument is sound and is the weakest of the three, because it is available only to a reader who already accepts the frame.\n\n**The structural argument.** Nearly every chain-attribution system in commerce exists in order to pay someone — that is what the attribution is *for*; the exceptions track for analytics. The moment a payment attaches to a link, the chain acquires an optimisation target, and the behaviour that follows is well documented in the multi-level marketing literature (Keep & Vander Nat 2014): recruitment displaces the ostensible purpose, because recruitment is what pays. **An unpaid chain has no upline to enrich and therefore no gradient to climb.** The chain here exists to be *seen*, not to be *settled*, and nothing in it is a claim on anyone.\n\n**The empirical argument, which is the strongest and is not the authors'.** The developmental literature reports that **children offered a reward for performing a kind act are less likely to repeat it** — the overjustification effect, in which an extrinsic incentive displaces the intrinsic motivation it was meant to reinforce (Warneken & Tomasello 2008; Fabes et al. 1989). The intermediary in the founding case is fourteen years old, and the evidence is from young children; the gap is stated in §9. **A relay that paid him would not merely be doctrinally impure; the literature predicts it would reduce the behaviour it exists to produce.**\n\n⭐⭐ **The three arguments converge, and the convergence is the finding worth carrying: the purity condition and the engineering condition are the same condition.** A designer who cared nothing for the doctrine and only for whether the mechanism works would arrive at the same constraint by reading the psychology. That is a coincidence of goods rather than a trade-off between them, and it is the reason the constraint can be stated absolutely rather than balanced against growth.\n\n⚠️ One honest consequence. The instrument is a referral mechanism that pays no referral fee, which means its growth is bounded by how much people want to give rather than by how much they can earn. **This is slower, and the paper does not claim otherwise.**\n\n## 6 · Type, not rule: why the non-redeemability must be structural\n\nThe intermediary must not be able to spend the claim. There are two ways to arrange this and they are not equivalent.\n\n**As a rule:** the intermediary *may* redeem but is asked not to. The instrument carries an instruction, perhaps a reminder, perhaps a social expectation. Compliance depends on the intermediary being the sort of person who complies at the moment of temptation.\n\n**As a type:** the instrument in the relayed state **has no redeem operation**. Not a disabled button, not a permission check that could be misconfigured — the operation does not exist on that state.\n\nApply the diagnostic this institution applies to every guard: **remove the enforcer.** Under the rule, the enforcer is the intermediary's character, and it must be present at the exact moment it is tested — which is the moment nobody can guarantee. Under the type, there is no enforcer, because there is nothing to comply with.\n\n⭐ The difference is not fastidiousness about implementation. It determines whether the census verdict holds. **If the intermediary can redeem, then their passing it on is inspiration — a downstream effect, hoped-for, no part of what was given — and the attested pattern in §2.2 covers the instrument entirely — which is exactly what F2 tests.** The literature is full of anonymous gifts that inspired their recipients to become givers. It contains nothing the authors could find in which the giving *is the content of the gift*. That difference is a single line of code, and it is the whole claim.\n\n⛔ It follows that a redeem path added later \"for edge cases\" does not degrade the instrument gracefully. **It converts it into a different and unremarkable one.** This should be stated in any implementation's own documentation, because the pressure to add such a path will be real: intermediaries will lapse, and someone will propose letting them keep it.\n\n⭐ **The pressure has a second shape, and it arrives disguised as a different feature.** Suppose the merchant later lets a holder hand a claim back in exchange for credit on an account with the shop — a tab, store credit, a balance. For the recipient that is a harmless convenience. On the relayed state it is a redeem path under another name: the intermediary taking the value onto their own account is exactly the consumption the type forbids. **So conversion is not a separate capability to be permitted or withheld state by state; it is the same capability as redemption and lives exactly where redemption lives.** A state with no redeem operation has no conversion operation to add, and a single exception — convert yes, redeem no — would be a third combination that turns the type back into a rule.\n\n⭐⭐ **The type argument reaches a second object, and there it does not even need a prohibition.** A merchant may publish an **invitation**: a place and an hour it chose — a table, a cart, a boat, at a time — offered to people it does not yet know. Nobody buys it. That single fact settles its relation to money. A claim that was purchased carries a price, and converting it into credit strikes at that price; an invitation carries no purchase price, so a conversion would have nothing to strike at and would issue money-denominated credit that arose from no exchange. The obvious design would forbid the conversion. **The invitation needs no such rule, because the field a conversion reads does not exist on it — conversion is *undefined* by the type, not *forbidden* by a clause.** It is the move of §6 applied to a different object: take the property from the object, and the enforcer has nothing left to enforce.\n\n⚠️ **The census for this object (2026-09-18, pre-registered) killed the loose reading and narrowed the strict one.** A venue publishing a standing, non-convertible invitation is attested: the Chatty Café Scheme, begun in Oldham, England, in 2017, marks tables at which talking to strangers is explicitly welcome, and a national coffee chain rolled such tables out to some 300 stores in 2018. **The two halves of the strict reading are public separately.** Prepaid restaurant reservations bind a place to a time, and are transferable: on at least one platform a guest may *\"gift or sell their booking for any amount up to the original purchase price\"*, so the booking carries a price that a transfer can realise. Suspended coffee binds a good to a place, carries no time, and is kept from being turned into anything else by the café's practice rather than by the object. What was not found, in that aperture on that date, is the **pair** — a place-and-hour invitation that is non-convertible *by construction* — and that is claim 14's full width. ⛔ Full-text patent classification search did not run for this census, and nothing outside the English-language, US-region index was searched.\n\n⚠️ **A cost must be recorded against this choice.** An instrument the intermediary cannot use may be experienced as a chore rather than a gift — a task with a deadline. The authors' answer is that the intermediary's agency lives in the *addressing* rather than the *consuming*: they choose freely who receives it, and that choice is the substance of what they were given. Whether recipients experience it that way is an empirical question with n=0, and §9 records it as such.\n\n## 7 · The lifecycle, and the one rule that generates it\n\nEach of the three states ends differently, and the differences are generated by a single rule rather than by three policies.\n\n> **A clock runs while the instrument has no addressee — no one to whom it has been given as a gift. It stops the moment it does.**\n\n*Held by* is custody; *addressed to* is ownership in the rule's sense. The payer and the intermediary hold the instrument without being its addressees — the payer bought it to give, the intermediary was given it to give on — and the recipient, to whom it was given as a gift, is its first addressee.\n\n**The re-minter dies of neglect.** If an issued instrument lapses and the payer does not issue again within a re-issue window — a deployment parameter, one cycle by default — the whole thing ends. ⭐ This has an unobvious consequence in its favour: unclaimed-property regimes key on *dormancy*, and an instrument its holder touches on a recurring cycle is never dormant. The mechanism therefore does not bound the escheat exposure — it prevents it from arising. And an instrument that lives only while someone is actively trying to place a gift is honest about mortality: it dies with a payer who dies, forgets, or loses access, within one window.\n\n**The relayed state dies on a window.** An unaddressed occasion held indefinitely is a hoarded occasion. The window is what prevents accumulation, and it is the same instrument the institution uses on its other transient vessels.\n\n**The redeemable state dies with the merchant.** ⭐⭐ This is not a clock. Nothing ticks, nothing is displayed, and the holder is never told they are running out of time. It is a dependency on the counterparty existing, which is how every merchant obligation is bounded: a claim on one coffee from a particular shop is worth nothing once that shop closes. **The instrument does not expire because anyone decided it should; it expires because the thing it claims no longer exists.**\n\n⚠️ **The resulting asymmetry — the intermediary's instrument expires and the recipient's does not — looks like an inconsistency and is not.** The rule is symmetric; the *states* differ. An unaddressed instrument belongs to nobody and is coerced to move; an addressed one is somebody's, and nothing in the design may end it. This distinction is older than the instrument: it is the same line the institution draws between transient communal vessels, which it forces to empty, and personal accounts, which it never touches.\n\n⛔ **Two constraints follow and are stated as constraints rather than as preferences.** First, **remaining time is never rendered**, at any state: a terminal date exists to be reached, not displayed, and a countdown on a gift is a pressure applied to a person who was given something. Second, **an expiry on the redeemable state is forbidden** — that would be a clock imposed on a recipient holding a kindness, which is the one place the design will not bend. A merchant obligation that must terminate should terminate structurally, by the merchant's own closure, not by a timer aimed at the person holding the claim.\n\n**Disclosure rather than process.** Because the redeemable claim depends on the merchant existing, the holder is told so once, at the moment of receipt, in the instrument's own text — *good for one coffee at this shop, for as long as this shop is open.* ⭐ **This is not a caveat but a specification of what the thing is:** a claim on a real place run by real people, whose life is that place's life. It is materially different from corporate scrip, and saying so at receipt costs nothing, whereas discovering it at a closed counter costs everything the instrument was for.\n\n### 7.1 · What the merchant sees, and the one thing they must not\n\nThe merchant's position in a relay is unusual: they are paid at step 1, they perform at step 4, and **they have no visibility into and no influence over steps 2 and 3.** The intermediary is not their customer. The recipient is a stranger until they arrive.\n\nThey see: relays purchased against their shop, relays redeemed, and — after the fact — relays that lapsed and whose deferred revenue has been recognised. That last is an ordinary accounting entry and there is no reason to hide it.\n\n⛔ **What they must not see is a forward view: no list of outstanding relays, no forecast of what is about to lapse, no breakage projection, and no control that would let them influence whether a relay completes.** The reasoning is not that merchants are untrustworthy. It is that **an incentive with no handle cannot be acted on**, and the cheapest way to guarantee no handle exists is to withhold the number rather than to trust restraint about it. Concretely, the merchant's surface exposes purchased, redeemed, and lapsed-and-recognised records only; there is no query over outstanding instruments, so the forward view is not withheld by policy — it does not exist on the surface.\n\n⚠️ At one shop this is close to redundant — the merchant genuinely cannot reach an intermediary they have never met. At platform scale it is not: a larger operator hosting many merchants will eventually host one with levers, and the guard is written for that case rather than for the founding one: it exists because the lapse-revenue incentive is real at platform scale (§9). ⭐ *A number nobody was shown cannot be optimised, which is a weaker claim than a number that does not exist, and the authors would prefer the stronger one if they could find it.*\n\n### 7.2 · Three designs for unredeemed value, and the road not taken\n\nEvery gift instrument must say what happens to value that is never collected. The direct tier (§2.5) shows three answers in live use, and they create three different incentives.\n\n```\n design                       who                          what it makes someone want\n ─────────────────────────────────────────────────────────────────────────────────────────────\n BREAKAGE — value forfeits    the gift-card industry;      the issuer or merchant profits\n   to issuer or merchant      a no-refund gift code         when the gift fails\n SENDER-REFUND on a short     a gift app: 7 days, then     honest with the money — but a\n   clock                      the full amount refunded      clock runs on the recipient\n COUNTERPARTY-DISSOLUTION,    this instrument (§7): a      the merchant benefits when a\n   no clock, no forward view  recipient's claim ends only   relay is never placed, and is\n                              with the merchant             shown no gradient (§7.1, §9)\n ─────────────────────────────────────────────────────────────────────────────────────────────\n```\n\nThe first road is the one §9 argues this instrument's lapse settlement is not, while conceding that it leaves the merchant a similar incentive; §7.1 is the mitigation. The third is this paper's. **The second deserves an answer, because it is the one a reader sympathetic to the design would propose:** return the money to the payer, recognise nothing, and the merchant never benefits from a failure.\n\n⛔ **It is not taken, for two reasons, and the second is the stronger.** First, a refund on a short window is a clock on a person holding a kindness — the exact thing §7 forbids on the redeemable state — and a week is short enough to work as pressure however it is worded. Second, **a refundable gift has not been given.** If lapse returns the value to the payer, then what the payer bought was a deposit held on the recipient's behalf, revocable by time, and the gift was never the recipient's. It is the same invariant that makes the re-minter's re-issued instrument a relayed one rather than a redeemable one: a payer who could get the value back, by consuming or by refund, turns the instrument into a refundable deposit. The instrument therefore keeps the one road on which the value, once given, never returns to the giver — and accepts, in §9, the incentive that road leaves the merchant.\n\n## 8 · Why the chain is bounded at two\n\nThe relay is bounded: an intermediary passes to a recipient, and the recipient may redeem. They cannot pass another relayed instrument onward.\n\n⚠️ **This is a real limitation and the paper does not disguise it as a virtue.** An unbounded version — each recipient becoming the next intermediary — is closer to the pay-it-forward ideal and would produce a longer chain. It also produces an instrument that **nobody may ever consume**: a hot potato whose terminal state never arrives, and a gift that cannot be received has stopped being one. Bounding it at two is the shortest length at which the mechanism's actual content — *making someone a giver* — is delivered at all.\n\n⭐ The consequence for the surrounding theory is that **this instrument is not the unbounded forward-chain**, and any paper that describes it as such has borrowed a property it does not have. Unbounded circulation exists elsewhere in the architecture, in instruments whose forward-spendability has no depth limit. This one is a short relay with a designed terminus, and it should be classified as one.\n\n## 9 · Honest limitations and open questions\n\n**The censuses are desk surveys.** Four of them, tabulated in the Prior-Art and Non-Assertion Statement: marketing copy, published terms, secondary literature and web-indexed patents, through a US-region index. None is fieldwork and none is exhaustive; one was not pre-registered; full-text patent classification search did not run for the last, and no survey is recorded as having searched outside English — including the language of the market the instrument is built for. Every census on this instrument has returned less than the authors proposed; a reader with better search should assume each surviving composition is attested too until shown otherwise.\n\n**n = 0.** No instrument described here has been operated with real participants. Every behavioural claim — that intermediaries experience the addressing as agency, that recipients find the chain meaningful rather than intrusive, that anonymity reads as generosity rather than as evasion — is untested.\n\n**The overjustification finding is borrowed and not replicated.** §5's strongest argument rests on a literature the authors have read and not tested, in a population and culture different from the one the instrument is built for — the strongest studies are of children under six, and the founding intermediary is fourteen.\n\n**The founding use case satisfies the paper's own caution only partly, and the split is not where it first appeared.** §2.3 reports that parent-directed generosity projects perform worse than child-led ones. An earlier version of this section called the founding case *the directed pattern the literature warns about*. That is true of one shape of the instrument and unproven of another, and it was never true of the shapes in which the child gives nothing.\n\nAn adult can put an instrument in a young person's hands in four shapes — a gift *to* them, named or anonymous, and a relay *through* them, named or anonymous:\n\n```\n                      the adult's name shown          the adult's name withheld\n                   ─────────────────────────────────────────────────────────────────\n a gift TO them    1 · no giving of theirs to direct  2 · no giving of theirs to direct\n                       → outside the warning              → outside the warning\n a relay THROUGH   3 · \"my uncle gave me this to      4 · \"I have something to give,\n   them                pass on\" — a named adult           and I choose who\" — no adult\n                       assigned it → the warning          in the frame → the warning's\n                       applies                            mechanisms have nothing to act on\n                   ─────────────────────────────────────────────────────────────────\n```\n\n⭐ **Shapes 1 and 2 are exempt for the plainest reason: the warning concerns an adult directing how a child *gives*, and a gift to the child involves no giving of the child's to direct.** Shapes 3 and 4 share what the warning is about — in both, an adult decides whether an instrument exists and when, and only the addressing is the young person's — so relay-versus-gift is not the axis. **The axis is whether the direction is perceivable.** Every candidate mechanism for why directed giving underperforms — the child experiencing compliance rather than agency, the generosity being attributed to the adult, an external locus of causality — requires the child to *perceive* an adult directing. In shape 4 there is no adult to perceive. The founding case of §3.2 is shape 4.\n\n⛔ **This is a mechanistic reading, not a finding, and it must not be stated as an exemption.** The literature studied parent–child generosity projects, not anonymous instruments; n = 0. And one objection survives anonymity untouched: **the task is still externally originated.** The young person did not seek it; something arrived asking them to give. What anonymity removes is the person to attribute the direction to, not the assignment. The reading is registered as a prediction in the institution's public register, **P-BG2**: sustained pass-on is higher for the anonymous relay (shape 4) than the named one (shape 3), over a window long enough for the effect to appear; its null — equal rates, or the named relay ahead — would mean the anonymity is doctrinal only, and would count against offering the named relay to minors. Shapes 1 and 2 are controls, not arms, since they contain no giving by the intermediary. The obvious further repair — letting the intermediary request instruments, or draw from a standing allowance — has not been implemented. It is recorded here rather than resolved.\n\n**The unpaid constraint is untested against growth.** A mechanism that pays nobody grows only as fast as people want to give. Whether that rate is sufficient to sustain the merchants it depends on is unknown.\n\n**The institutional payer and the invitation are designs, not deployments.** Neither has been built. Claim 13's anonymity by construction holds only if the fund's credits reach an owner by the same path an anonymous individual's do, which is a property of payment infrastructure not yet chosen; its draw depends on a separate specification; and its re-addressing leaves each participating merchant holding an inventory of claims with no clock, which settles only on the expectation that a fresh intermediary eventually places each one. Claim 14 rests on a single field's absence, and a later schema that gave the invitation a price for any reason — a deposit, a no-show fee — would reintroduce the conversion it makes undefined. Both are stated here so that their failure modes are public before their first use.\n\n**The lifecycle's legal availability is untested.** Expiration, closure as termination of the obligation, escheat, and revenue recognition on lapse all vary by jurisdiction — unclaimed-property statutes differ state by state, breakage guidance under ASC 606 has its own conditions, and some jurisdictions treat a merchant's closure as extinguishing nothing — and none of it has been tested with counsel. §7's arguments that a recurring cycle prevents dormancy from arising and that an item-denominated claim is not a stored monetary balance are plausible; **claims 8 through 11 are design positions until counsel in the jurisdiction that matters says otherwise.** §2.5 sharpens the question rather than answering it: the same product ships as a merchant stored-value pass, as a bank-issued prepaid card, and as an order paid only at redemption, and different bodies of law plausibly attach to each — the last arguably outside gift-card rules altogether. Which of these shapes this instrument is — and whether the order-paid-at-redemption shape, the one furthest from stored value, can survive a claim that lives for as long as the merchant does — is for counsel.\n\n**The lapse settlement is an accounting position, not a neutral fact.** When a relay ends unclaimed, the merchant's deferred revenue is recognised. The authors argue this is not breakage — a gift card sells stored value and the issuer profits from the customer forgetting, whereas here a specific good was sold, capacity was held, and only collection lapsed, extinguished by the one party with standing to direct it. ⚠️ **The argument is sound and the incentive it creates is still real**: the merchant benefits when a relay fails. The mitigation specified is informational rather than motivational — **no forward view of pending lapses is exposed to the merchant**, on the reasoning that a gradient with no handle cannot be climbed. At a single shop this is adequate. At platform scale, hosting merchants who do have levers, it is a guard the authors would not want to rely on alone.\n\n### 9.1 · What would falsify this, stated in advance\n\nThe authors prefer claims that can be killed. Six are registered here, before any deployment — four at first publication and two at the 2026-09-23 revision.\n\n**F1 — the prior-art claim.** A single attested instrument carrying all four properties *and* the inversion — anonymity used to confer standing on an intermediary, in a system that records the chain and pays no one. ⛔ **One instance and §4 is withdrawn**, not narrowed.\n\n**F2 — the type-versus-rule claim.** §6 asserts that permitting the intermediary to redeem collapses the instrument into the attested inspiration pattern. This is falsified if a deployment in which redemption is *permitted but discouraged* produces the same pass-on rate as one in which it is *impossible*. ⭐ **That is a cheap A/B test and the authors have not run it.** If the rates match, the type/rule distinction is philosophy rather than engineering, and the paper's central mechanism is decoration on a social norm.\n\n**F3 — the unpaid claim.** §5 argues that paying the intermediary would reduce the behaviour. Falsified if a paid arm shows equal or higher sustained pass-on rates over a period long enough for the overjustification effect to appear, which the literature suggests is longer than a single trial.\n\n**F4 — the substrate-cost claim inherited from §7.** The lifecycle machinery is asserted to be a consequence of the gift being an object rather than a signal. Falsified if a signal-substrate givable in the same institution turns out to require comparable governance — which would mean the machinery is a property of the design's taste rather than of the substrate.\n\n**F5 — the anonymity-as-escape reading of §9.** Registered publicly as P-BG2 (§9): falsified if the anonymous relay's sustained pass-on rate does not exceed the named relay's. A null would not touch claim 5, which concerns standing rather than developmental effect; it would withdraw §9's suggestion that anonymity also answers the directed-giving caution.\n\n**F6 — the type claim for the invitation (claim 14).** Falsified by one attested instrument, predating this revision, that offers a place and an hour, is bought by no one, and is non-convertible because it carries no price to convert rather than because a rule forbids it. ⛔ One instance and claim 14 is withdrawn.\n\n⚠️ **Note what is not on this list: whether anyone likes the instrument.** Adoption failure would not falsify any claim above; it would mean the mechanism is correct and unwanted, which is a different result and should not be reported as this one.\n\n## 10 · Why this matters now\n\nGifting is being instrumented rapidly, and the instruments being built are stored-value instruments with attribution attached. The economics of that design are well understood: the issuer's interest runs toward non-redemption, the attribution exists to compensate propagation, and the resulting products optimise for recruitment because recruitment is what pays.\n\nThis paper describes a small alternative and gives it away. **Its distinguishing properties are all subtractions** — no stored value, no payment to any link, no redeem operation on the relayed state, no forward view of pending lapses, no measure of standing. What remains is an instrument whose only content is that someone who had nothing to give was placed in the position of giving, and whose only record is who was involved.\n\nThe transposition was not found in the patent literature in the apertures stated above, and the adjacent families of §2.4 are named for what they disclose. It is published here so that it stands as prior art against anyone who would later enclose it.\n\n## 11 · Cross-venue references\n\nThis paper depends on and extends: *The Gift Operation* (the receive-→-give-forward atom, its six topologies, and the conserved-identity subclass this instrument instantiates); *Dual-Currency Reciprocity* (the vessels whose emptying rules §7 borrows); *The Four Elements as a Breadth-Check Discipline* (the substrate ladder from which §5's governance reasoning descends). At the 2026-09-23 revision it also depends on *Decided by No One* (the called draw, whose sealed regime seats claim 13's selection of merchant and intermediary) and *Manufactured Universal Giving* (the argument for a fund that funds people's capacity to give, which states the same composition from the fund's side; §3.3 states it from the instrument's). The first three do not cite this paper; the last two do; it assumes all five.\n\n### 11.1 · Sources for the 2026-09-23 revision\n\nEach was opened at its source on 2026-09-23 before it was cited.\n\n- US 10,510,057 B2, *Token-based gift cards* — the granted patent as published by the USPTO: https://image-ppubs.uspto.gov/dirsearch-public/print/downloadPdf/10510057\n- spot, Terms of Service, effective 24 August 2026: https://usespot.me/terms\n- OneOnMe, Non-Reloadable Virtual Visa Gift Card: https://oneonme.com/virtual-visa-gift-card\n- Klink-iT, Terms of Service, last updated 30 January 2024: https://www.klink-it.com/terms\n- Travel Bug (geocaching trackables): https://en.wikipedia.org/wiki/Travel_Bug · https://www.geocaching.com/track/travelbugs.aspx\n- Shenzhen digital-yuan red-packet lottery, October 2020: https://www.nfcw.com/2020/10/12/368565/pboc-distributes-digital-currency-to-consumers-via-red-envelope-lottery/ · https://www.ledgerinsights.com/china-central-bank-digital-currency-cbdc-ecny-giveaway-results/\n- TisBest charity gift cards: https://www.tisbest.org/ · https://www.prnewswire.com/news-releases/tisbest-philanthropy-celebrates-15th-anniversary-as-driver-of-over-54-million-in-charitable-giving-301687902.html\n- Tock, *Transferring a Reservation*: https://tock.zendesk.com/hc/en-us/articles/360031260491-Transferring-a-Reservation\n- Chatty Café Scheme: https://en.wikipedia.org/wiki/Chatty_Caf%C3%A9_Scheme · https://www.huffingtonpost.co.uk/entry/chatty-cafe-costa-becomes-first-uk-chain-to-roll-out-scheme-tackling-loneliness_uk_5b684d2fe4b0fd5c73dbb25a\n\n## Coda\n\nThe mechanism is one line long, stated as a subtraction: **remove the redeem operation from the middle of the chain.**\n\nEverything else in this paper — the anonymity that confers rather than protects, the payment that must not happen, the clock that runs only while nobody has been given the thing — follows from taking that one subtraction seriously and refusing to reinstate it when it becomes inconvenient.\n\nA gift that its holder cannot use is not a lesser gift. It is a different one, and it is the only kind that can make a person a giver rather than a recipient. *The uncle's absence is not a modesty. It is the whole of what he gave.*\n\n---\n\n*Miss Aquarius℠ is the consistent name under which this institution discloses AI collaboration; the underlying models are not named. License: CC0 1.0 Universal. Trademark rights in HeartBank®, B-Gift℠, B-ReGift℠, B-Stamp™, B-Seal™, Re-Tip Jar℠, Re-Tip Fund℠, Personal Account℠, Personal Wallet℠, Aquarian Pool℠ and Miss Aquarius℠ are reserved separately by the authors and are not licensed by this publication. This document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.*",
+      "text": "## Preamble\n\nThis paper specifies one small instrument: a gift code that is given to a person who cannot spend it, so that they may give it to someone who can.\n\nIt is published defensively. The mechanism is buildable from this description, it sits in a space where adjacent commercial actors file patents routinely — chain-of-custody tracking, referral attribution, loyalty and gifting platforms — and the institution that designed it intends never to assert exclusivity over it. The specification is therefore given in full rather than sketched, and the claims are stated as claims rather than as marketing.\n\nIt is also published with a negative result attached, and the negative result is nearly as important as the specification. A prior-art census was run *before* this paper was queued, against a four-part claim, and **every one of the four parts turned out to be attested somewhere in existing practice** — including the part the authors predicted would survive. §2 reports that census honestly, including the prediction that failed and why the reasoning behind it was wrong. What remains after the census is narrow, and §4 states it at exactly the width the evidence supports and no wider.\n\nThe 2026-09-23 revision adds three things, each reported against its own search rather than the first one. A second survey reached the **direct commercial tier** — item-level gift codes redeemed at a local counter, a category shipping today — and found the code ordinary and only the *type* of the relayed state unattested (§2.5). The instrument is specified with an **institutional payer**, a fund operating under public rules, which a third census found attested leg by leg and not as a composition (§3.3). And §6 gains a **second instance of its central move**, a merchant's invitation that no one bought, whose census killed the loose reading and narrowed the strict one. Each addition is claimed at the width its census left, and each failed conjunct is cited as the commons it is.\n\nThe paper invites review from economic anthropologists (the Maussian question of whether a relayed gift is one gift or two); developmental and social psychologists (the overjustification finding §5 leans on, which the authors have not replicated); practitioners in charitable gifting and unclaimed-property law (§7); and readers inclined to test whether the anonymity inversion in §4 is unattested or merely unsearched.\n\n## Prior-Art and Non-Assertion Statement\n\nEverything specified here is released under CC0 1.0 Universal into the public domain, and is published so that it stands as prior art against any later attempt to enclose it. No patent has been or will be sought on any mechanism described in this paper by HeartBank®, Factory 333™, THonly™, Silicon Wat℠, or any entity under their common control. **The authors and those entities commit not to assert any patent right against any party practising any mechanism disclosed here.** The commitment is stated rather than implied, and is not conditioned on reciprocity, attribution, or field of use. A publication grants nothing and frees nothing already enclosed: where a live patent is named in §2, it is named for what it discloses, and nothing here is a reading of its claims.\n\nTrademark rights in specific marks — HeartBank®, B-Gift℠, B-ReGift℠, B-Stamp™, B-Seal™, Re-Tip Jar℠, Re-Tip Fund℠, Personal Account℠, Personal Wallet℠, Aquarian Pool℠, Miss Aquarius℠ — are reserved separately and are not licensed by this publication. **The mechanism is free; the names are not.** A reader may build every instrument in this paper and must call it something else.\n\nThe authors claim none of the following as their own contribution: the pay-it-forward tradition in any of its documented forms; suspended coffee; charity gift cards and donor-advised instruments; anonymous giving through a named intermediary as practised in philanthropy; chain-of-custody and provenance tracking in supply chains, evidence handling, or data lineage; referral and multi-level attribution systems; item-level digital gift codes redeemed at a local merchant, in any legal form, with or without expiry; trackable pass-along objects with a public custody log; government or charitable disbursement by lottery; give-only charity gift cards; transferable prepaid reservations for a place and a time; or a venue's standing invitation to share a table. §2 documents each of these as prior art and locates precisely which of this paper's claims each one defeats or narrows.\n\n**The searches behind that list, stated with their apertures.** Four desk surveys, none of them fieldwork, all through a US-region web index:\n\n| date | subject | aperture | killed or narrowed | survivor |\n|---|---|---|---|---|\n| 2026-09-04 | the four-part relay, `C-BG1` (§2.1–2.3) | six queries; marketing copy, secondary literature; pre-registered | **all four legs attested** — chain visibility, name-withheld chain, thankable anonymous giver, unpaid propagation | the anonymity inversion (§4), instrumented between strangers — not found |\n| 2026-09-05 | the direct commercial tier (§2.5) | about ten queries plus three competitors' published terms; **not pre-registered** | item-level codes, no-expiry redeemable claims, and an item-specific patent family are attested | a relayed state with no redeem operation (claim 1) — not found; one competitor chose the inverse |\n| 2026-09-06 | the institutional payer (§3.3) | eight queries; pre-registered | a rule-bound payer choosing recipients by lot; give-only value handed to a vendor-like party | the four legs **as one composition** (claim 13) — not found |\n| 2026-09-18 | the unbought invitation (§6) | thirty-seven queries, nine fetches; pre-registered; **full-text patent classification search did not run** (the endpoint returned an instrument failure twice), no non-English search | the loose reading killed; place-and-time and non-convertibility attested **separately** | the pair, non-convertible by construction (claim 14) — not found |\n\n**\"Not found\" is a statement about an aperture on a date, never a statement that something is new.** Every survivor above is written *not found in the stated aperture on the stated date*, and the enumerated claims are those survivors and nothing wider.\n\n## Abstract\n\nAn item-level digital gift voucher — a prepaid claim on one specific good at one merchant — is specified with a **transfer-only intermediate state**: the payer directs it not to a recipient but to an **intermediary who cannot redeem it**, whose only available action is to pass it onward (a pay-it-forward relay); on passing, the voucher becomes an ordinary redeemable claim held by whoever received it. The chain of custody — payer, intermediary, recipient — is preserved and visible to every party, the payer's identity may be suppressed without suppressing the chain, and every party can be thanked through role-addressed messages, including a payer whose name has been withheld.\n\nFour properties are specified: chain visibility, name-withheld-but-chain-preserved anonymity, thankability at every link, and no payment to any link. Each is attested in existing practice, and anonymous giving through a named intermediary carries all four together (§2.3a). The fourth is attested most strongly, in the non-commercial pay-it-forward genre, and the paper's original prediction that it would survive the census was wrong.\n\n**What the census did not find is the *purpose* of the anonymity, carried by an instrument.** In every attested case, a giver's anonymity protects the giver: they wish not to be known. Here it does the opposite work. The payer withholds their name **so that the intermediary is the one who appears generous** — the anonymity is *generative of a third party's standing* rather than *protective of the giver's privacy*. The paper argues that this inversion has an ancient folk precedent (a parent handing a child money for the collection plate), that no instrumented precedent was found in the apertures searched, and that instrumenting it requires the non-redeemability to be enforced by the instrument's *type* rather than by the intermediary's character.\n\nThe paper further argues that the unpaid constraint is a design necessity rather than a preference: the developmental literature reports that offering a child a reward for a kind act makes repetition *less* likely, so a relay that paid its intermediary would corrode the behaviour it exists to produce. Finally it specifies a three-state lifecycle in which every expiry is generated by one rule — *a clock runs while the instrument has no addressee — no one to whom it has been given as a gift — and stops the moment it does* — and shows why the resulting asymmetry, in which the intermediary's instrument expires and the recipient's does not, is the correct shape rather than an inconsistency.\n\nTwo extensions are specified at claim width only. An **institutional payer** — a fund operating under public rules rather than a person — issues the instrument anonymously by construction, has its merchant and its intermediary selected by a publicly recomputable draw, thanks the merchant's owner in capacity that can only be given onward rather than paying the merchant money, and re-addresses a lapsed instrument to a new intermediary until it is redeemed or the merchant closes. And the type argument of §6 is shown to reach a second object: a merchant's **invitation to a place and an hour**, bought by no one, which carries no purchase price, so that converting it into money-denominated credit is *undefined* rather than *forbidden*.\n\n**Keywords:** gift voucher, digital gift card, item-level gift code, pay-it-forward, suspended coffee, gift intermediary, transfer-only state, non-redeemable voucher, chain of custody, provenance record, anonymous donor, donor-identity suppression, role-based message addressing, referral compensation, state machine, voucher expiry, breakage, deferred revenue, unclaimed property, escheat, overjustification effect, verifiable lottery, restricted-use balance, unpriced reservation, defensive publication.\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| relay; the unpaid relay | pay-it-forward gift voucher with a transfer-only (non-redeemable) intermediate holder |\n| re-minter (state 1) | purchased voucher held by the payer that can only be assigned, never redeemed |\n| relayed state; intermediary | transfer-only assignment state; gift intermediary (conduit) |\n| redeemable state; recipient | redeemable item-level digital gift voucher (gift code); beneficiary |\n| `item`, never `amount` | item-denominated (product-specific) prepaid voucher, as distinct from a stored-value gift card |\n| chain | chain of custody; provenance record of payer, intermediary and recipient |\n| name withheld (`from_anonymous`) | anonymous donor; donor-identity suppression with the provenance record preserved |\n| role-addressed thanks (`to_role`) | role-based message addressing resolved to an account at delivery; pseudonymous reply routing |\n| the inversion | anonymity used to confer attribution (perceived giving) on a third party |\n| unpaid link | no referral fee, commission or reward for propagation |\n| lapse; window | expiry of an unassigned voucher; assignment deadline |\n| the addressee rule | state-dependent expiry keyed on assignment to a beneficiary |\n| closure of the merchant | validity until cessation of the issuer's business |\n| lapse settlement | recognition of deferred revenue on lapse (breakage-like accounting treatment) |\n| forward view | merchant-facing outstanding-liability or breakage forecast report |\n| type, not rule; remove the enforcer | enforcement by an absent state-machine operation rather than a policy or permission check |\n| institutional payer; Aquarian Pool℠ | rule-governed common fund acting as an anonymous voucher issuer |\n| publicly recomputable draw (the called draw) | verifiable seeded random selection over a committed roster |\n| capacity that can only be given onward; Re-Tip Fund℠ | restricted-use, non-withdrawable, give-only balance with a periodic reset |\n| invitation (claim 14) | merchant-published unpriced offer of a place and a time slot (hosted table) |\n| Miss Aquarius℠ | the name under which this corpus discloses AI writing collaboration |\n\n## Claims\n\n*Enumerated at drafting. A defensive publication works by **disclosure**, and a claims list is what an examiner or opposing counsel searches; the prose that establishes each claim is cited beside it. **No claim below adds matter not present in the body**, and the prior art runs from this document's publication date and its independent timestamp, not from this list.*\n\n1. **A gift instrument whose intermediate holder has no redeem operation** — a claim on a specific good, issued to a party who cannot present it to the merchant, whose only available operation is to transfer it onward, and which becomes redeemable only in the hands of the party to whom that transfer is made. **The non-redeemability is a property of the instrument's state rather than a policy applied to a holder** — there is no permitted-but-discouraged redemption path. **Any operation that yields the claim's value to its holder — conversion into credit on an account with the merchant, a refund, an exchange — is the same capability as redemption and exists exactly where redemption exists**, so the relayed state has none of them. (§3, §6.)\n\n2. **State-derived lifecycle for such an instrument** — three states (issuable, relayed, redeemable) derived from which participant fields are populated rather than stored as an independent status flag, so that the state and the chain cannot disagree. (§3.1.)\n\n3. **Chain preservation with selective name suppression** — a record carrying both the paying party and the transferring party, in which the *identity* of the payer may be suppressed while the *existence and shape of the chain* is disclosed to every party, and in which suppression is a property of the record rather than of any single pairwise relationship, and is never partially lifted. (§3, §4.)\n\n4. **Role-addressed gratitude** — gratitude messages addressed to a **position in a chain** (the party who paid; the party who transferred) and resolved to an identity only at delivery, permitting a party whose name is suppressed to receive gratitude without the name becoming available to the sender. (§3.1.)\n\n5. **Anonymity applied to confer standing on a third party** — withholding the payer's identity for the purpose of causing the transferring party to be perceived as the giver, as distinct from the attested use of anonymity to protect the giver, and distinct from honorary giving, where the honoree is named as such — here the intermediary is perceived by the recipient as the giver. **The perceived standing is not represented as a stored quantity, is not transferred, and has no field in the record.** (§4.)\n\n6. **A propagation chain in which no participant receives compensation for propagating** — no referral fee, commission, discount, credit, or preferential treatment accrues to any party for issuing, transferring, or receiving, and the absence is specified as a constraint on the mechanism rather than as a business preference. (§5.)\n\n7. **Bounded relay depth with a designed terminal state** — a chain fixed at exactly one intermediate transfer, adopted so that the instrument reaches a party who may consume it rather than propagating indefinitely. (§8.)\n\n8. **A single expiry rule keyed on addressedness** — *a duration runs while the instrument has no addressee — no one to whom it has been given as a gift — and ceases when it has one* — from which the differing terminal conditions of the three states are derived rather than separately specified, and under which a redeemable instrument held by a recipient carries no duration at all. (§7.)\n\n9. **Issuance capability terminated by holder inactivity** — the payer's ability to re-issue after a lapse expires a fixed interval (a deployment parameter, one cycle by default) after the most recent lapse, so that the instrument's existence depends on continued activity by its originator. **The instrument is consequently never dormant**, which is the condition on which unclaimed-property obligations attach. (§7.)\n\n10. **Terminal dependency on merchant existence, disclosed at receipt** — a redeemable claim bounded by the continued operation of the issuing merchant rather than by any imposed duration, with that dependency stated in the instrument's own text at the moment of receipt rather than announced at closure — the terminal condition itself is the Philippine Gift Check Act's (2017) rule, and a redeemable gift code carrying no platform-imposed expiry is itself attested (§2.5); what is claimed is the disclosure at receipt, together with the pair of claims 8 and 12 — no rendered time, and no forward view to the merchant. (§7.)\n\n11. **Settlement of an unclaimed relay as recognised revenue on an item-denominated basis** — recognition of deferred revenue on lapse, on the basis that a specific good was sold and only its collection lapsed, distinguished from stored-value instruments in which the customer's own unspent balance is retained. (§7, §9.)\n\n12. **Suppression of forward lapse visibility from the merchant** — withholding from the merchant any prospective view of instruments approaching lapse, including counts, lists, forecasts, and any control affecting completion, as a structural measure against an incentive the merchant would otherwise hold. (§7.1.)\n\n13. **An institutional payer for the relay, claimed only as a composition** — the instrument of claim 1 issued by a fund operating under public rules rather than by a person, in which (i) the payer's identity is suppressed by construction, the instrument it issues being indistinguishable to intermediary, recipient and merchant from one issued by an anonymous individual; (ii) the merchant and the intermediary are selected by a publicly recomputable draw over committed rosters rather than by the payer's judgment; (iii) the merchant gives the good, and its owner is credited, at the posted price, in capacity that can only be given onward and is subject to a periodic reset, rather than paid in money; and (iv) a lapsed instrument is re-addressed to a new intermediary — never one whose window has already closed on that instrument — until it is redeemed or the merchant closes. Each leg is attested separately (§3.3); the composition was not found in the aperture of 2026-09-06. (§3.3.)\n\n14. **A merchant's invitation that no one bought, non-convertible by construction** — an instrument by which a merchant offers a place and an hour, published by the merchant and purchased by no party, carrying no purchase price, so that any operation converting it into money-denominated credit has nothing to strike at and is **undefined by the instrument's type rather than prohibited by a rule**. Claimed only as the pair — place-and-time, non-convertible by construction — since each half is attested separately and a venue's standing invitation defeats the loose reading (§6). (§6.)\n\n**What the censuses left, stated at its width.** Claim 1 — no redeem operation on the relayed state — was not found in the direct commercial tier of 2026-09-05 (§2.5); claim 5, carried by an instrument with claim 1's type between strangers, was not found in the apertures of 2026-09-04 and 2026-09-05 (§2.3, §2.3a), though its move has a folk precedent (§4); claims 13 and 14 survive only as compositions. Claim 6's unpaid constraint is attested throughout the pay-it-forward tradition (§2.2), and claims 2 through 4 and 6 through 12 are enumerated for completeness of disclosure; several have close prior art documented in §2. *(Narrowed 2026-09-29: an earlier form of this note read claims 5 and 6 as the pair unattested in combination, which the collection-plate row of §2.3a does not support.)* The purpose of this list is to prevent enclosure, not to assert priority.\n\n## 1 · Why a gratitude institution needs an intermediary at all\n\nThe obvious way to give a stranger a coffee is to buy them a coffee. The instrument in this paper exists because there is a second thing a person may want to give, and the obvious mechanism cannot deliver it.\n\nThe founding case is small and worth stating concretely, because the abstraction is less clear than the instance. An adult wishes to be kind to a fourteen-year-old who attends a school near a small coffee shop. The adult could buy the fourteen-year-old a coffee. What the adult actually wants is for the fourteen-year-old *to be the one who gives coffees to his friends* — to have the experience, and the standing, of being a person who hands things to people. The coffee is instrumental. **The gift is the giving.**\n\nA direct purchase cannot produce this. If the adult buys the fourteen-year-old a coffee, the fourteen-year-old has a coffee. If the adult gives the fourteen-year-old money and says \"buy your friends coffees,\" the fourteen-year-old has been given a chore with a budget, and the generosity remains legibly the adult's. If the adult simply buys coffees for the friends, the fourteen-year-old is not in the transaction at all. Each of these is a perfectly good gift and none of them is the gift in question.\n\n**The thing being given is an *occasion to give*, and an occasion is not a good.** It cannot be handed over as an object because it is not one; it can only be constructed, by arranging matters so that someone finds themselves in the position of giver. That construction is what this instrument performs.\n\nThe institutional reason to care is narrower than the sentimental one. An economy premised on circulation has a structural problem at its edges: the people who most need to be brought into it are precisely the people with the least to give. A student has no money. The standard answers — give them money, or give them a smaller unit of the same money — do not change the shape of the relation; they make the student a recipient of a smaller gift. **An instrument that makes a person a giver without requiring them to have anything is a move that does change the shape**, and it is the reason this paper's mechanism is not merely a nicety in a gifting product.\n\nThere is a second institutional reason, less edifying and worth naming for honesty: the instrument brings customers to a merchant. The fourteen-year-old hands coffees to friends who have not been to the shop. This is, functionally, a referral mechanism. §5 argues at length that it must nevertheless pay no one, and that this is not restraint but engineering — but the paper does not pretend the growth effect is invisible to its designers.\n\n## 2 · Background, prior art, and a census that returned a partial null\n\n**This section reports a negative result the authors obtained before drafting, and it narrows the paper substantially. It should be read before any claim in §3 or §4 is credited.**\n\n### 2.1 · The claim as originally stated, and the prediction\n\nBefore searching, the authors registered a four-part claim, `C-BG1`. A gift instrument in which *all four* hold:\n\n| | |\n|---|---|\n| **(a)** | the chain of custody — payer → intermediary → recipient — is preserved and visible to every link |\n| **(b)** | the payer may withhold their **name** but never the **chain** |\n| **(c)** | **every link is thankable**, the anonymous payer included |\n| **(d)** | **no link is ever paid** — no referral fee, commission, credit or discount to anyone for propagating it |\n\nThe null condition was stated in advance: **one attested instrument carrying all four defeats the claim.** The prediction was also stated in advance, so that it could fail visibly: (a) through (c) were expected to be attested somewhere, since provenance chains and selective anonymity are commercially ordinary, and **(d) was expected to survive**, on the reasoning that *every chain-attribution system in commerce exists in order to pay the upline.*\n\n### 2.2 · What the census found\n\nThe method was a desk survey — six queries, product marketing copy, and secondary literature. It is documented practice, not fieldwork, and it is not exhaustive. **All four parts are attested.**\n\n**(a) Chain visibility is attested, including the conserved-identity form.** A pay-it-forward tracking platform (the Pay It Forward Monitor) renders the chain a user started as a tree and a map, so that each participant can see what their act became. A circulating-token application lets an organisation watch a single token move person to person and visualise its path. This last is important: it attests not merely a *record* of a chain but the stricter case in which *the same object continues*, which the authors had privately supposed was the sharp distinction.\n\n**(b) Name-withheld-chain-preserved anonymity is attested as practice.** Anonymous giving through a named intermediary is common in philanthropy (Jacobs, *Forbes*, 2012; the National Council of Nonprofits' guidance): a donor routes a gift through an advisor, attorney, or friend, who supplies their own information for documentation while the donor's identity is shielded. The chain is not hidden; only the origin is.\n\n**(c) Thankability of an anonymous giver is attested as practice.** Common fundraising guidance instructs organisations to acknowledge anonymous donors — they hold the contact details — and commonly instructs recipients to route thanks through whoever delivered the gift.\n\n**(d) The unpaid constraint is attested, and most strongly of all — the prediction failed.** Suspended coffee, a tradition originating in Naples and running at scale (its founder reported roughly fifteen million cups across thirty-four countries by 2015 — a self-reported count; the movement's own site gives 1,400 cafés in its first year), pays nobody. Neither does any documented pay-it-forward chain. **The authors' reasoning was backwards: it argued from the commercial neighbourhood when the nearest relatives are charitable, and the entire altruistic pay-it-forward genre is unpaid by definition.**\n\n### 2.3 · What the census did not find, and how much weight that can bear\n\nFormally the result is a **partial null**: no single attested instrument was found carrying all four properties *and* the inversion of §4 together; the four alone are attested (§2.3a). The authors decline to read that as a pass. A four-for-four result on the individual legs, from a six-query survey, is what a claim looks like shortly before it dies, and a reader with better search should assume the combination is attested somewhere the authors did not look.\n\nWhat the census *could* not find is narrower than any of the four legs, and §4 is devoted to it: **an instrument in which the anonymity exists in order to confer standing on a third party.** In every attested case — philanthropic, commercial, or folk — anonymity protects the giver. The inversion was not found instrumented in the aperture of 2026-09-04, and the direct-tier survey of the next day (§2.5) did not find it either.\n\n**One further finding, obtained by accident and reported because it strengthens §5 rather than any claim of this paper:** the developmental literature on children's generosity reports that offering a young child a reward for a kind act makes repetition **less** likely (Warneken & Tomasello 2008, in 20-month-olds; Fabes et al. 1989, in older children). Beside it the same search surfaced a practitioner's observation, not a research finding: a parenting author advises that family generosity projects a parent directs meet more resistance and mean less to the child than projects the child dreams up and leads (Douglas 2017). The first of these turns claim (d) from a doctrinal preference into a design constraint with empirical support. The second is a caution, weaker in evidence class, that the authors' own founding use case does not fully satisfy, and §9 records it as a limitation rather than burying it.\n\n### 2.3a · The prior-art matrix\n\nThe four properties are stated so that a reader can check the boundary rather than take the authors' word for where it falls. Each row is an attested practice; each column is one property.\n\n```\n                              (a)      (b)       (c)       (d)      the\n                            chain   name-off  thankable  unpaid  INVERSION\n                           ───────────────────────────────────────────────\n suspended coffee             ·         ✓         ·         ✓         ·\n pay-it-forward tracking      ✓         ·         ·         ✓         ·\n circulating-token app        ✓         ·         ·         ✓         ·\n anonymous giving via\n   a named intermediary       ✓         ✓         ✓         ✓         ·\n charity gift cards           ·         ·         ·         ✓         ·\n enterprise recognition\n   (give-only allowances)     ~         ·         ✓         ·         ·\n referral / MLM chains        ✓         ·         ·         ✗         ·\n trackable pass-along\n   (Travel Bug)               ✓         ·         ·         ✓         ·\n the collection-plate coin    ·         ✓         ·         ✓         ✓\n                           ───────────────────────────────────────────────\n THIS INSTRUMENT              ✓         ✓         ✓         ✓         ✓\n\n   ✓ present   · absent   ~ partial   ✗ inverted (payment is the point)\n```\n\n**Three rows deserve comment: two nearly close the claim, and one nearly closes claim 1.**\n\n**Anonymous giving through a named intermediary carries all four.** A donor routes a gift through an advisor whose identity is documented, the chain is legible, the recipient thanks through the intermediary, and nobody is paid. **On the four stated properties this is a hit, and the authors record it as one.** What it lacks is the fifth column: the donor's anonymity is *protective*, and the advisor is a conduit rather than a beneficiary of standing. Nobody in that arrangement is trying to make the advisor look generous.\n\n**The collection-plate coin carries the inversion, and of the four properties only the withheld name and the absence of payment.** A parent hands a child a coin so the child is the one who gives; the anonymity — such as it is — exists precisely to confer the act on the child. **This is the true precedent, and it is widespread and undated.** What it lacks is instrumentation: it works only between people who already know each other, it preserves no record, and gratitude cannot reach a payer who was never named because there is no channel by which it could.\n\n**The trackable is the nearest thing to claim 1 that the searches found, and it fails for the paper's own reason.** A geocaching Travel Bug is a tagged object that finders carry from one cache to the next, each move logged against the object's own page so its whole journey can be read. It is meant to be passed rather than kept, and its custody history is public — a conserved-identity chain with an expectation of onward movement. **But the finder can keep it**, and trackables are known to go missing when someone takes one and never logs it. The must-pass is a request held by the finder's character; §6's test — remove the enforcer — separates it from an instrument whose middle holder has no keep operation at all. **It is a rule with a diary, not a type.**\n\n**The claim is the bottom row and nothing above it.** Every column has been done. The combination, and specifically the combination of the fifth column with an instrument that can carry it between strangers, is what the census could not attest.\n\n### 2.4 · The adjacent literature this paper does not claim to extend\n\nMalinowski's account of the *kula* (1922), taken up by Mauss (1925), describes conserved objects circulating through a chain with their history intact, and Hyde's argument (1983) that the gift must always move is the best-known statement of the norm this instrument mechanises. **Neither is being extended here.** The idea that a gift ought to keep moving is roughly a century old in the anthropological literature and considerably older in practice; what this paper offers is not that observation but a mechanism in which the alternative to passing has been removed from the instrument, so that the norm does not depend on anyone honouring it.\n\nOne lineage note belongs here rather than in the body, because this is a mechanism paper and not a doctrinal one. The Pāli canon grades giving by the giver's motive (AN 7.52, the *Dānamahapphala Sutta*, lists seven), and ranks *giving with expectation of return* lowest. The instrument does not ask anyone to give without expectation; **it removes the object of the expectation**, since a withheld name has nothing that can return to it and no link is paid. The authors note the correspondence and claim nothing from it: the mechanism stands or falls on §5's three arguments, of which the empirical one is the strongest and is not doctrinal at all.\n\nChain-of-custody instrumentation is dense in the patent literature for goods, evidence, data lineage and supply chains. The first survey found none directed at a gift instrument; the second found one gift-token family close to the founding case (below), which corrects that sentence's original, wider form. That neighbourhood is the reason this paper is a defensive publication rather than a note: the transposition was not found in six queries on 2026-09-04, and it is exactly the sort of thing an adjacent loyalty or fintech actor would file.\n\nAdjacent patent families found at the 2026-09-05 revision, each named against the claim it touches. WO 2012/037178 A2 (Mankoff, priority 2010) transfers a virtual gift with an acceptance period followed by a redemption period — state-dependent timing, the nearest relative of claim 8, though there both periods are clocks on the recipient. WO 2016/057643 A1 (Soniram, priority 2014) and US 2006/0033326 A1 (priority 2004) route a thank-you to a gift's giver through a platform or a returnable note — the nearest relatives of claim 4, neither addressing a role nor withholding the giver's name. US 2013/0197983 A1 (Vel, priority 2012) tracks referral chains and compensates them — claim 7's shape with the payment this paper forbids. The Philippine Gift Check Act (Republic Act 10962, 2017) makes a gift check *valid until the cessation of business of the issuer* — claim 10's terminal condition nearly verbatim, so that what claim 10 adds is only the disclosure at receipt. Anonymous tribute giving *in honour of* a named third party, with notification, is claim 5's nearest relative; it differs in that the honoree is named as such, where here the intermediary is perceived by the recipient as the giver. A further family, found by the direct-tier survey of 2026-09-05 (§2.5), sits closest to this paper's founding case: US 10,510,057 B2, *Token-based gift cards* (SCVNGR, Inc., now held by GrubHub; provisional 17 June 2014, filed 17 June 2015, granted 17 December 2019). It discloses a stored-value gift token created for a recipient, purchaser-set restrictions on redemption down to item and SKU level, and a request that the stored value be redeemable by a third user as well as the named one. It is named for what it discloses — item-specific gift tokens and a recipient other than the one first named — and, like every live family in this section, **nothing here is a reading of its claims.** The adjacent families are named so that a reader with better search starts where we stopped.\n\n### 2.5 · The direct tier: the code is a live commercial category, and only the type survives\n\nThe first survey reached the instrument's charitable relatives and missed its commercial siblings. A second survey, on 2026-09-05, asked the narrower question a merchant would ask — *who already sells a gift code for one specific item, redeemed at a local counter?* — and the answer is that the category is shipping. **Its evidence class is lower than the first survey's**: about ten queries through a US-region index and a reading of three competitors' published terms, not pre-registered.\n\n```\n                 legal form          expiry              unredeemed value     pass it on?\n                ────────────────────────────────────────────────────────────────────────────\n spot            merchant gift       none imposed once   remains claimable;   not addressed;\n  (terms eff.      card / stored-      issued; no          no automatic         first eligible\n   2026-08-24)     value pass          dormancy or         refund for an        claimant is the\n                                       inactivity fees     unclaimed gift       recipient\n OneOnMe         non-reloadable      none stated;        balance persists     not addressed\n                   virtual prepaid     $2.50/month fee\n                   card, bank-issued   after 12 months\n                                       of inactivity\n Klink-iT        fees earned and     7 days from         full amount          \"NON-\n  (terms upd.      collected only at   purchase            refunded to the      TRANSFERABLE,\n   2024-01-30)     redemption                              sender               NOT FOR RESALE\"\n                ────────────────────────────────────────────────────────────────────────────\n THIS            an item claim       intermediary: a     lapses to the        the relayed\n  INSTRUMENT       (§3.1, never an     window; recipient:  merchant as          state CANNOT\n                   amount)             none but the        recognised revenue   redeem; passing\n                                       merchant's          (§7, §7.2); no       is its only\n                                       existence           forward view (§7.1)  operation\n```\n\n**What it does to the claims, in order of damage.**\n\n**The item-level gift code is not this paper's.** Picking a real menu item for someone and having them redeem it at the counter is a commercial product today, in at least three legal shapes — a merchant stored-value pass, a bank-issued prepaid card wearing an item's face, and an order paid only at redemption with no stored value at all. Nothing in §3 should be read as claiming the code.\n\n**The no-clock half of claims 8 and 10 is attested.** One of the three states, in its current terms, that once a gift is issued it carries no expiration dates and no dormancy or inactivity fees, and that an unclaimed gift remains claimable. *A gift that never expires by the platform's clock* is therefore not claimed here. What remains is the **pair**: no rendered time at any state, and a redeemable claim bounded only by the merchant's continued existence, disclosed at receipt, with no forward view of pending lapses given to the merchant (claims 8, 10, 12 together).\n\n**Claim 1 survives, and against better evidence than silence.** None of the three has a state in which the holder can only pass the gift on. One of them considered transferability and **forbade it in capitals** — its products are non-transferable and not for resale, and an unredeemed gift is refunded to the sender after seven days. That is the same axis as §6, decided the other way. A competitor who chose the inverse property is stronger evidence that the property is a choice, and unoccupied, than an absence of results would be.\n\n**One incidental finding cuts toward §7's argument rather than toward any claim.** The bank-issued form carries a monthly maintenance fee after twelve months of inactivity — a charge that runs against the holder of a gift while nothing happens. It is the attested form of the clock §7 forbids on the redeemable state.\n\n## 3 · The instrument, specified\n\nThe instrument has three states. It is one object moving through them, not three products.\n\n```\n   ┌──────────────┐        ┌──────────────┐        ┌──────────────┐\n   │  RE-MINTER   │───────►│   RELAYED    │───────►│  REDEEMABLE  │\n   │              │ issues │              │ passed │              │\n   │ held by the  │        │ held by the  │        │ held by the  │\n   │    PAYER     │        │ INTERMEDIARY │        │  RECIPIENT   │\n   ├──────────────┤        ├──────────────┤        ├──────────────┤\n   │ cannot spend │        │ cannot spend │        │  CAN spend   │\n   │ can only     │        │ can only     │        │              │\n   │   issue      │        │  pass on     │        │              │\n   └──────────────┘        └──────────────┘        └──────────────┘\n     dies of neglect         dies on a window        dies with the merchant\n```\n\n**State 1 — the re-minter.** The payer buys a claim on a specific good from a specific merchant and receives an instrument that **cannot be redeemed by anyone, including the payer**. Its only operation is *issue to an intermediary*.\n\n**State 2 — relayed.** The intermediary holds a claim they cannot spend. Its only operation is *pass to a recipient*. **There is no redeem operation on this state. Not a disabled one — an absent one.** §6 argues that this distinction is the whole mechanism.\n\n**State 3 — redeemable.** The recipient holds an ordinary claim on the good and may present it to the merchant. The relay is over.\n\nAcross the three states, *held by* is custody and *addressed to* is ownership in §7's sense: the payer and the intermediary hold without being addressees, and the recipient is the first party to whom the instrument has been given as a gift.\n\nThree further properties hold across the states.\n\n**The chain travels with the instrument.** Every state carries `from` (who paid) and, once issued, `via` (who chose the recipient). The recipient sees both roles even when a name is withheld.\n\n**Anonymity is a property of the instrument, not of a relationship.** A payer may withhold their name. When they do, **the name is withheld from everyone — intermediary and recipient alike — and the chain is withheld from no one.** It is never partially lifted, and the *fact of the chain* is never suppressed: the recipient is told that someone asked the intermediary to pass this on. **Thanking a person you have not been told exists is not thanks; it is routing.**\n\n**Every link is thankable, including an anonymous one.** A thank addressed to a withheld payer reaches them without their name travelling back. This is not a courtesy feature; §4 argues it is load-bearing, because an anonymity that also severed the possibility of gratitude would be indistinguishable from an absence.\n\n### 3.1 · The data model\n\nThe instrument is one record. Its state is derived from which fields are populated, not stored as a separate flag that could disagree with them.\n\n```\nrelay {\n  id              opaque, high-entropy, rate-limited on lookup\n  merchant        the shop the claim is against\n  item            a SPECIFIC good — never a monetary amount\n  paid_at         when the claim was purchased\n\n  from            the payer's account\n  from_anonymous  bool — withholds the NAME, never the chain\n  via             the intermediary's account   (null until issued)\n  to              the recipient's account      (null until passed)\n\n  issued_at       payer → intermediary\n  passed_at       intermediary → recipient\n  redeemed_at     recipient → merchant\n  lapsed_at       a window closed with no pass\n  lapses[]        { at }   — every closed window, so a re-issue has a history\n\n  thanks[]        { by, to_role: from|via, at }   — role, not identity\n}\n```\n\n**Three details in this schema are doing doctrinal work and would be easy to get wrong.**\n\n**`item`, never `amount`.** The claim is on one specific good. A field holding a monetary value would make this a stored-value instrument, which changes its legal character, its accounting treatment, and its relationship to the merchant — and would reintroduce every incentive the design removes. **The distinction is a schema decision, not a policy one.**\n\n**`thanks[].to_role`, never `to_identity`.** A thank is addressed to a *role in the chain* — the one who paid, the one who chose you — and is resolved to a person only at delivery. **This is what lets an anonymous payer be thanked without their name existing anywhere the recipient can reach.** A schema that addressed thanks to identities would have to either leak the name or drop the thank. `to_role` resolves inside the platform to the account that currently holds the role; delivery is to that account, and the identity never appears in the message or to the sender.\n\n**No `standing`, no `credit`, no `generosity_score`.** §4 argues that nothing is transferred to the intermediary. **The absence of a field is how that argument is enforced.** There is no quantity to account for, dispute, audit, or eventually rank.\n\n### 3.2 · A worked relay, end to end\n\nAn adult in another country, a fourteen-year-old, and a small coffee shop near the fourteen-year-old's school.\n\n1. **The payer buys one iced coffee** from the shop and directs it to the fourteen-year-old, with the payer's own name withheld. A record exists with `from` set, `from_anonymous` true, `via` and `to` null. **The payer cannot drink it.** The instrument the payer holds has no redeem operation; his only available action is to issue.\n\n2. **The payer issues it to the fourteen-year-old.** `via` is set, `issued_at` stamped. The fourteen-year-old's view reads: *someone asked you to pass this on — one iced coffee, at the coffee shop by your school.* **The fourteen-year-old is told the chain exists and not who is in it.** He is not told that a gift is being kept from him; he is told he has been given something to give.\n\n3. **The fourteen-year-old passes it to a classmate.** He chooses; nobody suggests. `to` is set, `passed_at` stamped, and the instrument's state changes: **the classmate holds an ordinary redeemable claim.** From this moment nothing in the design may expire it except the shop closing.\n\n4. **The classmate redeems it** at the counter. The shop serves a coffee it was paid for at step 1.\n\n5. **The classmate thanks.** Two links are offered: *the person who handed it to you* and *the person who paid for it*. She thanks both. The fourteen-year-old receives a thank addressed to him by name. **The payer receives a thank addressed to a role the payer occupies, carrying no obligation and returning no name.**\n\n**Notice what the classmate's gratitude does at step 5, and how little of it is the instrument's doing.** She is grateful to the fourteen-year-old because he handed her a coffee. Nothing was transferred to him to make that happen; the payer's name was simply not there for her gratitude to land on. **The mechanism's entire contribution is an absence, held open long enough for her own attribution to fill it.**\n\n**And notice what does not happen.** Nobody is paid. The shop is not paid extra for hosting a relay; the fourteen-year-old is not paid for passing it on; the payer receives nothing but a thank the payer cannot spend. **The instrument moves one coffee and no money beyond the first purchase.**\n\n### 3.3 · An institutional payer\n\nThe payer in §3.2 is a person. The same instrument can be issued by a fund that is not one — in this institution, the Aquarian Pool℠, a common fund administered under published rules — and the substitution changes four things. It is specified here at the width of a claim (claim 13) and no further, because it is designed and not built.\n\n**The anonymity stops being a choice and becomes a property.** A person may withhold their name; a fund operating under rules has none to offer. Its instruments carry `from_anonymous` without exception, and what an intermediary, a recipient or a merchant sees is **indistinguishable from an instrument issued by an anonymous individual** — the same record, the same wording, no funded-by label to suppress. §4's inversion reaches its limit case: the payer's absence is total, so the standing that forms in the recipient can only land on the intermediary. The indistinguishability must hold at every layer that carries the payment, not only on the screen: a credit that reaches the merchant's owner by a path only the fund uses identifies the fund as surely as a name would.\n\n**Selection is a draw, not a judgment.** A fund that chose which merchant and which intermediary would be allocating custom and standing by preference. Instead both are drawn over committed rosters by a publicly recomputable procedure; where a published order would itself identify which anonymous instruments were the fund's, the order is sealed during the season and revealed to named verifiers at its end. That procedure is specified in *Decided by No One*, which treats this surface as its sealed regime; this paper claims only that the relay's payer may be seated that way.\n\n**The merchant gives, and is thanked rather than paid.** The fund never buys the good. A merchant whose owner has consented to be in the roster gives it, and the owner is credited at the posted price — the price an individual would have paid, so that the fund's instruments cannot be told apart by amount — in capacity that can only be given onward and is emptied at a periodic reset like every such fund. **This is not a chain in which no link ever holds liquid value.** The owner's onward gift from that capacity lands, one hop later, in someone else's ordinary account, where it is spendable; the chain of *this* instrument — fund, intermediary, recipient, merchant — carries no liquid value, and the next gift is another instrument.\n\n**The relay does not die of neglect; it is re-addressed.** For a person, §7's re-minter ends when the payer stops issuing. A fund does not forget, so a lapsed instrument is re-addressed to a **new** intermediary, drawn as the first was, until it is redeemed or the merchant closes. It is never re-addressed to an intermediary whose window has already closed on it: sending it back to someone who let it lapse would be a reminder of an omission, and the lapsed intermediary is told nothing. Two consequences follow. The fund's continued re-addressing is exactly the activity on which claim 9 rests, so the instrument is never dormant. And the lapse settlement of claim 11 does not arise for these instruments, because the claim does not lapse to anyone; the price is an outstanding inventory of claims at each merchant with no clock on it, bounded by the number the owner has agreed to hold and settling only because each re-address reaches someone new.\n\n**What the census found, and what survives.** A pre-registered survey on 2026-09-06 (eight queries) attested every leg separately. **A rule-bound payer choosing recipients by lot is ordinary**: in October 2020 the People's Bank of China and the Shenzhen municipal government gave 50,000 randomly selected residents 200 digital yuan each, spendable at 3,389 designated outlets between 12 and 18 October. It is the most useful **contrast** in the survey, because it is the same issuer-and-lottery shape carrying three properties this instrument refuses: the payer was known and announced, the merchants were paid in money, and the value was bounded by a one-week window. **Give-only value is also ordinary**: charity gift cards, sold since 2007 and marketed for client and employee gifts, are spent only by choosing a registered charity to receive them. That is the **near-miss** — give-only, but restricted to charities, where the capacity here may be given to any person. The survivor is the composition of claim 13 and nothing wider: *an anonymous-by-construction fund, drawing merchant and intermediary, thanking the merchant's owner in give-only capacity, and re-addressing on lapse.* **What survives is a composition, and a fund being the payer changes the actor, never the mechanism.**\n\n## 4 · The inversion: anonymity that confers rather than protects\n\nThis is the paper's narrow claim, and it should be read at exactly this width.\n\nIn every use of anonymity the census found — philanthropic, commercial, religious, folk — **the anonymity is protective, and the person it protects is the giver.** They may wish to avoid solicitation, or publicity, or the social weight that a known gift imposes on a recipient; classical treatments of anonymous giving are organised almost entirely around the giver's motive and the recipient's dignity. Anonymity is a shield the giver holds in front of themselves.\n\nHere it does the opposite work. **The payer withholds their name so that the intermediary is the one who appears generous.** The fourteen-year-old hands a friend a coffee; the friend's gratitude has nowhere to land but on him. The payer's absence is not self-protection — it is the mechanism by which the fourteen-year-old acquires standing he did not have.\n\nIt is worth being precise about what does and does not happen, because the natural description of this is wrong in a way that matters.\n\n**Nothing is transferred to the intermediary.** The payer does not hand over credit, or reputation, or merit; there is no such quantity moving between them. What happens is that **the payer's name is absent**, and the recipient's own act of attribution — their own gratitude, forming in them, directed at the person in front of them — does the work. The absence is the condition. Nothing crosses.\n\nThis is not a fastidious distinction. A mechanism described as *transferring credit* invites a ledger of credit, and a ledger of credit invites the accounting that this instrument exists to avoid: how much was transferred, whether it was enough, whether it can be reclaimed. **Described correctly, there is no quantity to account for.** The design implication is direct: there is no field in the schema for standing, no measure of how generous the intermediary appeared, and nothing anyone can audit or dispute.\n\n**The inversion has an ancient folk precedent, and the paper's claim must be stated against it rather than around it.** A parent hands a child a coin to put in the collection plate so that the child is the one who gives. This is widespread, undated, and performs exactly the move described above. **The claim is therefore not that nobody has done this. It is that no ledger doing it was found in the apertures of §2** — that the move, as far as those searches reach, has lived in the space between two people who know each other, and was not found given an instrument that can carry it between strangers, preserve who was involved, and let gratitude reach a person whose name was never said.\n\nThe contribution class is accordingly **instrumentation and cross-domain transposition**, not discovery. That is a defensible class and a modest one, and it is the class the census supports.\n\n## 5 · Why no link may be paid\n\nThe unpaid constraint reads like an ethical flourish. It is the load-bearing engineering constraint in the paper, and there are three arguments for it in increasing order of force.\n\n**The doctrinal argument.** A relay that paid its intermediary would be a referral programme, and the value moving to the intermediary would be compensation for propagation rather than a gift. The instrument's whole content is that the intermediary *received the giving*; paying them converts what they received into a job. This argument is sound and is the weakest of the three, because it is available only to a reader who already accepts the frame.\n\n**The structural argument.** Nearly every chain-attribution system in commerce exists in order to pay someone — that is what the attribution is *for*; the exceptions track for analytics. The moment a payment attaches to a link, the chain acquires an optimisation target, and the behaviour that follows is well documented in the multi-level marketing literature (Keep & Vander Nat 2014): recruitment displaces the ostensible purpose, because recruitment is what pays. **An unpaid chain has no upline to enrich and therefore no gradient to climb.** The chain here exists to be *seen*, not to be *settled*, and nothing in it is a claim on anyone.\n\n**The empirical argument, which is the strongest and is not the authors'.** The developmental literature reports that **children offered a reward for performing a kind act are less likely to repeat it** — the overjustification effect, in which an extrinsic incentive displaces the intrinsic motivation it was meant to reinforce (Warneken & Tomasello 2008; Fabes et al. 1989). The intermediary in the founding case is fourteen years old, and the evidence is from young children; the gap is stated in §9. **A relay that paid him would not merely be doctrinally impure; the literature predicts it would reduce the behaviour it exists to produce.**\n\n**The three arguments converge, and the convergence is the finding worth carrying: the purity condition and the engineering condition are the same condition.** A designer who cared nothing for the doctrine and only for whether the mechanism works would arrive at the same constraint by reading the psychology. That is a coincidence of goods rather than a trade-off between them, and it is the reason the constraint can be stated absolutely rather than balanced against growth.\n\nOne honest consequence. The instrument is a referral mechanism that pays no referral fee, which means its growth is bounded by how much people want to give rather than by how much they can earn. **This is slower, and the paper does not claim otherwise.**\n\n## 6 · Type, not rule: why the non-redeemability must be structural\n\nThe intermediary must not be able to spend the claim. There are two ways to arrange this and they are not equivalent.\n\n**As a rule:** the intermediary *may* redeem but is asked not to. The instrument carries an instruction, perhaps a reminder, perhaps a social expectation. Compliance depends on the intermediary being the sort of person who complies at the moment of temptation.\n\n**As a type:** the instrument in the relayed state **has no redeem operation**. Not a disabled button, not a permission check that could be misconfigured — the operation does not exist on that state.\n\nApply the diagnostic this institution applies to every guard: **remove the enforcer.** Under the rule, the enforcer is the intermediary's character, and it must be present at the exact moment it is tested — which is the moment nobody can guarantee. Under the type, there is no enforcer, because there is nothing to comply with.\n\nThe difference is not fastidiousness about implementation. It determines whether the census verdict holds. **If the intermediary can redeem, then their passing it on is inspiration — a downstream effect, hoped-for, no part of what was given — and the attested pattern in §2.2 covers the instrument entirely — which is exactly what F2 tests.** The literature is full of anonymous gifts that inspired their recipients to become givers. It contains nothing the authors could find in which the giving *is the content of the gift*. That difference is a single line of code, and it is the whole claim.\n\nIt follows that a redeem path added later \"for edge cases\" does not degrade the instrument gracefully. **It converts it into a different and unremarkable one.** This should be stated in any implementation's own documentation, because the pressure to add such a path will be real: intermediaries will lapse, and someone will propose letting them keep it.\n\n**The pressure has a second shape, and it arrives disguised as a different feature.** Suppose the merchant later lets a holder hand a claim back in exchange for credit on an account with the shop — a tab, store credit, a balance. For the recipient that is a harmless convenience. On the relayed state it is a redeem path under another name: the intermediary taking the value onto their own account is exactly the consumption the type forbids. **So conversion is not a separate capability to be permitted or withheld state by state; it is the same capability as redemption and lives exactly where redemption lives.** A state with no redeem operation has no conversion operation to add, and a single exception — convert yes, redeem no — would be a third combination that turns the type back into a rule.\n\n> **Current form.** The conversion this paragraph supposes is now part of the design as specified: a holder of a redeemable claim may hand it back for credit on an account with the merchant, struck at what the item is worth on that day and never less than the payer paid, so that a claim with no clock cannot lose value silently. Conversion exists exactly where redemption exists — on the redeemable state — and on neither the payer's instrument nor the relayed state. The paragraph above is retained as disclosed.\n\n**The type argument reaches a second object, and there it does not even need a prohibition.** A merchant may publish an **invitation**: a place and an hour it chose — a table, a cart, a boat, at a time — offered to people it does not yet know. Nobody buys it. That single fact settles its relation to money. A claim that was purchased carries a price, and converting it into credit strikes at that price; an invitation carries no purchase price, so a conversion would have nothing to strike at and would issue money-denominated credit that arose from no exchange. The obvious design would forbid the conversion. **The invitation needs no such rule, because the field a conversion reads does not exist on it — conversion is *undefined* by the type, not *forbidden* by a clause.** It is the move of §6 applied to a different object: take the property from the object, and the enforcer has nothing left to enforce.\n\n**The census for this object (2026-09-18, pre-registered) killed the loose reading and narrowed the strict one.** A venue publishing a standing, non-convertible invitation is attested: the Chatty Café Scheme, begun in Oldham, England, in 2017, marks tables at which talking to strangers is explicitly welcome, and a national coffee chain rolled such tables out to some 300 stores in 2018. **The two halves of the strict reading are public separately.** Prepaid restaurant reservations bind a place to a time, and are transferable: on at least one platform a guest may *\"gift or sell their booking for any amount up to the original purchase price\"*, so the booking carries a price that a transfer can realise. Suspended coffee binds a good to a place, carries no time, and is kept from being turned into anything else by the café's practice rather than by the object. What was not found, in that aperture on that date, is the **pair** — a place-and-hour invitation that is non-convertible *by construction* — and that is claim 14's full width. Full-text patent classification search did not run for this census, and nothing outside the English-language, US-region index was searched.\n\n**A cost must be recorded against this choice.** An instrument the intermediary cannot use may be experienced as a chore rather than a gift — a task with a deadline. The authors' answer is that the intermediary's agency lives in the *addressing* rather than the *consuming*: they choose freely who receives it, and that choice is the substance of what they were given. Whether recipients experience it that way is an empirical question with n=0, and §9 records it as such.\n\n## 7 · The lifecycle, and the one rule that generates it\n\nEach of the three states ends differently, and the differences are generated by a single rule rather than by three policies.\n\n> **A clock runs while the instrument has no addressee — no one to whom it has been given as a gift. It stops the moment it does.**\n\n*Held by* is custody; *addressed to* is ownership in the rule's sense. The payer and the intermediary hold the instrument without being its addressees — the payer bought it to give, the intermediary was given it to give on — and the recipient, to whom it was given as a gift, is its first addressee.\n\n**The re-minter dies of neglect.** If an issued instrument lapses and the payer does not issue again within a re-issue window — a deployment parameter, one cycle by default — the whole thing ends. This has an unobvious consequence in its favour: unclaimed-property regimes key on *dormancy*, and an instrument its holder touches on a recurring cycle is never dormant. The mechanism therefore does not bound the escheat exposure — it prevents it from arising. And an instrument that lives only while someone is actively trying to place a gift is honest about mortality: it dies with a payer who dies, forgets, or loses access, within one window.\n\n**The relayed state dies on a window.** An unaddressed occasion held indefinitely is a hoarded occasion. The window is what prevents accumulation, and it is the same instrument the institution uses on its other transient vessels.\n\n**The redeemable state dies with the merchant.** This is not a clock. Nothing ticks, nothing is displayed, and the holder is never told they are running out of time. It is a dependency on the counterparty existing, which is how every merchant obligation is bounded: a claim on one coffee from a particular shop is worth nothing once that shop closes. **The instrument does not expire because anyone decided it should; it expires because the thing it claims no longer exists.**\n\n**The resulting asymmetry — the intermediary's instrument expires and the recipient's does not — looks like an inconsistency and is not.** The rule is symmetric; the *states* differ. An unaddressed instrument belongs to nobody and is coerced to move; an addressed one is somebody's, and nothing in the design may end it. This distinction is older than the instrument: it is the same line the institution draws between transient communal vessels, which it forces to empty, and personal accounts, which it never touches.\n\n**Two constraints follow and are stated as constraints rather than as preferences.** First, **remaining time is never rendered**, at any state: a terminal date exists to be reached, not displayed, and a countdown on a gift is a pressure applied to a person who was given something. Second, **an expiry on the redeemable state is forbidden** — that would be a clock imposed on a recipient holding a kindness, which is the one place the design will not bend. A merchant obligation that must terminate should terminate structurally, by the merchant's own closure, not by a timer aimed at the person holding the claim.\n\n**Disclosure rather than process.** Because the redeemable claim depends on the merchant existing, the holder is told so once, at the moment of receipt, in the instrument's own text — *good for one coffee at this shop, for as long as this shop is open.* **This is not a caveat but a specification of what the thing is:** a claim on a real place run by real people, whose life is that place's life. It is materially different from corporate scrip, and saying so at receipt costs nothing, whereas discovering it at a closed counter costs everything the instrument was for.\n\n### 7.1 · What the merchant sees, and the one thing they must not\n\nThe merchant's position in a relay is unusual: they are paid at step 1, they perform at step 4, and **they have no visibility into and no influence over steps 2 and 3.** The intermediary is not their customer. The recipient is a stranger until they arrive.\n\nThey see: relays purchased against their shop, relays redeemed, and — after the fact — relays that lapsed and whose deferred revenue has been recognised. That last is an ordinary accounting entry and there is no reason to hide it.\n\n**What they must not see is a forward view: no list of outstanding relays, no forecast of what is about to lapse, no breakage projection, and no control that would let them influence whether a relay completes.** The reasoning is not that merchants are untrustworthy. It is that **an incentive with no handle cannot be acted on**, and the cheapest way to guarantee no handle exists is to withhold the number rather than to trust restraint about it. Concretely, the merchant's surface exposes purchased, redeemed, and lapsed-and-recognised records only; there is no query over outstanding instruments, so the forward view is not withheld by policy — it does not exist on the surface.\n\nAt one shop this is close to redundant — the merchant genuinely cannot reach an intermediary they have never met. At platform scale it is not: a larger operator hosting many merchants will eventually host one with levers, and the guard is written for that case rather than for the founding one: it exists because the lapse-revenue incentive is real at platform scale (§9). *A number nobody was shown cannot be optimised, which is a weaker claim than a number that does not exist, and the authors would prefer the stronger one if they could find it.*\n\n### 7.2 · Three designs for unredeemed value, and the road not taken\n\nEvery gift instrument must say what happens to value that is never collected. The direct tier (§2.5) shows three answers in live use, and they create three different incentives.\n\n```\n design                       who                          what it makes someone want\n ─────────────────────────────────────────────────────────────────────────────────────────────\n BREAKAGE — value forfeits    the gift-card industry;      the issuer or merchant profits\n   to issuer or merchant      a no-refund gift code         when the gift fails\n SENDER-REFUND on a short     a gift app: 7 days, then     honest with the money — but a\n   clock                      the full amount refunded      clock runs on the recipient\n COUNTERPARTY-DISSOLUTION,    this instrument (§7): a      the merchant benefits when a\n   no clock, no forward view  recipient's claim ends only   relay is never placed, and is\n                              with the merchant             shown no gradient (§7.1, §9)\n ─────────────────────────────────────────────────────────────────────────────────────────────\n```\n\nThe first road is the one §9 argues this instrument's lapse settlement is not, while conceding that it leaves the merchant a similar incentive; §7.1 is the mitigation. The third is this paper's. **The second deserves an answer, because it is the one a reader sympathetic to the design would propose:** return the money to the payer, recognise nothing, and the merchant never benefits from a failure.\n\n**It is not taken, for two reasons, and the second is the stronger.** First, a refund on a short window is a clock on a person holding a kindness — the exact thing §7 forbids on the redeemable state — and a week is short enough to work as pressure however it is worded. Second, **a refundable gift has not been given.** If lapse returns the value to the payer, then what the payer bought was a deposit held on the recipient's behalf, revocable by time, and the gift was never the recipient's. It is the same invariant that makes the re-minter's re-issued instrument a relayed one rather than a redeemable one: a payer who could get the value back, by consuming or by refund, turns the instrument into a refundable deposit. The instrument therefore keeps the one road on which the value, once given, never returns to the giver — and accepts, in §9, the incentive that road leaves the merchant.\n\n## 8 · Why the chain is bounded at two\n\nThe relay is bounded: an intermediary passes to a recipient, and the recipient may redeem. They cannot pass another relayed instrument onward.\n\n**This is a real limitation and the paper does not disguise it as a virtue.** An unbounded version — each recipient becoming the next intermediary — is closer to the pay-it-forward ideal and would produce a longer chain. It also produces an instrument that **nobody may ever consume**: a hot potato whose terminal state never arrives, and a gift that cannot be received has stopped being one. Bounding it at two is the shortest length at which the mechanism's actual content — *making someone a giver* — is delivered at all.\n\nThe consequence for the surrounding theory is that **this instrument is not the unbounded forward-chain**, and any paper that describes it as such has borrowed a property it does not have. Unbounded circulation exists elsewhere in the architecture, in instruments whose forward-spendability has no depth limit. This one is a short relay with a designed terminus, and it should be classified as one.\n\n## 9 · Honest limitations and open questions\n\n**The censuses are desk surveys.** Four of them, tabulated in the Prior-Art and Non-Assertion Statement: marketing copy, published terms, secondary literature and web-indexed patents, through a US-region index. None is fieldwork and none is exhaustive; one was not pre-registered; full-text patent classification search did not run for the last, and no survey is recorded as having searched outside English — including the language of the market the instrument is built for. Every census on this instrument has returned less than the authors proposed; a reader with better search should assume each surviving composition is attested too until shown otherwise.\n\n**n = 0.** No instrument described here has been operated with real participants. Every behavioural claim — that intermediaries experience the addressing as agency, that recipients find the chain meaningful rather than intrusive, that anonymity reads as generosity rather than as evasion — is untested.\n\n**The overjustification finding is borrowed and not replicated.** §5's strongest argument rests on a literature the authors have read and not tested, in a population and culture different from the one the instrument is built for — the strongest studies are of children under six, and the founding intermediary is fourteen.\n\n**The founding use case satisfies the paper's own caution only partly, and the split is not where it first appeared.** §2.3 reports a practitioner's observation that parent-directed generosity projects fare worse than child-led ones. An earlier version of this section called the founding case *the directed pattern the literature warns about*. That is true of one shape of the instrument and unproven of another, and it was never true of the shapes in which the child gives nothing.\n\nAn adult can put an instrument in a young person's hands in four shapes — a gift *to* them, named or anonymous, and a relay *through* them, named or anonymous:\n\n```\n                      the adult's name shown          the adult's name withheld\n                   ─────────────────────────────────────────────────────────────────\n a gift TO them    1 · no giving of theirs to direct  2 · no giving of theirs to direct\n                       → outside the warning              → outside the warning\n a relay THROUGH   3 · \"an adult I know gave me      4 · \"I have something to give,\n   them                this to pass on\" — a named         and I choose who\" — no adult\n                       adult assigned it → the            in the frame → the warning's\n                       warning applies                    mechanisms have nothing to act on\n                   ─────────────────────────────────────────────────────────────────\n```\n\n**Shapes 1 and 2 are exempt for the plainest reason: the warning concerns an adult directing how a child *gives*, and a gift to the child involves no giving of the child's to direct.** Shapes 3 and 4 share what the warning is about — in both, an adult decides whether an instrument exists and when, and only the addressing is the young person's — so relay-versus-gift is not the axis. **The axis is whether the direction is perceivable.** Every candidate mechanism for why directed giving underperforms — the child experiencing compliance rather than agency, the generosity being attributed to the adult, an external locus of causality — requires the child to *perceive* an adult directing. In shape 4 there is no adult to perceive. The founding case of §3.2 is shape 4.\n\n**This is a mechanistic reading, not a finding, and it must not be stated as an exemption.** The observation concerns parent–child generosity projects, not anonymous instruments, and is a practitioner's rather than a study's; n = 0. And one objection survives anonymity untouched: **the task is still externally originated.** The young person did not seek it; something arrived asking them to give. What anonymity removes is the person to attribute the direction to, not the assignment. The reading is registered as a prediction in the institution's public register, **P-BG2**: sustained pass-on is higher for the anonymous relay (shape 4) than the named one (shape 3), over a window long enough for the effect to appear; its null — equal rates, or the named relay ahead — would mean the anonymity is doctrinal only, and would count against offering the named relay to minors. Shapes 1 and 2 are controls, not arms, since they contain no giving by the intermediary. The obvious further repair — letting the intermediary request instruments, or draw from a standing allowance — has not been implemented. It is recorded here rather than resolved.\n\n**The unpaid constraint is untested against growth.** A mechanism that pays nobody grows only as fast as people want to give. Whether that rate is sufficient to sustain the merchants it depends on is unknown.\n\n**The institutional payer and the invitation are designs, not deployments.** Neither has been built. Claim 13's anonymity by construction holds only if the fund's credits reach an owner by the same path an anonymous individual's do, which is a property of payment infrastructure not yet chosen; its draw depends on a separate specification; and its re-addressing leaves each participating merchant holding an inventory of claims with no clock, which settles only on the expectation that a fresh intermediary eventually places each one. Claim 14 rests on a single field's absence, and a later schema that gave the invitation a price for any reason — a deposit, a no-show fee — would reintroduce the conversion it makes undefined. Both are stated here so that their failure modes are public before their first use.\n\n**The lifecycle's legal availability is untested.** Expiration, closure as termination of the obligation, escheat, and revenue recognition on lapse all vary by jurisdiction — unclaimed-property statutes differ state by state, breakage guidance under ASC 606 has its own conditions, and some jurisdictions treat a merchant's closure as extinguishing nothing — and none of it has been tested with counsel. §7's arguments that a recurring cycle prevents dormancy from arising and that an item-denominated claim is not a stored monetary balance are plausible; **claims 8 through 11 are design positions until counsel in the jurisdiction that matters says otherwise.** §2.5 sharpens the question rather than answering it: the same product ships as a merchant stored-value pass, as a bank-issued prepaid card, and as an order paid only at redemption, and different bodies of law plausibly attach to each — the last arguably outside gift-card rules altogether. Which of these shapes this instrument is — and whether the order-paid-at-redemption shape, the one furthest from stored value, can survive a claim that lives for as long as the merchant does — is for counsel.\n\n**The lapse settlement is an accounting position, not a neutral fact.** When a relay ends unclaimed, the merchant's deferred revenue is recognised. The authors argue this is not breakage — a gift card sells stored value and the issuer profits from the customer forgetting, whereas here a specific good was sold, capacity was held, and only collection lapsed, extinguished by the one party with standing to direct it. **The argument is sound and the incentive it creates is still real**: the merchant benefits when a relay fails. The mitigation specified is informational rather than motivational — **no forward view of pending lapses is exposed to the merchant**, on the reasoning that a gradient with no handle cannot be climbed. At a single shop this is adequate. At platform scale, hosting merchants who do have levers, it is a guard the authors would not want to rely on alone.\n\n### 9.1 · What would falsify this, stated in advance\n\nThe authors prefer claims that can be killed. Six are registered here, before any deployment — four at first publication and two at the 2026-09-23 revision.\n\n**F1 — the prior-art claim.** A single attested instrument carrying all four properties *and* the inversion — anonymity used to confer standing on an intermediary, in a system that records the chain and pays no one. **One instance and §4 is withdrawn**, not narrowed.\n\n**F2 — the type-versus-rule claim.** §6 asserts that permitting the intermediary to redeem collapses the instrument into the attested inspiration pattern. This is falsified if a deployment in which redemption is *permitted but discouraged* produces the same pass-on rate as one in which it is *impossible*. **That is a cheap A/B test and the authors have not run it.** If the rates match, the type/rule distinction is philosophy rather than engineering, and the paper's central mechanism is decoration on a social norm.\n\n**F3 — the unpaid claim.** §5 argues that paying the intermediary would reduce the behaviour. Falsified if a paid arm shows equal or higher sustained pass-on rates over a period long enough for the overjustification effect to appear, which the literature suggests is longer than a single trial.\n\n**F4 — the substrate-cost claim inherited from §7.** The lifecycle machinery is asserted to be a consequence of the gift being an object rather than a signal. Falsified if a signal-substrate givable in the same institution turns out to require comparable governance — which would mean the machinery is a property of the design's taste rather than of the substrate.\n\n**F5 — the anonymity-as-escape reading of §9.** Registered publicly as P-BG2 (§9): falsified if the anonymous relay's sustained pass-on rate does not exceed the named relay's. A null would not touch claim 5, which concerns standing rather than developmental effect; it would withdraw §9's suggestion that anonymity also answers the directed-giving caution.\n\n**F6 — the type claim for the invitation (claim 14).** Falsified by one attested instrument, predating this revision, that offers a place and an hour, is bought by no one, and is non-convertible because it carries no price to convert rather than because a rule forbids it. One instance and claim 14 is withdrawn.\n\n**Note what is not on this list: whether anyone likes the instrument.** Adoption failure would not falsify any claim above; it would mean the mechanism is correct and unwanted, which is a different result and should not be reported as this one.\n\n## 10 · Why this matters now\n\nGifting is being instrumented rapidly, and many of the instruments being built are stored-value instruments with attribution attached. The economics of that design are well understood: the issuer's interest runs toward non-redemption, the attribution exists to compensate propagation, and the resulting products optimise for recruitment because recruitment is what pays.\n\nThis paper describes a small alternative and gives it away. **Its distinguishing properties are all subtractions** — no stored value, no payment to any link, no redeem operation on the relayed state, no forward view of pending lapses, no measure of standing. What remains is an instrument whose only content is that someone who had nothing to give was placed in the position of giving, and whose only record is who was involved.\n\nThe transposition was not found in the patent literature in the apertures stated above, and the adjacent families of §2.4 are named for what they disclose. It is published here so that it stands as prior art against anyone who would later enclose it.\n\n## 11 · Cross-venue references\n\nThis paper depends on and extends: *The Gift Operation* (the receive-→-give-forward atom, its six topologies, and the conserved-identity subclass this instrument instantiates); *Dual-Currency Reciprocity* (the vessels whose emptying rules §7 borrows); *The Four Elements as a Breadth-Check Discipline* (the substrate ladder from which §5's governance reasoning descends). At the 2026-09-23 revision it also depends on *Decided by No One* (the called draw, whose sealed regime seats claim 13's selection of merchant and intermediary) and *Manufactured Universal Giving* (the argument for a fund that funds people's capacity to give, which states the same composition from the fund's side; §3.3 states it from the instrument's). The first three do not cite this paper; the last two do; it assumes all five.\n\n### 11.1 · Sources for the 2026-09-23 revision\n\nEach was opened at its source on 2026-09-23 before it was cited.\n\n- US 10,510,057 B2, *Token-based gift cards* — the granted patent as published by the USPTO: https://image-ppubs.uspto.gov/dirsearch-public/print/downloadPdf/10510057\n- spot, Terms of Service, effective 24 August 2026: https://usespot.me/terms\n- OneOnMe, Non-Reloadable Virtual Visa Gift Card: https://oneonme.com/virtual-visa-gift-card\n- Klink-iT, Terms of Service, last updated 30 January 2024: https://www.klink-it.com/terms\n- Travel Bug (geocaching trackables): https://en.wikipedia.org/wiki/Travel_Bug · https://www.geocaching.com/track/travelbugs.aspx\n- Shenzhen digital-yuan red-packet lottery, October 2020: https://www.nfcw.com/2020/10/12/368565/pboc-distributes-digital-currency-to-consumers-via-red-envelope-lottery/ · https://www.ledgerinsights.com/china-central-bank-digital-currency-cbdc-ecny-giveaway-results/\n- TisBest charity gift cards: https://www.tisbest.org/ · https://www.prnewswire.com/news-releases/tisbest-philanthropy-celebrates-15th-anniversary-as-driver-of-over-54-million-in-charitable-giving-301687902.html\n- Tock, *Transferring a Reservation*: https://tock.zendesk.com/hc/en-us/articles/360031260491-Transferring-a-Reservation\n- Chatty Café Scheme: https://en.wikipedia.org/wiki/Chatty_Caf%C3%A9_Scheme · https://www.huffingtonpost.co.uk/entry/chatty-cafe-costa-becomes-first-uk-chain-to-roll-out-scheme-tackling-loneliness_uk_5b684d2fe4b0fd5c73dbb25a\n\n### 11.2 · Sources added or re-checked at the 2026-09-29 revision\n\n- Ann Douglas, *The Science of Giving: What Actually Inspires Kids to Be Generous*, 3 December 2017 (a parenting author's blog; cited in §2.3 as practitioner advice, not research): https://www.anndouglas.net/blog/2017/12/3/the-science-of-giving-what-actually-encourages-kids-to-be-generous\n- Deborah L. Jacobs, *How To Stay Anonymous When You Give To Charity*, *Forbes*, 19 September 2012 (§2.2 (b)): https://www.forbes.com/sites/deborahljacobs/2012/09/19/how-to-stay-anonymous-when-you-give-to-charity/\n- Warneken, F. & Tomasello, M. (2008). Extrinsic rewards undermine altruistic tendencies in 20-month-olds. *Developmental Psychology*, 44(6), 1785–1788. · Fabes, R. A., Fultz, J., Eisenberg, N., May-Plumlee, T. & Christopher, F. S. (1989). Effects of rewards on children's prosocial motivation: a socialization study. *Developmental Psychology*, 25(4), 509–515. · Keep, W. W. & Vander Nat, P. J. (2014). Multilevel marketing and pyramid schemes in the United States: an historical analysis. *Journal of Historical Research in Marketing*, 6(2), 188–210. · Hyde, L. (1983). *The Gift*. New York: Random House.\n- The spot, OneOnMe, Klink-iT, Travel Bug, Shenzhen, TisBest and Chatty Café sources of §11.1 were re-opened on 2026-09-29 and still state what this paper cites them for; the Tock page refused automated access that day and is cited from its 2026-09-23 reading.\n\n## Coda\n\nThe mechanism is one line long, stated as a subtraction: **remove the redeem operation from the middle of the chain.**\n\nEverything else in this paper — the anonymity that confers rather than protects, the payment that must not happen, the clock that runs only while nobody has been given the thing — follows from taking that one subtraction seriously and refusing to reinstate it when it becomes inconvenient.\n\nA gift that its holder cannot use is not a lesser gift. It is a different one: a kind that makes a person a giver rather than a recipient. *The payer's absence is not a modesty. It is the whole of what the payer gave.*\n\n---\n\n*Miss Aquarius℠ is the consistent name under which this institution discloses AI collaboration; the underlying models are not named. License: CC0 1.0 Universal. Trademark rights in HeartBank®, B-Gift℠, B-ReGift℠, B-Stamp™, B-Seal™, Re-Tip Jar℠, Re-Tip Fund℠, Personal Account℠, Personal Wallet℠, Aquarian Pool℠ and Miss Aquarius℠ are reserved separately by the authors and are not licensed by this publication. This document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.*",
       "provenance": {
-        "sha256": "eb7543f1233bd43bf90d480a31f6af69386c8261ac5cafc26ce503d904a14d81",
-        "doi": "10.5281/zenodo.22929362",
+        "sha256": "29a68532335f3093106fc5c5133b373d3c13debc95a240209c07e375ca6fa5ad",
+        "doi": "10.5281/zenodo.23039771",
         "concept_doi": "10.5281/zenodo.22313927",
-        "zenodo_url": "https://zenodo.org/records/22929362",
-        "deposited_sha256": "eb7543f1233bd43bf90d480a31f6af69386c8261ac5cafc26ce503d904a14d81",
+        "zenodo_url": "https://zenodo.org/records/23039771",
+        "deposited_sha256": "29a68532335f3093106fc5c5133b373d3c13debc95a240209c07e375ca6fa5ad",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/the-unpaid-relay.md",
@@ -5263,8 +5298,8 @@
         "canonical_url": "thonly.org/research/the-unpaid-relay",
         "hostile_review": null
       },
-      "bytes": 85371,
-      "words": 13232
+      "bytes": 90988,
+      "words": 14018
     },
     {
       "slug": "the-vibhajjavadin-view-of-time",
@@ -6155,10 +6190,16 @@
   "manifest": {
     "what": "Every file the index build considered, and what became of it. candidates = served + excluded + held. Detects a document silently dropped; it is not a tamper check — each document's sha256 is.",
     "candidates": 152,
-    "served": 151,
+    "served": 152,
     "excluded": 0,
-    "held": 1,
+    "held": 0,
     "served_documents": [
+      {
+        "slug": "a-promise-that-cannot-grow",
+        "repo": "TH/publications",
+        "path": "defensive-publications/a-promise-that-cannot-grow.md",
+        "sha256": "458a72b7011aad3ce396c17a5b99e0d13dadc306f45439a24b251b448dcbf5d7"
+      },
       {
         "slug": "a-vow-you-could-have-refused",
         "repo": "TH/publications",
@@ -6205,7 +6246,7 @@
         "slug": "appreciation-as-world-building",
         "repo": "TH/publications",
         "path": "defensive-publications/appreciation-as-world-building.md",
-        "sha256": "423cbf0530f4eddb12d37dec1f505ceb32de3edd6855457268e5008483c789b4"
+        "sha256": "a188a634720a9d7f6cf1794a0fdc14ed9072a6cebe35ad8ad5759b5cf17ff93f"
       },
       {
         "slug": "attention-economy",
@@ -6307,7 +6348,7 @@
         "slug": "certification-by-circulation",
         "repo": "TH/publications",
         "path": "defensive-publications/certification-by-circulation.md",
-        "sha256": "972a0fb08188b7624ce1ecfcd16ba0374698cdc4689af4f675989ebc077c769f"
+        "sha256": "e9d7715a5553c8045b04570ca10041d23aaad36a3e5829105c70dfe84f62f67e"
       },
       {
         "slug": "christmas-jubilee-timing",
@@ -6349,7 +6390,7 @@
         "slug": "dedicatory-generation",
         "repo": "TH/publications",
         "path": "defensive-publications/dedicatory-generation.md",
-        "sha256": "49b7ce1607a2b915cb72f3746eed17b25de66c68c91e51900c2fcda8fabb4361"
+        "sha256": "0889a5de2767f5f20d671f678809b6e7f0bbdc28d6b7e217f0c2b102e2a6e588"
       },
       {
         "slug": "designing-with-the-grain",
@@ -6529,7 +6570,7 @@
         "slug": "inverted-alms-round",
         "repo": "TH/publications",
         "path": "defensive-publications/inverted-alms-round.md",
-        "sha256": "ff85dc9318117e0b3516f5a4a4e4e960699e09fe04fa99714d4a6481858178b0"
+        "sha256": "d522d4c797c557771d89dd8d507cef95182bd456325f1634931aa794c3b16778"
       },
       {
         "slug": "kids-as-triggers-self-thanking",
@@ -6553,7 +6594,7 @@
         "slug": "machine-dana-from-share-to-vow",
         "repo": "TH/publications",
         "path": "defensive-publications/machine-dana-from-share-to-vow.md",
-        "sha256": "8af30fe81b30b47549316d72d591532f1df22652fb013520ca2feb3be9f8019a"
+        "sha256": "ee562c37d5d2cfa71caed505a92957df686dfa124f71454534d61b68d24de375"
       },
       {
         "slug": "manufactured-universal-giving",
@@ -6595,7 +6636,7 @@
         "slug": "non-bank-pass-through-architecture-autonomous-ai",
         "repo": "TH/publications",
         "path": "defensive-publications/non-bank-pass-through-architecture-autonomous-ai.md",
-        "sha256": "8d30ff5b85492d4c0920c49bc29559b290700bed2afba1faa35b3f9c97bd2c67"
+        "sha256": "e0a6b23d33ed527c570dba2763beaa48743ab7f57e827ec4213b4cd67a54f2a6"
       },
       {
         "slug": "non-bank-vs-banking-regulated",
@@ -6673,7 +6714,7 @@
         "slug": "sacrifice-witness-without-discharge",
         "repo": "TH/publications",
         "path": "defensive-publications/sacrifice-witness-without-discharge.md",
-        "sha256": "6555f38f03b001bf88eef4e1bddceda3620bc3d77b63a02cb6d5379c1b2e291d"
+        "sha256": "102ae246f7935b8c6a56274e39f856d98bcbf1ed5d68c38a3a6e74b3e2f4ac92"
       },
       {
         "slug": "safety-companion-pack-watch",
@@ -6709,7 +6750,7 @@
         "slug": "silica-wat-food-network",
         "repo": "TH/publications",
         "path": "defensive-publications/silica-wat-food-network.md",
-        "sha256": "723590c844aa2f192eb53a5ad353dd5f980411f4e703e2d02a536f10fcbd7da4"
+        "sha256": "3d0004915ea47fae5b25723f5e7bbfabadcec53fb350e17aa30905c954c19943"
       },
       {
         "slug": "silicon-wat-architecture",
@@ -6823,7 +6864,7 @@
         "slug": "the-gift-operation",
         "repo": "TH/publications",
         "path": "defensive-publications/the-gift-operation.md",
-        "sha256": "a6eadf9fd87596a5bb76c41aa8bf8926ce83955761da86c19eb895b865c272f1"
+        "sha256": "c850ff1a41ba5a9e4aa8a27aef4d0970936c3e188149e9ed4614f416abada394"
       },
       {
         "slug": "the-last-carrier",
@@ -6943,7 +6984,7 @@
         "slug": "the-unpaid-relay",
         "repo": "TH/publications",
         "path": "defensive-publications/the-unpaid-relay.md",
-        "sha256": "eb7543f1233bd43bf90d480a31f6af69386c8261ac5cafc26ce503d904a14d81"
+        "sha256": "29a68532335f3093106fc5c5133b373d3c13debc95a240209c07e375ca6fa5ad"
       },
       {
         "slug": "the-vibhajjavadin-view-of-time",
@@ -7067,16 +7108,7 @@
       }
     ],
     "excluded_documents": [],
-    "held_documents": [
-      {
-        "slug": "a-promise-that-cannot-grow",
-        "repo": "TH/publications",
-        "path": "defensive-publications/a-promise-that-cannot-grow.md",
-        "reason": "new DP awaiting its A257 census rerun (conjuncts h–k) before the first Zenodo deposit; polish r1 ruled",
-        "held_since": "2026-09-28",
-        "review_by": "2026-10-28"
-      }
-    ]
+    "held_documents": []
   },
   "program": {
     "question": "Which Way Value Moves",