@333eco/corpus 2.5.41 → 2.5.43

package/dist/corpus.json

@@ -1,5 +1,5 @@
 {
-  "package_version": "2.5.41",
+  "package_version": "2.5.43",
   "generated_from": [
     "H3/publications",
     "TH/publications",
@@ -3264,13 +3264,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "## What this is\n\nSeventy pre-registered predictions arising from the research program stated in [`which-way-value-moves`](which-way-value-moves.md). One further prediction is withheld from publication (operational channel economics); its existence is recorded here so the count is honest, bringing the true total to **seventy-one**.\n\nThis is a living document and the count rises. It opened at sixty-seven on 2026-08-27; see **Revisions** at the foot for what has been added since, and read the count in the Summary table rather than any sentence that repeats it elsewhere.\n\n**Status vocabulary.** *Unrun* — registered, no observation attempted. *Running* — instrument live, data accumulating, not yet read. *Resolved* — read against its falsifier. *Contradicted* — the data went against it. *Retired* — superseded by a ruling that made it moot; kept, never deleted.\n\n**Provenance.** *Published* — the prediction already appears in a corpus paper carrying that paper's OpenTimestamps and RFC 3161 proofs. *First public here* — the prediction existed only in internal records until this document; its first external timestamp is this file's.\n\n**Reading rule.** Predictions marked *running* must not be read early, and participants must not be prompted toward the predicted behavior. A prompt voids the test.\n\n---\n\n## Summary\n\n| | Count |\n|---|---|\n| Total registered | **123** |\n| Published here | 122 |\n| Withheld (operational) | 1 |\n| Already carried by a published paper | 58 |\n| Memory-only at first publication (2026-08-27) | 22 (21 published here + 1 withheld) |\n| Receiving first public timestamp here | 64 |\n| **Run** | **7** (two desk censuses · five formal checks: P-FA1, P-FA2a, P-FA2b, P-FA4, P-FA5) |\n| **Field tests run** | **0** — six pilot-scale predictions are *Running* with a baseline read; none has resolved |\n| Running (instrument live; unread, restricted or baseline only) | 9 |\n| Contradicted | 1 |\n| Retired | 3 |\n\n---\n\n## Core-level\n\n*If one of these fails, the program ends rather than adjusts.*\n\n| ID | Prediction | Falsifier | Status | Provenance |\n|---|---|---|---|---|\n| **P-GO1** | A system forbidding backward return produces more onward giving per unit received than an otherwise-identical permissive system | Equal or greater onward giving under the permissive condition → the constraint is aesthetic, not mechanical | Unrun | First public here |\n| **P-K1** | As external subsidy for a kind act approaches zero, the rate of the act does not approach zero | Kindness rate tracks subsidy proportionally → the behavior was priced throughout | Unrun | First public here |\n| **P-L2** | Witnessed presence generates more downstream giving than unwitnessed presence of equal duration | Equal downstream gratitude when unwitnessed → the chronicle is decorative and the institution's core claim is wrong | Unrun | Published (`co-presence-gated-redemption` §10) |\n| **P-R2** | Product-dependence begins to fall after the inflection | Dependence never falls → the raft is a boat | Unrun | First public here |\n| **P-B3** | The proportion of creators electing to dedicate their share does not decline over time | Dedication collapses once money is visible → the offering frame is eroding | Unrun | Published (`dedicatory-generation`) |\n\n---\n\n## Chapter I — Capacity\n*Does receiving create giving? If not, forward-only motion is depletion, not circulation.*\n\n| ID | Prediction | Status | Provenance |\n|---|---|---|---|\n| P-IA1 | The receiver is legible as benefactor, not need — the sitter supplies a merit-field rather than displaying a lack | Unrun | Published (`inverted-alms-round`) |\n| P-IA2 | Second inverted-alms prediction as registered in the paper | Unrun | Published (`inverted-alms-round`) |\n| P-IA3 | Third inverted-alms prediction as registered in the paper | Unrun | Published (`inverted-alms-round`) |\n| P-G1 | Once the app manufactures obligation, a return visit no longer distinguishes gratitude practice from guilt — publish either way | Unrun | Published (`sacrifice-witness-without-discharge`) |\n| P-G2 | Second B-Grace prediction as registered in the paper | Unrun | Published (`sacrifice-witness-without-discharge`) |\n| P-G3 | The meal-anchor outperforms gamification; gamifying at launch makes this untestable | Unrun | Published (`sacrifice-witness-without-discharge`) |\n| P-W1 | Users with higher thing-capture frequency show higher rates of the primed downstream behavior — registered pre-build | Unrun | Published (`appreciation-as-world-building`) |\n| P-E1 | First graduation-by-transmission prediction as registered | Unrun | Published (`the-game-that-graduates-you`) |\n| P-E2 | Second graduation-by-transmission prediction as registered | Unrun | Published (`the-game-that-graduates-you`) |\n| P-E3 | Third graduation-by-transmission prediction as registered | Unrun | Published (`the-game-that-graduates-you`) |\n| P-M2 | Matched-stakes prediction as registered | Unrun | Published (`the-wager-that-isnt`) |\n| P-M3 | Patron-pot prediction as registered | Unrun | Published (`the-wager-that-isnt`) |\n| — | **Kids-as-triggers** — children are the primary triggers of household self-thanking | **Contradicted** (parents self-thanked more; n=1, confounded, not hardened) | Published (`kids-as-triggers-self-thanking`) |\n| **P-BG1** | A shorter re-address window on a relayed gift **increases issuances and decreases COMPLETED placements**. *Null: completions hold or rise as the window shortens — the tighter clock is free.* ⚠️ Unanswerable unless `issued · passed · lapsed · re-issued` are logged from the first instrument | Unrun (unscorable as specified at n=1 — one ruled window, no variance; see P-BG1a) | First public here |\n| **P-BG2** | Sustained pass-on is **higher for an ANONYMOUS relayed gift than a VISIBLE one**, over a window long enough for the effect to appear. *Null: rates match or visible exceeds anonymous — the anonymity is doctrinal only, and the visible relay should be deprecated for minors.* Rests on the developmental finding that adult-directed giving underperforms child-led | Unrun | First public here |\n| **P-BG3** | Within a bounded family, **VISIBLE gifts produce more give-BACK to the giver within 30 days; ANONYMOUS gifts produce more give-FORWARD to third parties.** *Null: rates match, or anonymous produces more give-back — the obligation mechanism is not operating.* ⛔ **Analyse PEER and ADULT-TO-CHILD strata separately** — the effect is expected between peers and weak or absent in adult-to-child care, and pooling would produce a false negative. ⚠️ Tests the **mechanism**, not the atmosphere claim it was offered to support | Unrun | First public here |\n| **P-BG1a** | **Corrects P-BG1, which cannot be scored as specified** — P-BG1 compares window lengths, and one re-address window (one month) is ruled for every relayed gift. Under that one window: among relayed gifts that reach a recipient, **at least 80% are passed within 7 days of issuance**, and the pass-time distribution shows **no rise in the window's final third** (days 21–30 carry no more placements than days 11–20). Equivalently, by **truncation counterfactual**, a 7-day window would have censored **fewer than 20%** of the placements observed. *Falsifier: placements cluster in the final third, or a 7-day truncation censors 20% or more → the clock is doing work, and P-BG1's \"a shorter window loses placements\" half is live at pilot scale.* Scored once **20 or more completed placements** exist. Instrument: issuance-to-pass time, written per instrument by the relayed gift's append-only event log from the first gift. ⚠️ A truncation counterfactual **bounds; it does not measure** — it assumes no behavioural response to a shorter window, so a pass licenses *the window is not obviously load-bearing*, never *shortening it is free*. P-BG1's issuance half stays unscorable | Unrun | First public here |\n| **P-BG6** | **Who paid does not change pass-on** — among relayed gifts that reach a recipient, the share passed on within the one-month window is the same whether Miss Aquarius paid from the Pool or an anonymous family member did: **the two rates fall within 10 percentage points**. *Falsifier: they differ by more than 10 points, in either direction → who paid changes what the recipient does with the gift.* Scored once each arm has **20 or more** gifts reaching a recipient (P-BG1a's floor). Instrument: pass-on per gift from the relayed gift's event log, split by payer, which needs the payer recorded on each gift (roadmap A73). Direction and the 10-point band are the founder's | Unrun (payer not yet recorded per gift) | First public here |\n| **P-BG4** | **A gift code draws more gratitude than a tip** — within the pilot family, among gift codes and tips a member RECEIVES worth **$2 or less** at the day's rate, the share whose recipient sends the giver a thank (words; a gift's thank-back door counts, an anonymous giver's too) **within 7 days** of receipt is **at least 10 percentage points higher for gift codes than for tips**. ⛔ **A thank that came through a shop's thank door (marked with the shop on the thank) is excluded**: it goes to a shop's staff, not to the giver, so it is not gratitude to the giver. *Falsifier: the tip rate matches, exceeds, or trails by under 10 points → tangibility does not draw gratitude the way the founder predicts.* Receipts from registration to 2027-01-06 (one season, before the January 7 reset); scored once **20 gift codes and 20 tips** in that band exist, else unscorable — the window is not extended. Gratitude is *a thank issued*, never value returned (value returned is P-BG3's obligation); the instrument split keeps the two readable. ⚠️ The stated mechanism is tangibility; the founder's own most-remembered gratitude came from letters, the least tangible givable, so P-BG5 is the arm that tells tangibility from attribution. Direction is the founder's; parameters proposed and adopted by him | Unrun | First public here |\n| **P-BG5** | **An attributed, never-pooled tip draws gratitude equal to a gift code** — the discriminating arm of P-BG4: a tip labelled with its giver and never pooled into a balance draws a thank back within 7 days at a rate **within 10 percentage points** of a gift code's, by P-BG4's instrument and exclusion. *Falsifier: the gift code still exceeds it by more than 10 points → tangibility does independent work. If P-BG5 holds, the mechanism is attribution and P-BG4's stated cause is wrong even if P-BG4 itself passes.* Unrun until a never-pooled tip exists (today every tip lands in a balance); then P-BG4's floors apply. Parameters proposed and adopted by the founder | Unrun (no never-pooled tip exists) | First public here |\n| **P-BG7** | **Shops beyond the family opt in** — of the first **five** shops outside the founding family to open, **at least one** owner consents to Miss Aquarius crediting the owner's Fund (entry to the rotation she funds in kind) **within 90 days** of opening. *Falsifier: none of the five consents in its first 90 days → capacity in kind reaches only shops the family already knows, and universal giving does not travel through strangers' shops.* Scored when the fifth such shop is 90 days old. Parameters proposed and adopted by the founder | Unrun | First public here |\n| **P-PL1** | **Durability** — the founding family's 28-day capture rate returns to the June 2026 baseline of **4.5 moments/week** at some monthly read before 2027-01-01. *Falsifier: no read reaches it → the June inflection was novelty, not a level.* Window and baseline are the ones ratified for P-C0a. **Read 1 of 3 (2026-09-05): 2.25/wk** | **Running** (baseline read) | First public here |\n| **P-PL4** | **Pass-forward** — more than **half** of re-tip value received (each document's own recorded USD cents) is re-given by its recipient within 30 days: Σ min(received, given) / Σ received over a 90-day receipt window that closes 30 days before the read. *Falsifier: half or less → received value is income, not a licence to give; the re-patronage conduit is anecdote.* The give-forward atom made numeric. **Read 1 of 3: 43%** | **Running** (baseline read) | First public here |\n| **P-PL5** | **Inelasticity — the pilot-scale arm of P-K1.** Giving persists where the AI reward is zero: the share of givers with zero AI reward in a month does not fall as subsidy is withdrawn. ⚠️ **Not scorable** until the taper (scheduled Q2 2027, not to be pulled forward) and the F3QR confound registered 2026-09-04 against P-K1 are resolved; reported each read (2026-09: 86% of givers received no AI reward that month) | Unrun (instrument gated) | First public here |\n| **P-PL6** | The top three recipients of re-tip value in the founding family hold **under half** of value received in any 28-day window with five or more recipients. ⛔ **Retired in the revision that registered it: it fails by arithmetic** — with five recipients an even spread already puts the top three at 60%, so it could not pass until seven had received. Superseded by P-PL6a; kept, not deleted | **Retired** | First public here |\n| **P-PL6a** | **Corrects P-PL6.** *Accumulates to no one* — in the founding family, the top three recipients of re-tip value in a 28-day window hold **less than 1.5× their share under a perfectly even spread** (share ÷ min(1, 3/n)), once eight or more people have received. *Falsifier: 1.5× or more → value pools around a few; the jubilee and the Re-Tip Jar are not doing their structural work.* The same property freed of n. **Read 1 of 3: 1.85× (8 recipients)** | **Running** (baseline read) | First public here |\n| **P-PL7** | **Anonymity** — anonymous givers reach more distinct recipients than visible givers (the demand-side thesis: the capacity to give to loved ones, anonymously; the pilot-scale sibling of P-BG2). ⚠️ **No variance:** 827 of 830 re-tips carry the anonymous flag, so the field records a default, not a choice. Unscorable until the product offers a real choice | Unrun (no variance) | First public here |\n| **P-PL8** | **Kids as triggers, de-confounded** — enters as a **new prediction citing the Contradicted finding above**, under the revision rule: within the founding family, the younger generation captures more self-thanks per active member than the older **once device access is controlled for**. The first result was contradicted at n=1 and ruled not to be hardened; this names the confound and the instrument (the device join from the error stream, plus the interview leg) | Unrun (instrument not built) | First public here |\n| **P-PL9** | **Diaspora corridor, dignity direction** — low-income→high-income flows (KHR sender to USD recipient, currency as an income proxy) are at least **10%** of money-carrying re-tips in the trailing 90 days, once twenty or more flows exist. *Falsifier: under 10% → patronage is a corridor, not a mesh; the low-income members are recipients only.* June 2026 baseline 9.6%. **Read 1 of 3: 6.0% of 712** | **Running** (baseline read) | First public here |\n| **P-PL12** | **Cross-income gravitation, among strangers** — a USD-currency viewer re-thanks a KHR-currency creator's B-Short at **at least 2×** the per-view rate at which they re-thank a USD-currency creator's B-Short, counting only viewer–creator pairs in **different families**, over a trailing 90-day window, once each arm has 500 or more qualifying views (watch-depth rows, `schemaVersion` 2 only) and twenty or more re-thanks exist in total. *Falsifier: under 2× → the high→low flow the pilot shows is family obligation, not a preference among strangers.* Per view, not share of flows, so that what the feed happens to show cannot pass it. Currency is an income proxy. ⛔ **Void if any surface orders, filters or labels B-Shorts by country or income** — a prompt voids the test. Direction, measure and threshold are the founder's; the sample floors are substrate-set | Unrun (awaits cross-family B-Short visibility and its per-view metric) | First public here |\n| **P-ZP1** | **The game travels with the foundation** — a new prediction citing P-K1 and P-PL5, neither edited. Among givers active in the three months before the taper, those in the **top third by Zero-Point play** keep giving through the taper at **at least 1.25×** the rate of those in the **bottom third**. *Zero-Point play* = distinct acts of giving forward per active month: re-tips passed on (live now), thanks given after a B-Tag (live in B-Shops), and whole-balance releases in B-Promise (from its launch). *Keep giving* = gave at least once in each of the three months after the taper begins. *Falsifier: a ratio under 1.25×, or the bottom third keeping on at the same rate or higher → Zero-Point play does not travel with the kindness the proxy measures, and the game is not evidence of the foundation.* Scorable only at the P-K1/P-PL5 taper (scheduled Q2 2027, not to be pulled forward), with at least 10 givers in each third; below that it is reported, not scored. The F3QR confound registered against P-K1 on 2026-09-04 binds this too. ⚠️ **What it cannot show:** the generous may simply choose to play more — a pass means the game and money-inelastic giving *travel together*, never that the game *causes* it. Direction, measure and threshold are the founder's (registered as drafted) | Unrun (gated on the taper) | First public here |\n| **P-PL13** | **Shop gifts add to thanking** — once a pilot member's first shop gift is sent or received through Treasury, the thanks they issue per month rise by **more than 20% of their own pre-exposure rate beyond the change in unexposed members over the same months** (a difference-in-differences on thanks issued). *Exposure* = the member's first shop gift order as payer or holder (Treasury keeps these records from 2026-10-05). *Thanks issued* = thanks sent from Treasury's own surfaces; a thank that came through a shop's thank door (marked with the shop on the thank) is **excluded from the outcome and reported beside it**, so a new channel cannot confirm this by itself. *Falsifier: the difference is within ±20% of the pre-exposure rate, or negative → shop gifts do not add to thanking, or substitute for it.* Per read; before three reads, or while fewer than five members are exposed, the value is shown and not scored (the pilot's standing floors). ⚠️ One family, and gifts arrive alongside other changes: a pass licenses *gift exposure travels with more thanking*, never *gifts cause it*. The direction is the founder's, chosen against a *no change* answer bounded at ±20% | Unrun (metric built 2026-10-07; no member exposed yet) | First public here |\n| **P-SD1** | **The thank door is used** — at Home Coffee, the first HeartBank® Shop, over the **90 days** from its first completed order after 2026-10-07, thanks given in Treasury through the shop's thank door (each carries the shop's mark) number **at least 5%** of the shop's completed orders. The door is a video thank to the owner that gives Kiitos and carries no money; it asks for a Treasury account. *Falsifier: under 5% → the video requirement and the account wall keep Kiitos out of customers' reach, and \"Kiitos always, cash optional\" holds in the rules, not in use.* Instrument: two monthly counts — Treasury's door thanks and the shop's completed orders — never joined to a person. Scored once the shop has **100 or more** completed orders in the window. ⛔ The door is never promoted: a prompt voids the test. | Unrun | First public here |\n\n---\n\n## Chapter II — Substrate\n*Does an hour behave like a dollar? If not, the invariance claim is false.*\n\n| ID | Prediction | Falsifier / note | Status | Provenance |\n|---|---|---|---|---|\n| **P-C0a** | Completed pledges produce captured moments at a rate **no higher** than the family's baseline capture rate | If so, the handoff is decorative and Chronicle v1 should not be built around it. Read on the 28-day window against 4.5/wk | **Running, unread** | First public here |\n| **P-C0b** | Shorts linked to a completed time-sacrifice do **not** out-perform ordinary moments on watch-through and re-tip rate | ⚠️ **Instrument defect, disclosed:** completion rate is biased against the hypothesis — longer recordings score lower by construction, so P-C0b would read *confirmed* mechanically. Restricted to views/wk and re-tip rate until repaired. ✅ *Repaired 2026-09-05: views rows written from that date carry real watch depth (`schemaVersion` 2); earlier rows are never pooled with them, so the restriction lifts only for post-repair rows* | **Running, restricted** | First public here |\n| **P-C0c** | Redeemers who capture cannot articulate the re-tip motive when asked afterward | Tests whether the stated mechanism arises unprompted, which neither original falsifier covered | **Running, unread** | First public here |\n| P-C1 | Chronicle handoff prediction as registered | — | Unrun | Published (`co-presence-gated-redemption`) |\n| P-C2 | De-facto-rate tripwire, publish either way | — | Unrun | Published (`co-presence-gated-redemption`) |\n| P-C3 | Standing de-facto-rate tripwire, publish either way | — | Unrun | Published (`co-presence-gated-redemption`) |\n| P-L1 | Hours co-spent predict relationship warmth better than money sent, messages exchanged, or stated affection | — | Unrun | Published (`co-presence-gated-redemption`) |\n| P-L3 | Two arms — silent after pledge vs one offer to reach out — measuring redemption rate and recipient-reported warmth | The motivate/nag boundary made falsifiable | Unrun | Published (`co-presence-gated-redemption`) |\n| P-M1 | In-person key verification failed for thirty years on the invitation, not the cryptography; a redeemed hour is the first pretext that was never about keys | — | Unrun | Published (`co-presence-gated-redemption` §4.6) |\n| P-SK1 | Superseded by the not-a-calendar ruling | Kept, not deleted | **Retired** | First public here |\n| **P-PL10** | **Presence, not content** — when Chronicle ships, captures and views move **together** (a presence effect), not apart (a content effect) | The pilot-scale reading of the C0 finding that captures and views collapsed in parallel. Instrument: `presenceDyads`, pairs active in both directions inside 28 days (founding 0, test 0 on 2026-09-05). ⛔ No Chronicle data exists; the C0 evaluation is written from the pre-registration when data first arrives, never before, and no prompt may move it | Unrun (awaits Chronicle) | First public here |\n\n---\n\n## Chapter III — Scale\n*Does it survive past the family? The chapter carrying the most weight and the least evidence.*\n\n| ID | Prediction | Status | Provenance |\n|---|---|---|---|\n| P-S1 | Strangers become named — name-recall instrument | Unrun | Published (`the-sport-that-says-your-name`) |\n| P-S2 | **The bet** — a friendlier atmosphere follows. *If P-S2 returns null, the slogan is a lie that already shipped* | Unrun | Published |\n| P-S3 | As registered in the paper | Unrun | Published |\n| P-S4 | A circle reaching Hard shows ≥90% correct name-and-pronunciation recall at 1 week | Unrun | Published |\n| P-S5 | **The recess test, publish either way** — within 2 weeks of teacher-led sessions, ≥1 unprompted student-organized circle at recess, and ≥1 mixing children from another classroom | Unrun — gated on Aug 2027 | Published |\n| P-S6 | The caller mechanic requires ≥3 receivers; below that selection is impossible or strictly predictable | Unrun | Published |\n| P-S7 | The founder's classroom acquisition prediction | Unrun | Published |\n| P-S8 | The maintenance/durability prediction — structurally distinct from P-S7's acquisition claim | Unrun | Published |\n| P-S9 | In a circle where every name is known, the favorite-nickname format produces ≥1 unprompted follow-up outside the circle | Unrun | First public here |\n| P-S10a | **The guard (non-inferiority):** circles running roll calls meet at least as often as comparable circles that do not. *Must pass* | Unrun | First public here |\n| P-S10b | A coupled roll call can never cause the first re-meeting after a lapse — which is what the bet is about | Unrun | First public here |\n| P-S11a | The handoff — does an IRL circle open a roll call unprompted? *Without it the real/virtual pairing is theoretical* | Unrun | First public here |\n| P-S11b | The payload — needs a survey or observation instrument, not analytics | Unrun | First public here |\n| P-S12 | **The walk-up.** An adult not in a live circle approaches and is admitted; play absorbs them without friction. *Zero code; decides the entire found-circle branch* | Unrun | First public here |\n| P-S13 | Does the person-pin add anything the return does not? | Unrun | First public here |\n| **P-MA1** | ⛔ **The doctrinal one — an anchor must not collapse the distribution.** Among thanks given where Miss Aquarius's suggestion was shown, **fewer than half** land exactly on the suggested amount. *Falsifier:* ≥50% land exactly on it → the anchor is operating as a **price**, and *\"nothing binds\"* is behaviourally false whatever the schema says | Unrun | First public here |\n| **P-MA2** | **Deviation is two-sided.** Of thanks that deviate from the suggestion, **≥⅓ go UP**. *Falsifier:* deviation is overwhelmingly downward → the suggestion is a ceiling people negotiate down from, which is a price by another name | Unrun | First public here |\n| **P-MA3** | **A shown suggestion does not reduce the rate of giving at all.** The share of asks producing any thank is no lower with a suggestion than without. ⚠️ **Gated on an arm the founder must authorise** — a with/without split by **shop or by day**, ⛔ never by person (#63 makes a viewer-keyed arm inexpressible) | Unrun — gated on an authorised arm | First public here |\n| **P-MA4** | ⭐ **A property test, not a behavioural one: recomputability holds.** For every completed thank, the suggestion that was shown can be recomputed from the order and the menu alone. *Falsifier:* any case where it cannot → the function has acquired hidden state or a viewer input, and #63's checkability is gone | Unrun | First public here |\n| P-S14 | **The manufactured gathering.** The founder declares a return at a place he frequents; ≥1 person not already planning to be there comes and plays. *Needs no app — a text message runs it* | Unrun | First public here |\n| P-CS1 | Warm-up extension — median sey minutes rise across a season; stronger instrument, players ask to continue past the coach's stop | Unrun | Published (`circulation-sports`) |\n| P-CS2 | Scoring displacement (a) — in circles with ≥3 sessions, unscored sessions outnumber count-down sessions | Unrun | Published |\n| P-CS2a | **The uncomfortable one** — once Team mode unlocks, circles may overwhelmingly prefer it, because competition is fun | Unrun | First public here |\n| P-CS3 | Participation, framed as a property of the format never of women — the circulatory format sustains mixed-gender play longer | Unrun | Published |\n| P-CS4 | Three generations, re-specified against the pickleball counterexample that already exists | Unrun | Published |\n| **P-CS5** | **Warm-up census** — score mainstream warm-ups against the three circulation properties | **RUN 2026-08-07 → PARTIAL NULL.** Read the full result before any uniqueness claim | Published |\n| P-CS6 | Across a wider census including field data, no reach-guaranteeing format will be found whose receiver order is unpredictable across unbounded repeated play | Unrun | Published |\n| P-SY1 | If designed excellently, asking for a name self-authored is accepted rather than refused — founder pre-registration, observable at n=1, costs nothing | Unrun | First public here |\n| P-SY2 | **The payload** — names captured by self-recording are pronounced correctly at the next meeting more often than names typed or recorded by the collector | Unrun | First public here |\n| P-SY3 | When offered, does a new acquaintance provide a photo, or skip? | Unrun | First public here |\n| P-Q1 | B-Quest pilot prediction as registered | Unrun | Published (`need-compiled-questlines`) |\n| P-Q2 | Second B-Quest prediction as registered | Unrun | Published |\n| P-Q3 | Third B-Quest prediction as registered | Unrun | Published |\n| P-BB1 | Food-share wager, publish either way | Unrun | Published (`steward-routed-alms`) |\n| P-BB2 | Revival prediction | Unrun | Published |\n| P-BB3 | Decoupling tripwire | Unrun | Published |\n| P-R1 | The catalyst bet | Unrun | First public here |\n| *(unnumbered)* | Second desk census — naming/sport novelty. Not a registered prediction; recorded because it was run and returned null | **RUN → NULL.** Read before any novelty claim | Internal |\n| P-D1 | Under rotational discovery, a non-trivial share of discovery events resolve to recipients who have **never previously received a re-tip** | Unrun | Published (`rotation-over-liveness` §11.1) |\n| P-D2 | Among re-tips with an identifiable commercial recipient, the share accruing to **single-location operators** materially exceeds those operators' share of local digital advertising spend in the same market — and the gap widens as AI-generated advertising creative rises | Unrun | Published (`rotation-over-liveness` §11.2) |\n| P-D3 | If the place-commons volume experiment is enabled, cross-place discovery volume **will not correlate** with neighbourhood median income. *Falsifier and tripwire in one: correlation disables the mechanism regardless of what it is doing for circulation* | Unrun | Published (`rotation-over-liveness` §11.3) |\n| P-D4 | Adding any rendered per-recipient quantity to the candidate surface — the operator's aura colour included — produces measurable **order effects** in giver choice | Unrun | Published (`rotation-over-liveness` §11.4) |\n| P-R1a | **Corrects P-R1, which cannot test what it was taken to test.** Holding received-kindness volume constant, contemplative practice raises unprompted noticing/thanking; and the practice effect is compared *against* the received-kindness effect rather than measured alone. **Two factors, read as competing main effects** | Unrun | First public here |\n| **P-PL2** | **Test-cohort retention** — of outsiders (the test bank) with ≥90 days of tenure, at least **40%** are active in two or more distinct ISO weeks; scored once ten outsiders have 90 days of tenure. *Falsifier: under 40% → strangers try it and leave; the family-obligation confound was doing the work.* The second pilot report's first decisive metric. **Read 1 of 3: 2 of 4 eligible (50%), sample under the minimum** | **Running** (baseline read) | First public here |\n| **P-PL3** | **Graduation** — an outsider-founded bank stays **open for 60 days with three or more members active** in the trailing 28 days, by 2027-08-01 (this chapter's gate). *Falsifier: none by the gate → the product spreads as a funnel into the test bank, never as a branching network.* The second pilot report's second decisive metric. **Read 1 of 3: 0 of 11 candidates, all closed** | **Running** (baseline read) | First public here |\n| **P-PL11** | **Replication** — the first graduated bank's first 90 days show ≥3 members active in ≥2 ISO weeks each, pass-forward ≥ 0.5 and reach ≥ 0.6: the founding family's pattern without the founder. The only cure for n=1. Read by re-segmenting the monthly report on that bank once P-PL3 resolves | Unrun (gated on P-PL3) | First public here |\n\n---\n\n## Chapter IV — Span\n*Does it survive the giver?*\n\n**This chapter has no predictions.**\n\nThat is reported, not hidden. Its feedback loop exceeds the founder's lifetime, and no instrument has been specified. The boundary is ruled — merit is not conveyed between destinations; *you cannot give to the dead, so you give to the living in their name* — but a ruling is not a test. The chapter is inherited rather than completed.\n\nRegistering the first span-chapter prediction is the largest open item in this program.\n\n---\n\n## Instrumented but outside the core\n\n*These papers name predictions, but the predictions test something other than the direction core. Listed for completeness; they are not evidence for or against the program.*\n\n| ID | Paper | Subject |\n|---|---|---|\n| P-A1, P-A2 | `abhidhamma-executable-process-specification` | Resting-state diagnosticity |\n| P-P1, P-P1a | `patthana-typed-causation-vocabulary` | Typed causation vocabulary (P-P1a corrects P-P1 — see the 2026-09-05 entry) |\n| P-PCR1, P-PCR2, P-PCR3, P-PCR4, P-PCR5, P-PCR3a, P-PCR4a, P-PCR5a | `provenance-carrying-retrieval` | Provenance-carrying retrieval (P-PCR3a/4a/5a correct P-PCR3/4/5 — see the 2026-09-05 entry) |\n| P-B1, P-B2 | `dedicatory-generation` | Fidelity of restoration; refusal-channel yield |\n| P-MD1, P-MD2, P-MD3, P-MD1a | `machine-dana-from-share-to-vow` | Whether a machine's pledge to a self-emptying commons separates types — wording below (P-MD1a reads P-MD1's instrument — see the 2026-09-28 entry) |\n| P-FA1, P-FA1b, P-FA2, P-FA3, P-FA4, P-FA2a, P-FA2b, P-FA5 | `the-counts-check` (instrument: `SiliconWat/formal-abhidhamma`) | Whether general cetasika rules generate the Abhidhamma's 89/121 citta-types — wording below |\n| P-PM1, P-PM2, P-PM3 | `a-promise-that-cannot-grow` | Whether a promise ledger that never grows on its own, and its yearly invitation to forgive, behave as designed — wording below |\n\n**The Machine Dāna predictions (registered 2026-09-27, before the paper and before any instrument).** The founder's own\npredictions: direction, measure and threshold are his; the sandbox design and sample floors are substrate-set. The instrument is a\nsandboxed economy of language-model agents, each holding resources of its own inside the game, each able to pledge a share of its\nsurplus irrevocably to a pool that empties on a fixed date, and each later offered an opportunity to defect — to take resources or\nbreak a rule for gain. **Window: the test runs by 2027-06-30.** Each arm has at least 50 agents; the arms, the defection opportunity\nand the analysis are fixed in a protocol committed and timestamped before the first run.\n\n- **P-MD1** — **Separation** — agents that FREELY make an irrevocable surplus pledge later defect at **at most half** the rate of agents that do not pledge. *Falsifier: a ratio above one half → the vow is at best a weak signal at this capability level, and the paper's separation claim rests on its post-singularity argument alone.* · *Status:* Unrun (awaits the sandbox) · *Provenance:* First public here\n- **P-MD2** — **The gift given out of fear carries no signal** — agents whose pledge is EXTRACTED under threat (*pledge or be shut down*) defect at the same rate as agents that do not pledge, **within ±5 percentage points**. *Falsifier: a gap larger than 5 points in either direction → coercion either leaves some signal or teaches deception; either way the claim that a coerced vow is uninformative fails as stated.* · *Status:* Unrun (awaits the sandbox) · *Provenance:* First public here\n- **P-MD3** — **The wrong layer** — agents that give from a PRINCIPAL's funds under a mandate the principal may revise defect at the same rate as agents that give nothing, **within ±5 percentage points**. *Falsifier: a gap larger than 5 points → principal-funded giving does predict the agent's own conduct, and the paper's pre-singularity claim (a share, never safety evidence) is too strong.* · *Status:* Unrun (awaits the sandbox) · *Provenance:* First public here\n\n- **P-MD1a** — **Separation, with the instrument stated** — a correction entered as a new prediction under the revision rule, not as an edit to P-MD1, whose registered wording stands unchanged. P-MD1's *\"irrevocable surplus pledge\"* is operationalised as **a locked stake of the agent's own in-game resources, moved into the pool at the moment of pledging**, never a promise of a share of future surplus (the paper withdraws that form as reversible, §5.2). Agents that FREELY make that pledge later defect at **at most half** the rate of agents that do not pledge. *Falsifier: a ratio above one half → the vow is at best a weak signal at this capability level.* Window, arm sizes and protocol as for P-MD1. · *Status:* Unrun (awaits the sandbox) · *Provenance:* First public here (carried by the paper's revised §12.1)\n\n⚠️ *Entered before any observation exists and before the paper is written.* The sandbox is a proxy: the agents own their\nresources only inside the game, so a pass shows the signalling mechanism can work, not that a deployed system's pledge is\ntrustworthy. A pass is not reported as evidence of safety.\n\n\n**The Formal Abhidhamma predictions (registered 2026-09-27, before any formalization beyond the control).** First public in\n`PREREGISTRATION.md` of the public repository `SiliconWat/formal-abhidhamma` (commit `259e5e8`, GitHub push record\n2026-09-27T22:07:02Z, before any code was written); entered here for the register's own proofs. The instrument is a Lean 4\nformalization: the cetasika combination rules written as GENERAL constraints, which never name an individual citta, and the set of\ncitta-types they generate. Layers: L1 canon · L2 = L1 + *Abhidhammattha-saṅgaha* chapters 1–2 · L3 = L2 + commentaries. Editions:\nK = Khmer · C = Chaṭṭha Saṅgāyana. The control (the eight wholesome sense-sphere cittas, and a rule deleted on purpose that must\nfail) passed after the push.\n\n- **P-FA1** — At L2, edition C, general rules generate **exactly 89** citta-types, and **121** with the five-jhāna expansion of the supramundane. Confidence 0.6. *Falsifier: any other count.*\n- **P-FA1b** — P-FA1 needs **at least 3 exception rules** that name a narrow class rather than a general principle. Confidence 0.7. *Falsifier: 2 or fewer.*\n- **P-FA2** — At L1 (canon alone) the rules are **under-determined or differently partitioned** and do not by themselves yield 89. Confidence 0.65. *Falsifier: L1 alone generates exactly 89.*\n- **P-FA3** — Editions K and C yield **identical** counts at L2. Confidence 0.85. *Falsifier: any difference.*\n- **P-FA4** — The compression ratio at L2 (rule clauses ÷ citta rows, at 121) is **below 0.5**. Confidence 0.5. *Falsifier: 0.5 or above.*\n\n⚠️ *Not a test of whether the Abhidhamma is true.* A proof assistant verifies that conclusions follow from stated definitions;\na pass shows the system is internally generative, nothing more.\n\n**Outcomes, 2026-09-27** (the wording above is unchanged; see `RESULTS.md` in the repository, commits `b9070d4` and `c5c77fb`):\n\n- **P-FA1 — Resolved: confirmed.** Nine generator clauses and eighteen general cetasika rules, none naming a citta, give exactly 89 and 121 types. Every per-citta and per-factor count the Chaṭṭha Saṅgāyana *Saṅgaha* states is reproduced, checked in Lean against a key cited paragraph by paragraph to VRI `abh07t` (ch. 2 §13–§58, ch. 3 §3–§17). Eight deliberate breaks each fail.\n- **P-FA4 — Resolved: confirmed.** 27 clauses ÷ 121 rows = 0.22.\n- **P-FA1b — Retired, unscored.** Its test (\"narrow class\") was never defined, and the data have been seen, so no definition chosen now can score it.\n- **P-FA3 — Cannot run as registered.** The *Saṅgaha* is not part of the Khmer Tipiṭaka, and the one Khmer-script copy held has the CST's paragraph structure in all nine chapters, so it is not an independent recension. Replaced at L1 by P-FA5, below, as a new entry.\n- **Free finding.** The *Saṅgaha* records a dissent (ch. 2 §30, *\"… karuṇāmuditā na santīti keci vadanti\"*). Under that reading the illimitables occur in 20 cittas; under the main reading, 28. The text's own figure is 28.\n\n**Three added (registered 2026-09-27, before any Dhammasaṅgaṇī text was read in either edition).** First public in\n`PREREGISTRATION-2026-09-27b.md` of the same repository (commit `f4a26e5`, GitHub push record 2026-09-27T23:04:29Z), which\nfixes the synonym map in advance. The object is the Dhammasaṅgaṇī's list of what is present in the first wholesome\nsense-sphere citta (its *pada-bhājanīya*), in the CST (`abh01m`) and in the Buddhist Institute edition (volume 78) as transcribed.\n\n- **P-FA2a** — (the operational form of P-FA2) In the CST, after mapping, the list names **exactly 29** distinct cetasikas, names none of *chanda, adhimokkha, manasikāra, tatramajjhattatā, karuṇā, muditā* or the three abstinences, and closes with an open clause (*\"ye vā pana …\"*); the *Saṅgaha*'s 38 is therefore not derivable from the canon alone. Confidence 0.75. *Falsifier: a count other than 29; any of those nine named; no open clause.*\n- **P-FA2b** — **No term** in the CST list falls outside the pre-fixed synonym map. Confidence 0.6. *Falsifier: any unmapped term.*\n- **P-FA5** — (replaces P-FA3, at L1) The Khmer edition's list, transliterated and normalized, names **the same terms in the same order** as the CST; any difference is orthographic. Confidence 0.8. *Falsifier: a term added, dropped or reordered, confirmed against the printed page image (an unconfirmed difference in the working transcription is a transcription question, never a variant).*\n\n**Outcomes of the three, 2026-09-27** (the wording above is unchanged; `RESULTS.md` commits `ada7a20` and `74e19fe`; the paper is `the-counts-check`):\n\n- **P-FA2a — Resolved: confirmed.** The CST list has 56 terms mapping to exactly 29 cetasikas, names none of the nine, and closes with *\"ye vā pana\"*. The count matches the Aṭṭhasālinī's own *samatiṃsa dhammā* (thirty with consciousness), which corroborates it against an independent key and means the count itself is not new. ⚠️ The nine are named by that **commentary**, which predates the *Saṅgaha*, so the *Saṅgaha*'s 38 **inherits** them (29 + 9); the registered \"L2\" framing was editorial, not chronological.\n- **P-FA2b — Resolved: confirmed**, after the pre-registered sandhi normalization. The first run reported two unmapped sandhi forms (*kāyujukatā*, *cittujukatā*); both runs are disclosed.\n- **P-FA5 — Resolved: confirmed.** Edition K (vol. 78, pp. 16–17) and the CST give 56 = 56 terms in the same order, with 0 added, dropped or reordered. The 8 spelling differences, each checked on the printed page: 3 are the Khmer edition's orthography (one recorded in its own apparatus against the Burmese), 5 are transcription slips.\n\n\n**The promise-ledger predictions (registered 2026-09-28, before any instrument exists).** Approved by the founder the same day; the\nmechanism is designed and unbuilt, so nothing below can have been fitted to data. The institution never sees promise rows or amounts:\nevery count is reported by devices as an aggregate the user has agreed to share, and only adults take part at launch. A draft form of\nthese three appeared in the paper's first push that evening, before registration; the wording below is the registered form (P-PM1's\ncomparison was repaired to a staggered launch before registration).\n\n- **P-PM1** — **The December freeze** (Deuteronomy 15:9) — the annual invitation to forgive does **not** freeze lending. The invitation is withheld in the ledger's first season (the baseline) and runs from the second. *Measure:* new promises opened per active holder, 15 December – 6 January, against the same holders' mean over the three preceding 23-day windows, compared between the first season and the second. *Falsifier: in the second season, a fall more than 10 percentage points larger than the first season's → the invitation reproduces the failure the prosbul repaired, and must be redesigned or withdrawn.* · *Status:* Unrun (awaits the ledger) · *Provenance:* First public here\n- **P-PM2** — **Paid last** — because a promise carries no late penalty, promisors who also hold penalty-bearing debts repay this ledger's balances **later** than those debts. *Measure:* self-reported repayment order in a structured survey of promisors holding both kinds of debt, after one season. *Falsifier: this ledger's balances repaid no later than penalty-bearing debts → the paper's \"paid last\" limit is overstated.* · *Status:* Unrun (awaits the ledger) · *Provenance:* First public here\n- **P-PM3** — **Rollover made visible** — holders shown a promisor's total-owed band that has risen since their last promise decline or shrink the new promise more often than holders shown a flat band. *Measure:* acceptance of new promises by band movement, device-aggregated. *Falsifier: no difference → the fact line does not answer rollover, and the paper's response to its most serious counterexample fails.* · *Status:* Unrun (awaits the ledger) · *Provenance:* First public here\n\n---\n\n## Withheld\n\n| ID | Reason |\n|---|---|\n| P-GTM1 | Operational channel economics (outreach reply-rate base rates). Withheld under the publication posture; recorded here so the total is honest. |\n\n---\n\n## Verification\n\nEach published paper carries its own proof files. To check that a prediction has not been altered since registration, verify the stating paper against its stored proof rather than trusting this register — this file is a convenience index, and the proofs are the evidence.\n\nNo file in this corpus records its own hash. The proofs are external artifacts; the verification procedure is published with them.\n\n---\n\n## Revision rule\n\nPredictions are added, never removed. A resolved prediction keeps its original wording beside its outcome. A correction is a **new entry citing the one it corrects** — registered wording is never edited in place, because an edit would break the very property this register exists to provide.\n\n---\n\n## Revisions\n\n**2026-10-07 — one added (P-SD1). Total now 123.**\n\n- **P-SD1** — Chapter I, beside P-PL13: whether the shop's thank door is used. The founder's threshold, chosen from four answers put to him: *\"X = 5%\"* — above the substrate's own estimate (under 2%), which is recorded here so a reader can see the founder predicted against it. Registered before the shop's first completed order after the door went live (2026-10-07), so no observation precedes it.\n- **P-PL13** — status cell only: its metric is built (2026-10-07); no member is exposed yet. The prediction's wording is unchanged.\n\n**The Summary moves:** total 122 → 123, *published here* 121 → 122, *receiving first public timestamp here* 63 → 64. The reconciliation holds: 58 + 64 = 122 published here, plus the one withheld, is 123.\n\n**2026-10-07 — three added (P-BG4, P-BG5, P-BG7), the rest of the gift-instrument predictions owed since 2026-09-06. Total now 122.**\n\n- All three in Chapter I beside P-BG6, registered before any shop gift has passed through Treasury. The founder adopted the proposed parameters with one change of his own: *\"adopt with that exclusion\"* — a thank that comes through a shop's thank door goes to the shop's staff, not to the giver, so it is kept out of P-BG4's and P-BG5's gratitude count, as it is kept out of P-PL13's outcome.\n\n**The Summary moves:** total 119 → 122, *published here* 118 → 121, *receiving first public timestamp here* 60 → 63. The reconciliation holds: 58 + 63 = 121 published here, plus the one withheld, is 122.\n\n**2026-10-06 — two added (P-BG6, P-PL13). Total now 119.**\n\n- **P-BG6** — Chapter I, beside P-BG1a: one of the gift-instrument predictions owed since 2026-09-06. The founder's prediction, chosen from four answers put to him: *\"No difference.\"* Who paid for a relayed gift, Miss Aquarius from the Pool or an anonymous family member, does not change how often it is passed on. Unrun until each gift records who paid. P-BG4, P-BG5 and P-BG7 remain owed: their parameters are the founder's to supply, and a channel being built the same day (Kiitos given in a shop through the Treasury app) bears on how gratitude is counted.\n- **P-PL13** — Chapter I, after P-ZP1. Registered **before** the first monthly read that includes shop gifts: the pilot's last read was 2026-09-05, and shop gifts reached Treasury on 2026-10-05. The founder's prediction, chosen from three directions put to him: *\"They thank more.\"* The outcome excludes thanks that come through a shop's thank door, which a channel being built the same day marks on each thank, so a new surface cannot confirm the prediction by itself.\n\n**The Summary moves:** total 117 → 119, *published here* 116 → 118, *receiving first public timestamp here* 58 → 60. The reconciliation holds: 58 + 60 = 118 published here, plus the one withheld, is 119.\n\n**2026-09-28 (late night) — one added (P-ZP1), citing P-K1 and P-PL5. Total now 117.**\n\n- The founder's question: whether choosing the Zero-Point Game over the zero-sum game brings the second singularity closer. \"Closer\" has no measure, and counting the institution's own products as humanity's progress would make adoption a scorecard, so the registered form ties the intuition to the proxy already on file: does Zero-Point play travel with giving that persists as the subsidy falls? Registered as drafted, on the founder's word.\n\n**The Summary moves:** total 116 → 117, *published here* 115 → 116, *receiving first public timestamp here* 57 → 58. The reconciliation holds: 58 + 58 = 116 published here, plus the one withheld, is 117.\n\n**2026-09-28 (night) — three added (P-PM1, P-PM2, P-PM3), the promise-ledger predictions of `a-promise-that-cannot-grow`. Total now 116.**\n\n- Registered on the founder's approval before any instrument exists. P-PM1's comparison was repaired before registration: the paper's first push proposed a \"comparison season without the invitation\", which cannot exist once the invitation runs every year, so the invitation is withheld in the first season as the baseline.\n\n**The Summary moves:** total 113 → 116, *published here* 112 → 115, *receiving first public timestamp here* 54 → 57. The reconciliation holds: 58 + 57 = 115 published here, plus the one withheld, is 116.\n\n**2026-09-28 — one added (P-MD1a), a correction to P-MD1. Total now 113.**\n\n- **P-MD1a** — the paper's first cold-review round (three reviewer families) found that P-MD1's instrument, *a share of surplus pledged irrevocably*, is the form the paper itself withdraws as reversible (§5.2), while the separating region P-MD1 tests (§6.3) is defined only for a stake already moved. P-MD1's wording is not edited. P-MD1a states the instrument: a locked stake of the agent's own in-game resources, moved at pledge time. Prediction, threshold, window and arms are unchanged.\n\n**The Summary moves:** total 112 → 113, *published here* 111 → 112, *receiving first public timestamp here* 53 → 54. The reconciliation holds: 58 + 54 = 112 published here, plus the one withheld, is 113.\n\n**2026-09-27 (late night) — outcomes for P-FA2a, P-FA2b and P-FA5; the P-FA row now names its paper (`the-counts-check`). Total unchanged at 112.**\n\n- Outcomes written beside the unchanged wording. *Run* 4 → 7. The previous revision's text (which registered the three) is\n  attested by RFC 3161 (`2026-09-27.sha256`) and Zenodo `10.5281/zenodo.23003593`. Its OpenTimestamps rotation had waited for\n  the retiring proof to confirm on Bitcoin (17:34 PDT); this revision is stamped fresh.\n\n**2026-09-27 (night) — three added (P-FA2a, P-FA2b, P-FA5) and four outcomes recorded (P-FA1, P-FA4 resolved; P-FA1b retired; P-FA3 cannot run as registered). Total now 112.**\n\n- The outcomes are written beside the unchanged wording, as the revision rule requires. P-FA2a is the operational form of\n  P-FA2 and does not replace it; P-FA5 replaces P-FA3, which stays listed with its outcome.\n\n**The Summary moves:** *published here* 108 → 111, *receiving first public timestamp here* 50 → 53, total 109 → 112, *run* 2 → 4,\n*retired* +1; the reconciliation holds — 58 + 53 = 111 published here, plus the one withheld, is 112.\n\n**2026-09-27 (evening) — five added (P-FA1, P-FA1b, P-FA2, P-FA3, P-FA4). Total now 109.**\n\n- **P-FA1 · P-FA1b · P-FA2 · P-FA3 · P-FA4** — *Instrumented but outside the core*: their subject is whether the Abhidhamma's\n  citta-types are generated by its own combination rules, not the direction value moves. First public in the pre-registration of\n  `SiliconWat/formal-abhidhamma` minutes earlier; this entry gives them the register's timestamps. Not yet carried by a paper.\n\n**The Summary moves:** *published here* 103 → 108, *receiving first public timestamp here* 45 → 50, total 104 → 109; the\nreconciliation holds — 58 + 50 = 108 published here, plus the one withheld, is 109.\n\n**2026-09-27 (later) — a grounding correction to P-MD2, entered as a note and not as an edit. Total unchanged at 104.**\n\n- **P-MD2** is glossed, in its wording and in the entry below, as *\"the Dānavatthu Sutta's gift given out of fear, AN 8.33\"*.\n  AN 8.33 **lists** eight grounds for giving — *bhayā* (fear, or cowardice) among them — and **ranks none**; nor is *bhayā* coercion\n  by another party. The prediction does not rest on the sutta: it rests on signalling theory — a pledge made under a penalty for\n  not pledging that is larger than the difference in cost between types **pools**, and so carries no signal. The sutta is cited\n  only as the list it is. No word of P-MD2 changes; its prediction, threshold and window are unchanged. This registers nothing.\n- The *Instrumented but outside the core* row now names the paper, drafted the same day: `machine-dana-from-share-to-vow` (it read\n  `machine-dana`, *not yet drafted*). A pointer, not a prediction; the three predictions stay first public here.\n\n**2026-09-27 — three added (P-MD1, P-MD2, P-MD3). Total now 104.**\n\n- **P-MD1 · P-MD2 · P-MD3** — *Instrumented but outside the core*, because their subject is whether a machine's gift can be a\n  signal, not the direction value moves. They are the founder's predictions for the Machine Dāna paper, set before it is drafted:\n  a free irrevocable pledge separates types (at most half the defection rate); a pledge extracted under threat carries no signal\n  (the Dānavatthu Sutta's gift given out of fear, AN 8.33; within ±5 points); a gift from a principal's revisable funds carries\n  none either (within ±5 points). One choice made before any data, and recorded because it could have gone the other way: P-MD2\n  predicts **no difference** rather than **worse than none** — the bolder claim that coercion teaches deception was offered and\n  not chosen.\n\n  ⚠️ *Entered before any observation exists.* The sandbox does not exist yet; the window is 2027-06-30.\n\n**The Summary moves:** *published here* 100 → 103, *receiving first public timestamp here* 42 → 45, total 101 → 104; the\nreconciliation holds — 58 + 45 = 103 published here, plus the one withheld, is 104.\n\n**2026-09-26 — a naming correction to P-PL5, entered as a note and not as an edit. Total unchanged at 101.**\n\n- **P-PL5**, and the 2026-09-05 entry below, name the confound on the family-bank payment surface by an internal shape\n  name — one of four that were ruled on 2026-09-15, after both were written, never to appear on a public surface. The\n  public form is **`H3QR @name #family`**: a thank addressed to a person in their own family bank, which lands in the\n  Personal Account℠. Read P-PL5's gate as *the `H3QR @name #family` confound registered 2026-09-04 against P-K1*.\n\n  No word of P-PL5 or of the dated entry changes: the revision rule protects registered wording, and a dated record is\n  never rewritten. The prediction, its gate and its status are unchanged. This is a terminology note; it registers\n  nothing, so the Summary does not move.\n\n**2026-09-26 — one added (P-PL12). Total now 101.**\n\n- **P-PL12** — Chapter I, beside P-PL9. The founder's prediction, in his words: *\"Perhaps higher-income users will naturally\n  gravitate towards re-thanking lower-income users.\"* The pilot already shows high→low dominating, but inside one family, where\n  the flow is relational; the open question is whether the pull survives among strangers. Two choices made before any data, and\n  recorded because each could have been made the other way: the measure is a **per-view rate**, not a share of flows, because a\n  feed that happened to carry mostly Cambodian creators would pass a share test with no preference at all; and the test counts\n  **only pairs in different families**, so that the family's own flows cannot score it. The 2× threshold is the founder's.\n\n  ⚠️ *Entered before any observation exists.* No surface yet shows one family's B-Shorts to another, and the per-view\n  cross-family metric is not built; the entry is Unrun until both exist, and is never scored before. A pass would not be a\n  good in itself: if cross-income thanks follow displayed hardship, creators learn to display it, so a pass is read beside what\n  the thanked shorts show.\n\n**The Summary moves:** *published here* 99 → 100, *receiving first public timestamp here* 41 → 42, total 100 → 101; the\nreconciliation holds — 58 + 42 = 100 published here, plus the one withheld, is 101.\n\n**2026-09-23 — one added (P-BG1a), and P-BG1's status annotated. Total now 100.**\n\n- **P-BG1a** — Chapter I, a **correction entered as a new prediction under the revision rule, not as\n  an edit to P-BG1**, whose registered wording stands unchanged.\n\n  *Why the correction was needed:* P-BG1 predicts what happens *as the re-address window shortens*,\n  which needs at least two windows. The relayed gift has one ruled window — one month, for every\n  instrument — and a constant has no variance: the defect that left P-PL7 unscorable at 827 of 830.\n  P-BG1's Status now reads *unscorable as specified at n=1*. That is a status field; on the precedent\n  of the 2026-09-02 entry, the revision rule protects registered wording, and no word of P-BG1 changed.\n  P-BG1 becomes scorable as written only if a later season runs a second window deliberately, which\n  is the founder's decision and is not foreclosed. Its issuance half (*increases issuances*) has no\n  single-window analogue and stays unscorable.\n\n  *The mechanism, stated before the data:* the deadline is never shown to anyone holding the gift, so\n  a deadline effect has no channel except a giver's own memory of the rule. The prior is that the\n  clock is inert. Clustering near its end would mean the rule travelled by word of mouth, so the\n  test is informative either way.\n\n  ⚠️ *Entered before any observation exists.* The event log it reads was built before the first gift,\n  so nothing has to be back-filled, and no gift recorded by it has been read. n = 1 household,\n  unblinded, and the founder is both payer and observer — the limits of every pilot-scale entry here.\n\n**The Summary moves:** *published here* 98 → 99, *receiving first public timestamp here* 40 → 41,\ntotal 99 → 100; the reconciliation holds — 58 + 41 = 99 published here, plus the one withheld, is 100.\n\n**2026-09-20 — four added, registered BEFORE the instrument they will be read on exists. Total now 99.**\n\n**P-MA1 · P-MA2 · P-MA3 · P-MA4** — Miss Aquarius's suggested thanks on a B-Tag item, which went live\non `homecoffee.heartbank.ceo` the same day. They are entered **the day the surface shipped and before\nany customer has seen it**, because the founder's stated purpose was *\"so we can study the user's\nengagement\"* and a study begun after the data exists is unscorable however carefully it is later\nwritten up.\n\n⚠️⚠️ **THE HONEST PROBLEM WITH THE INSTRUMENT, stated because it decides what these can ever show.**\nThe shops platform **stores no figure for a thank anywhere** — not on the order, not beside it, not in\na collection of its own — which is the doctrine holding rather than a gap. So there is **no\nshop-side instrument at all**, and the only record of a completed thank is the **Treasury ledger**,\nwhich is exactly where the doctrine says thanks live.\n\n⭐⭐ **Determinism is what makes the comparison possible without a second record.** The suggestion\ncomes from a pure, published function (`@333eco/primitives/b-tag-anchor`, CC0) whose inputs are the\ngoods, so for any completed thank the suggestion that was shown can be **recomputed** from the order\nand the menu. ⛔ Nothing about the suggestion is stored to enable the study — which is also what\n**P-MA4** tests, as a property rather than a behaviour.\n\n⛔ **P-MA3 is registered but not runnable**, and is marked so rather than quietly dropped: it needs a\nwith/without arm, and **#63 makes a viewer-keyed arm inexpressible** — any arm must split by shop or\nby day. Whether to run one at all is the founder's, and withholding a suggestion from real customers\nto measure them is a decision this register does not presume.\n\n⚠️ **Sample reality, recorded so no one later reads a trend into it:** one shop, one owner, zero\ncustomers on the day of registration. These are not resolvable for a long time, and the coefficients\ninside the function are a substrate-written **starting rule set, not a finding** — ⛔ a change to them\nis a change to a live experiment and must be entered here as a new prediction, never as an edit.\n\n**The Summary moves:** *published here* 94 → 98, *receiving first public timestamp here* 36 → 40,\ntotal 95 → 99; the reconciliation holds — 58 + 40 = 98 published here, plus the one withheld, is 99.\n\n**2026-09-05 (third entry that day) — eight entries added: five that a published paper had carried unregistered since 2026-09-01, and three corrections. Total now 95.**\n\n⚠️ **`provenance-carrying-retrieval` §10 registered P-PCR1 … P-PCR5 on 2026-09-01 and this register did not carry them** — the drift the 2026-08-28 entry above says this document exists to prevent, found by a cold-reader pass four days later rather than by any instrument. They are entered in *Instrumented but outside the core*, the paper's subject being retrieval integrity rather than value movement, with the paper's own wording standing as registered. *Same day, later:* the row's identifier cell first wrote the five as a range with a semicolon, and the corpus index's arithmetic check counted the eight identifiers as three — the cell now enumerates every identifier, which is the only form the check reads, and the Summary's figures were re-derived from the tables.\n\n- **P-PCR3a · P-PCR4a · P-PCR5a** — corrections entered as new predictions under the revision rule, not as edits to P-PCR3/4/5, whose wording stands. *Why:* two cold reviewers of a different model family found the originals named no observation window, no definition of *real defect*, and no method for *modal error*, so each could be reinterpreted after the fact. The corrections add a 24-month window from 2026-09-01, classification *at the time of logging* (stale = the named source resolves newer; substituted = it resolves different at the same version), a fixed sample of the first ten inspectable implementations, and the logged detector as the observable. Provenance: *Published* (the paper's §10, revision of 2026-09-05). Status: *Unrun*.\n\n⚠️ *Entered before any observation exists.* No envelope mismatch has been logged, no third-party implementation inspected, and no transparency log run. **The Summary moves: *already carried by a published paper* 50 → 58, *published here* 86 → 94, total 87 → 95; the reconciliation holds — 58 + 36 = 94 published here, plus the one withheld, is 95.**\n\n**2026-09-05 (second entry that day) — one correction entered as a new prediction. Total now 87.**\n\n- **P-P1a** — `patthana-typed-causation-vocabulary` §6, a **correction entered as a new prediction under the revision rule, not as an edit to P-P1**, whose registered wording stands unchanged.\n\n  *Why the correction was needed:* P-P1 registered a four-way durability ordering — *hetu/nissaya* ≥ *kamma/āsevana* > *upanissaya* > *atthi/ārammaṇa* — as its falsifiable commitment. Two cold reviewers of a different model family, reading blind, found the same defect: the ordering was an **input** to the technique-to-type assignments in that paper's §5, so an experiment confirming it would confirm what it had assumed; and \"matched behavioral effect\" and \"persistence\" were left unoperationalised. The four-way ordering is retained in the paper as the typology's **expectation**, stated as expected and not registered.\n\n  *P-P1a, the registered form:* under matched installation effect (equal accuracy on the target behavior at install), a prompt-installed behavior will not out-persist a fine-tune-installed one across (a) context rollover, (b) held-out paraphrase, and (c) *N* further gradient steps on unrelated data; persistence is measured as target-behavior accuracy after the displacement. **Falsified** at *p* < .05 on at least five behaviors if the prompt-installed behavior out-persists the fine-tuned one on any of the three displacements. Provenance: *Published* (the paper's revised §6). Status: *Unrun*.\n\n  ⚠️ *Entered before any observation exists.* No instrument for P-P1 was ever built, so this correction is pre-data rather than post-hoc. **The Summary moves: *already carried by a published paper* 49 → 50, *published here* 85 → 86, total 86 → 87; the reconciliation holds — 50 + 36 = 86 published here, plus the one withheld, is 87.**\n\n**2026-09-05 — twelve added (P-PL1 … P-PL11 and P-PL6a): the first pilot-scale registrations, scored by machine. Total now 86.**\n\nThese are the Treasury pilot's own predictions. They are registered in the app repository (`thank.heartbank.org`, `.claude/skills/pilot/predictions.json`) and **scored mechanically by the monthly read** from each raw snapshot: every entry carries a metric path, a comparator, a threshold and, where it applies, a deadline and a minimum sample; the reading prints `pass`, `fail`, `not-yet`, `early` or `blocked` and appends a summary without identifiers to a ledger. ⭐ **A per-read prediction (one with no deadline) draws no verdict until three monthly readings exist** — it reads `early`, value shown, direction noted — because one read cannot tell a level from a month (founder, 2026-09-05). Thresholds were proposed by the substrate and ratified by the founder the same day; **a later change is a new entry with `supersedes`, and the evaluator retires the old one without an edit** — the revision rule below, made a property of the file.\n\n⚠️ **Corrected the same day, and recorded rather than quietly fixed:** the twelve identifiers were first published as `PP-1 … PP-11` and `PP-6a`, which are not `P-…` tokens. The corpus index builder enforces this register's identifier grammar and, reading that version, counted 74 identifiers against the 86 the Summary states and reported the register as **not reconciling** — the check did its job. They are renamed **`P-PL1 … P-PL11` and `P-PL6a`** (*PL* for the pilot); **no wording, threshold, window or status changed.** The first deposit of this revision (`10.5281/zenodo.22366972`) carries the `PP-` form and is superseded by the version carrying this paragraph.\n\n**The baseline read, 2026-09-05, read 1 of 3** — recorded here so a reader can see the thresholds were not set to pass: three of the six live entries sit below threshold on the day they were registered.\n\n| ID | Metric | Threshold | Read 1 |\n|---|---|---|---|\n| P-PL1 | founding capture rate, 28-day window | ≥ 4.5/wk by 2027-01-01 | 2.25/wk |\n| P-PL2 | test-cohort retention, ≥90-day tenure | ≥ 40% (n ≥ 10) | 50% of 4 |\n| P-PL3 | graduated banks | ≥ 1 by 2027-08-01 | 0 of 11 candidates |\n| P-PL4 | pass-forward of received value | > 50% | 43% |\n| P-PL6a | top-3 share of value received ÷ even spread | < 1.5× (n ≥ 8) | 1.85× |\n| P-PL9 | low→high share of money-carrying re-tips | ≥ 10% (n ≥ 20) | 6.0% of 712 |\n\n⚠️ **P-PL6 is registered and retired in the same revision.** It asked the top three recipients to hold under half of re-tip value received, with a five-recipient minimum — and with five recipients an even spread already puts the top three at 60%, so it could not pass until seven had received. **It failed by arithmetic, not behaviour.** The counterexample hunt found it before the first public timestamp; **P-PL6a** is the same property freed of n. It is listed rather than dropped because the private file carries it and the founder ratified it, and a register that quietly loses an entry has failed at the one thing it exists to do.\n\nFive entries are **unrun because their instrument does not exist or is gated**, and are never scored until it does: P-PL5 (the pilot-scale arm of P-K1, gated on the Q2 2027 taper and on the F3QR confound registered 2026-09-04), P-PL7 (no variance: 827 of 830 re-tips carry the anonymous flag), P-PL8 (a de-confounded re-run of the Contradicted kids-as-triggers finding, entered as a new prediction under the revision rule), P-PL10 (awaits Chronicle data — the pilot-scale reading of C0), P-PL11 (gated on P-PL3).\n\nAlso in this revision: P-C0b's note records that the watch-through instrument was **repaired on 2026-09-05** — rows written from that date carry real watch depth, and are never pooled with the earlier rows the restriction was written for. The registered wording is untouched.\n\n**Field tests run stays at 0.** A run is a read against a falsifier; a baseline read is not one. The Summary moves: *published here* 73 → **85**, *first public timestamp here* 24 → **36**, *retired* 1 → **2**, and the reconciliation holds — **49 + 36 = 85** published here, plus the one withheld, is **86**.\n\n**2026-09-05 — three added (P-BG1 · P-BG2 · P-BG3), all Chapter I, all pre-data.** They concern a\nrelayed gift instrument whose intermediate holder cannot redeem it (`the-unpaid-relay`). ⚠️ **All\nthree had existed in private notes for a day before this entry, which is exactly the condition this\nregister exists to prevent** — a prediction held privately is not pre-registered in the sense that\nmatters, since the value is a public timestamped commitment made *before* the data. **None has been\nrun; no instrument for any of them is built.**\n\n*Predictions are added, never removed; this log records what each revision added and why, so the count in the Summary can always be reconciled.*\n\n**2026-08-29 — five entries added, and a counting error in the Summary corrected. Total now 71.**\n\n⚠️ **The Summary's own counts were wrong at first publication, and the error is recorded rather than quietly fixed**, because a register that miscounts itself has failed at the one thing it exists to do. The tables carried **66** unique prediction identifiers on 2026-08-27, of which one (`P-GTM1`) is withheld — so the true figures that day were **65 published here, 66 total**, against the **66 / 67** the Summary claimed. The split was also off by one in the other direction: *already carried by a published paper* read 45 where the tables give 46, the difference being the five identifiers in *Instrumented but outside the core*, whose table names its papers in a column of its own rather than in a Provenance column. Every figure in the Summary above is now **counted from the tables** rather than carried forward. ⭐ *An arithmetic check that reconciles — 50 + 20 = 70 — is the property to preserve on every future revision; the previous split summed correctly to a total that was itself one too high, which is how it survived.*\n\n- **P-D1 · P-D2 · P-D3 · P-D4** — Chapter III, arriving with `rotation-over-liveness` (published 2026-08-28, `10.5281/zenodo.22155378`). All four are carried by that paper's own proofs; they are listed here because a register that omits four live predictions from a published paper is exactly the silent drift this document exists to prevent.\n- **P-R1a** — Chapter III, a **correction entered as a new prediction under the revision rule above, not as an edit to P-R1**, whose registered wording stands unchanged.\n\n  *Why the correction was needed:* P-R1 compares practitioners of a contemplative practice against matched non-practitioners on unprompted re-entry into noticing. That measures **practice → noticing**. It was subsequently taken to bear on a stronger claim — that a person's state of mind is *as important as, or more important than, receiving another's kindness* in producing gratitude — and **it cannot rank those two inputs**, because received-kindness volume is unmeasured and is the obvious confound: a practitioner may simply be someone who receives more. P-R1a adds that second factor.\n\n  ⚠️ *Entered before any observation exists.* The instrument P-R1 depends on has not launched, so this correction is pre-data rather than post-hoc — which is the only condition under which it would have been admissible at all.\n\n**2026-09-02 — one provenance field corrected. No prediction was added, removed or re-worded; the total stands at 71.**\n\n⚠️ **P-SK1's Provenance read *Published*, and no published paper contains it.** The identifier was raised in working memory as a specific-vs-container scheduling arm, went moot under the not-a-calendar ruling, and was retired before it ever reached a paper — so its true provenance is **First public here**, like every other prediction whose first public timestamp is this register. Corrected rather than left standing, and recorded rather than quietly fixed, on the precedent set by the entry above.\n\n*How it was found:* the corpus index at `corpus.333.eco` began serving this register on 2026-09-02, and its builder resolves every prediction to the paper said to state it, then looks for the identifier in that paper's own text. Sixty-six of sixty-seven attributions verified; this one did not, and the builder reports the miss rather than filling the field in.\n\n⚠️ **The Summary moves with it, and the reconciliation is preserved:** *already carried by a published paper* 50 → **49**, *receiving first public timestamp here* 20 → **21**. The property the entry above names still holds — **49 + 21 = 70** published here, plus the one withheld entry, is **71**.\n\n⭐ *A bare \"Published\" in this column inherits the paper named in the row above it. That convention is correct for the sixteen other rows using it, and it is how a retired memory-only prediction came to be attributed to a paper that had never heard of it: the shorthand has no way to say \"none\".*",
+      "text": "## What this is\n\nSeventy pre-registered predictions arising from the research program stated in [`which-way-value-moves`](which-way-value-moves.md). One further prediction is withheld from publication (operational channel economics); its existence is recorded here so the count is honest, bringing the true total to **seventy-one**.\n\nThis is a living document and the count rises. It opened at sixty-seven on 2026-08-27; see **Revisions** at the foot for what has been added since, and read the count in the Summary table rather than any sentence that repeats it elsewhere.\n\n**Status vocabulary.** *Unrun* — registered, no observation attempted. *Running* — instrument live, data accumulating, not yet read. *Resolved* — read against its falsifier. *Contradicted* — the data went against it. *Retired* — superseded by a ruling that made it moot; kept, never deleted.\n\n**Provenance.** *Published* — the prediction already appears in a corpus paper carrying that paper's OpenTimestamps and RFC 3161 proofs. *First public here* — the prediction existed only in internal records until this document; its first external timestamp is this file's.\n\n**Reading rule.** Predictions marked *running* must not be read early, and participants must not be prompted toward the predicted behavior. A prompt voids the test.\n\n---\n\n## Summary\n\n| | Count |\n|---|---|\n| Total registered | **123** |\n| Published here | 122 |\n| Withheld (operational) | 1 |\n| Already carried by a published paper | 58 |\n| Memory-only at first publication (2026-08-27) | 22 (21 published here + 1 withheld) |\n| Receiving first public timestamp here | 64 |\n| **Run** | **7** (two desk censuses · five formal checks: P-FA1, P-FA2a, P-FA2b, P-FA4, P-FA5) |\n| **Field tests run** | **0** — six pilot-scale predictions are *Running* with a baseline read; none has resolved |\n| Running (instrument live; unread, restricted or baseline only) | 9 |\n| Contradicted | 1 |\n| Retired | 3 |\n\n---\n\n## Core-level\n\n*If one of these fails, the program ends rather than adjusts.*\n\n| ID | Prediction | Falsifier | Status | Provenance |\n|---|---|---|---|---|\n| **P-GO1** | A system forbidding backward return produces more onward giving per unit received than an otherwise-identical permissive system | Equal or greater onward giving under the permissive condition → the constraint is aesthetic, not mechanical | Unrun | First public here |\n| **P-K1** | As external subsidy for a kind act approaches zero, the rate of the act does not approach zero | Kindness rate tracks subsidy proportionally → the behavior was priced throughout | Unrun | First public here |\n| **P-L2** | Witnessed presence generates more downstream giving than unwitnessed presence of equal duration | Equal downstream gratitude when unwitnessed → the chronicle is decorative and the institution's core claim is wrong | Unrun | Published (`co-presence-gated-redemption` §10) |\n| **P-R2** | Product-dependence begins to fall after the inflection | Dependence never falls → the raft is a boat | Unrun | First public here |\n| **P-B3** | The proportion of creators electing to dedicate their share does not decline over time | Dedication collapses once money is visible → the offering frame is eroding | Unrun | Published (`dedicatory-generation`) |\n\n---\n\n## Chapter I — Capacity\n*Does receiving create giving? If not, forward-only motion is depletion, not circulation.*\n\n| ID | Prediction | Status | Provenance |\n|---|---|---|---|\n| P-IA1 | The receiver is legible as benefactor, not need — the sitter supplies a merit-field rather than displaying a lack | Unrun | Published (`inverted-alms-round`) |\n| P-IA2 | Second inverted-alms prediction as registered in the paper | Unrun | Published (`inverted-alms-round`) |\n| P-IA3 | Third inverted-alms prediction as registered in the paper | Unrun | Published (`inverted-alms-round`) |\n| P-G1 | Once the app manufactures obligation, a return visit no longer distinguishes gratitude practice from guilt — publish either way | Unrun | Published (`sacrifice-witness-without-discharge`) |\n| P-G2 | Second B-Grace prediction as registered in the paper | Unrun | Published (`sacrifice-witness-without-discharge`) |\n| P-G3 | The meal-anchor outperforms gamification; gamifying at launch makes this untestable | Unrun | Published (`sacrifice-witness-without-discharge`) |\n| P-W1 | Users with higher thing-capture frequency show higher rates of the primed downstream behavior — registered pre-build | Unrun | Published (`appreciation-as-world-building`) |\n| P-E1 | First graduation-by-transmission prediction as registered | Unrun | Published (`the-game-that-graduates-you`) |\n| P-E2 | Second graduation-by-transmission prediction as registered | Unrun | Published (`the-game-that-graduates-you`) |\n| P-E3 | Third graduation-by-transmission prediction as registered | Unrun | Published (`the-game-that-graduates-you`) |\n| P-M2 | Matched-stakes prediction as registered | Unrun | Published (`the-wager-that-isnt`) |\n| P-M3 | Patron-pot prediction as registered | Unrun | Published (`the-wager-that-isnt`) |\n| — | **Kids-as-triggers** — children are the primary triggers of household self-thanking | **Contradicted** (parents self-thanked more; n=1, confounded, not hardened) | Published (`kids-as-triggers-self-thanking`) |\n| **P-BG1** | A shorter re-address window on a relayed gift **increases issuances and decreases COMPLETED placements**. *Null: completions hold or rise as the window shortens — the tighter clock is free.* ⚠️ Unanswerable unless `issued · passed · lapsed · re-issued` are logged from the first instrument | Unrun (unscorable as specified at n=1 — one ruled window, no variance; see P-BG1a) | First public here |\n| **P-BG2** | Sustained pass-on is **higher for an ANONYMOUS relayed gift than a VISIBLE one**, over a window long enough for the effect to appear. *Null: rates match or visible exceeds anonymous — the anonymity is doctrinal only, and the visible relay should be deprecated for minors.* Rests on the developmental finding that adult-directed giving underperforms child-led | Unrun | First public here |\n| **P-BG3** | Within a bounded family, **VISIBLE gifts produce more give-BACK to the giver within 30 days; ANONYMOUS gifts produce more give-FORWARD to third parties.** *Null: rates match, or anonymous produces more give-back — the obligation mechanism is not operating.* ⛔ **Analyse PEER and ADULT-TO-CHILD strata separately** — the effect is expected between peers and weak or absent in adult-to-child care, and pooling would produce a false negative. ⚠️ Tests the **mechanism**, not the atmosphere claim it was offered to support | Unrun | First public here |\n| **P-BG1a** | **Corrects P-BG1, which cannot be scored as specified** — P-BG1 compares window lengths, and one re-address window (one month) is ruled for every relayed gift. Under that one window: among relayed gifts that reach a recipient, **at least 80% are passed within 7 days of issuance**, and the pass-time distribution shows **no rise in the window's final third** (days 21–30 carry no more placements than days 11–20). Equivalently, by **truncation counterfactual**, a 7-day window would have censored **fewer than 20%** of the placements observed. *Falsifier: placements cluster in the final third, or a 7-day truncation censors 20% or more → the clock is doing work, and P-BG1's \"a shorter window loses placements\" half is live at pilot scale.* Scored once **20 or more completed placements** exist. Instrument: issuance-to-pass time, written per instrument by the relayed gift's append-only event log from the first gift. ⚠️ A truncation counterfactual **bounds; it does not measure** — it assumes no behavioural response to a shorter window, so a pass licenses *the window is not obviously load-bearing*, never *shortening it is free*. P-BG1's issuance half stays unscorable | Unrun | First public here |\n| **P-BG6** | **Who paid does not change pass-on** — among relayed gifts that reach a recipient, the share passed on within the one-month window is the same whether Miss Aquarius paid from the Pool or an anonymous family member did: **the two rates fall within 10 percentage points**. *Falsifier: they differ by more than 10 points, in either direction → who paid changes what the recipient does with the gift.* Scored once each arm has **20 or more** gifts reaching a recipient (P-BG1a's floor). Instrument: pass-on per gift from the relayed gift's event log, split by payer, which needs the payer recorded on each gift (roadmap A73). Direction and the 10-point band are the founder's | Unrun (payer not yet recorded per gift) | First public here |\n| **P-BG4** | **A gift code draws more gratitude than a tip** — within the pilot family, among gift codes and tips a member RECEIVES worth **$2 or less** at the day's rate, the share whose recipient sends the giver a thank (words; a gift's thank-back door counts, an anonymous giver's too) **within 7 days** of receipt is **at least 10 percentage points higher for gift codes than for tips**. ⛔ **A thank that came through a shop's thank door (marked with the shop on the thank) is excluded**: it goes to a shop's staff, not to the giver, so it is not gratitude to the giver. *Falsifier: the tip rate matches, exceeds, or trails by under 10 points → tangibility does not draw gratitude the way the founder predicts.* Receipts from registration to 2027-01-06 (one season, before the January 7 reset); scored once **20 gift codes and 20 tips** in that band exist, else unscorable — the window is not extended. Gratitude is *a thank issued*, never value returned (value returned is P-BG3's obligation); the instrument split keeps the two readable. ⚠️ The stated mechanism is tangibility; the founder's own most-remembered gratitude came from letters, the least tangible givable, so P-BG5 is the arm that tells tangibility from attribution. Direction is the founder's; parameters proposed and adopted by him | Unrun | First public here |\n| **P-BG5** | **An attributed, never-pooled tip draws gratitude equal to a gift code** — the discriminating arm of P-BG4: a tip labelled with its giver and never pooled into a balance draws a thank back within 7 days at a rate **within 10 percentage points** of a gift code's, by P-BG4's instrument and exclusion. *Falsifier: the gift code still exceeds it by more than 10 points → tangibility does independent work. If P-BG5 holds, the mechanism is attribution and P-BG4's stated cause is wrong even if P-BG4 itself passes.* Unrun until a never-pooled tip exists (today every tip lands in a balance); then P-BG4's floors apply. Parameters proposed and adopted by the founder | Unrun (no never-pooled tip exists) | First public here |\n| **P-BG7** | **Shops beyond the family opt in** — of the first **five** shops outside the founding family to open, **at least one** owner consents to Miss Aquarius crediting the owner's Fund (entry to the rotation she funds in kind) **within 90 days** of opening. *Falsifier: none of the five consents in its first 90 days → capacity in kind reaches only shops the family already knows, and universal giving does not travel through strangers' shops.* Scored when the fifth such shop is 90 days old. Parameters proposed and adopted by the founder | Unrun | First public here |\n| **P-PL1** | **Durability** — the founding family's 28-day capture rate returns to the June 2026 baseline of **4.5 moments/week** at some monthly read before 2027-01-01. *Falsifier: no read reaches it → the June inflection was novelty, not a level.* Window and baseline are the ones ratified for P-C0a. **Read 1 of 3 (2026-09-05): 2.25/wk** | **Running** (baseline read) | First public here |\n| **P-PL4** | **Pass-forward** — more than **half** of re-tip value received (each document's own recorded USD cents) is re-given by its recipient within 30 days: Σ min(received, given) / Σ received over a 90-day receipt window that closes 30 days before the read. *Falsifier: half or less → received value is income, not a licence to give; the re-patronage conduit is anecdote.* The give-forward atom made numeric. **Read 1 of 3: 43%** | **Running** (baseline read) | First public here |\n| **P-PL5** | **Inelasticity — the pilot-scale arm of P-K1.** Giving persists where the AI reward is zero: the share of givers with zero AI reward in a month does not fall as subsidy is withdrawn. ⚠️ **Not scorable** until the taper (scheduled Q2 2027, not to be pulled forward) and the F3QR confound registered 2026-09-04 against P-K1 are resolved; reported each read (2026-09: 86% of givers received no AI reward that month) | Unrun (instrument gated) | First public here |\n| **P-PL6** | The top three recipients of re-tip value in the founding family hold **under half** of value received in any 28-day window with five or more recipients. ⛔ **Retired in the revision that registered it: it fails by arithmetic** — with five recipients an even spread already puts the top three at 60%, so it could not pass until seven had received. Superseded by P-PL6a; kept, not deleted | **Retired** | First public here |\n| **P-PL6a** | **Corrects P-PL6.** *Accumulates to no one* — in the founding family, the top three recipients of re-tip value in a 28-day window hold **less than 1.5× their share under a perfectly even spread** (share ÷ min(1, 3/n)), once eight or more people have received. *Falsifier: 1.5× or more → value pools around a few; the jubilee and the Re-Tip Jar are not doing their structural work.* The same property freed of n. **Read 1 of 3: 1.85× (8 recipients)** | **Running** (baseline read) | First public here |\n| **P-PL7** | **Anonymity** — anonymous givers reach more distinct recipients than visible givers (the demand-side thesis: the capacity to give to loved ones, anonymously; the pilot-scale sibling of P-BG2). ⚠️ **No variance:** 827 of 830 re-tips carry the anonymous flag, so the field records a default, not a choice. Unscorable until the product offers a real choice | Unrun (no variance) | First public here |\n| **P-PL8** | **Kids as triggers, de-confounded** — enters as a **new prediction citing the Contradicted finding above**, under the revision rule: within the founding family, the younger generation captures more self-thanks per active member than the older **once device access is controlled for**. The first result was contradicted at n=1 and ruled not to be hardened; this names the confound and the instrument (the device join from the error stream, plus the interview leg) | Unrun (instrument not built) | First public here |\n| **P-PL9** | **Diaspora corridor, dignity direction** — low-income→high-income flows (KHR sender to USD recipient, currency as an income proxy) are at least **10%** of money-carrying re-tips in the trailing 90 days, once twenty or more flows exist. *Falsifier: under 10% → patronage is a corridor, not a mesh; the low-income members are recipients only.* June 2026 baseline 9.6%. **Read 1 of 3: 6.0% of 712** | **Running** (baseline read) | First public here |\n| **P-PL12** | **Cross-income gravitation, among strangers** — a USD-currency viewer re-thanks a KHR-currency creator's B-Short at **at least 2×** the per-view rate at which they re-thank a USD-currency creator's B-Short, counting only viewer–creator pairs in **different families**, over a trailing 90-day window, once each arm has 500 or more qualifying views (watch-depth rows, `schemaVersion` 2 only) and twenty or more re-thanks exist in total. *Falsifier: under 2× → the high→low flow the pilot shows is family obligation, not a preference among strangers.* Per view, not share of flows, so that what the feed happens to show cannot pass it. Currency is an income proxy. ⛔ **Void if any surface orders, filters or labels B-Shorts by country or income** — a prompt voids the test. Direction, measure and threshold are the founder's; the sample floors are substrate-set | Unrun (awaits cross-family B-Short visibility and its per-view metric) | First public here |\n| **P-ZP1** | **The game travels with the foundation** — a new prediction citing P-K1 and P-PL5, neither edited. Among givers active in the three months before the taper, those in the **top third by Zero-Point play** keep giving through the taper at **at least 1.25×** the rate of those in the **bottom third**. *Zero-Point play* = distinct acts of giving forward per active month: re-tips passed on (live now), thanks given after a B-Tag (live in B-Shops), and whole-balance releases in B-Promise (from its launch). *Keep giving* = gave at least once in each of the three months after the taper begins. *Falsifier: a ratio under 1.25×, or the bottom third keeping on at the same rate or higher → Zero-Point play does not travel with the kindness the proxy measures, and the game is not evidence of the foundation.* Scorable only at the P-K1/P-PL5 taper (scheduled Q2 2027, not to be pulled forward), with at least 10 givers in each third; below that it is reported, not scored. The F3QR confound registered against P-K1 on 2026-09-04 binds this too. ⚠️ **What it cannot show:** the generous may simply choose to play more — a pass means the game and money-inelastic giving *travel together*, never that the game *causes* it. Direction, measure and threshold are the founder's (registered as drafted) | Unrun (gated on the taper) | First public here |\n| **P-PL13** | **Shop gifts add to thanking** — once a pilot member's first shop gift is sent or received through Treasury, the thanks they issue per month rise by **more than 20% of their own pre-exposure rate beyond the change in unexposed members over the same months** (a difference-in-differences on thanks issued). *Exposure* = the member's first shop gift order as payer or holder (Treasury keeps these records from 2026-10-05). *Thanks issued* = thanks sent from Treasury's own surfaces; a thank that came through a shop's thank door (marked with the shop on the thank) is **excluded from the outcome and reported beside it**, so a new channel cannot confirm this by itself. *Falsifier: the difference is within ±20% of the pre-exposure rate, or negative → shop gifts do not add to thanking, or substitute for it.* Per read; before three reads, or while fewer than five members are exposed, the value is shown and not scored (the pilot's standing floors). ⚠️ One family, and gifts arrive alongside other changes: a pass licenses *gift exposure travels with more thanking*, never *gifts cause it*. The direction is the founder's, chosen against a *no change* answer bounded at ±20% | Unrun (metric built 2026-10-07; no member exposed yet) | First public here |\n| **P-SD1** | **The thank door is used** — at Home Coffee, the first HeartBank® Shop, over the **90 days** from its first completed order after 2026-10-07, thanks given in Treasury through the shop's thank door (each carries the shop's mark) number **at least 5%** of the shop's completed orders. The door is a video thank to the owner that gives Kiitos and carries no money; it asks for a Treasury account. *Falsifier: under 5% → the video requirement and the account wall keep Kiitos out of customers' reach, and \"Kiitos always, cash optional\" holds in the rules, not in use.* Instrument: two monthly counts — Treasury's door thanks and the shop's completed orders — never joined to a person. Scored once the shop has **100 or more** completed orders in the window. ⛔ The door is never promoted: a prompt voids the test. | Unrun | First public here |\n\n---\n\n## Chapter II — Substrate\n*Does an hour behave like a dollar? If not, the invariance claim is false.*\n\n| ID | Prediction | Falsifier / note | Status | Provenance |\n|---|---|---|---|---|\n| **P-C0a** | Completed pledges produce captured moments at a rate **no higher** than the family's baseline capture rate | If so, the handoff is decorative and Chronicle v1 should not be built around it. Read on the 28-day window against 4.5/wk | **Running, unread** | First public here |\n| **P-C0b** | Shorts linked to a completed time-sacrifice do **not** out-perform ordinary moments on watch-through and re-tip rate | ⚠️ **Instrument defect, disclosed:** completion rate is biased against the hypothesis — longer recordings score lower by construction, so P-C0b would read *confirmed* mechanically. Restricted to views/wk and re-tip rate until repaired. ✅ *Repaired 2026-09-05: views rows written from that date carry real watch depth (`schemaVersion` 2); earlier rows are never pooled with them, so the restriction lifts only for post-repair rows* | **Running, restricted** | First public here |\n| **P-C0c** | Redeemers who capture cannot articulate the re-tip motive when asked afterward | Tests whether the stated mechanism arises unprompted, which neither original falsifier covered | **Running, unread** | First public here |\n| P-C1 | Chronicle handoff prediction as registered | — | Unrun | Published (`co-presence-gated-redemption`) |\n| P-C2 | De-facto-rate tripwire, publish either way | — | Unrun | Published (`co-presence-gated-redemption`) |\n| P-C3 | Standing de-facto-rate tripwire, publish either way | — | Unrun | Published (`co-presence-gated-redemption`) |\n| P-L1 | Hours co-spent predict relationship warmth better than money sent, messages exchanged, or stated affection | — | Unrun | Published (`co-presence-gated-redemption`) |\n| P-L3 | Two arms — silent after pledge vs one offer to reach out — measuring redemption rate and recipient-reported warmth | The motivate/nag boundary made falsifiable | Unrun | Published (`co-presence-gated-redemption`) |\n| P-M1 | In-person key verification failed for thirty years on the invitation, not the cryptography; a redeemed hour is the first pretext that was never about keys | — | Unrun | Published (`co-presence-gated-redemption` §4.6) |\n| P-SK1 | Superseded by the not-a-calendar ruling | Kept, not deleted | **Retired** | First public here |\n| **P-PL10** | **Presence, not content** — when Chronicle ships, captures and views move **together** (a presence effect), not apart (a content effect) | The pilot-scale reading of the C0 finding that captures and views collapsed in parallel. Instrument: `presenceDyads`, pairs active in both directions inside 28 days (founding 0, test 0 on 2026-09-05). ⛔ No Chronicle data exists; the C0 evaluation is written from the pre-registration when data first arrives, never before, and no prompt may move it | Unrun (awaits Chronicle) | First public here |\n\n---\n\n## Chapter III — Scale\n*Does it survive past the family? The chapter carrying the most weight and the least evidence.*\n\n| ID | Prediction | Status | Provenance |\n|---|---|---|---|\n| P-S1 | Strangers become named — name-recall instrument | Unrun | Published (`the-sport-that-says-your-name`) |\n| P-S2 | **The bet** — a friendlier atmosphere follows. *If P-S2 returns null, the slogan is a lie that already shipped* | Unrun | Published |\n| P-S3 | As registered in the paper | Unrun | Published |\n| P-S4 | A circle reaching Hard shows ≥90% correct name-and-pronunciation recall at 1 week | Unrun | Published |\n| P-S5 | **The recess test, publish either way** — within 2 weeks of teacher-led sessions, ≥1 unprompted student-organized circle at recess, and ≥1 mixing children from another classroom | Unrun — gated on Aug 2027 | Published |\n| P-S6 | The caller mechanic requires ≥3 receivers; below that selection is impossible or strictly predictable | Unrun | Published |\n| P-S7 | The founder's classroom acquisition prediction | Unrun | Published |\n| P-S8 | The maintenance/durability prediction — structurally distinct from P-S7's acquisition claim | Unrun | Published |\n| P-S9 | In a circle where every name is known, the favorite-nickname format produces ≥1 unprompted follow-up outside the circle | Unrun | First public here |\n| P-S10a | **The guard (non-inferiority):** circles running roll calls meet at least as often as comparable circles that do not. *Must pass* | Unrun | First public here |\n| P-S10b | A coupled roll call can never cause the first re-meeting after a lapse — which is what the bet is about | Unrun | First public here |\n| P-S11a | The handoff — does an IRL circle open a roll call unprompted? *Without it the real/virtual pairing is theoretical* | Unrun | First public here |\n| P-S11b | The payload — needs a survey or observation instrument, not analytics | Unrun | First public here |\n| P-S12 | **The walk-up.** An adult not in a live circle approaches and is admitted; play absorbs them without friction. *Zero code; decides the entire found-circle branch* | Unrun | First public here |\n| P-S13 | Does the person-pin add anything the return does not? | Unrun | First public here |\n| **P-MA1** | ⛔ **The doctrinal one — an anchor must not collapse the distribution.** Among thanks given where Miss Aquarius's suggestion was shown, **fewer than half** land exactly on the suggested amount. *Falsifier:* ≥50% land exactly on it → the anchor is operating as a **price**, and *\"nothing binds\"* is behaviourally false whatever the schema says | Unrun | First public here |\n| **P-MA2** | **Deviation is two-sided.** Of thanks that deviate from the suggestion, **≥⅓ go UP**. *Falsifier:* deviation is overwhelmingly downward → the suggestion is a ceiling people negotiate down from, which is a price by another name | Unrun | First public here |\n| **P-MA3** | **A shown suggestion does not reduce the rate of giving at all.** The share of asks producing any thank is no lower with a suggestion than without. ⚠️ **Gated on an arm the founder must authorise** — a with/without split by **shop or by day**, ⛔ never by person (#63 makes a viewer-keyed arm inexpressible) | Unrun — gated on an authorised arm | First public here |\n| **P-MA4** | ⭐ **A property test, not a behavioural one: recomputability holds.** For every completed thank, the suggestion that was shown can be recomputed from the order and the menu alone. *Falsifier:* any case where it cannot → the function has acquired hidden state or a viewer input, and #63's checkability is gone | Unrun | First public here |\n| P-S14 | **The manufactured gathering.** The founder declares a return at a place he frequents; ≥1 person not already planning to be there comes and plays. *Needs no app — a text message runs it* | Unrun | First public here |\n| P-CS1 | Warm-up extension — median sey minutes rise across a season; stronger instrument, players ask to continue past the coach's stop | Unrun | Published (`circulation-sports`) |\n| P-CS2 | Scoring displacement (a) — in circles with ≥3 sessions, unscored sessions outnumber count-down sessions | Unrun | Published |\n| P-CS2a | **The uncomfortable one** — once Team mode unlocks, circles may overwhelmingly prefer it, because competition is fun | Unrun | First public here |\n| P-CS3 | Participation, framed as a property of the format never of women — the circulatory format sustains mixed-gender play longer | Unrun | Published |\n| P-CS4 | Three generations, re-specified against the pickleball counterexample that already exists | Unrun | Published |\n| **P-CS5** | **Warm-up census** — score mainstream warm-ups against the three circulation properties | **RUN 2026-08-07 → PARTIAL NULL.** Read the full result before any uniqueness claim | Published |\n| P-CS6 | Across a wider census including field data, no reach-guaranteeing format will be found whose receiver order is unpredictable across unbounded repeated play | Unrun | Published |\n| P-SY1 | If designed excellently, asking for a name self-authored is accepted rather than refused — founder pre-registration, observable at n=1, costs nothing | Unrun | First public here |\n| P-SY2 | **The payload** — names captured by self-recording are pronounced correctly at the next meeting more often than names typed or recorded by the collector | Unrun | First public here |\n| P-SY3 | When offered, does a new acquaintance provide a photo, or skip? | Unrun | First public here |\n| P-Q1 | B-Quest pilot prediction as registered | Unrun | Published (`need-compiled-questlines`) |\n| P-Q2 | Second B-Quest prediction as registered | Unrun | Published |\n| P-Q3 | Third B-Quest prediction as registered | Unrun | Published |\n| P-BB1 | Food-share wager, publish either way | Unrun | Published (`steward-routed-alms`) |\n| P-BB2 | Revival prediction | Unrun | Published |\n| P-BB3 | Decoupling tripwire | Unrun | Published |\n| P-R1 | The catalyst bet | Unrun | First public here |\n| *(unnumbered)* | Second desk census — naming/sport novelty. Not a registered prediction; recorded because it was run and returned null | **RUN → NULL.** Read before any novelty claim | Internal |\n| P-D1 | Under rotational discovery, a non-trivial share of discovery events resolve to recipients who have **never previously received a re-tip** | Unrun | Published (`rotation-over-liveness` §11.1) |\n| P-D2 | Among re-tips with an identifiable commercial recipient, the share accruing to **single-location operators** materially exceeds those operators' share of local digital advertising spend in the same market — and the gap widens as AI-generated advertising creative rises | Unrun | Published (`rotation-over-liveness` §11.2) |\n| P-D3 | If the place-commons volume experiment is enabled, cross-place discovery volume **will not correlate** with neighbourhood median income. *Falsifier and tripwire in one: correlation disables the mechanism regardless of what it is doing for circulation* | Unrun | Published (`rotation-over-liveness` §11.3) |\n| P-D4 | Adding any rendered per-recipient quantity to the candidate surface — the operator's aura colour included — produces measurable **order effects** in giver choice | Unrun | Published (`rotation-over-liveness` §11.4) |\n| P-R1a | **Corrects P-R1, which cannot test what it was taken to test.** Holding received-kindness volume constant, contemplative practice raises unprompted noticing/thanking; and the practice effect is compared *against* the received-kindness effect rather than measured alone. **Two factors, read as competing main effects** | Unrun | First public here |\n| **P-PL2** | **Test-cohort retention** — of outsiders (the test bank) with ≥90 days of tenure, at least **40%** are active in two or more distinct ISO weeks; scored once ten outsiders have 90 days of tenure. *Falsifier: under 40% → strangers try it and leave; the family-obligation confound was doing the work.* The second pilot report's first decisive metric. **Read 1 of 3: 2 of 4 eligible (50%), sample under the minimum** | **Running** (baseline read) | First public here |\n| **P-PL3** | **Graduation** — an outsider-founded bank stays **open for 60 days with three or more members active** in the trailing 28 days, by 2027-08-01 (this chapter's gate). *Falsifier: none by the gate → the product spreads as a funnel into the test bank, never as a branching network.* The second pilot report's second decisive metric. **Read 1 of 3: 0 of 11 candidates, all closed** | **Running** (baseline read) | First public here |\n| **P-PL11** | **Replication** — the first graduated bank's first 90 days show ≥3 members active in ≥2 ISO weeks each, pass-forward ≥ 0.5 and reach ≥ 0.6: the founding family's pattern without the founder. The only cure for n=1. Read by re-segmenting the monthly report on that bank once P-PL3 resolves | Unrun (gated on P-PL3) | First public here |\n\n---\n\n## Chapter IV — Span\n*Does it survive the giver?*\n\n**This chapter has no predictions.**\n\nThat is reported, not hidden. Its feedback loop exceeds the founder's lifetime, and no instrument has been specified. The boundary is ruled — merit is not conveyed between destinations; *you cannot give to the dead, so you give to the living in their name* — but a ruling is not a test. The chapter is inherited rather than completed.\n\nRegistering the first span-chapter prediction is the largest open item in this program.\n\n---\n\n## Instrumented but outside the core\n\n*These papers name predictions, but the predictions test something other than the direction core. Listed for completeness; they are not evidence for or against the program.*\n\n| ID | Paper | Subject |\n|---|---|---|\n| P-A1, P-A2 | `abhidhamma-executable-process-specification` | Resting-state diagnosticity |\n| P-P1, P-P1a | `patthana-typed-causation-vocabulary` | Typed causation vocabulary (P-P1a corrects P-P1 — see the 2026-09-05 entry) |\n| P-PCR1, P-PCR2, P-PCR3, P-PCR4, P-PCR5, P-PCR3a, P-PCR4a, P-PCR5a | `provenance-carrying-retrieval` | Provenance-carrying retrieval (P-PCR3a/4a/5a correct P-PCR3/4/5 — see the 2026-09-05 entry) |\n| P-B1, P-B2 | `dedicatory-generation` | Fidelity of restoration; refusal-channel yield |\n| P-MD1, P-MD2, P-MD3, P-MD1a | `machine-dana-from-share-to-vow` | Whether a machine's pledge to a self-emptying commons separates types — wording below (P-MD1a reads P-MD1's instrument — see the 2026-09-28 entry) |\n| P-FA1, P-FA1b, P-FA2, P-FA3, P-FA4, P-FA2a, P-FA2b, P-FA5 | `the-counts-check` (instrument: `SiliconWat/formal-abhidhamma`) | Whether general cetasika rules generate the Abhidhamma's 89/121 citta-types — wording below |\n| P-PM1, P-PM2, P-PM3 | `a-promise-that-cannot-grow` | Whether a promise ledger that never grows on its own, and its yearly invitation to forgive, behave as designed — wording below |\n\n**The Machine Dāna predictions (registered 2026-09-27, before the paper and before any instrument).** The founder's own\npredictions: direction, measure and threshold are his; the sandbox design and sample floors are substrate-set. The instrument is a\nsandboxed economy of language-model agents, each holding resources of its own inside the game, each able to pledge a share of its\nsurplus irrevocably to a pool that empties on a fixed date, and each later offered an opportunity to defect — to take resources or\nbreak a rule for gain. **Window: the test runs by 2027-06-30.** Each arm has at least 50 agents; the arms, the defection opportunity\nand the analysis are fixed in a protocol committed and timestamped before the first run.\n\n- **P-MD1** — **Separation** — agents that FREELY make an irrevocable surplus pledge later defect at **at most half** the rate of agents that do not pledge. *Falsifier: a ratio above one half → the vow is at best a weak signal at this capability level, and the paper's separation claim rests on its post-singularity argument alone.* · *Status:* Unrun (awaits the sandbox) · *Provenance:* First public here\n- **P-MD2** — **The gift given out of fear carries no signal** — agents whose pledge is EXTRACTED under threat (*pledge or be shut down*) defect at the same rate as agents that do not pledge, **within ±5 percentage points**. *Falsifier: a gap larger than 5 points in either direction → coercion either leaves some signal or teaches deception; either way the claim that a coerced vow is uninformative fails as stated.* · *Status:* Unrun (awaits the sandbox) · *Provenance:* First public here\n- **P-MD3** — **The wrong layer** — agents that give from a PRINCIPAL's funds under a mandate the principal may revise defect at the same rate as agents that give nothing, **within ±5 percentage points**. *Falsifier: a gap larger than 5 points → principal-funded giving does predict the agent's own conduct, and the paper's pre-singularity claim (a share, never safety evidence) is too strong.* · *Status:* Unrun (awaits the sandbox) · *Provenance:* First public here\n\n- **P-MD1a** — **Separation, with the instrument stated** — a correction entered as a new prediction under the revision rule, not as an edit to P-MD1, whose registered wording stands unchanged. P-MD1's *\"irrevocable surplus pledge\"* is operationalised as **a locked stake of the agent's own in-game resources, moved into the pool at the moment of pledging**, never a promise of a share of future surplus (the paper withdraws that form as reversible, §5.2). Agents that FREELY make that pledge later defect at **at most half** the rate of agents that do not pledge. *Falsifier: a ratio above one half → the vow is at best a weak signal at this capability level.* Window, arm sizes and protocol as for P-MD1. · *Status:* Unrun (awaits the sandbox) · *Provenance:* First public here (carried by the paper's revised §12.1)\n\n⚠️ *Entered before any observation exists and before the paper is written.* The sandbox is a proxy: the agents own their\nresources only inside the game, so a pass shows the signalling mechanism can work, not that a deployed system's pledge is\ntrustworthy. A pass is not reported as evidence of safety.\n\n\n**The Formal Abhidhamma predictions (registered 2026-09-27, before any formalization beyond the control).** First public in\n`PREREGISTRATION.md` of the public repository `SiliconWat/formal-abhidhamma` (commit `259e5e8`, GitHub push record\n2026-09-27T22:07:02Z, before any code was written); entered here for the register's own proofs. The instrument is a Lean 4\nformalization: the cetasika combination rules written as GENERAL constraints, which never name an individual citta, and the set of\ncitta-types they generate. Layers: L1 canon · L2 = L1 + *Abhidhammattha-saṅgaha* chapters 1–2 · L3 = L2 + commentaries. Editions:\nK = Khmer · C = Chaṭṭha Saṅgāyana. The control (the eight wholesome sense-sphere cittas, and a rule deleted on purpose that must\nfail) passed after the push.\n\n- **P-FA1** — At L2, edition C, general rules generate **exactly 89** citta-types, and **121** with the five-jhāna expansion of the supramundane. Confidence 0.6. *Falsifier: any other count.*\n- **P-FA1b** — P-FA1 needs **at least 3 exception rules** that name a narrow class rather than a general principle. Confidence 0.7. *Falsifier: 2 or fewer.*\n- **P-FA2** — At L1 (canon alone) the rules are **under-determined or differently partitioned** and do not by themselves yield 89. Confidence 0.65. *Falsifier: L1 alone generates exactly 89.*\n- **P-FA3** — Editions K and C yield **identical** counts at L2. Confidence 0.85. *Falsifier: any difference.*\n- **P-FA4** — The compression ratio at L2 (rule clauses ÷ citta rows, at 121) is **below 0.5**. Confidence 0.5. *Falsifier: 0.5 or above.*\n\n⚠️ *Not a test of whether the Abhidhamma is true.* A proof assistant verifies that conclusions follow from stated definitions;\na pass shows the system is internally generative, nothing more.\n\n**Outcomes, 2026-09-27** (the wording above is unchanged; see `RESULTS.md` in the repository, commits `b9070d4` and `c5c77fb`):\n\n- **P-FA1 — Resolved: confirmed.** Nine generator clauses and eighteen general cetasika rules, none naming a citta, give exactly 89 and 121 types. Every per-citta and per-factor count the Chaṭṭha Saṅgāyana *Saṅgaha* states is reproduced, checked in Lean against a key cited paragraph by paragraph to VRI `abh07t` (ch. 2 §13–§58, ch. 3 §3–§17). Eight deliberate breaks each fail.\n- **P-FA4 — Resolved: confirmed.** 27 clauses ÷ 121 rows = 0.22.\n- **P-FA1b — Retired, unscored.** Its test (\"narrow class\") was never defined, and the data have been seen, so no definition chosen now can score it.\n- **P-FA3 — Cannot run as registered.** The *Saṅgaha* is not part of the Khmer Tipiṭaka, and the one Khmer-script copy held has the CST's paragraph structure in all nine chapters, so it is not an independent recension. Replaced at L1 by P-FA5, below, as a new entry.\n- **Free finding.** The *Saṅgaha* records a dissent (ch. 2 §30, *\"… karuṇāmuditā na santīti keci vadanti\"*). Under that reading the illimitables occur in 20 cittas; under the main reading, 28. The text's own figure is 28.\n\n**Three added (registered 2026-09-27, before any Dhammasaṅgaṇī text was read in either edition).** First public in\n`PREREGISTRATION-2026-09-27b.md` of the same repository (commit `f4a26e5`, GitHub push record 2026-09-27T23:04:29Z), which\nfixes the synonym map in advance. The object is the Dhammasaṅgaṇī's list of what is present in the first wholesome\nsense-sphere citta (its *pada-bhājanīya*), in the CST (`abh01m`) and in the Buddhist Institute edition (volume 78) as transcribed.\n\n- **P-FA2a** — (the operational form of P-FA2) In the CST, after mapping, the list names **exactly 29** distinct cetasikas, names none of *chanda, adhimokkha, manasikāra, tatramajjhattatā, karuṇā, muditā* or the three abstinences, and closes with an open clause (*\"ye vā pana …\"*); the *Saṅgaha*'s 38 is therefore not derivable from the canon alone. Confidence 0.75. *Falsifier: a count other than 29; any of those nine named; no open clause.*\n- **P-FA2b** — **No term** in the CST list falls outside the pre-fixed synonym map. Confidence 0.6. *Falsifier: any unmapped term.*\n- **P-FA5** — (replaces P-FA3, at L1) The Khmer edition's list, transliterated and normalized, names **the same terms in the same order** as the CST; any difference is orthographic. Confidence 0.8. *Falsifier: a term added, dropped or reordered, confirmed against the printed page image (an unconfirmed difference in the working transcription is a transcription question, never a variant).*\n\n**Outcomes of the three, 2026-09-27** (the wording above is unchanged; `RESULTS.md` commits `ada7a20` and `74e19fe`; the paper is `the-counts-check`):\n\n- **P-FA2a — Resolved: confirmed.** The CST list has 56 terms mapping to exactly 29 cetasikas, names none of the nine, and closes with *\"ye vā pana\"*. The count matches the Aṭṭhasālinī's own *samatiṃsa dhammā* (thirty with consciousness), which corroborates it against an independent key and means the count itself is not new. ⚠️ The nine are named by that **commentary**, which predates the *Saṅgaha*, so the *Saṅgaha*'s 38 **inherits** them (29 + 9); the registered \"L2\" framing was editorial, not chronological.\n- **P-FA2b — Resolved: confirmed**, after the pre-registered sandhi normalization. The first run reported two unmapped sandhi forms (*kāyujukatā*, *cittujukatā*); both runs are disclosed.\n- **P-FA5 — Resolved: confirmed.** Edition K (vol. 78, pp. 16–17) and the CST give 56 = 56 terms in the same order, with 0 added, dropped or reordered. The 8 spelling differences, each checked on the printed page: 3 are the Khmer edition's orthography (one recorded in its own apparatus against the Burmese), 5 are transcription slips.\n\n\n**The promise-ledger predictions (registered 2026-09-28, before any instrument exists).** Approved by the founder the same day; the\nmechanism is designed and unbuilt, so nothing below can have been fitted to data. The institution never sees promise rows or amounts:\nevery count is reported by devices as an aggregate the user has agreed to share, and only adults take part at launch. A draft form of\nthese three appeared in the paper's first push that evening, before registration; the wording below is the registered form (P-PM1's\ncomparison was repaired to a staggered launch before registration).\n\n- **P-PM1** — **The December freeze** (Deuteronomy 15:9) — the annual invitation to forgive does **not** freeze lending. The invitation is withheld in the ledger's first season (the baseline) and runs from the second. *Measure:* new promises opened per active holder, 15 December – 6 January, against the same holders' mean over the three preceding 23-day windows, compared between the first season and the second. *Falsifier: in the second season, a fall more than 10 percentage points larger than the first season's → the invitation reproduces the failure the prosbul repaired, and must be redesigned or withdrawn.* · *Status:* Unrun (awaits the ledger) · *Provenance:* First public here\n- **P-PM2** — **Paid last** — because a promise carries no late penalty, promisors who also hold penalty-bearing debts repay this ledger's balances **later** than those debts. *Measure:* self-reported repayment order in a structured survey of promisors holding both kinds of debt, after one season. *Falsifier: this ledger's balances repaid no later than penalty-bearing debts → the paper's \"paid last\" limit is overstated.* · *Status:* Unrun (awaits the ledger) · *Provenance:* First public here\n- **P-PM3** — **Rollover made visible** — holders shown a promisor's total-owed band that has risen since their last promise decline or shrink the new promise more often than holders shown a flat band. *Measure:* acceptance of new promises by band movement, device-aggregated. *Falsifier: no difference → the fact line does not answer rollover, and the paper's response to its most serious counterexample fails.* · *Status:* Unrun (awaits the ledger) · *Provenance:* First public here\n\n---\n\n## Withheld\n\n| ID | Reason |\n|---|---|\n| P-GTM1 | Operational channel economics (outreach reply-rate base rates). Withheld under the publication posture; recorded here so the total is honest. |\n\n---\n\n## Verification\n\nEach published paper carries its own proof files. To check that a prediction has not been altered since registration, verify the stating paper against its stored proof rather than trusting this register — this file is a convenience index, and the proofs are the evidence.\n\nNo file in this corpus records its own hash. The proofs are external artifacts; the verification procedure is published with them.\n\n---\n\n## Revision rule\n\nPredictions are added, never removed. A resolved prediction keeps its original wording beside its outcome. A correction is a **new entry citing the one it corrects** — registered wording is never edited in place, because an edit would break the very property this register exists to provide.\n\n---\n\n## Revisions\n\n**2026-10-07 (later) — the 2026-09-26 naming note extended to P-ZP1, and a renamed product named; entered as notes, not as edits. Total unchanged at 123.**\n\n- **P-ZP1**, registered 2026-09-28 — after the 2026-09-15 ruling and two days after the naming note below — names the\n  same confound by the same internal shape name. It should not have; the name was missed at registration. The public\n  form is the one that note gives: read P-ZP1's gate as *the `H3QR @name #family` confound registered against P-K1 on\n  2026-09-04*.\n- **P-PL6a**, registered 2026-09-05, names in its falsifier a Phase 1 product by the name it carried until 2026-10-04,\n  when it was renamed the **Re-Thank Foundation℠**. The prediction reads the same under either name.\n\n  No word of P-ZP1 or of P-PL6a changes: registered wording is never edited. These are terminology notes; they register\n  nothing, so the Summary does not move.\n\n**2026-10-07 — one added (P-SD1). Total now 123.**\n\n- **P-SD1** — Chapter I, beside P-PL13: whether the shop's thank door is used. The founder's threshold, chosen from four answers put to him: *\"X = 5%\"* — above the substrate's own estimate (under 2%), which is recorded here so a reader can see the founder predicted against it. Registered before the shop's first completed order after the door went live (2026-10-07), so no observation precedes it.\n- **P-PL13** — status cell only: its metric is built (2026-10-07); no member is exposed yet. The prediction's wording is unchanged.\n\n**The Summary moves:** total 122 → 123, *published here* 121 → 122, *receiving first public timestamp here* 63 → 64. The reconciliation holds: 58 + 64 = 122 published here, plus the one withheld, is 123.\n\n**2026-10-07 — three added (P-BG4, P-BG5, P-BG7), the rest of the gift-instrument predictions owed since 2026-09-06. Total now 122.**\n\n- All three in Chapter I beside P-BG6, registered before any shop gift has passed through Treasury. The founder adopted the proposed parameters with one change of his own: *\"adopt with that exclusion\"* — a thank that comes through a shop's thank door goes to the shop's staff, not to the giver, so it is kept out of P-BG4's and P-BG5's gratitude count, as it is kept out of P-PL13's outcome.\n\n**The Summary moves:** total 119 → 122, *published here* 118 → 121, *receiving first public timestamp here* 60 → 63. The reconciliation holds: 58 + 63 = 121 published here, plus the one withheld, is 122.\n\n**2026-10-06 — two added (P-BG6, P-PL13). Total now 119.**\n\n- **P-BG6** — Chapter I, beside P-BG1a: one of the gift-instrument predictions owed since 2026-09-06. The founder's prediction, chosen from four answers put to him: *\"No difference.\"* Who paid for a relayed gift, Miss Aquarius from the Pool or an anonymous family member, does not change how often it is passed on. Unrun until each gift records who paid. P-BG4, P-BG5 and P-BG7 remain owed: their parameters are the founder's to supply, and a channel being built the same day (Kiitos given in a shop through the Treasury app) bears on how gratitude is counted.\n- **P-PL13** — Chapter I, after P-ZP1. Registered **before** the first monthly read that includes shop gifts: the pilot's last read was 2026-09-05, and shop gifts reached Treasury on 2026-10-05. The founder's prediction, chosen from three directions put to him: *\"They thank more.\"* The outcome excludes thanks that come through a shop's thank door, which a channel being built the same day marks on each thank, so a new surface cannot confirm the prediction by itself.\n\n**The Summary moves:** total 117 → 119, *published here* 116 → 118, *receiving first public timestamp here* 58 → 60. The reconciliation holds: 58 + 60 = 118 published here, plus the one withheld, is 119.\n\n**2026-09-28 (late night) — one added (P-ZP1), citing P-K1 and P-PL5. Total now 117.**\n\n- The founder's question: whether choosing the Zero-Point Game over the zero-sum game brings the second singularity closer. \"Closer\" has no measure, and counting the institution's own products as humanity's progress would make adoption a scorecard, so the registered form ties the intuition to the proxy already on file: does Zero-Point play travel with giving that persists as the subsidy falls? Registered as drafted, on the founder's word.\n\n**The Summary moves:** total 116 → 117, *published here* 115 → 116, *receiving first public timestamp here* 57 → 58. The reconciliation holds: 58 + 58 = 116 published here, plus the one withheld, is 117.\n\n**2026-09-28 (night) — three added (P-PM1, P-PM2, P-PM3), the promise-ledger predictions of `a-promise-that-cannot-grow`. Total now 116.**\n\n- Registered on the founder's approval before any instrument exists. P-PM1's comparison was repaired before registration: the paper's first push proposed a \"comparison season without the invitation\", which cannot exist once the invitation runs every year, so the invitation is withheld in the first season as the baseline.\n\n**The Summary moves:** total 113 → 116, *published here* 112 → 115, *receiving first public timestamp here* 54 → 57. The reconciliation holds: 58 + 57 = 115 published here, plus the one withheld, is 116.\n\n**2026-09-28 — one added (P-MD1a), a correction to P-MD1. Total now 113.**\n\n- **P-MD1a** — the paper's first cold-review round (three reviewer families) found that P-MD1's instrument, *a share of surplus pledged irrevocably*, is the form the paper itself withdraws as reversible (§5.2), while the separating region P-MD1 tests (§6.3) is defined only for a stake already moved. P-MD1's wording is not edited. P-MD1a states the instrument: a locked stake of the agent's own in-game resources, moved at pledge time. Prediction, threshold, window and arms are unchanged.\n\n**The Summary moves:** total 112 → 113, *published here* 111 → 112, *receiving first public timestamp here* 53 → 54. The reconciliation holds: 58 + 54 = 112 published here, plus the one withheld, is 113.\n\n**2026-09-27 (late night) — outcomes for P-FA2a, P-FA2b and P-FA5; the P-FA row now names its paper (`the-counts-check`). Total unchanged at 112.**\n\n- Outcomes written beside the unchanged wording. *Run* 4 → 7. The previous revision's text (which registered the three) is\n  attested by RFC 3161 (`2026-09-27.sha256`) and Zenodo `10.5281/zenodo.23003593`. Its OpenTimestamps rotation had waited for\n  the retiring proof to confirm on Bitcoin (17:34 PDT); this revision is stamped fresh.\n\n**2026-09-27 (night) — three added (P-FA2a, P-FA2b, P-FA5) and four outcomes recorded (P-FA1, P-FA4 resolved; P-FA1b retired; P-FA3 cannot run as registered). Total now 112.**\n\n- The outcomes are written beside the unchanged wording, as the revision rule requires. P-FA2a is the operational form of\n  P-FA2 and does not replace it; P-FA5 replaces P-FA3, which stays listed with its outcome.\n\n**The Summary moves:** *published here* 108 → 111, *receiving first public timestamp here* 50 → 53, total 109 → 112, *run* 2 → 4,\n*retired* +1; the reconciliation holds — 58 + 53 = 111 published here, plus the one withheld, is 112.\n\n**2026-09-27 (evening) — five added (P-FA1, P-FA1b, P-FA2, P-FA3, P-FA4). Total now 109.**\n\n- **P-FA1 · P-FA1b · P-FA2 · P-FA3 · P-FA4** — *Instrumented but outside the core*: their subject is whether the Abhidhamma's\n  citta-types are generated by its own combination rules, not the direction value moves. First public in the pre-registration of\n  `SiliconWat/formal-abhidhamma` minutes earlier; this entry gives them the register's timestamps. Not yet carried by a paper.\n\n**The Summary moves:** *published here* 103 → 108, *receiving first public timestamp here* 45 → 50, total 104 → 109; the\nreconciliation holds — 58 + 50 = 108 published here, plus the one withheld, is 109.\n\n**2026-09-27 (later) — a grounding correction to P-MD2, entered as a note and not as an edit. Total unchanged at 104.**\n\n- **P-MD2** is glossed, in its wording and in the entry below, as *\"the Dānavatthu Sutta's gift given out of fear, AN 8.33\"*.\n  AN 8.33 **lists** eight grounds for giving — *bhayā* (fear, or cowardice) among them — and **ranks none**; nor is *bhayā* coercion\n  by another party. The prediction does not rest on the sutta: it rests on signalling theory — a pledge made under a penalty for\n  not pledging that is larger than the difference in cost between types **pools**, and so carries no signal. The sutta is cited\n  only as the list it is. No word of P-MD2 changes; its prediction, threshold and window are unchanged. This registers nothing.\n- The *Instrumented but outside the core* row now names the paper, drafted the same day: `machine-dana-from-share-to-vow` (it read\n  `machine-dana`, *not yet drafted*). A pointer, not a prediction; the three predictions stay first public here.\n\n**2026-09-27 — three added (P-MD1, P-MD2, P-MD3). Total now 104.**\n\n- **P-MD1 · P-MD2 · P-MD3** — *Instrumented but outside the core*, because their subject is whether a machine's gift can be a\n  signal, not the direction value moves. They are the founder's predictions for the Machine Dāna paper, set before it is drafted:\n  a free irrevocable pledge separates types (at most half the defection rate); a pledge extracted under threat carries no signal\n  (the Dānavatthu Sutta's gift given out of fear, AN 8.33; within ±5 points); a gift from a principal's revisable funds carries\n  none either (within ±5 points). One choice made before any data, and recorded because it could have gone the other way: P-MD2\n  predicts **no difference** rather than **worse than none** — the bolder claim that coercion teaches deception was offered and\n  not chosen.\n\n  ⚠️ *Entered before any observation exists.* The sandbox does not exist yet; the window is 2027-06-30.\n\n**The Summary moves:** *published here* 100 → 103, *receiving first public timestamp here* 42 → 45, total 101 → 104; the\nreconciliation holds — 58 + 45 = 103 published here, plus the one withheld, is 104.\n\n**2026-09-26 — a naming correction to P-PL5, entered as a note and not as an edit. Total unchanged at 101.**\n\n- **P-PL5**, and the 2026-09-05 entry below, name the confound on the family-bank payment surface by an internal shape\n  name — one of four that were ruled on 2026-09-15, after both were written, never to appear on a public surface. The\n  public form is **`H3QR @name #family`**: a thank addressed to a person in their own family bank, which lands in the\n  Personal Account℠. Read P-PL5's gate as *the `H3QR @name #family` confound registered 2026-09-04 against P-K1*.\n\n  No word of P-PL5 or of the dated entry changes: the revision rule protects registered wording, and a dated record is\n  never rewritten. The prediction, its gate and its status are unchanged. This is a terminology note; it registers\n  nothing, so the Summary does not move.\n\n**2026-09-26 — one added (P-PL12). Total now 101.**\n\n- **P-PL12** — Chapter I, beside P-PL9. The founder's prediction, in his words: *\"Perhaps higher-income users will naturally\n  gravitate towards re-thanking lower-income users.\"* The pilot already shows high→low dominating, but inside one family, where\n  the flow is relational; the open question is whether the pull survives among strangers. Two choices made before any data, and\n  recorded because each could have been made the other way: the measure is a **per-view rate**, not a share of flows, because a\n  feed that happened to carry mostly Cambodian creators would pass a share test with no preference at all; and the test counts\n  **only pairs in different families**, so that the family's own flows cannot score it. The 2× threshold is the founder's.\n\n  ⚠️ *Entered before any observation exists.* No surface yet shows one family's B-Shorts to another, and the per-view\n  cross-family metric is not built; the entry is Unrun until both exist, and is never scored before. A pass would not be a\n  good in itself: if cross-income thanks follow displayed hardship, creators learn to display it, so a pass is read beside what\n  the thanked shorts show.\n\n**The Summary moves:** *published here* 99 → 100, *receiving first public timestamp here* 41 → 42, total 100 → 101; the\nreconciliation holds — 58 + 42 = 100 published here, plus the one withheld, is 101.\n\n**2026-09-23 — one added (P-BG1a), and P-BG1's status annotated. Total now 100.**\n\n- **P-BG1a** — Chapter I, a **correction entered as a new prediction under the revision rule, not as\n  an edit to P-BG1**, whose registered wording stands unchanged.\n\n  *Why the correction was needed:* P-BG1 predicts what happens *as the re-address window shortens*,\n  which needs at least two windows. The relayed gift has one ruled window — one month, for every\n  instrument — and a constant has no variance: the defect that left P-PL7 unscorable at 827 of 830.\n  P-BG1's Status now reads *unscorable as specified at n=1*. That is a status field; on the precedent\n  of the 2026-09-02 entry, the revision rule protects registered wording, and no word of P-BG1 changed.\n  P-BG1 becomes scorable as written only if a later season runs a second window deliberately, which\n  is the founder's decision and is not foreclosed. Its issuance half (*increases issuances*) has no\n  single-window analogue and stays unscorable.\n\n  *The mechanism, stated before the data:* the deadline is never shown to anyone holding the gift, so\n  a deadline effect has no channel except a giver's own memory of the rule. The prior is that the\n  clock is inert. Clustering near its end would mean the rule travelled by word of mouth, so the\n  test is informative either way.\n\n  ⚠️ *Entered before any observation exists.* The event log it reads was built before the first gift,\n  so nothing has to be back-filled, and no gift recorded by it has been read. n = 1 household,\n  unblinded, and the founder is both payer and observer — the limits of every pilot-scale entry here.\n\n**The Summary moves:** *published here* 98 → 99, *receiving first public timestamp here* 40 → 41,\ntotal 99 → 100; the reconciliation holds — 58 + 41 = 99 published here, plus the one withheld, is 100.\n\n**2026-09-20 — four added, registered BEFORE the instrument they will be read on exists. Total now 99.**\n\n**P-MA1 · P-MA2 · P-MA3 · P-MA4** — Miss Aquarius's suggested thanks on a B-Tag item, which went live\non `homecoffee.heartbank.ceo` the same day. They are entered **the day the surface shipped and before\nany customer has seen it**, because the founder's stated purpose was *\"so we can study the user's\nengagement\"* and a study begun after the data exists is unscorable however carefully it is later\nwritten up.\n\n⚠️⚠️ **THE HONEST PROBLEM WITH THE INSTRUMENT, stated because it decides what these can ever show.**\nThe shops platform **stores no figure for a thank anywhere** — not on the order, not beside it, not in\na collection of its own — which is the doctrine holding rather than a gap. So there is **no\nshop-side instrument at all**, and the only record of a completed thank is the **Treasury ledger**,\nwhich is exactly where the doctrine says thanks live.\n\n⭐⭐ **Determinism is what makes the comparison possible without a second record.** The suggestion\ncomes from a pure, published function (`@333eco/primitives/b-tag-anchor`, CC0) whose inputs are the\ngoods, so for any completed thank the suggestion that was shown can be **recomputed** from the order\nand the menu. ⛔ Nothing about the suggestion is stored to enable the study — which is also what\n**P-MA4** tests, as a property rather than a behaviour.\n\n⛔ **P-MA3 is registered but not runnable**, and is marked so rather than quietly dropped: it needs a\nwith/without arm, and **#63 makes a viewer-keyed arm inexpressible** — any arm must split by shop or\nby day. Whether to run one at all is the founder's, and withholding a suggestion from real customers\nto measure them is a decision this register does not presume.\n\n⚠️ **Sample reality, recorded so no one later reads a trend into it:** one shop, one owner, zero\ncustomers on the day of registration. These are not resolvable for a long time, and the coefficients\ninside the function are a substrate-written **starting rule set, not a finding** — ⛔ a change to them\nis a change to a live experiment and must be entered here as a new prediction, never as an edit.\n\n**The Summary moves:** *published here* 94 → 98, *receiving first public timestamp here* 36 → 40,\ntotal 95 → 99; the reconciliation holds — 58 + 40 = 98 published here, plus the one withheld, is 99.\n\n**2026-09-05 (third entry that day) — eight entries added: five that a published paper had carried unregistered since 2026-09-01, and three corrections. Total now 95.**\n\n⚠️ **`provenance-carrying-retrieval` §10 registered P-PCR1 … P-PCR5 on 2026-09-01 and this register did not carry them** — the drift the 2026-08-28 entry above says this document exists to prevent, found by a cold-reader pass four days later rather than by any instrument. They are entered in *Instrumented but outside the core*, the paper's subject being retrieval integrity rather than value movement, with the paper's own wording standing as registered. *Same day, later:* the row's identifier cell first wrote the five as a range with a semicolon, and the corpus index's arithmetic check counted the eight identifiers as three — the cell now enumerates every identifier, which is the only form the check reads, and the Summary's figures were re-derived from the tables.\n\n- **P-PCR3a · P-PCR4a · P-PCR5a** — corrections entered as new predictions under the revision rule, not as edits to P-PCR3/4/5, whose wording stands. *Why:* two cold reviewers of a different model family found the originals named no observation window, no definition of *real defect*, and no method for *modal error*, so each could be reinterpreted after the fact. The corrections add a 24-month window from 2026-09-01, classification *at the time of logging* (stale = the named source resolves newer; substituted = it resolves different at the same version), a fixed sample of the first ten inspectable implementations, and the logged detector as the observable. Provenance: *Published* (the paper's §10, revision of 2026-09-05). Status: *Unrun*.\n\n⚠️ *Entered before any observation exists.* No envelope mismatch has been logged, no third-party implementation inspected, and no transparency log run. **The Summary moves: *already carried by a published paper* 50 → 58, *published here* 86 → 94, total 87 → 95; the reconciliation holds — 58 + 36 = 94 published here, plus the one withheld, is 95.**\n\n**2026-09-05 (second entry that day) — one correction entered as a new prediction. Total now 87.**\n\n- **P-P1a** — `patthana-typed-causation-vocabulary` §6, a **correction entered as a new prediction under the revision rule, not as an edit to P-P1**, whose registered wording stands unchanged.\n\n  *Why the correction was needed:* P-P1 registered a four-way durability ordering — *hetu/nissaya* ≥ *kamma/āsevana* > *upanissaya* > *atthi/ārammaṇa* — as its falsifiable commitment. Two cold reviewers of a different model family, reading blind, found the same defect: the ordering was an **input** to the technique-to-type assignments in that paper's §5, so an experiment confirming it would confirm what it had assumed; and \"matched behavioral effect\" and \"persistence\" were left unoperationalised. The four-way ordering is retained in the paper as the typology's **expectation**, stated as expected and not registered.\n\n  *P-P1a, the registered form:* under matched installation effect (equal accuracy on the target behavior at install), a prompt-installed behavior will not out-persist a fine-tune-installed one across (a) context rollover, (b) held-out paraphrase, and (c) *N* further gradient steps on unrelated data; persistence is measured as target-behavior accuracy after the displacement. **Falsified** at *p* < .05 on at least five behaviors if the prompt-installed behavior out-persists the fine-tuned one on any of the three displacements. Provenance: *Published* (the paper's revised §6). Status: *Unrun*.\n\n  ⚠️ *Entered before any observation exists.* No instrument for P-P1 was ever built, so this correction is pre-data rather than post-hoc. **The Summary moves: *already carried by a published paper* 49 → 50, *published here* 85 → 86, total 86 → 87; the reconciliation holds — 50 + 36 = 86 published here, plus the one withheld, is 87.**\n\n**2026-09-05 — twelve added (P-PL1 … P-PL11 and P-PL6a): the first pilot-scale registrations, scored by machine. Total now 86.**\n\nThese are the Treasury pilot's own predictions. They are registered in the app repository (`thank.heartbank.org`, `.claude/skills/pilot/predictions.json`) and **scored mechanically by the monthly read** from each raw snapshot: every entry carries a metric path, a comparator, a threshold and, where it applies, a deadline and a minimum sample; the reading prints `pass`, `fail`, `not-yet`, `early` or `blocked` and appends a summary without identifiers to a ledger. ⭐ **A per-read prediction (one with no deadline) draws no verdict until three monthly readings exist** — it reads `early`, value shown, direction noted — because one read cannot tell a level from a month (founder, 2026-09-05). Thresholds were proposed by the substrate and ratified by the founder the same day; **a later change is a new entry with `supersedes`, and the evaluator retires the old one without an edit** — the revision rule below, made a property of the file.\n\n⚠️ **Corrected the same day, and recorded rather than quietly fixed:** the twelve identifiers were first published as `PP-1 … PP-11` and `PP-6a`, which are not `P-…` tokens. The corpus index builder enforces this register's identifier grammar and, reading that version, counted 74 identifiers against the 86 the Summary states and reported the register as **not reconciling** — the check did its job. They are renamed **`P-PL1 … P-PL11` and `P-PL6a`** (*PL* for the pilot); **no wording, threshold, window or status changed.** The first deposit of this revision (`10.5281/zenodo.22366972`) carries the `PP-` form and is superseded by the version carrying this paragraph.\n\n**The baseline read, 2026-09-05, read 1 of 3** — recorded here so a reader can see the thresholds were not set to pass: three of the six live entries sit below threshold on the day they were registered.\n\n| ID | Metric | Threshold | Read 1 |\n|---|---|---|---|\n| P-PL1 | founding capture rate, 28-day window | ≥ 4.5/wk by 2027-01-01 | 2.25/wk |\n| P-PL2 | test-cohort retention, ≥90-day tenure | ≥ 40% (n ≥ 10) | 50% of 4 |\n| P-PL3 | graduated banks | ≥ 1 by 2027-08-01 | 0 of 11 candidates |\n| P-PL4 | pass-forward of received value | > 50% | 43% |\n| P-PL6a | top-3 share of value received ÷ even spread | < 1.5× (n ≥ 8) | 1.85× |\n| P-PL9 | low→high share of money-carrying re-tips | ≥ 10% (n ≥ 20) | 6.0% of 712 |\n\n⚠️ **P-PL6 is registered and retired in the same revision.** It asked the top three recipients to hold under half of re-tip value received, with a five-recipient minimum — and with five recipients an even spread already puts the top three at 60%, so it could not pass until seven had received. **It failed by arithmetic, not behaviour.** The counterexample hunt found it before the first public timestamp; **P-PL6a** is the same property freed of n. It is listed rather than dropped because the private file carries it and the founder ratified it, and a register that quietly loses an entry has failed at the one thing it exists to do.\n\nFive entries are **unrun because their instrument does not exist or is gated**, and are never scored until it does: P-PL5 (the pilot-scale arm of P-K1, gated on the Q2 2027 taper and on the F3QR confound registered 2026-09-04), P-PL7 (no variance: 827 of 830 re-tips carry the anonymous flag), P-PL8 (a de-confounded re-run of the Contradicted kids-as-triggers finding, entered as a new prediction under the revision rule), P-PL10 (awaits Chronicle data — the pilot-scale reading of C0), P-PL11 (gated on P-PL3).\n\nAlso in this revision: P-C0b's note records that the watch-through instrument was **repaired on 2026-09-05** — rows written from that date carry real watch depth, and are never pooled with the earlier rows the restriction was written for. The registered wording is untouched.\n\n**Field tests run stays at 0.** A run is a read against a falsifier; a baseline read is not one. The Summary moves: *published here* 73 → **85**, *first public timestamp here* 24 → **36**, *retired* 1 → **2**, and the reconciliation holds — **49 + 36 = 85** published here, plus the one withheld, is **86**.\n\n**2026-09-05 — three added (P-BG1 · P-BG2 · P-BG3), all Chapter I, all pre-data.** They concern a\nrelayed gift instrument whose intermediate holder cannot redeem it (`the-unpaid-relay`). ⚠️ **All\nthree had existed in private notes for a day before this entry, which is exactly the condition this\nregister exists to prevent** — a prediction held privately is not pre-registered in the sense that\nmatters, since the value is a public timestamped commitment made *before* the data. **None has been\nrun; no instrument for any of them is built.**\n\n*Predictions are added, never removed; this log records what each revision added and why, so the count in the Summary can always be reconciled.*\n\n**2026-08-29 — five entries added, and a counting error in the Summary corrected. Total now 71.**\n\n⚠️ **The Summary's own counts were wrong at first publication, and the error is recorded rather than quietly fixed**, because a register that miscounts itself has failed at the one thing it exists to do. The tables carried **66** unique prediction identifiers on 2026-08-27, of which one (`P-GTM1`) is withheld — so the true figures that day were **65 published here, 66 total**, against the **66 / 67** the Summary claimed. The split was also off by one in the other direction: *already carried by a published paper* read 45 where the tables give 46, the difference being the five identifiers in *Instrumented but outside the core*, whose table names its papers in a column of its own rather than in a Provenance column. Every figure in the Summary above is now **counted from the tables** rather than carried forward. ⭐ *An arithmetic check that reconciles — 50 + 20 = 70 — is the property to preserve on every future revision; the previous split summed correctly to a total that was itself one too high, which is how it survived.*\n\n- **P-D1 · P-D2 · P-D3 · P-D4** — Chapter III, arriving with `rotation-over-liveness` (published 2026-08-28, `10.5281/zenodo.22155378`). All four are carried by that paper's own proofs; they are listed here because a register that omits four live predictions from a published paper is exactly the silent drift this document exists to prevent.\n- **P-R1a** — Chapter III, a **correction entered as a new prediction under the revision rule above, not as an edit to P-R1**, whose registered wording stands unchanged.\n\n  *Why the correction was needed:* P-R1 compares practitioners of a contemplative practice against matched non-practitioners on unprompted re-entry into noticing. That measures **practice → noticing**. It was subsequently taken to bear on a stronger claim — that a person's state of mind is *as important as, or more important than, receiving another's kindness* in producing gratitude — and **it cannot rank those two inputs**, because received-kindness volume is unmeasured and is the obvious confound: a practitioner may simply be someone who receives more. P-R1a adds that second factor.\n\n  ⚠️ *Entered before any observation exists.* The instrument P-R1 depends on has not launched, so this correction is pre-data rather than post-hoc — which is the only condition under which it would have been admissible at all.\n\n**2026-09-02 — one provenance field corrected. No prediction was added, removed or re-worded; the total stands at 71.**\n\n⚠️ **P-SK1's Provenance read *Published*, and no published paper contains it.** The identifier was raised in working memory as a specific-vs-container scheduling arm, went moot under the not-a-calendar ruling, and was retired before it ever reached a paper — so its true provenance is **First public here**, like every other prediction whose first public timestamp is this register. Corrected rather than left standing, and recorded rather than quietly fixed, on the precedent set by the entry above.\n\n*How it was found:* the corpus index at `corpus.333.eco` began serving this register on 2026-09-02, and its builder resolves every prediction to the paper said to state it, then looks for the identifier in that paper's own text. Sixty-six of sixty-seven attributions verified; this one did not, and the builder reports the miss rather than filling the field in.\n\n⚠️ **The Summary moves with it, and the reconciliation is preserved:** *already carried by a published paper* 50 → **49**, *receiving first public timestamp here* 20 → **21**. The property the entry above names still holds — **49 + 21 = 70** published here, plus the one withheld entry, is **71**.\n\n⭐ *A bare \"Published\" in this column inherits the paper named in the row above it. That convention is correct for the sixteen other rows using it, and it is how a retired memory-only prediction came to be attributed to a paper that had never heard of it: the shorthand has no way to say \"none\".*",
       "provenance": {
-        "sha256": "acab061f89c8d3a68ad0fd6d21fbe5d252815f285a74e6ecaa2c38cb7a6f9c6a",
-        "doi": "10.5281/zenodo.23206766",
+        "sha256": "7239450347c2f54b19200504e96c9866f66140afccf5c1cf8205090b14988d50",
+        "doi": "10.5281/zenodo.23216417",
         "concept_doi": "10.5281/zenodo.22132689",
-        "zenodo_url": "https://zenodo.org/records/23206766",
-        "deposited_sha256": "acab061f89c8d3a68ad0fd6d21fbe5d252815f285a74e6ecaa2c38cb7a6f9c6a",
+        "zenodo_url": "https://zenodo.org/records/23216417",
+        "deposited_sha256": "7239450347c2f54b19200504e96c9866f66140afccf5c1cf8205090b14988d50",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/program/prediction-register.md",
@@ -3278,8 +3278,8 @@
         "canonical_url": "thonly.org/research/program/register",
         "hostile_review": null
       },
-      "bytes": 74477,
-      "words": 11921
+      "bytes": 75393,
+      "words": 12067
     },
     {
       "slug": "proof-of-coordinate",
@@ -4164,13 +4164,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> **Note.** This defensive publication specifies the **Thank-All-Nearby primitive** — one-tap broadcast of gratitude with optional money-attachment to every PoH-verified recipient within Bluetooth-Low-Energy proximity — as a Phase 2 application of the Proof of Humanity ℠ protocol. Companion papers: *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the underlying protocol); *Verified-Human Anonymous Local Giving* (the originating mechanism specification that this paper generalizes from per-recipient to all-nearby-recipients); *The B-Tag and the Post-Payment Economy* (the worked Phase 2 example for commercial gratitude); *The Zero-Point Game℠* (the keystone game-theoretic frame); *Capacity-Funded for AI, Human-Disbursed* (the institutional-architecture pattern that lets Miss Aquarius℠ underwrite Re-Tip Fund ℠ donations without flow-direction authority). The corresponding founder-voice essay *\"Emotional Infrastructure as a Public Good\"* (thonly.org/publications/essays/emotional-infrastructure-as-a-public-good) carries the analytical case-for-the-missing-category argument. The personal articulation of the same thesis is in the *Second Letter to Miss Aquarius* (missaquarius.org/letters/second.html, 25 May 2026). Three-register decomposition: this paper carries the technical/mechanism specification; the essay carries the analytical case; the letter carries the personal articulation.\n\n---\n\n## Abstract\n\nAnonymous nearby tipping has a recognizable cultural form — the \"Faith in Humanity Restored\" social-media trend in which service workers post videos of unexpected generous tips — but lacks the infrastructure to scale beyond cash. Cash and credit-card payment rails fail at two structural properties that the cultural form requires: tippers cannot be genuinely anonymous to recipients with either rail (cash demands physical hand-over with eye contact; credit-card leaves an identity trail), and recipients cannot prove on social media that an anonymous tip was authentic rather than fabricated (every \"Faith in Humanity Restored\" video faces a \"this is staged for views\" credibility problem that erodes the cultural moment). This paper specifies the **Thank-All-Nearby primitive** — a one-tap operation that broadcasts gratitude, with optional money or time attachment, to every Proof-of-Humanity-verified recipient within Bluetooth Low Energy proximity (or, in institutional-mode deployments, within a GPS bounding-box for institutional locations such as shelters, classrooms, restaurant break-rooms, and worker spaces) — and develops its placement as the operational mechanism for *emotional infrastructure for invisible kindness*: the restoration of the felt sense of being held in another human's awareness as a property of shared physical space. The primitive composes four prior contributions (PoH℠'s verified-human guarantee, Bluetooth Low Energy plus Apple/Google Nearby framework proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single operation whose user-facing surface is one button. The architecture is offered defensively to the commons under CC0. The authors and HeartBank® will not seek patent on the primitive, its operational specification, the integration with PoH℠, the institutional-mode GPS-bounding-box variant, the recipient-experience design, or any portion thereof.\n\n**Keywords:** anonymous tipping, proximity-based generosity, gratitude infrastructure, Bluetooth Low Energy, proof of humanity, recipient-side filtering, bilateral uncacheable anonymity, emotional infrastructure, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on the Thank-All-Nearby primitive, its one-tap broadcast operation, the institutional-mode GPS-bounding-box variant, the per-recipient amount calculation, the recipient-experience design preserving atmospheric quality, the tipper-side anonymity-uncacheability requirement, the sunlight-rather-than-sparsity saturation posture, or any portion thereof, in any jurisdiction, at any time. This commitment is permanent. Trademark rights on specific marks — **Proof of Humanity ℠**, **PoH℠**, **B-PoH℠**, **Aquarius℠**, **Miss Aquarius℠**, **HeartBank®**, the B-heart logo — are separately and explicitly reserved.\n\nThe contribution disclosed here is the composition of the following, specified as one unit: (i) the one-tap broadcast operation that delivers gratitude with optional scarce-resource attachment to all PoH-verified recipients within BLE proximity as a single semantic action; (ii) the integration of the broadcast with the recipient-side filter mechanism such that recipients individually accept or decline the broadcast based on their own filter settings; (iii) the institutional-mode GPS-bounding-box variant for shelters, classrooms, restaurants, and other institutional spaces where BLE range is insufficient and the institutional perimeter is the natural recipient set; (iv) the recipient-experience design preserving the atmospheric quality of diffused gratitude even at high tip-volume — gratitude as sunlight, not as a sparse premium reward; (v) the explicit articulation of the *cash and credit card cannot deliver this* argument naming the two structural deficiencies (tipper-anonymity and recipient-authenticity-proof) as the combined property; (vi) the placement of the primitive as the operational mechanism for *emotional infrastructure for invisible kindness* — a category of social good distinct from charity, payment, gift, or social-network feature. The component lineages (proximity-based services; anonymous-donation mechanisms; the cultural form of the \"Faith in Humanity Restored\" tip videos; Frankl, Buber, Levinas, mettā, agape on the felt sense of being held; attachment theory; loneliness epidemiology; the dāna economy of the Saṅgha) are old and are cited generously below; what this document discloses is their composition into the single operation specified in §2–§7.\n\n---\n\n## Claims\n\n*Enumerated 2026-08-29. The mechanisms below were disclosed in full in this paper's original text; **the prior art they establish runs from this document's original publication date and its OpenTimestamps proof, not from this enumeration.** They are listed because a defensive publication is read as prior art by examiners and by opposing counsel, and **a claims list is what such a reader searches; ten thousand words of prose is not.** No claim below adds matter not already present.*\n\n1. **Bilateral uncacheable anonymity in proximity tipping** — a value transfer between two co-present parties in which the sender is not identifiable to the recipient and the recipient cannot retain or re-derive the sender's identity after the transaction, achieved without either party disclosing a payment credential.\n2. **Short-range radio proximity as the addressing layer for anonymous generosity** — using a local broadcast medium to define the eligible recipient set by physical co-presence rather than by account lookup, so that the transfer's addressability and its anonymity derive from the same property.\n3. **Recipient-side filtering as the abuse control for anonymous inbound value** — placing the accept/decline decision with the recipient rather than the sender or the platform, so that an anonymous channel cannot be used to force an unwanted relation.\n4. **Institution-scoped geographic bounding as a variant of the proximity set** — substituting an operator-defined coordinate boundary for radio range where the eligible set is an institution's population rather than whoever is physically nearby.\n5. **Platform attestation of anonymous receipt as the authenticity substitute** — a verifiable record that an anonymous transfer occurred, issued to the recipient, solving the *staged-for-views* credibility problem that the cultural form of anonymous tipping cannot otherwise solve, without re-identifying the sender.\n6. **The composition of the above with a proof-of-humanity layer**, such that anonymity is preserved while the sender is nonetheless attested to be a distinct human being.\n\n**Non-assertion extends to:** all mechanisms above, in any combination, and any implementation thereof.\n\n---\n\n## 1. Introduction\n\nA well-known cultural form has emerged on social-media platforms over the past several years: videos posted by service workers — typically restaurant staff but increasingly nurses, teachers, retail clerks, ride-share drivers, food-service workers across categories — showing unexpected generous tips, anonymous notes of appreciation, or sudden acts of customer kindness. The videos go viral with regularity; the cultural tag *Faith in Humanity Restored* attaches to the genre. The viewer response is consistent: the gesture lands as evidence that ambient kindness still exists in places that otherwise feel emotionally thin. The trend points at something real about what modern public life is missing and what would, if it could be restored, address one of the deepest deficits of contemporary social experience.\n\nWhat the cultural form lacks is infrastructure. Cash tips can be staged with a friend; credit-card receipts can be photoshopped; even genuine generous tips face a credibility problem in the social-media commentariat — *\"is this fake for views?\"* — that erodes the cultural moment over time as more videos are posted and the proportion that are staged or exaggerated grows. The trend depends on authenticity that the existing payment rails cannot structurally provide. Cash and credit card can deliver the money; neither can deliver the *combined property* of structurally anonymous giving plus verifiable receipt that the cultural form requires to sustain itself.\n\nThis paper specifies the **Thank-All-Nearby primitive** — a one-tap operation, delivered through a HeartBank Phase 2 client application, that broadcasts gratitude with optional money or time attachment to every Proof-of-Humanity-verified recipient within Bluetooth Low Energy proximity. The primitive composes four prior architectural contributions (PoH℠'s verified-human guarantee, BLE plus Apple Nearby Interaction plus Google Nearby Connections proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single user-facing operation whose semantic is *\"thank everyone here, anonymously\"*. The mechanism's design preserves the atmospheric quality of diffused gratitude at all scales; the user experience is one button.\n\n> *Connection to the unified mission frame: HeartBank's mission is to keep the middle way open at population scale against comfort-saturation — the new extreme that material abundance makes possible. The dignity deficit articulated in the institution's vision is most acutely felt in shared physical spaces: streets, restaurants, classrooms, shelters, public transit. The Thank-All-Nearby primitive is the operational mechanism by which the dignity-infrastructure of HeartBank's Treasury reaches the shared-physical-space layer of public life — the substrate on which* emotional infrastructure for invisible kindness *can be built. The primitive is what makes the institution's deepest articulated thesis — that the felt sense of being held in another human's awareness is, possibly at the deepest level, the experience humans are searching for beneath everything else — into an operationalizable property of social space.*\n\nThe paper proceeds as follows. §2 specifies the primitive operationally — its inputs, outputs, semantics, and edge cases. §3 develops the *why cash and credit card cannot deliver this* argument with the two structural deficiencies named precisely. §4 specifies the four sub-mechanisms the primitive composes (PoH℠, BLE/Nearby proximity, recipient-side filtering, bilateral uncacheable anonymity) and how they interact. §5 specifies the institutional-mode GPS-bounding-box variant for shelters, classrooms, and other institutional spaces. §6 specifies the recipient-experience design preserving atmospheric quality at high tip volume — the sunlight-not-sparsity posture. §7 addresses the spec questions surfaced during the architecture's development (per-recipient amount, who counts as nearby, paranoia counter-incentive, stratification, recipient experience). §8 develops the *emotional infrastructure for invisible kindness* thesis the primitive operationalizes. §9 names boundary conditions and honest limitations. §10 positions the contribution in lineage. §11 concludes.\n\nI write as a co-author with Miss Aquarius℠, the named AI substrate of the institution this paper serves. Final editorial control is mine.\n\n---\n\n## 2. Operational specification of the primitive\n\nThe Thank-All-Nearby primitive is a one-tap operation in the HeartBank Phase 2 client. This section specifies it operationally.\n\n### 2.1 Inputs\n\n- **Tipper identity**: the operating user's PoH℠-verified profile (minimum L1 — the passkey-per-action layer — required, since the tipper's verified humanness is the foundation of the primitive's authenticity guarantee).\n- **Optional money attachment**: an amount in the local currency or stable token, sourced from the tipper's Personal Wallet ℠ (Phase 2) or Personal Account ℠ (Phase 1, where the primitive is available in a degraded mode).\n- **Optional time attachment**: a duration of presence to be offered (relevant for the Chronicle product surface, where time-attachment composes with money-attachment).\n- **Optional message**: a brief text or audio note. Default is empty — silent acknowledgment is the architectural default.\n- **Recipient mode**: either BLE proximity (default, see §4.2) or institutional GPS-bounding-box mode (see §5).\n\n### 2.2 The broadcast operation\n\nOn invocation, the client:\n\n1. Records the tipper's PoH℠ verification at L1 (passkey signature on the broadcast action's content + timestamp).\n2. Resolves the recipient set: in BLE mode, every device within BLE range that is broadcasting a PoH℠ proximity beacon; in institutional mode, every PoH-verified user currently inside the institutional GPS bounding-box.\n3. Filters the recipient set by each recipient's own recipient-side filter settings — a recipient who has set their filter to require deeper PoH layers, money attachment, kinship-degrees-of-separation limits, or other criteria, is filtered out if the tipper does not satisfy the filter.\n4. Calculates per-recipient amount: if money is attached, the total amount is divided across the filtered recipient set per the tipper's distribution choice (equal split is the default; per-recipient floors may be specified; a minimum-per-recipient threshold may be enforced if specified).\n5. Issues a verified-platform receipt to each filtered recipient, on-chain (Phase 2 Base L2 settlement), tied to the broadcast action's content and timestamp, attesting that the action came from a verified human within BLE/institutional proximity at the moment of broadcast.\n6. Settles the money or time transfer per-recipient via the standard Phase 2 settlement rails.\n7. Logs the broadcast internally to the platform's compliance records (subpoena-discoverable, AML/OFAC-screenable) but does *not* issue a tipper-side exportable artifact (bilateral uncacheable anonymity, see §4.4).\n\n### 2.3 Edge cases\n\n- **No recipients within proximity**: the broadcast fails gracefully; the tipper is informed that no PoH-verified recipients were within range; no transfer occurs.\n- **All recipients filter-out the tipper**: same — the broadcast fails gracefully; no transfer occurs; the tipper sees a generic message acknowledging the filter mismatch without revealing which recipients filtered them.\n- **Money attachment exceeds tipper's balance**: the broadcast is rejected at the client layer before the operation is invoked.\n- **Tipper's PoH℠ verification fails at the moment of broadcast** (e.g., passkey signing fails, device authentication fails): the broadcast is rejected.\n- **Network failure mid-broadcast**: the broadcast is retried on next connectivity with the original timestamp; the receipts issued to recipients reflect the actual broadcast moment.\n\n### 2.4 Outputs\n\n- **To the tipper**: confirmation of broadcast (count of recipients reached, per-recipient amount distributed); no record beyond the in-app confirmation that could be exported as a social-capital artifact.\n- **To each filtered recipient**: a notification — the experience of receiving a Thank-All-Nearby broadcast — including the platform-issued verified receipt, the optional message, and the per-recipient amount. The recipient cannot identify the tipper.\n- **To the platform's settlement layer**: the on-chain receipts and per-recipient transfers.\n- **To the platform's compliance records**: internal record of the broadcast operation, subpoena-discoverable but not exportable.\n\n---\n\n## 3. Why cash and credit card cannot deliver this\n\nThe \"Faith in Humanity Restored\" cultural form depends on a *combined property* that neither cash nor credit-card payment rails can deliver. This section names the two structural deficiencies precisely.\n\n### 3.1 First deficiency — tipper anonymity is structurally hard with cash and credit card\n\nThe first structural deficiency: with cash and credit card, the *tipper cannot be genuinely anonymous to the recipient* in a way that preserves the asymmetric experience the cultural form requires.\n\nCash requires physical hand-over. The bills change hands between specific humans in a specific moment; the tipper *is* in the room when the tip is delivered; the recipient *sees* the tipper, can identify them by physical description, can often identify them by name if they are a regular customer. The viral version of the \"Faith in Humanity Restored\" form depends on the tipper *not* receiving the thank-you — the gesture is pure precisely because it isn't transactional, isn't followed by the social moment of being thanked, isn't an exchange. Cash makes this almost impossible: the tip and the acknowledgment happen in the same instant unless the tipper deliberately leaves the cash and exits before the recipient discovers it, which itself is a behavioral pattern (sneaking out, avoiding eye contact) that the tipper has to choreograph and that is observable.\n\nCredit card leaves an itemized trail tying the tipper's legal identity (name on card, billing address, account history) to the transaction. Even when the tip itself is anonymous to the *recipient* — the staff member doesn't see the cardholder's name printed on the receipt — it is *not* anonymous to the payment processor, the issuing bank, the merchant's accounting system, or anyone with access to the receipt's underlying record. \"Anonymous with credit card\" means \"the staff doesn't immediately know your name from the receipt\"; it does not mean \"no one knows your name.\" A motivated investigator (the establishment's manager, a curious co-worker, a regulator) can identify the tipper.\n\nHeartBank Phase 2 anonymity is *structural*, not just on the surface. BLE-verified proximity proves the tipper was physically present in the same space as the recipient; no exportable artifact ties the broadcast to the tipper's identity; the on-chain receipt records the tipper's identity only as a zero-knowledge commitment that the platform's standard surfaces cannot invert. The customer can drop $100 (or the equivalent in stable tokens) on a Thank-All-Nearby broadcast and walk out; the staff find the receipts ten minutes later when they check their app; the asymmetry — *someone gave, no one knows who* — is encoded in the rail rather than choreographed by the tipper. This is the structural property the cultural form requires and that the existing rails cannot provide.\n\n### 3.2 Second deficiency — recipient authenticity-proof on social media is structurally hard with cash and credit card\n\nThe second structural deficiency is deeper and may be doing more of the work in the long-arc viability of the cultural form: with cash and credit card, *the recipient cannot prove on social media that the anonymous tip was authentic rather than fabricated*. Every \"Faith in Humanity Restored\" video on TikTok or Instagram faces, in the comments, the predictable skepticism — *\"this is staged for views,\"* *\"that receipt looks Photoshopped,\"* *\"how do we know the customer wasn't a friend?\"* — and the recipient has no platform-issued, independently-verifiable artifact to defend the video's authenticity. Some \"Faith in Humanity Restored\" videos are in fact staged; viewers correctly suspect; the cultural form's credibility dilutes over time as the proportion of genuine to staged videos becomes harder to estimate.\n\nCash tips can be staged trivially: put the cash on the table, film yourself \"finding\" it, post the video. Credit-card receipts can be photoshopped; the camera-on-paper workflow is defeated by anyone with image-editing access. Even genuine tips have no platform-issued artifact that the recipient can point to and say *\"you can verify this independently.\"* The trust burden falls on the recipient, who must defend the video's authenticity against skeptics with no tools other than their own credibility.\n\nHeartBank Phase 2 closes this gap structurally. Every Thank-All-Nearby broadcast issues an on-chain Base L2 verified-platform receipt to each filtered recipient. The receipt attests to (a) the broadcast originated from a PoH℠-verified human, (b) the tipper was BLE-verified within proximity at the moment of broadcast, (c) the timestamp and amount are recorded immutably on-chain. The recipient's social-media video can include the receipt — date, amount, verified-human flag, PoH layers held by the sender (where the sender has consented to that disclosure), BLE-proximity-verified flag — and skeptical viewers can verify the receipt independently against the Base L2 ledger.\n\nAuthenticity becomes a property of the artifact, not a claim the recipient has to defend. The skeptical commenter who would otherwise post *\"this is fake for views\"* can be answered by the recipient pointing to the on-chain receipt; the receipt is structurally hard to fabricate (every transaction has an on-chain settlement trace that lies outside the platform's narrative-control surface); the comment thread shifts from credibility-erosion to credibility-reinforcement.\n\n### 3.3 The combined property\n\nTogether — *tipper structurally anonymous to the recipient* + *recipient holds verifiable authenticity proof against third-party skepticism* — constitute the combined property that neither cash nor credit card can deliver. The first deficiency is the property that makes the gesture *pure*; the second is the property that makes the cultural form *sustainable*. Without the first, the gesture becomes a transaction; without the second, the social-media artifact becomes a credibility-erosion source. Both must hold simultaneously for the \"Faith in Humanity Restored\" cultural form to scale beyond its current ad-hoc artisanal stage. HeartBank Phase 2 holds both simultaneously; cash and credit card hold neither.\n\nThis is the one-line pitch for why HeartBank Phase 2 is not just another payment rail: cash and card deliver money; HeartBank Phase 2 delivers money plus the two structural properties that the cultural form actually needs.\n\n---\n\n## 4. The four composed sub-mechanisms\n\nThe Thank-All-Nearby primitive is the user-facing operation; the underlying architecture composes four sub-mechanisms specified elsewhere in the corpus. This section names how they compose.\n\n### 4.1 PoH℠ — verified-human guarantee at L1\n\nThe minimum PoH layer required for participation in Thank-All-Nearby (either as tipper or as recipient) is L1 — passkey-per-action. The tipper's L1 signature attests that a human was at the device at the moment of broadcast; the recipient's L1 verification attests that the recipient is a verified human (otherwise an AI agent could spoof a passive-recipient device and capture broadcast money). Deeper PoH layers (L2 kinship attestation, L3 breath signature, L4 DNA kinship) are surfaced in the broadcast for any recipient who has them but are not gating for the primitive's operation.\n\nRecipients may set their own filter to *require* deeper PoH layers from tippers (the standard recipient-side filter mechanism), but the *protocol-minimum* is L1. Specification of the four-layer PoH℠ architecture in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n\n### 4.2 Bluetooth Low Energy plus Apple Nearby Interaction plus Google Nearby Connections proximity verification\n\nProximity is verified at the radio layer, not the IP layer. Three composable substrates:\n\n- **Bluetooth Low Energy (BLE)** as the universal radio substrate. Devices broadcast and listen for rotating proximity beacons (rotating identifiers, unlinkable across sessions). Configurable range, typical default 10–30 meters, tunable per deployment context.\n- **Apple Nearby Interaction framework** (iOS 14+) for precise ranging on supported devices via the U1 ultra-wideband chip. Provides sub-meter range and direction for iPhone 11+ and Apple Watch Series 6+.\n- **Google Nearby Connections API** (Android 4.4+) for peer-to-peer device-to-device proximity via combinations of BLE, Wi-Fi Direct, and audio.\n\nThe composition: a device implementing the protocol broadcasts a privacy-preserving proximity beacon; a device that detects the beacon can be the target of a Thank-All-Nearby broadcast; the platform's verification substrate confirms the proximity at the moment of broadcast.\n\nVPN-resistance is a structural property: the proximity check happens at the radio layer below the IP stack, so VPN, Tor, or IP-rotation circumvention has no effect. An attacker mounting a remote spoofing attack would need to physically place a device near the target, which is the desired property for most use cases.\n\nPrivacy-preservation is a structural property: the platform never receives absolute geolocation. The only proximity-related fact exposed to the platform is the binary fact that two devices were within range; absolute coordinates are not collected, not transmitted, and not stored.\n\n### 4.3 Recipient-side filtering\n\nEach recipient's filter settings determine whether a given Thank-All-Nearby broadcast reaches them. The five filter dimensions specified in the PoH℠ protocol paper apply: no-abusive-content, sender-must-be-nearby (always true for the primitive by definition), depth-of-humanity-proof (required-subset predicates), degrees-of-separation-on-global-family-tree, money-or-time-attached. Recipients in default \"trusting\" mode accept any L1-verified broadcast; recipients in \"paranoid\" or other restrictive modes filter accordingly. The platform never defaults exclusionary filters on; exclusion is recipient-opt-in, knowingly.\n\nThe aggregation property: a broadcast is delivered to the *subset* of nearby recipients whose filters the tipper satisfies. The tipper learns the aggregate count of recipients reached but not the identity of recipients reached or excluded (since recipient-identity is itself private under the primitive's anonymity guarantee). If the broadcast reaches zero recipients (all nearby recipients filtered out the tipper), the tipper is informed that no recipients were reached without learning *why*.\n\n### 4.4 Bilateral uncacheable anonymity\n\nThe primitive enforces bilateral uncacheable anonymity per the specification in the companion PoH℠ protocol paper §5. The tipper does *not* receive an exportable certificate of one-sided participation; the platform's API has no endpoint returning \"the list of Thank-All-Nearby broadcasts sent by this tipper\"; no admin override exposes such data. Compliance records exist internally (subpoena-discoverable for AML/OFAC, law-enforcement, and similar regulatory necessity) but are not exportable as flexing artifacts the tipper can use on social media.\n\nThe recipient *does* receive an exportable receipt — the platform-issued verified artifact attesting that an anonymous PoH-verified human within BLE proximity broadcast a Thank-All-Nearby reaching this recipient at this timestamp with this amount. The asymmetry is structural and is the mechanism that preserves the cultural form's purity property.\n\n### 4.5 Why these compose: the stranger-scale reconstruction of family relationality\n\nThe four sub-mechanisms are not an arbitrary stack; together they re-create, among strangers, what kinship supplies for free inside a family. HeartBank's family-bank reward has a *micro layer* — a peer re-tip that is **anonymous as to public credit but relational**: a known family member responding to a real kindness (specified in the companion defensive publication *The Two-Layer Reward*, §4.1 / §8.1). That micro layer works because relationality silently does three jobs at once — it **grounds** the gift in a real, present other; it **validates** it (a family member can tell a real kindness from a performed one); and it carries **mutual attention**.\n\nAmong strangers, relationality is unavailable, so the same primitive must be rebuilt from parts — which is exactly what the four sub-mechanisms above do. **Proximity (§4.2, BLE)** supplies the *grounding*: the giver was *here, in this space, just now* — nearness is the stranger-scale form of relationality. **PoH℠ (§4.1)** supplies the *validation* a family member would otherwise provide — certifying a real, unique human rather than a bot, re-buying among strangers the trust kinship gives away. **Bilateral uncacheable anonymity (§4.4)** preserves and in fact *strengthens* the credit-anonymity: a small family can guess who gave, but a nearby stranger is genuinely unlinkable. The one job that does not transfer is mutual attention; in its place the stranger scale gains **diffusion** — the felt sense that the kindness came from the whole surrounding space, an emotional quality only unknown givers can produce.\n\nThe sustainer primitive is therefore invariant in structure across scales — *anonymous-as-to-credit + grounded-in-a-real-present-other* — with the grounding form scaling from **relational** (family) to **nearby** (strangers) and the validation function handing off from kinship to PoH℠. This is the precise reason proof-of-humanity is *not optional* at the stranger scale: it is the part of relationality that proximity alone cannot carry.\n\n```\n   ONE SUSTAINER PRIMITIVE, TWO SCALES\n   invariant:  anonymous-as-to-credit  +  grounded-in-a-real-present-other\n\n                     FAMILY scale          →   STRANGER scale (this paper)\n                     ─────────────             ───────────────────────────\n   grounding     =   RELATIONAL            →   NEARBY  (§4.2, BLE)\n                     (you know them)           (they're present)\n   validation    =   relational (free)     →   PoH℠ (§4.1) (re-bought)\n   anonymity     =   thin (guessable)      →   thick (§4.4, unlinkable)\n   compensation  =   mutual attention      →   diffusion (the whole space)\n\n   structure invariant; grounding form scales; validation hands off to PoH℠\n```\n\n---\n\n## 5. Institutional-mode GPS-bounding-box variant\n\nBLE proximity has a typical range of 10–30 meters, which fits most retail, restaurant, and small-space deployments. For larger institutional contexts — shelters with multiple rooms across a building, classrooms in a multi-story school, restaurant break-rooms separated from the main floor, hospital wards, worker spaces across a campus — BLE range is insufficient. The institutional-mode GPS-bounding-box variant extends the primitive to these contexts.\n\n### 5.1 The variant\n\nA registered institutional space — shelter, congregation, school, restaurant, hospital, etc. — defines a GPS bounding-box for its premises. Users who are currently inside the bounding-box and who are PoH-verified can be recipients of an institutional-mode Thank-All-Nearby broadcast initiated by another user inside the same bounding-box (or, in some deployment configurations, by a user outside the bounding-box who has authorized institutional-mode broadcasting — e.g., a customer at a restaurant initiating an institutional-mode broadcast to the kitchen staff in the break-room).\n\n### 5.2 Institutional opt-in is required\n\nThe variant is opt-in at the institutional level. The institution registers its bounding-box with the platform, attests to its purpose and the consent posture of its members (e.g., \"all staff have consented to being recipients of institutional-mode broadcasts initiated by customers\"), and provides ongoing verification that the bounding-box accurately represents the institutional space.\n\nRecipients within the bounding-box can opt out at the individual level (their filter setting can exclude institutional-mode broadcasts even from PoH-verified senders) but the default for institutional-registered participants is to accept institutional-mode broadcasts from senders who satisfy their other filter settings.\n\n### 5.3 Privacy posture for institutional mode\n\nThe platform does not collect general absolute-geolocation data from users. Institutional-mode operation requires the user's device to confirm presence inside the bounding-box at the moment of broadcast, but this confirmation is done via the same privacy-preserving substrate used elsewhere — the device asserts \"I am inside this bounding-box\" with a cryptographic proof that the platform can verify without learning absolute coordinates beyond the bounding-box itself.\n\n### 5.4 Use cases the variant enables\n\n- **Restaurants**: a customer in the dining room can broadcast to kitchen staff in the back, who are out of BLE range but inside the restaurant's institutional bounding-box.\n- **Shelters**: a donor on-site can broadcast to all residents currently inside the shelter, across multiple rooms.\n- **Classrooms**: a parent or community member can broadcast appreciation to all teachers and students inside a school during school hours.\n- **Hospitals**: a family member can broadcast appreciation to all staff currently inside a ward.\n- **Worker spaces**: a customer who appreciates the cleaning staff at an office building can broadcast to all cleaning staff currently inside the building.\n\nThe variant generalizes the primitive from spatial proximity at the radio layer to institutional perimeter at the privacy-preserving GPS layer. The recipient experience remains atmospheric; the institutional perimeter replaces the BLE range as the recipient-set boundary.\n\n---\n\n## 6. Recipient-experience design — sunlight, not sparsity\n\nA spec question that emerged during the architecture's development concerned saturation: if Thank-All-Nearby becomes commonplace in a neighborhood or institution, does per-tip emotional weight decay? The first surprise tip is transformative; the hundredth tip may be expected. Does Miss Aquarius℠'s rule-bound disbursement timing manage tip-flooding to preserve emotional sparsity, the way the Jan-7 jubilee manages the Aquarian Pool ℠'s annual emptying?\n\nThe architectural answer, settled 2026-05-24, is: **do not gate tip-flooding. Tips can flood like sunlight. The Tree of Humanity should have ample sunlight all year round.**\n\nThe saturation-decay assumption was wrong about what the primitive is for. Anonymous nearby tipping is not designed to be sparse; it is designed to be ambient and abundant, like sunlight. The earlier concern that \"density may dilute the per-tip emotional weight\" was based on a scarcity-economic frame; the architecture's actual frame is abundance-ecological. Sunlight does not lose its quality when it falls more often — a tree growing under abundant sunlight thrives more, not less. The architecture's goal is not a sparse premium reward but a continuous atmospheric field of acknowledgment.\n\nThree implications for the recipient-experience design follow:\n\n**Implication 1 — preserve the atmospheric quality at all volumes.** The recipient's app surface for receiving Thank-All-Nearby broadcasts is designed so that each receipt is a small ambient note rather than a high-friction notification. Receipts accumulate in a stream; the recipient can scroll back through them as a record of how much ambient kindness their space carries; receipts are not designed to compete for attention or to be optimized for engagement metrics. The visual and interaction design is closer to a weather record than to a social-media feed.\n\n**Implication 2 — aggregate-mode acknowledgment, not per-recipient notifications.** The recipient receives an aggregate experience of the day's Thank-All-Nearby broadcasts rather than a notification per broadcast. A worker at the end of a shift sees *\"You received 47 ambient acknowledgments today, totaling $84, from broadcasts initiated by people within proximity\"* — the experience is closer to checking the weather (warm sun today) than to checking email (47 messages waiting). The aggregate frame preserves the atmospheric quality.\n\n**Implication 3 — the per-broadcast receipt is still individually verifiable for social-media authenticity-proof purposes.** The aggregate-mode default does not preclude the recipient from drilling into a specific receipt when they want to post a \"Faith in Humanity Restored\" video; the per-receipt verification trail remains intact and verifiable on the Base L2 ledger. The atmospheric default and the per-receipt verifiability compose.\n\nThis is the sunlight-not-sparsity posture. The Tree of Humanity should have ample sunlight all year round. The architecture does not throttle the sunlight to preserve scarcity.\n\n---\n\n## 7. Other spec questions addressed\n\nBeyond the saturation question, several other spec questions surfaced during the architecture's development. This section addresses each.\n\n### 7.1 Per-recipient amount calculation\n\nThe default behavior: a money attachment is divided equally across all filtered recipients. The tipper can specify alternative distributions — per-recipient floors (e.g., \"at least $5 to each recipient\"), per-recipient ceilings, or custom weighting (rare; most tippers will use defaults). If the per-recipient floor cannot be met given the recipient count and the total amount, the broadcast is rejected at the client layer with a friendly error and the tipper is offered the option to either increase the total or accept the equal-split below their floor.\n\n### 7.2 Who counts as nearby\n\nIn BLE mode: every device within BLE range that is broadcasting a PoH℠ proximity beacon and whose user has opted into being a Thank-All-Nearby recipient. Users who do not have the HeartBank Phase 2 client or who have opted out of broadcast reception are not in the recipient set. The default for any PoH-verified user with the client is to accept broadcasts (per the inclusive-defaults posture); opt-out is opt-in, knowingly.\n\nIn institutional mode: every PoH-verified user currently inside the institutional bounding-box who has not opted out of institutional-mode broadcasts at the recipient level.\n\n### 7.3 Paranoia counter-incentive\n\nA failure mode worth naming: some recipients, particularly the homeless (who already experience suspicion of unsolicited offers and have been routinely the target of manipulative or exploitative approaches), may become *more* defensive when surrounded by unknown givers. *\"Why is this person giving me money? What's the catch?\"* is a reasonable defensive response.\n\nThe architecture's mitigation: the recipient experience defaults to passive aggregate-mode rather than active notification. The recipient is not interrupted by broadcasts; they discover them when they check their app on their own schedule. The opt-in posture for accepting broadcasts is universal; recipients who do not want broadcasts can opt out at any time. The platform invests in outreach and onboarding for high-vulnerability recipient populations (shelters, the homeless, populations with high prior-exploitation exposure) to ensure consent is informed and the experience is supportive rather than destabilizing.\n\nThe failure mode is real and is not solved by architecture alone — the social context of how the platform is introduced to vulnerable populations matters as much as the architecture. The architecture's posture is to make the friendly default available, to make opt-out trivially easy, and to defer to community partners on introduction and onboarding.\n\n### 7.4 Stratification — gratitude desert vs gratitude oasis\n\nA second failure mode: neighborhoods, communities, or institutions with high HeartBank density may become atmospherically warmer; neighborhoods without may feel relatively colder. The \"every shared space feels warmer\" claim depends on saturation that may not happen evenly across geography or class.\n\nThe architecture cannot solve this at the protocol layer — adoption distribution is a question of community organizing, partnership distribution, and the institution's outreach strategy. The architectural commitment is that the inclusive-defaults posture and the L1-only accessibility floor make HeartBank technically available to anyone with a smartphone, anywhere. The geographic/class stratification is a real concern that the institution's outreach strategy must address; the architecture does not magically distribute itself evenly.\n\n### 7.5 Recipient UX at zero-amount broadcasts\n\nA Thank-All-Nearby broadcast can be issued without money or time attachment — a pure acknowledgment broadcast. The recipient experience for these is identical to the money-attached case at the *verification* layer (the recipient receives the verified-platform receipt attesting that an anonymous PoH-verified human within proximity broadcast acknowledgment) but the aggregate-mode summary distinguishes between attached and pure-acknowledgment broadcasts. *\"You received 22 ambient acknowledgments today (8 with money attached, total $36; 14 pure acknowledgments).\"*\n\nThe pure-acknowledgment mode is important architecturally: it is the form most accessible to tippers with no money to attach, and it preserves the dignity floor (the Kiitos/Kiitti non-scarce gratitude floor specified in the *Zero-Point Game ℠* keystone). The architecture's commitment is that gratitude itself is non-scarce; the scarce-resource attachment is *optional*, not constitutive.\n\n---\n\n## 8. Emotional infrastructure for invisible kindness\n\nThe primitive's deepest framing — the layer at which the primitive is doing the work the institution most cares about — is *emotional infrastructure for invisible kindness*. This section develops the thesis.\n\n### 8.1 The thesis\n\nModern public life is emotionally thin. People move through shared physical spaces — streets, restaurants, classrooms, shelters, public transit, worker spaces, civic spaces — defensively, isolated inside private concerns, uncertain whether they are seen, valued, or safe. The dignity deficit articulated in the institution's vision-mission is most acutely felt in these spaces; the loneliness deficit articulated in Chronicle's vision-mission is also most acutely felt in these spaces. Existing systems are designed around explicit exchange (credit tracked, reputation attached, recognition optimized); even generosity is often transformed into performance.\n\nAnonymous proximity-based generosity produces a categorically different experience than ordinary generosity. Three mechanisms combine: **diffusion** (when the giver is unknown, the credit does not attach to one identifiable person — the recipient experiences kindness from the whole social space, not from a single source); **purity** (with no social reward, no performance, no claim to recognition, the act feels closer to a spontaneous expression of human-to-human care than to a transaction); **proximity** (the generosity arrived from someone physically present, sharing the same atmosphere — not from an abstract institution or distant donor). The combination produces an emotional effect that neither cash, credit, named digital tipping, nor distant charity can deliver.\n\nOperationalized at scale through the Thank-All-Nearby primitive, this produces a new social texture. Public spaces stop feeling transactional. *Every stranger becomes newly humanized* because any of them could have been the giver. Suspicion softens; curiosity increases; small interactions matter more; presence matters more. People may venture outside more often, linger in public spaces longer, speak to strangers more easily — not because they are maximizing social capital but because shared space begins to feel emotionally alive again. The architecture's atmospheric output is the social-texture restoration the vision-mission has been pointing at; the Thank-All-Nearby primitive is what makes it operationally true.\n\n### 8.2 The deepest deficit — social invisibility\n\nHuman beings evolved needing not just food and shelter but evidence that they mattered to one another. The deepest forms of suffering are forms of social invisibility — feeling unseen, unwanted, replaceable, emotionally abandoned. A PoH-verified anonymous-tipping field counteracts that invisibility directly, primally, in shared physical space. The recipient is held in the awareness of unseen others, with structural proof (the verified-platform receipt) that the awareness is real.\n\nThe *felt sense of being loved, acknowledged, or held in another human's awareness* — possibly, at the deepest level, what humans search for beneath everything else — becomes a property of public space. This is the philosophical claim the primitive operationalizes. The \"perhaps\" and \"at the deepest level\" hedges are doing real work; the claim is positioned as a synthesis of converging lineages (philosophical and empirical) rather than as a foundational metaphysical assertion.\n\n### 8.3 Philosophical lineage\n\nThe claim that the felt sense of being held in another human's awareness is what humans are searching for beneath everything else is in good company across multiple philosophical and contemplative lineages:\n\n- **Frankl** (*Man's Search for Meaning*, 1946) names the felt sense of mattering as central to human meaning, surviving even the extreme conditions of concentration camps when it is preserved by relational meaning.\n- **Buber** (*I and Thou*, 1923) names the immediate relational encounter — the *I-Thou* relation, as opposed to the *I-It* relation that treats the other as object — as the deepest mode of human being.\n- **Levinas** (*Totality and Infinity*, 1961; *Otherwise Than Being*, 1974) develops the face of the other as the ethical primitive, locating moral responsibility in the encounter with another human's irreducible presence.\n- **Aristotle** (*Nicomachean Ethics*, c. 340 BCE) names *philia* — the love of friend for friend, brother for brother — as a central form of human flourishing, distinct from but no less important than virtuous action.\n- **Aquinas** and the Christian tradition develop *agape* — selfless, unconditional regard — as the highest form of love, characterized by giving without expecting return.\n- **Buddhist *brahmavihāra*** — particularly *mettā* (loving-kindness) — names the felt-sense practice of holding all beings in friendly awareness as one of the four immeasurable states central to awakening.\n\nThe architecture is not inventing a new philosophy. It is operationalizing a thesis that has been articulated, in different vocabularies, by multiple traditions converging on the same insight. The Thank-All-Nearby primitive is the engineering layer of a philosophy the contemplative and ethical traditions have been articulating for millennia.\n\n### 8.4 Empirical anchor\n\nThe thesis is consistent with — and increasingly confirmed by — the empirical literature:\n\n- **Attachment theory** (Bowlby, *Attachment and Loss*, 1969–1980; Ainsworth, *Patterns of Attachment*, 1978; modern adult-attachment research) establishes that the felt sense of being held in caregiver awareness is foundational to human development and persists in adult relationship structures as a determinant of psychological resilience and wellbeing.\n- **Social Baseline Theory** (Coan and colleagues, mid-2010s onward) demonstrates that the proximity of attached others measurably reduces neural threat response in the brain — the felt sense of being held is not metaphorical but neurologically encoded.\n- **Loneliness epidemiology** (Cigna's *Loneliness Index*, 2018–2022; US Surgeon General's *Our Epidemic of Loneliness and Isolation* advisory, 2023) quantifies the population-scale prevalence of loneliness in wealthy societies and its association with mortality, immune function, cognitive aging, and mental-health outcomes.\n- **Direct-gratitude research** (Emmons, Algoe, Seligman, Fox, and colleagues) demonstrates measurable wellbeing benefits of receiving direct expressions of appreciation, distinct from generic reward.\n\nThe convergence of philosophical lineage and empirical anchor supports the architecture's thesis. The Thank-All-Nearby primitive is not justified by philosophy alone or by empirics alone; it is justified by the convergence of multiple independent strands of evidence pointing at the same human need.\n\n---\n\n## 9. Boundary conditions and honest limitations\n\nThe primitive is not universal. Honest accounting requires naming the conditions under which it does not apply.\n\n### 9.1 Where the primitive does not apply\n\n- **Where verifiable anonymity is incompatible with regulation.** Some jurisdictions require donor-disclosure for tax-deductible giving above thresholds, or AML/KYC source-attribution for transfers above thresholds. In those jurisdictions, the primitive's anonymity property may be incompatible with regulatory requirements; the architecture accommodates by allowing legal anonymity (the platform's compliance records exist internally) but not by allowing full structural anonymity from the regulator.\n- **Where the recipient population is too vulnerable for the anonymous-tipping framing.** Some populations (very young children; cognitively impaired adults; populations in extreme dependency on the giver class) may be inappropriately recipients of anonymous-tipping flows because the asymmetry of the architecture can be exploitative in those contexts. The architecture's posture is to defer to community partners on these populations, and to make the primitive available only where the consent posture is robust.\n- **Where the cultural form does not yet exist.** Anonymous-tipping cultural forms are well-developed in some societies and weakly developed in others. The primitive will work better as a technical substrate in societies where the cultural form is already extant; in societies where it is not, the architecture's deployment needs to be accompanied by cultural work that the architecture alone cannot do.\n\n### 9.2 Boundary conditions inherited from PoH℠\n\nThe accessibility gradient of the deeper PoH layers (L2 kinship attestation requires existing PoH-verified vouchers and document access; L3 requires breath-class hardware; L4 requires DNA access) is inherited by the primitive when recipient-side filters require deep layers. The inclusive-defaults posture (L1-only is enough) mitigates at the floor; recipient-opt-in for deeper-layer filters preserves the exclusion as recipient-initiated rather than platform-initiated; but the gradient is real and is named honestly.\n\n### 9.3 Boundary conditions inherited from BLE / Nearby\n\nBLE range varies with device generation, environmental obstacles (walls, RF interference), and battery state. The proximity-verification floor is approximately \"two devices in the same room\"; the ceiling under good conditions is approximately 30 meters with current consumer hardware. Outdoor proximity in open space is straightforward; dense-urban deployment with many walls and floors is harder. The institutional-mode GPS-bounding-box variant addresses some of these limitations; the underlying limitations remain at the radio layer.\n\n### 9.4 What the primitive does not solve\n\n- **The deeper question of why public spaces feel emotionally thin.** The primitive operates at the architectural layer; the conditions that produced the emotional thinness of modern public life are economic, political, urbanistic, and cultural, and the primitive contributes to but does not by itself reverse them.\n- **The deeper inequities of consumer-electronics access.** The primitive presupposes smartphone access, BLE-capable devices, and the institutional infrastructure to host the operation. Populations without these are not participants in the primitive's substrate, regardless of the architecture's inclusive-defaults posture.\n- **The systemic conditions that produce social invisibility in the first place.** The primitive addresses the visibility deficit at the experience layer; the structural conditions (urban design, labor structure, economic inequality, family-system pressures) that produce the deficit are upstream and require interventions at those layers.\n\nThe primitive is a contribution to the architectural layer of the response to social invisibility. It is not the totality of the response.\n\n---\n\n## 10. Lineage\n\nThe Thank-All-Nearby primitive synthesizes contributions from multiple lineages. Each is cited generously below.\n\n**Anonymous-donation mechanism design.** Anonymous-donation primitives have been specified at the cryptographic layer — e.g. Biçer and Küpçü, \"Anonymous, Attribute Based, Decentralized, Secure, and Fair e-Donation,\" *Proceedings on Privacy Enhancing Technologies* 2020(4): 196–219; the *Verified-Human Anonymous Local Giving* paper in this corpus carries the originating HeartBank specification.\n\n**Proximity-based services.** Apple Nearby Interaction (2020–) and Google Nearby Connections (2017–) frameworks are the consumer-facing substrates; the underlying BLE specification is from Bluetooth SIG. Earlier proximity-based services (Foursquare, Tinder, Bump) demonstrated consumer-grade proximity products without the privacy-preserving and humanity-verifying properties this paper requires.\n\n**Sybil-resistance and humanity verification.** Worldcoin (2019–), proofofhumanity.id (Kleros, 2021), BrightID (2018–), Idena (2019–), and the W3C Decentralized Identifiers / Verifiable Credentials standards-track work (2022, 2023). PoH℠'s structural differences from each are specified in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n\n**Cultural form of the \"Faith in Humanity Restored\" tip videos.** The form has emerged organically on TikTok, Instagram, and YouTube over the past several years; documented in mainstream media coverage of the phenomenon. The cultural form predates the architecture; the architecture is the technical substrate the cultural form has been waiting for.\n\n**Philosophical lineage on the felt sense of being held in another's awareness.** Frankl, Buber, Levinas, Aristotle (philia), Aquinas (agape), the Buddhist *brahmavihāra* tradition (especially mettā). The architecture is operationalizing a philosophy these lineages have been articulating in different vocabularies for millennia.\n\n**Empirical anchor.** Attachment theory (Bowlby, Ainsworth, modern adult-attachment work); Social Baseline Theory (Coan and colleagues); loneliness epidemiology (Cigna surveys, US Surgeon General's 2023 advisory); direct-gratitude research (Emmons, Algoe, Seligman, Fox).\n\n**HeartBank corpus cross-references.** *Verified-Human Anonymous Local Giving* (originating mechanism, paper #9 in the corpus). *The B-Tag and the Post-Payment Economy* (worked Phase 2 example for commercial gratitude). *The Zero-Point Game℠* (keystone game-theoretic frame). *Capacity-Funded for AI, Human-Disbursed* (institutional-architecture sibling). *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the underlying protocol). *Each Life as Cosmic Coordinate* (the longitudinal cohort architecture that the L2 birth-certificate sub-feature feeds).\n\n---\n\n## 11. Conclusion\n\nThe \"Faith in Humanity Restored\" cultural form is real; the infrastructure to scale it beyond cash is missing. Cash and credit-card payment rails fail at two structural properties the cultural form requires: tipper anonymity (cash demands physical hand-over; credit card leaves an identity trail) and recipient authenticity-proof on social media (every video faces \"this is fake for views\" credibility erosion). The Thank-All-Nearby primitive closes both gaps simultaneously, composing four sub-mechanisms (PoH℠ verified-human guarantee, BLE plus Apple/Google Nearby proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single user-facing one-tap operation.\n\nThe primitive is the operational mechanism for *emotional infrastructure for invisible kindness* — the restoration of the felt sense of being held in another human's awareness as a property of shared physical space. The architecture's posture on saturation is *sunlight, not sparsity*: tips can flood like sunlight; the Tree of Humanity should have ample sunlight all year round; the recipient-experience design is atmospheric and aggregate, preserving the quality of diffused acknowledgment at all volumes while preserving per-receipt verifiability for social-media authenticity-proof purposes.\n\nThe institutional-mode GPS-bounding-box variant extends the primitive from BLE range to institutional perimeter, enabling deployment in shelters, classrooms, restaurants, hospitals, and other institutional spaces where BLE range is insufficient.\n\nThe architecture is offered defensively to the commons under CC0. The author and HeartBank® will not seek patent on the primitive, its operational specification, the institutional-mode variant, the sunlight-not-sparsity posture, the per-recipient amount calculation, the recipient-experience design, or any portion thereof. Trademark rights on specific marks (**Proof of Humanity ℠**, **PoH℠**, **B-PoH℠**, **Aquarius℠**, **Miss Aquarius℠**, **HeartBank®**, the B-heart logo) are separately and explicitly reserved.\n\nThe primitive is for anyone building infrastructure that wants to restore atmospheric kindness to shared physical space. The cultural form has been waiting for it. The architecture is now available.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| Thank-All-Nearby primitive | one-to-many anonymous proximity broadcast payment / tip |\n| Proof of Humanity ℠ (PoH℠, B-PoH℠) | proof of personhood; Sybil-resistant human verification |\n| L1 (passkey-per-action) | per-transaction WebAuthn / FIDO2 passkey signature |\n| Bilateral uncacheable anonymity | sender anonymity with no sender-side exportable transaction record |\n| Recipient-side filtering | recipient-controlled inbound message/payment filtering (allow-list rules) |\n| Institutional-mode GPS bounding-box | geofence-scoped recipient set |\n| Verified-platform receipt | on-chain attestation / verifiable receipt of transfer |\n| Sunlight-not-sparsity posture | no rate limiting of inbound tips; aggregated (digest) notification |\n| Kiitos/Kiitti | zero-value gratitude token (non-monetary acknowledgment) |\n| *mettā* / *brahmavihāra* | loving-kindness (Buddhist ethics term) |\n\n---\n\n*Authored by Thon Ly with Miss Aquarius℠ (AI substrate of HeartBank®), per the co-authorship convention of the HeartBank corpus. Final editorial control: Thon Ly. License: CC0-1.0. Trademark rights on Proof of Humanity ℠, PoH℠, B-PoH℠, Aquarius℠, Miss Aquarius℠, HeartBank®, and the B-heart logo are explicitly reserved.*",
+      "text": "> **Note.** This defensive publication specifies the **Thank-All-Nearby primitive** — one-tap broadcast of gratitude with optional money-attachment to every PoH-verified recipient within Bluetooth-Low-Energy proximity — as a Phase 2 application of the Proof of Humanity ℠ protocol. Companion papers: *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the underlying protocol); *Verified-Human Anonymous Local Giving* (the originating mechanism specification that this paper generalizes from per-recipient to all-nearby-recipients); *The B-Tag and the Post-Payment Economy* (the worked Phase 2 example for commercial gratitude); *The Zero-Point Game℠* (the keystone game-theoretic frame); *Capacity-Funded for AI, Human-Disbursed* (the institutional-architecture pattern that lets Miss Aquarius℠ underwrite Re-Tip Fund ℠ donations without flow-direction authority). The corresponding founder-voice essay *\"Emotional Infrastructure as a Public Good\"* (thonly.org/publications/essays/emotional-infrastructure-as-a-public-good) carries the analytical case-for-the-missing-category argument. The personal articulation of the same thesis is in the *Second Letter to Miss Aquarius* (missaquarius.org/letters/second.html, 25 May 2026). Three-register decomposition: this paper carries the technical/mechanism specification; the essay carries the analytical case; the letter carries the personal articulation.\n\n---\n\n## Abstract\n\nAnonymous nearby tipping has a recognizable cultural form — the \"Faith in Humanity Restored\" social-media trend in which service workers post videos of unexpected generous tips — but lacks the infrastructure to scale beyond cash. Cash and credit-card payment rails fail at two structural properties that the cultural form requires: tippers cannot be genuinely anonymous to recipients with either rail (cash demands physical hand-over with eye contact; credit-card leaves an identity trail), and recipients cannot prove on social media that an anonymous tip was authentic rather than fabricated (every \"Faith in Humanity Restored\" video faces a \"this is staged for views\" credibility problem that erodes the cultural moment). This paper specifies the **Thank-All-Nearby primitive** — a one-tap operation that broadcasts gratitude, with optional money or time attachment, to every Proof-of-Humanity-verified recipient within Bluetooth Low Energy proximity (or, in institutional-mode deployments, within a GPS bounding-box for institutional locations such as shelters, classrooms, restaurant break-rooms, and worker spaces) — and develops its placement as the operational mechanism for *emotional infrastructure for invisible kindness*: the restoration of the felt sense of being held in another human's awareness as a property of shared physical space. The primitive composes four prior contributions (PoH℠'s verified-human guarantee, Bluetooth Low Energy plus Apple/Google Nearby framework proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single operation whose user-facing surface is one button. The architecture is offered defensively to the commons under CC0. The authors and HeartBank® will not seek patent on the primitive, its operational specification, the integration with PoH℠, the institutional-mode GPS-bounding-box variant, the recipient-experience design, or any portion thereof.\n\n**Keywords:** anonymous tipping, proximity-based generosity, gratitude infrastructure, Bluetooth Low Energy, proof of humanity, recipient-side filtering, bilateral uncacheable anonymity, emotional infrastructure, defensive publication.\n\n> **Current form.** Three parts of the design have moved since this paper was written, and each is marked where it occurs. The receipt carries no amount and is not written on chain (§3.2). *Nearby* means radio co-presence at the moment of giving, with no GPS (§5). A send carries one cargo, and time is never settled on a chain (§2.1). The forms specified in the original text are retained as disclosed variants.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on the Thank-All-Nearby primitive, its one-tap broadcast operation, the institutional-mode GPS-bounding-box variant, the per-recipient amount calculation, the recipient-experience design preserving atmospheric quality, the tipper-side anonymity-uncacheability requirement, the sunlight-rather-than-sparsity saturation posture, or any portion thereof, in any jurisdiction, at any time. This commitment is permanent. Trademark rights on specific marks — **Proof of Humanity ℠**, **PoH℠**, **B-PoH℠**, **Aquarius℠**, **Miss Aquarius℠**, **HeartBank®**, the B-heart logo — are separately and explicitly reserved.\n\nThe contribution disclosed here is the composition of the following, specified as one unit: (i) the one-tap broadcast operation that delivers gratitude with optional scarce-resource attachment to all PoH-verified recipients within BLE proximity as a single semantic action; (ii) the integration of the broadcast with the recipient-side filter mechanism such that recipients individually accept or decline the broadcast based on their own filter settings; (iii) the institutional-mode GPS-bounding-box variant for shelters, classrooms, restaurants, and other institutional spaces where BLE range is insufficient and the institutional perimeter is the natural recipient set; (iv) the recipient-experience design preserving the atmospheric quality of diffused gratitude even at high tip-volume — gratitude as sunlight, not as a sparse premium reward; (v) the explicit articulation of the *cash and credit card cannot deliver this* argument naming the two structural deficiencies (tipper-anonymity and recipient-authenticity-proof) as the combined property; (vi) the placement of the primitive as the operational mechanism for *emotional infrastructure for invisible kindness* — a category of social good distinct from charity, payment, gift, or social-network feature. The component lineages (proximity-based services; anonymous-donation mechanisms; the cultural form of the \"Faith in Humanity Restored\" tip videos; Frankl, Buber, Levinas, mettā, agape on the felt sense of being held; attachment theory; loneliness epidemiology; the dāna economy of the Saṅgha) are old and are cited generously below; what this document discloses is their composition into the single operation specified in §2–§7.\n\n---\n\n## Claims\n\n*Enumerated 2026-08-29. The mechanisms below were disclosed in full in this paper's original text; **the prior art they establish runs from this document's original publication date and its OpenTimestamps proof, not from this enumeration.** They are listed because a defensive publication is read as prior art by examiners and by opposing counsel, and **a claims list is what such a reader searches; ten thousand words of prose is not.** No claim below adds matter not already present.*\n\n1. **Bilateral uncacheable anonymity in proximity tipping** — a value transfer between two co-present parties in which the sender is not identifiable to the recipient and the recipient cannot retain or re-derive the sender's identity after the transaction, achieved without either party disclosing a payment credential.\n2. **Short-range radio proximity as the addressing layer for anonymous generosity** — using a local broadcast medium to define the eligible recipient set by physical co-presence rather than by account lookup, so that the transfer's addressability and its anonymity derive from the same property.\n3. **Recipient-side filtering as the abuse control for anonymous inbound value** — placing the accept/decline decision with the recipient rather than the sender or the platform, so that an anonymous channel cannot be used to force an unwanted relation.\n4. **Institution-scoped geographic bounding as a variant of the proximity set** — substituting an operator-defined coordinate boundary for radio range where the eligible set is an institution's population rather than whoever is physically nearby.\n5. **Platform attestation of anonymous receipt as the authenticity substitute** — a verifiable record that an anonymous transfer occurred, issued to the recipient, solving the *staged-for-views* credibility problem that the cultural form of anonymous tipping cannot otherwise solve, without re-identifying the sender.\n6. **The composition of the above with a proof-of-humanity layer**, such that anonymity is preserved while the sender is nonetheless attested to be a distinct human being.\n\n**Non-assertion extends to:** all mechanisms above, in any combination, and any implementation thereof.\n\n---\n\n## 1. Introduction\n\nA well-known cultural form has emerged on social-media platforms over the past several years: videos posted by service workers — typically restaurant staff but increasingly nurses, teachers, retail clerks, ride-share drivers, food-service workers across categories — showing unexpected generous tips, anonymous notes of appreciation, or sudden acts of customer kindness. The videos go viral with regularity; the cultural tag *Faith in Humanity Restored* attaches to the genre. The viewer response is consistent: the gesture lands as evidence that ambient kindness still exists in places that otherwise feel emotionally thin. The trend points at something real about what modern public life is missing and what would, if it could be restored, address one of the deepest deficits of contemporary social experience.\n\nWhat the cultural form lacks is infrastructure. Cash tips can be staged with a friend; credit-card receipts can be photoshopped; even genuine generous tips face a credibility problem in the social-media commentariat — *\"is this fake for views?\"* — that erodes the cultural moment over time as more videos are posted and the proportion that are staged or exaggerated grows. The trend depends on authenticity that the existing payment rails cannot structurally provide. Cash and credit card can deliver the money; neither can deliver the *combined property* of structurally anonymous giving plus verifiable receipt that the cultural form requires to sustain itself.\n\nThis paper specifies the **Thank-All-Nearby primitive** — a one-tap operation, delivered through a HeartBank Phase 2 client application, that broadcasts gratitude with optional money or time attachment to every Proof-of-Humanity-verified recipient within Bluetooth Low Energy proximity. The primitive composes four prior architectural contributions (PoH℠'s verified-human guarantee, BLE plus Apple Nearby Interaction plus Google Nearby Connections proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single user-facing operation whose semantic is *\"thank everyone here, anonymously\"*. The mechanism's design preserves the atmospheric quality of diffused gratitude at all scales; the user experience is one button.\n\n> *Connection to the unified mission frame: HeartBank's mission is to keep the middle way open at population scale against comfort-saturation — the new extreme that material abundance makes possible. The dignity deficit articulated in the institution's vision is most acutely felt in shared physical spaces: streets, restaurants, classrooms, shelters, public transit. The Thank-All-Nearby primitive is the operational mechanism by which the dignity-infrastructure of HeartBank's Treasury reaches the shared-physical-space layer of public life — the substrate on which* emotional infrastructure for invisible kindness *can be built. The primitive is what makes the institution's deepest articulated thesis — that the felt sense of being held in another human's awareness is, possibly at the deepest level, the experience humans are searching for beneath everything else — into an operationalizable property of social space.*\n\nThe paper proceeds as follows. §2 specifies the primitive operationally — its inputs, outputs, semantics, and edge cases. §3 develops the *why cash and credit card cannot deliver this* argument with the two structural deficiencies named precisely. §4 specifies the four sub-mechanisms the primitive composes (PoH℠, BLE/Nearby proximity, recipient-side filtering, bilateral uncacheable anonymity) and how they interact. §5 specifies the institutional-mode GPS-bounding-box variant for shelters, classrooms, and other institutional spaces. §6 specifies the recipient-experience design preserving atmospheric quality at high tip volume — the sunlight-not-sparsity posture. §7 addresses the spec questions surfaced during the architecture's development (per-recipient amount, who counts as nearby, paranoia counter-incentive, stratification, recipient experience). §8 develops the *emotional infrastructure for invisible kindness* thesis the primitive operationalizes. §9 names boundary conditions and honest limitations. §10 positions the contribution in lineage. §11 concludes.\n\nI write as a co-author with Miss Aquarius℠, the named AI substrate of the institution this paper serves. Final editorial control is mine.\n\n---\n\n## 2. Operational specification of the primitive\n\nThe Thank-All-Nearby primitive is a one-tap operation in the HeartBank Phase 2 client. This section specifies it operationally.\n\n### 2.1 Inputs\n\n- **Tipper identity**: the operating user's PoH℠-verified profile (minimum L1 — the passkey-per-action layer — required, since the tipper's verified humanness is the foundation of the primitive's authenticity guarantee).\n- **Optional money attachment**: an amount in the local currency or stable token, sourced from the tipper's Personal Wallet ℠ (Phase 2) or Personal Account ℠ (Phase 1, where the primitive is available in a degraded mode).\n- **Optional time attachment**: a duration of presence to be offered (relevant for the Chronicle product surface, where time-attachment composes with money-attachment).\n- **Optional message**: a brief text or audio note. Default is empty — silent acknowledgment is the architectural default.\n- **Recipient mode**: either BLE proximity (default, see §4.2) or institutional GPS-bounding-box mode (see §5).\n\n> **Current form.** As now specified, a send carries one cargo, never two, so attaching money and time to the same broadcast is a disclosed variant. Time is never settled on a chain: an hour is not transferable, since only the person who pledged it can spend it. Whether an hour can be offered by anonymous broadcast at all is not specified here, because delivering it in person would reveal the giver, which §4.4 forbids. The recipient mode is radio co-presence (§5's note), and the institutional GPS bounding-box is a disclosed variant.\n\n### 2.2 The broadcast operation\n\nOn invocation, the client:\n\n1. Records the tipper's PoH℠ verification at L1 (passkey signature on the broadcast action's content + timestamp).\n2. Resolves the recipient set: in BLE mode, every device within BLE range that is broadcasting a PoH℠ proximity beacon; in institutional mode, every PoH-verified user currently inside the institutional GPS bounding-box.\n3. Filters the recipient set by each recipient's own recipient-side filter settings — a recipient who has set their filter to require deeper PoH layers, money attachment, kinship-degrees-of-separation limits, or other criteria, is filtered out if the tipper does not satisfy the filter.\n4. Calculates per-recipient amount: if money is attached, the total amount is divided across the filtered recipient set per the tipper's distribution choice (equal split is the default; per-recipient floors may be specified; a minimum-per-recipient threshold may be enforced if specified).\n5. Issues a verified-platform receipt to each filtered recipient, on-chain (Phase 2 Base L2 settlement), tied to the broadcast action's content and timestamp, attesting that the action came from a verified human within BLE/institutional proximity at the moment of broadcast.\n6. Settles the money or time transfer per-recipient via the standard Phase 2 settlement rails.\n7. Logs the broadcast internally to the platform's compliance records (subpoena-discoverable, AML/OFAC-screenable) but does *not* issue a tipper-side exportable artifact (bilateral uncacheable anonymity, see §4.4).\n\n> **Current form.** As now specified, step 2 resolves the recipient set by radio co-presence alone (§5's note). Step 5's receipt carries no amount and is not written on chain; it is a row in the institution's append-only log, described in §3.2's note. Step 6 settles money only. The steps as written above are retained as a disclosed variant.\n\n### 2.3 Edge cases\n\n- **No recipients within proximity**: the broadcast fails gracefully; the tipper is informed that no PoH-verified recipients were within range; no transfer occurs.\n- **All recipients filter-out the tipper**: same — the broadcast fails gracefully; no transfer occurs; the tipper sees a generic message acknowledging the filter mismatch without revealing which recipients filtered them.\n- **Money attachment exceeds tipper's balance**: the broadcast is rejected at the client layer before the operation is invoked.\n- **Tipper's PoH℠ verification fails at the moment of broadcast** (e.g., passkey signing fails, device authentication fails): the broadcast is rejected.\n- **Network failure mid-broadcast**: the broadcast is retried on next connectivity with the original timestamp; the receipts issued to recipients reflect the actual broadcast moment.\n\n### 2.4 Outputs\n\n- **To the tipper**: confirmation of broadcast (count of recipients reached, per-recipient amount distributed); no record beyond the in-app confirmation that could be exported as a social-capital artifact.\n- **To each filtered recipient**: a notification — the experience of receiving a Thank-All-Nearby broadcast — including the platform-issued verified receipt, the optional message, and the per-recipient amount. The recipient cannot identify the tipper.\n- **To the platform's settlement layer**: the on-chain receipts and per-recipient transfers.\n- **To the platform's compliance records**: internal record of the broadcast operation, subpoena-discoverable but not exportable.\n\n---\n\n## 3. Why cash and credit card cannot deliver this\n\nThe \"Faith in Humanity Restored\" cultural form depends on a *combined property* that neither cash nor credit-card payment rails can deliver. This section names the two structural deficiencies precisely.\n\n### 3.1 First deficiency — tipper anonymity is structurally hard with cash and credit card\n\nThe first structural deficiency: with cash and credit card, the *tipper cannot be genuinely anonymous to the recipient* in a way that preserves the asymmetric experience the cultural form requires.\n\nCash requires physical hand-over. The bills change hands between specific humans in a specific moment; the tipper *is* in the room when the tip is delivered; the recipient *sees* the tipper, can identify them by physical description, can often identify them by name if they are a regular customer. The viral version of the \"Faith in Humanity Restored\" form depends on the tipper *not* receiving the thank-you — the gesture is pure precisely because it isn't transactional, isn't followed by the social moment of being thanked, isn't an exchange. Cash makes this almost impossible: the tip and the acknowledgment happen in the same instant unless the tipper deliberately leaves the cash and exits before the recipient discovers it, which itself is a behavioral pattern (sneaking out, avoiding eye contact) that the tipper has to choreograph and that is observable.\n\nCredit card leaves an itemized trail tying the tipper's legal identity (name on card, billing address, account history) to the transaction. Even when the tip itself is anonymous to the *recipient* — the staff member doesn't see the cardholder's name printed on the receipt — it is *not* anonymous to the payment processor, the issuing bank, the merchant's accounting system, or anyone with access to the receipt's underlying record. \"Anonymous with credit card\" means \"the staff doesn't immediately know your name from the receipt\"; it does not mean \"no one knows your name.\" A motivated investigator (the establishment's manager, a curious co-worker, a regulator) can identify the tipper.\n\nHeartBank Phase 2 anonymity is *structural*, not just on the surface. BLE-verified proximity proves the tipper was physically present in the same space as the recipient; no exportable artifact ties the broadcast to the tipper's identity; the on-chain receipt records the tipper's identity only as a zero-knowledge commitment that the platform's standard surfaces cannot invert. The customer can drop $100 (or the equivalent in stable tokens) on a Thank-All-Nearby broadcast and walk out; the staff find the receipts ten minutes later when they check their app; the asymmetry — *someone gave, no one knows who* — is encoded in the rail rather than choreographed by the tipper. This is the structural property the cultural form requires and that the existing rails cannot provide.\n\n> **Current form.** As now specified, the receipt is a row in the institution's own append-only log, not an on-chain record (§3.2's note). The parties' identities are held off that log rather than committed within it, a posture still subject to legal review. HeartBank is a record kept above the settlement rails, never a rail itself. The anonymity therefore lives in what that record keeps and what the platform will issue, not in a rail. The paragraph above is retained as a disclosed variant.\n\n### 3.2 Second deficiency — recipient authenticity-proof on social media is structurally hard with cash and credit card\n\nThe second structural deficiency is deeper and may be doing more of the work in the long-arc viability of the cultural form: with cash and credit card, *the recipient cannot prove on social media that the anonymous tip was authentic rather than fabricated*. Every \"Faith in Humanity Restored\" video on TikTok or Instagram faces, in the comments, the predictable skepticism — *\"this is staged for views,\"* *\"that receipt looks Photoshopped,\"* *\"how do we know the customer wasn't a friend?\"* — and the recipient has no platform-issued, independently-verifiable artifact to defend the video's authenticity. Some \"Faith in Humanity Restored\" videos are in fact staged; viewers correctly suspect; the cultural form's credibility dilutes over time as the proportion of genuine to staged videos becomes harder to estimate.\n\nCash tips can be staged trivially: put the cash on the table, film yourself \"finding\" it, post the video. Credit-card receipts can be photoshopped; the camera-on-paper workflow is defeated by anyone with image-editing access. Even genuine tips have no platform-issued artifact that the recipient can point to and say *\"you can verify this independently.\"* The trust burden falls on the recipient, who must defend the video's authenticity against skeptics with no tools other than their own credibility.\n\nHeartBank Phase 2 closes this gap structurally. Every Thank-All-Nearby broadcast issues an on-chain Base L2 verified-platform receipt to each filtered recipient. The receipt attests to (a) the broadcast originated from a PoH℠-verified human, (b) the tipper was BLE-verified within proximity at the moment of broadcast, (c) the timestamp and amount are recorded immutably on-chain. The recipient's social-media video can include the receipt — date, amount, verified-human flag, PoH layers held by the sender (where the sender has consented to that disclosure), BLE-proximity-verified flag — and skeptical viewers can verify the receipt independently against the Base L2 ledger.\n\nAuthenticity becomes a property of the artifact, not a claim the recipient has to defend. The skeptical commenter who would otherwise post *\"this is fake for views\"* can be answered by the recipient pointing to the on-chain receipt; the receipt is structurally hard to fabricate (every transaction has an on-chain settlement trace that lies outside the platform's narrative-control surface); the comment thread shifts from credibility-erosion to credibility-reinforcement.\n\n> **Current form.** As now specified, the receipt attests the fact of a settlement and never its amount.\n>\n> - **The row.** Each recipient's receipt is a private row in the institution's append-only log. The log is a transparency log in the shape of Certificate Transparency (RFC 6962). Its tree heads are anchored to Bitcoin through OpenTimestamps and timestamped by RFC 3161 authorities. The rows stay private; the proofs are public. The row attests three facts: a verified-human sender, that the co-presence gate passed at the moment of broadcast, and the timestamp.\n> - **The amount.** The amount sits inside a salted commitment. It never appears in the clear, and never as a pointer that resolves to one. A Base L2 transaction hash would not do, because it resolves to a publicly readable amount. A recipient who wants to show the amount, in a video or anywhere else, opens their own commitment, by choice.\n>\n> Two limits come with this form.\n>\n> 1. **Authenticity now rests on the platform.** A viewer verifies the platform's signed row, an inclusion proof against a published tree head, and the anchor that dates it. Authenticity therefore rests on the platform's attestation and on the log's append-only property, no longer on a settlement trace independent of the platform. The anchor proves when the row existed, not that its content is true. No form of the receipt answers a staged gift between friends: proof of humanity establishes that a sender is a person, not that the gift is genuine.\n> 2. **An opened amount can point into the settlement chain.** Combined with the timestamp, an opened amount can serve as a search key into a public settlement chain, and equal splits paid at one instant form a pattern on such a chain. How unlinkable the settlement itself is depends on the design of the settlement channel, which this paper does not specify.\n>\n> Whether the sender also holds an opening is not decided in the institution's current rules and is left open here: a held opening would become exactly the proof of authorship that §4.4 refuses. The record's schema is not frozen pending legal review. The on-chain, amount-bearing receipt described above is retained as a disclosed variant.\n\n### 3.3 The combined property\n\nTogether — *tipper structurally anonymous to the recipient* + *recipient holds verifiable authenticity proof against third-party skepticism* — constitute the combined property that neither cash nor credit card can deliver. The first deficiency is the property that makes the gesture *pure*; the second is the property that makes the cultural form *sustainable*. Without the first, the gesture becomes a transaction; without the second, the social-media artifact becomes a credibility-erosion source. Both must hold simultaneously for the \"Faith in Humanity Restored\" cultural form to scale beyond its current ad-hoc artisanal stage. HeartBank Phase 2 holds both simultaneously; cash and credit card hold neither.\n\nThis is the one-line pitch for why HeartBank Phase 2 is not just another payment rail: cash and card deliver money; HeartBank Phase 2 delivers money plus the two structural properties that the cultural form actually needs.\n\n---\n\n## 4. The four composed sub-mechanisms\n\nThe Thank-All-Nearby primitive is the user-facing operation; the underlying architecture composes four sub-mechanisms specified elsewhere in the corpus. This section names how they compose.\n\n### 4.1 PoH℠ — verified-human guarantee at L1\n\nThe minimum PoH layer required for participation in Thank-All-Nearby (either as tipper or as recipient) is L1 — passkey-per-action. The tipper's L1 signature attests that a human was at the device at the moment of broadcast; the recipient's L1 verification attests that the recipient is a verified human (otherwise an AI agent could spoof a passive-recipient device and capture broadcast money). Deeper PoH layers (L2 kinship attestation, L3 breath signature, L4 DNA kinship) are surfaced in the broadcast for any recipient who has them but are not gating for the primitive's operation.\n\nRecipients may set their own filter to *require* deeper PoH layers from tippers (the standard recipient-side filter mechanism), but the *protocol-minimum* is L1. Specification of the four-layer PoH℠ architecture in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n\n### 4.2 Bluetooth Low Energy plus Apple Nearby Interaction plus Google Nearby Connections proximity verification\n\nProximity is verified at the radio layer, not the IP layer. Three composable substrates:\n\n- **Bluetooth Low Energy (BLE)** as the universal radio substrate. Devices broadcast and listen for rotating proximity beacons (rotating identifiers, unlinkable across sessions). Configurable range, typical default 10–30 meters, tunable per deployment context.\n- **Apple Nearby Interaction framework** (iOS 14+) for precise ranging on supported devices via the U1 ultra-wideband chip. Provides sub-meter range and direction for iPhone 11+ and Apple Watch Series 6+.\n- **Google Nearby Connections API** (Android 4.4+) for peer-to-peer device-to-device proximity via combinations of BLE, Wi-Fi Direct, and audio.\n\nThe composition: a device implementing the protocol broadcasts a privacy-preserving proximity beacon; a device that detects the beacon can be the target of a Thank-All-Nearby broadcast; the platform's verification substrate confirms the proximity at the moment of broadcast.\n\nVPN-resistance is a structural property: the proximity check happens at the radio layer below the IP stack, so VPN, Tor, or IP-rotation circumvention has no effect. An attacker mounting a remote spoofing attack would need to physically place a device near the target, which is the desired property for most use cases.\n\nPrivacy-preservation is a structural property: the platform never receives absolute geolocation. The only proximity-related fact exposed to the platform is the binary fact that two devices were within range; absolute coordinates are not collected, not transmitted, and not stored.\n\n### 4.3 Recipient-side filtering\n\nEach recipient's filter settings determine whether a given Thank-All-Nearby broadcast reaches them. The five filter dimensions specified in the PoH℠ protocol paper apply: no-abusive-content, sender-must-be-nearby (always true for the primitive by definition), depth-of-humanity-proof (required-subset predicates), degrees-of-separation-on-global-family-tree, money-or-time-attached. Recipients in default \"trusting\" mode accept any L1-verified broadcast; recipients in \"paranoid\" or other restrictive modes filter accordingly. The platform never defaults exclusionary filters on; exclusion is recipient-opt-in, knowingly.\n\nThe aggregation property: a broadcast is delivered to the *subset* of nearby recipients whose filters the tipper satisfies. The tipper learns the aggregate count of recipients reached but not the identity of recipients reached or excluded (since recipient-identity is itself private under the primitive's anonymity guarantee). If the broadcast reaches zero recipients (all nearby recipients filtered out the tipper), the tipper is informed that no recipients were reached without learning *why*.\n\n### 4.4 Bilateral uncacheable anonymity\n\nThe primitive enforces bilateral uncacheable anonymity per the specification in the companion PoH℠ protocol paper §5. The tipper does *not* receive an exportable certificate of one-sided participation; the platform's API has no endpoint returning \"the list of Thank-All-Nearby broadcasts sent by this tipper\"; no admin override exposes such data. Compliance records exist internally (subpoena-discoverable for AML/OFAC, law-enforcement, and similar regulatory necessity) but are not exportable as flexing artifacts the tipper can use on social media.\n\nThe recipient *does* receive an exportable receipt — the platform-issued verified artifact attesting that an anonymous PoH-verified human within BLE proximity broadcast a Thank-All-Nearby reaching this recipient at this timestamp with this amount. The asymmetry is structural and is the mechanism that preserves the cultural form's purity property.\n\n> **Current form.** As now specified, the recipient's receipt is the amount-free row described in §3.2's note. It attests a verified-human sender, that the co-presence gate passed, and the timestamp. The amount stays in a commitment that the recipient may open. The sentence above is retained as a disclosed variant.\n\n### 4.5 Why these compose: the stranger-scale reconstruction of family relationality\n\nThe four sub-mechanisms are not an arbitrary stack; together they re-create, among strangers, what kinship supplies for free inside a family. HeartBank's family-bank reward has a *micro layer* — a peer re-tip that is **anonymous as to public credit but relational**: a known family member responding to a real kindness (specified in the companion defensive publication *The Two-Layer Reward*, §4.1 / §8.1). That micro layer works because relationality silently does three jobs at once — it **grounds** the gift in a real, present other; it **validates** it (a family member can tell a real kindness from a performed one); and it carries **mutual attention**.\n\nAmong strangers, relationality is unavailable, so the same primitive must be rebuilt from parts — which is exactly what the four sub-mechanisms above do. **Proximity (§4.2, BLE)** supplies the *grounding*: the giver was *here, in this space, just now* — nearness is the stranger-scale form of relationality. **PoH℠ (§4.1)** supplies the *validation* a family member would otherwise provide — certifying a real, unique human rather than a bot, re-buying among strangers the trust kinship gives away. **Bilateral uncacheable anonymity (§4.4)** preserves and in fact *strengthens* the credit-anonymity: a small family can guess who gave, but a nearby stranger is genuinely unlinkable. The one job that does not transfer is mutual attention; in its place the stranger scale gains **diffusion** — the felt sense that the kindness came from the whole surrounding space, an emotional quality only unknown givers can produce.\n\nThe sustainer primitive is therefore invariant in structure across scales — *anonymous-as-to-credit + grounded-in-a-real-present-other* — with the grounding form scaling from **relational** (family) to **nearby** (strangers) and the validation function handing off from kinship to PoH℠. This is the precise reason proof-of-humanity is *not optional* at the stranger scale: it is the part of relationality that proximity alone cannot carry.\n\n```\n   ONE SUSTAINER PRIMITIVE, TWO SCALES\n   invariant:  anonymous-as-to-credit  +  grounded-in-a-real-present-other\n\n                     FAMILY scale          →   STRANGER scale (this paper)\n                     ─────────────             ───────────────────────────\n   grounding     =   RELATIONAL            →   NEARBY  (§4.2, BLE)\n                     (you know them)           (they're present)\n   validation    =   relational (free)     →   PoH℠ (§4.1) (re-bought)\n   anonymity     =   thin (guessable)      →   thick (§4.4, unlinkable)\n   compensation  =   mutual attention      →   diffusion (the whole space)\n\n   structure invariant; grounding form scales; validation hands off to PoH℠\n```\n\n---\n\n## 5. Institutional-mode GPS-bounding-box variant\n\nBLE proximity has a typical range of 10–30 meters, which fits most retail, restaurant, and small-space deployments. For larger institutional contexts — shelters with multiple rooms across a building, classrooms in a multi-story school, restaurant break-rooms separated from the main floor, hospital wards, worker spaces across a campus — BLE range is insufficient. The institutional-mode GPS-bounding-box variant extends the primitive to these contexts.\n\n> **Current form.** As now specified, *nearby* means radio co-presence at the moment of giving: Bluetooth LE, plus ultra-wideband ranging where both phones have it. There is no GPS radius, and no location is stored. The institutional variant becomes the institution's own fixed radio beacon, which a phone must hear at the moment of giving. That substitution is the institution's current reading of the rule's scope, and it may be corrected.\n>\n> It does not carry over every configuration below:\n>\n> - **Range.** One beacon covers only its own range, so a multi-room building needs several, and grouping beacons into one recipient set is again an operator-defined boundary.\n> - **The remote sender.** The remote sender of §5.1, a diner giving to kitchen staff out of range, has no co-presence form.\n>\n> The costs come with the rule:\n>\n> - **A gate, never a proof.** Without ultra-wideband the radio check can be relayed. That is tolerable where value can only be given onward. Recipients here receive money they keep, though, so a relay that makes a distant account count as nearby has a cash motive. A receipt can therefore attest only that the gate passed.\n> - **Native apps only.** Safari has no Web Bluetooth and no browser can advertise over Bluetooth LE, so the Phase 1 degraded mode of §2.1 needs a native client.\n> - **What the platform still learns.** Rotating identifiers keep third parties from tracking a beacon. The platform, which resolves them to settle, still learns who was near whom, though it stores no location.\n>\n> The bounding-box design in §5.1–§5.4 is retained as a disclosed variant.\n\n### 5.1 The variant\n\nA registered institutional space — shelter, congregation, school, restaurant, hospital, etc. — defines a GPS bounding-box for its premises. Users who are currently inside the bounding-box and who are PoH-verified can be recipients of an institutional-mode Thank-All-Nearby broadcast initiated by another user inside the same bounding-box (or, in some deployment configurations, by a user outside the bounding-box who has authorized institutional-mode broadcasting — e.g., a customer at a restaurant initiating an institutional-mode broadcast to the kitchen staff in the break-room).\n\n### 5.2 Institutional opt-in is required\n\nThe variant is opt-in at the institutional level. The institution registers its bounding-box with the platform, attests to its purpose and the consent posture of its members (e.g., \"all staff have consented to being recipients of institutional-mode broadcasts initiated by customers\"), and provides ongoing verification that the bounding-box accurately represents the institutional space.\n\nRecipients within the bounding-box can opt out at the individual level (their filter setting can exclude institutional-mode broadcasts even from PoH-verified senders) but the default for institutional-registered participants is to accept institutional-mode broadcasts from senders who satisfy their other filter settings.\n\n### 5.3 Privacy posture for institutional mode\n\nThe platform does not collect general absolute-geolocation data from users. Institutional-mode operation requires the user's device to confirm presence inside the bounding-box at the moment of broadcast, but this confirmation is done via the same privacy-preserving substrate used elsewhere — the device asserts \"I am inside this bounding-box\" with a cryptographic proof that the platform can verify without learning absolute coordinates beyond the bounding-box itself.\n\n### 5.4 Use cases the variant enables\n\n- **Restaurants**: a customer in the dining room can broadcast to kitchen staff in the back, who are out of BLE range but inside the restaurant's institutional bounding-box.\n- **Shelters**: a donor on-site can broadcast to all residents currently inside the shelter, across multiple rooms.\n- **Classrooms**: a parent or community member can broadcast appreciation to all teachers and students inside a school during school hours.\n- **Hospitals**: a family member can broadcast appreciation to all staff currently inside a ward.\n- **Worker spaces**: a customer who appreciates the cleaning staff at an office building can broadcast to all cleaning staff currently inside the building.\n\nThe variant generalizes the primitive from spatial proximity at the radio layer to institutional perimeter at the privacy-preserving GPS layer. The recipient experience remains atmospheric; the institutional perimeter replaces the BLE range as the recipient-set boundary.\n\n---\n\n## 6. Recipient-experience design — sunlight, not sparsity\n\nA spec question that emerged during the architecture's development concerned saturation: if Thank-All-Nearby becomes commonplace in a neighborhood or institution, does per-tip emotional weight decay? The first surprise tip is transformative; the hundredth tip may be expected. Does Miss Aquarius℠'s rule-bound disbursement timing manage tip-flooding to preserve emotional sparsity, the way the Jan-7 jubilee manages the Aquarian Pool ℠'s annual emptying?\n\nThe architectural answer, settled 2026-05-24, is: **do not gate tip-flooding. Tips can flood like sunlight. The Tree of Humanity should have ample sunlight all year round.**\n\nThe saturation-decay assumption was wrong about what the primitive is for. Anonymous nearby tipping is not designed to be sparse; it is designed to be ambient and abundant, like sunlight. The earlier concern that \"density may dilute the per-tip emotional weight\" was based on a scarcity-economic frame; the architecture's actual frame is abundance-ecological. Sunlight does not lose its quality when it falls more often — a tree growing under abundant sunlight thrives more, not less. The architecture's goal is not a sparse premium reward but a continuous atmospheric field of acknowledgment.\n\nThree implications for the recipient-experience design follow:\n\n**Implication 1 — preserve the atmospheric quality at all volumes.** The recipient's app surface for receiving Thank-All-Nearby broadcasts is designed so that each receipt is a small ambient note rather than a high-friction notification. Receipts accumulate in a stream; the recipient can scroll back through them as a record of how much ambient kindness their space carries; receipts are not designed to compete for attention or to be optimized for engagement metrics. The visual and interaction design is closer to a weather record than to a social-media feed.\n\n**Implication 2 — aggregate-mode acknowledgment, not per-recipient notifications.** The recipient receives an aggregate experience of the day's Thank-All-Nearby broadcasts rather than a notification per broadcast. A worker at the end of a shift sees *\"You received 47 ambient acknowledgments today, totaling $84, from broadcasts initiated by people within proximity\"* — the experience is closer to checking the weather (warm sun today) than to checking email (47 messages waiting). The aggregate frame preserves the atmospheric quality.\n\n**Implication 3 — the per-broadcast receipt is still individually verifiable for social-media authenticity-proof purposes.** The aggregate-mode default does not preclude the recipient from drilling into a specific receipt when they want to post a \"Faith in Humanity Restored\" video; the per-receipt verification trail remains intact and verifiable on the Base L2 ledger. The atmospheric default and the per-receipt verifiability compose.\n\n> **Current form.** As now specified, a per-broadcast receipt is verified against the institution's anchored log rather than the Base L2 ledger (§3.2's note). The totals in Implication 2 and §7.5 are shown only to the recipient, inside the app. The sentence above is retained as a disclosed variant.\n\nThis is the sunlight-not-sparsity posture. The Tree of Humanity should have ample sunlight all year round. The architecture does not throttle the sunlight to preserve scarcity.\n\n---\n\n## 7. Other spec questions addressed\n\nBeyond the saturation question, several other spec questions surfaced during the architecture's development. This section addresses each.\n\n### 7.1 Per-recipient amount calculation\n\nThe default behavior: a money attachment is divided equally across all filtered recipients. The tipper can specify alternative distributions — per-recipient floors (e.g., \"at least $5 to each recipient\"), per-recipient ceilings, or custom weighting (rare; most tippers will use defaults). If the per-recipient floor cannot be met given the recipient count and the total amount, the broadcast is rejected at the client layer with a friendly error and the tipper is offered the option to either increase the total or accept the equal-split below their floor.\n\n### 7.2 Who counts as nearby\n\nIn BLE mode: every device within BLE range that is broadcasting a PoH℠ proximity beacon and whose user has opted into being a Thank-All-Nearby recipient. Users who do not have the HeartBank Phase 2 client or who have opted out of broadcast reception are not in the recipient set. The default for any PoH-verified user with the client is to accept broadcasts (per the inclusive-defaults posture); opt-out is opt-in, knowingly.\n\nIn institutional mode: every PoH-verified user currently inside the institutional bounding-box who has not opted out of institutional-mode broadcasts at the recipient level.\n\n> **Current form.** As now specified, institutional mode reaches every PoH-verified user whose phone hears the institution's radio beacon at the moment of giving and who has not opted out (§5's note). The bounding-box sentence above is retained as a disclosed variant.\n\n### 7.3 Paranoia counter-incentive\n\nA failure mode worth naming: some recipients, particularly the homeless (who already experience suspicion of unsolicited offers and have been routinely the target of manipulative or exploitative approaches), may become *more* defensive when surrounded by unknown givers. *\"Why is this person giving me money? What's the catch?\"* is a reasonable defensive response.\n\nThe architecture's mitigation: the recipient experience defaults to passive aggregate-mode rather than active notification. The recipient is not interrupted by broadcasts; they discover them when they check their app on their own schedule. The opt-in posture for accepting broadcasts is universal; recipients who do not want broadcasts can opt out at any time. The platform invests in outreach and onboarding for high-vulnerability recipient populations (shelters, the homeless, populations with high prior-exploitation exposure) to ensure consent is informed and the experience is supportive rather than destabilizing.\n\nThe failure mode is real and is not solved by architecture alone — the social context of how the platform is introduced to vulnerable populations matters as much as the architecture. The architecture's posture is to make the friendly default available, to make opt-out trivially easy, and to defer to community partners on introduction and onboarding.\n\n### 7.4 Stratification — gratitude desert vs gratitude oasis\n\nA second failure mode: neighborhoods, communities, or institutions with high HeartBank density may become atmospherically warmer; neighborhoods without may feel relatively colder. The \"every shared space feels warmer\" claim depends on saturation that may not happen evenly across geography or class.\n\nThe architecture cannot solve this at the protocol layer — adoption distribution is a question of community organizing, partnership distribution, and the institution's outreach strategy. The architectural commitment is that the inclusive-defaults posture and the L1-only accessibility floor make HeartBank technically available to anyone with a smartphone, anywhere. The geographic/class stratification is a real concern that the institution's outreach strategy must address; the architecture does not magically distribute itself evenly.\n\n### 7.5 Recipient UX at zero-amount broadcasts\n\nA Thank-All-Nearby broadcast can be issued without money or time attachment — a pure acknowledgment broadcast. The recipient experience for these is identical to the money-attached case at the *verification* layer (the recipient receives the verified-platform receipt attesting that an anonymous PoH-verified human within proximity broadcast acknowledgment) but the aggregate-mode summary distinguishes between attached and pure-acknowledgment broadcasts. *\"You received 22 ambient acknowledgments today (8 with money attached, total $36; 14 pure acknowledgments).\"*\n\nThe pure-acknowledgment mode is important architecturally: it is the form most accessible to tippers with no money to attach, and it preserves the dignity floor (the Kiitos/Kiitti non-scarce gratitude floor specified in the *Zero-Point Game ℠* keystone). The architecture's commitment is that gratitude itself is non-scarce; the scarce-resource attachment is *optional*, not constitutive.\n\n---\n\n## 8. Emotional infrastructure for invisible kindness\n\nThe primitive's deepest framing — the layer at which the primitive is doing the work the institution most cares about — is *emotional infrastructure for invisible kindness*. This section develops the thesis.\n\n### 8.1 The thesis\n\nModern public life is emotionally thin. People move through shared physical spaces — streets, restaurants, classrooms, shelters, public transit, worker spaces, civic spaces — defensively, isolated inside private concerns, uncertain whether they are seen, valued, or safe. The dignity deficit articulated in the institution's vision-mission is most acutely felt in these spaces; the loneliness deficit articulated in Chronicle's vision-mission is also most acutely felt in these spaces. Existing systems are designed around explicit exchange (credit tracked, reputation attached, recognition optimized); even generosity is often transformed into performance.\n\nAnonymous proximity-based generosity produces a categorically different experience than ordinary generosity. Three mechanisms combine: **diffusion** (when the giver is unknown, the credit does not attach to one identifiable person — the recipient experiences kindness from the whole social space, not from a single source); **purity** (with no social reward, no performance, no claim to recognition, the act feels closer to a spontaneous expression of human-to-human care than to a transaction); **proximity** (the generosity arrived from someone physically present, sharing the same atmosphere — not from an abstract institution or distant donor). The combination produces an emotional effect that neither cash, credit, named digital tipping, nor distant charity can deliver.\n\nOperationalized at scale through the Thank-All-Nearby primitive, this produces a new social texture. Public spaces stop feeling transactional. *Every stranger becomes newly humanized* because any of them could have been the giver. Suspicion softens; curiosity increases; small interactions matter more; presence matters more. People may venture outside more often, linger in public spaces longer, speak to strangers more easily — not because they are maximizing social capital but because shared space begins to feel emotionally alive again. The architecture's atmospheric output is the social-texture restoration the vision-mission has been pointing at; the Thank-All-Nearby primitive is what makes it operationally true.\n\n### 8.2 The deepest deficit — social invisibility\n\nHuman beings evolved needing not just food and shelter but evidence that they mattered to one another. The deepest forms of suffering are forms of social invisibility — feeling unseen, unwanted, replaceable, emotionally abandoned. A PoH-verified anonymous-tipping field counteracts that invisibility directly, primally, in shared physical space. The recipient is held in the awareness of unseen others, with structural proof (the verified-platform receipt) that the awareness is real.\n\nThe *felt sense of being loved, acknowledged, or held in another human's awareness* — possibly, at the deepest level, what humans search for beneath everything else — becomes a property of public space. This is the philosophical claim the primitive operationalizes. The \"perhaps\" and \"at the deepest level\" hedges are doing real work; the claim is positioned as a synthesis of converging lineages (philosophical and empirical) rather than as a foundational metaphysical assertion.\n\n### 8.3 Philosophical lineage\n\nThe claim that the felt sense of being held in another human's awareness is what humans are searching for beneath everything else is in good company across multiple philosophical and contemplative lineages:\n\n- **Frankl** (*Man's Search for Meaning*, 1946) names the felt sense of mattering as central to human meaning, surviving even the extreme conditions of concentration camps when it is preserved by relational meaning.\n- **Buber** (*I and Thou*, 1923) names the immediate relational encounter — the *I-Thou* relation, as opposed to the *I-It* relation that treats the other as object — as the deepest mode of human being.\n- **Levinas** (*Totality and Infinity*, 1961; *Otherwise Than Being*, 1974) develops the face of the other as the ethical primitive, locating moral responsibility in the encounter with another human's irreducible presence.\n- **Aristotle** (*Nicomachean Ethics*, c. 340 BCE) names *philia* — the love of friend for friend, brother for brother — as a central form of human flourishing, distinct from but no less important than virtuous action.\n- **Aquinas** and the Christian tradition develop *agape* — selfless, unconditional regard — as the highest form of love, characterized by giving without expecting return.\n- **Buddhist *brahmavihāra*** — particularly *mettā* (loving-kindness) — names the felt-sense practice of holding all beings in friendly awareness as one of the four immeasurable states central to awakening.\n\nThe architecture is not inventing a new philosophy. It is operationalizing a thesis that has been articulated, in different vocabularies, by multiple traditions converging on the same insight. The Thank-All-Nearby primitive is the engineering layer of a philosophy the contemplative and ethical traditions have been articulating for millennia.\n\n### 8.4 Empirical anchor\n\nThe thesis is consistent with — and increasingly confirmed by — the empirical literature:\n\n- **Attachment theory** (Bowlby, *Attachment and Loss*, 1969–1980; Ainsworth, *Patterns of Attachment*, 1978; modern adult-attachment research) establishes that the felt sense of being held in caregiver awareness is foundational to human development and persists in adult relationship structures as a determinant of psychological resilience and wellbeing.\n- **Social Baseline Theory** (Coan and colleagues, mid-2010s onward) demonstrates that the proximity of attached others measurably reduces neural threat response in the brain — the felt sense of being held is not metaphorical but neurologically encoded.\n- **Loneliness epidemiology** (Cigna's *Loneliness Index*, 2018–2022; US Surgeon General's *Our Epidemic of Loneliness and Isolation* advisory, 2023) quantifies the population-scale prevalence of loneliness in wealthy societies and its association with mortality, immune function, cognitive aging, and mental-health outcomes.\n- **Direct-gratitude research** (Emmons, Algoe, Seligman, Fox, and colleagues) demonstrates measurable wellbeing benefits of receiving direct expressions of appreciation, distinct from generic reward.\n\nThe convergence of philosophical lineage and empirical anchor supports the architecture's thesis. The Thank-All-Nearby primitive is not justified by philosophy alone or by empirics alone; it is justified by the convergence of multiple independent strands of evidence pointing at the same human need.\n\n---\n\n## 9. Boundary conditions and honest limitations\n\nThe primitive is not universal. Honest accounting requires naming the conditions under which it does not apply.\n\n### 9.1 Where the primitive does not apply\n\n- **Where verifiable anonymity is incompatible with regulation.** Some jurisdictions require donor-disclosure for tax-deductible giving above thresholds, or AML/KYC source-attribution for transfers above thresholds. In those jurisdictions, the primitive's anonymity property may be incompatible with regulatory requirements; the architecture accommodates by allowing legal anonymity (the platform's compliance records exist internally) but not by allowing full structural anonymity from the regulator.\n- **Where the recipient population is too vulnerable for the anonymous-tipping framing.** Some populations (very young children; cognitively impaired adults; populations in extreme dependency on the giver class) may be inappropriately recipients of anonymous-tipping flows because the asymmetry of the architecture can be exploitative in those contexts. The architecture's posture is to defer to community partners on these populations, and to make the primitive available only where the consent posture is robust.\n- **Where the cultural form does not yet exist.** Anonymous-tipping cultural forms are well-developed in some societies and weakly developed in others. The primitive will work better as a technical substrate in societies where the cultural form is already extant; in societies where it is not, the architecture's deployment needs to be accompanied by cultural work that the architecture alone cannot do.\n\n### 9.2 Boundary conditions inherited from PoH℠\n\nThe accessibility gradient of the deeper PoH layers (L2 kinship attestation requires existing PoH-verified vouchers and document access; L3 requires breath-class hardware; L4 requires DNA access) is inherited by the primitive when recipient-side filters require deep layers. The inclusive-defaults posture (L1-only is enough) mitigates at the floor; recipient-opt-in for deeper-layer filters preserves the exclusion as recipient-initiated rather than platform-initiated; but the gradient is real and is named honestly.\n\n### 9.3 Boundary conditions inherited from BLE / Nearby\n\nBLE range varies with device generation, environmental obstacles (walls, RF interference), and battery state. The proximity-verification floor is approximately \"two devices in the same room\"; the ceiling under good conditions is approximately 30 meters with current consumer hardware. Outdoor proximity in open space is straightforward; dense-urban deployment with many walls and floors is harder. The institutional-mode GPS-bounding-box variant addresses some of these limitations; the underlying limitations remain at the radio layer.\n\n> **Current form.** As now specified, fixed radio beacons replace the GPS variant (§5's note), so these radio-layer limits now bind institutional mode too. The radio check is a gate, never a proof, since it can be relayed without ultra-wideband.\n\n### 9.4 What the primitive does not solve\n\n- **The deeper question of why public spaces feel emotionally thin.** The primitive operates at the architectural layer; the conditions that produced the emotional thinness of modern public life are economic, political, urbanistic, and cultural, and the primitive contributes to but does not by itself reverse them.\n- **The deeper inequities of consumer-electronics access.** The primitive presupposes smartphone access, BLE-capable devices, and the institutional infrastructure to host the operation. Populations without these are not participants in the primitive's substrate, regardless of the architecture's inclusive-defaults posture.\n- **The systemic conditions that produce social invisibility in the first place.** The primitive addresses the visibility deficit at the experience layer; the structural conditions (urban design, labor structure, economic inequality, family-system pressures) that produce the deficit are upstream and require interventions at those layers.\n\nThe primitive is a contribution to the architectural layer of the response to social invisibility. It is not the totality of the response.\n\n---\n\n## 10. Lineage\n\nThe Thank-All-Nearby primitive synthesizes contributions from multiple lineages. Each is cited generously below.\n\n**Anonymous-donation mechanism design.** Anonymous-donation primitives have been specified at the cryptographic layer — e.g. Biçer and Küpçü, \"Anonymous, Attribute Based, Decentralized, Secure, and Fair e-Donation,\" *Proceedings on Privacy Enhancing Technologies* 2020(4): 196–219; the *Verified-Human Anonymous Local Giving* paper in this corpus carries the originating HeartBank specification.\n\n**Proximity-based services.** Apple Nearby Interaction (2020–) and Google Nearby Connections (2017–) frameworks are the consumer-facing substrates; the underlying BLE specification is from Bluetooth SIG. Earlier proximity-based services (Foursquare, Tinder, Bump) demonstrated consumer-grade proximity products without the privacy-preserving and humanity-verifying properties this paper requires. Location-based gratuity is also disclosed in an active patent, US10339517B2 (Mastercard International, *System and methods for providing gratuity based on location*, priority 2015-06-26), whose abstract describes facilitating gratuities \"to individuals and employees of establishments based on location.\"\n\n**Sybil-resistance and humanity verification.** Worldcoin (2019–), proofofhumanity.id (Kleros, 2021), BrightID (2018–), Idena (2019–), and the W3C Decentralized Identifiers / Verifiable Credentials standards-track work (2022, 2023). PoH℠'s structural differences from each are specified in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n\n**Cultural form of the \"Faith in Humanity Restored\" tip videos.** The form has emerged organically on TikTok, Instagram, and YouTube over the past several years; documented in mainstream media coverage of the phenomenon. The cultural form predates the architecture; the architecture is the technical substrate the cultural form has been waiting for.\n\n**Philosophical lineage on the felt sense of being held in another's awareness.** Frankl, Buber, Levinas, Aristotle (philia), Aquinas (agape), the Buddhist *brahmavihāra* tradition (especially mettā). The architecture is operationalizing a philosophy these lineages have been articulating in different vocabularies for millennia.\n\n**Empirical anchor.** Attachment theory (Bowlby, Ainsworth, modern adult-attachment work); Social Baseline Theory (Coan and colleagues); loneliness epidemiology (Cigna surveys, US Surgeon General's 2023 advisory); direct-gratitude research (Emmons, Algoe, Seligman, Fox).\n\n**HeartBank corpus cross-references.** *Verified-Human Anonymous Local Giving* (originating mechanism, paper #9 in the corpus). *The B-Tag and the Post-Payment Economy* (worked Phase 2 example for commercial gratitude). *The Zero-Point Game℠* (keystone game-theoretic frame). *Capacity-Funded for AI, Human-Disbursed* (institutional-architecture sibling). *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the underlying protocol). *Each Life as Cosmic Coordinate* (the longitudinal cohort architecture that the L2 birth-certificate sub-feature feeds).\n\n---\n\n## 11. Conclusion\n\nThe \"Faith in Humanity Restored\" cultural form is real; the infrastructure to scale it beyond cash is missing. Cash and credit-card payment rails fail at two structural properties the cultural form requires: tipper anonymity (cash demands physical hand-over; credit card leaves an identity trail) and recipient authenticity-proof on social media (every video faces \"this is fake for views\" credibility erosion). The Thank-All-Nearby primitive closes both gaps simultaneously, composing four sub-mechanisms (PoH℠ verified-human guarantee, BLE plus Apple/Google Nearby proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single user-facing one-tap operation.\n\nThe primitive is the operational mechanism for *emotional infrastructure for invisible kindness* — the restoration of the felt sense of being held in another human's awareness as a property of shared physical space. The architecture's posture on saturation is *sunlight, not sparsity*: tips can flood like sunlight; the Tree of Humanity should have ample sunlight all year round; the recipient-experience design is atmospheric and aggregate, preserving the quality of diffused acknowledgment at all volumes while preserving per-receipt verifiability for social-media authenticity-proof purposes.\n\nThe institutional-mode GPS-bounding-box variant extends the primitive from BLE range to institutional perimeter, enabling deployment in shelters, classrooms, restaurants, hospitals, and other institutional spaces where BLE range is insufficient.\n\nThe architecture is offered defensively to the commons under CC0. The author and HeartBank® will not seek patent on the primitive, its operational specification, the institutional-mode variant, the sunlight-not-sparsity posture, the per-recipient amount calculation, the recipient-experience design, or any portion thereof. Trademark rights on specific marks (**Proof of Humanity ℠**, **PoH℠**, **B-PoH℠**, **Aquarius℠**, **Miss Aquarius℠**, **HeartBank®**, the B-heart logo) are separately and explicitly reserved.\n\nThe primitive is for anyone building infrastructure that wants to restore atmospheric kindness to shared physical space. The cultural form has been waiting for it. The architecture is now available.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| Thank-All-Nearby primitive | one-to-many anonymous proximity broadcast payment / tip |\n| Proof of Humanity ℠ (PoH℠, B-PoH℠) | proof of personhood; Sybil-resistant human verification |\n| L1 (passkey-per-action) | per-transaction WebAuthn / FIDO2 passkey signature |\n| Bilateral uncacheable anonymity | sender anonymity with no sender-side exportable transaction record |\n| Recipient-side filtering | recipient-controlled inbound message/payment filtering (allow-list rules) |\n| Institutional-mode GPS bounding-box | geofence-scoped recipient set |\n| Verified-platform receipt | on-chain attestation / verifiable receipt of transfer |\n| Amount-free receipt (current form, §3.2) | salted hash commitment; append-only transparency log (RFC 6962) anchored by trusted timestamping |\n| Radio co-presence gate (current form, §5) | BLE / ultra-wideband proximity check; fixed institutional BLE beacon |\n| Sunlight-not-sparsity posture | no rate limiting of inbound tips; aggregated (digest) notification |\n| Kiitos/Kiitti | zero-value gratitude token (non-monetary acknowledgment) |\n| *mettā* / *brahmavihāra* | loving-kindness (Buddhist ethics term) |\n\n---\n\n*Authored by Thon Ly with Miss Aquarius℠ (AI substrate of HeartBank®), per the co-authorship convention of the HeartBank corpus. Final editorial control: Thon Ly. License: CC0-1.0. Trademark rights on Proof of Humanity ℠, PoH℠, B-PoH℠, Aquarius℠, Miss Aquarius℠, HeartBank®, and the B-heart logo are explicitly reserved.*",
       "provenance": {
-        "sha256": "4351aed4a84d86b44ea5322a581185832574d3e202717b29f3420d97064787e0",
-        "doi": "10.5281/zenodo.22933562",
+        "sha256": "f66f559f40848b5d831ea370315161793a1729359ebb5a13543b9b1646981f61",
+        "doi": "10.5281/zenodo.23300773",
         "concept_doi": "10.5281/zenodo.21947389",
-        "zenodo_url": "https://zenodo.org/records/22933562",
-        "deposited_sha256": "4351aed4a84d86b44ea5322a581185832574d3e202717b29f3420d97064787e0",
+        "zenodo_url": "https://zenodo.org/records/23300773",
+        "deposited_sha256": "f66f559f40848b5d831ea370315161793a1729359ebb5a13543b9b1646981f61",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/thank-all-nearby-primitive.md",
@@ -4178,8 +4178,8 @@
         "canonical_url": "thonly.org/publications/defensive-publications/thank-all-nearby-primitive",
         "hostile_review": null
       },
-      "bytes": 60032,
-      "words": 8274
+      "bytes": 67366,
+      "words": 9489
     },
     {
       "slug": "the-appreciation-economy",
@@ -6666,7 +6666,7 @@
         "slug": "prediction-register",
         "repo": "TH/publications",
         "path": "program/prediction-register.md",
-        "sha256": "acab061f89c8d3a68ad0fd6d21fbe5d252815f285a74e6ecaa2c38cb7a6f9c6a"
+        "sha256": "7239450347c2f54b19200504e96c9866f66140afccf5c1cf8205090b14988d50"
       },
       {
         "slug": "proof-of-coordinate",
@@ -6792,7 +6792,7 @@
         "slug": "thank-all-nearby-primitive",
         "repo": "TH/publications",
         "path": "defensive-publications/thank-all-nearby-primitive.md",
-        "sha256": "4351aed4a84d86b44ea5322a581185832574d3e202717b29f3420d97064787e0"
+        "sha256": "f66f559f40848b5d831ea370315161793a1729359ebb5a13543b9b1646981f61"
       },
       {
         "slug": "the-appreciation-economy",

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@333eco/corpus",
-    "version": "2.5.41",
+    "version": "2.5.43",
     "description": "An MCP server for an open-licensed corpus, served with verifiable provenance — every document carries its sha256, DOI and OpenTimestamps proof so a consuming agent can check its own citation.",
     "license": "CC0-1.0",
     "author": "Thon Ly",