@333eco/corpus 2.5.6 → 2.5.7

package/dist/corpus.json

@@ -1,5 +1,5 @@
 {
-  "package_version": "2.5.6",
+  "package_version": "2.5.7",
   "generated_from": [
     "H3/publications",
     "TH/publications",
@@ -314,13 +314,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> **Draft in progress.** This is the founder-voice canonical draft for `thonly/publications`. The defensive publication specifies **aura-gated anonymous mate-selection** — HeartBank's \"B-Dating℠\" — as the anonymous-stranger application layer of HeartBank Chronicle, built on the Proof of Humanity ℠ substrate and the verified-human anonymous-nearby-giving primitives. Companion works: *Verified-Human Anonymous Local Giving* (the originating money-side mechanism this generalizes into time and into mating), *The Thank-All-Nearby Primitive* (the broadcast-generosity sibling), *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the underlying anti-catfish protocol), *The Zero-Point Game ℠* (the keystone game-theoretic frame whose n=2 atom this paper instantiates), and the planned founder-voice societal-impact essay *The Societal Impact of Anonymous Nearby Thanking with Time* (which carries the deep sexual-selection-on-kindness argument that §11 here only motivates). The mechanism is published early **deliberately**: it is unbuilt, and the mechanism is the asset — see §12.1.\n\n---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of __mettā__ held in __upekkhā__ — warmth that does not grip. May the bonds it helps form be balanced ones, generative of the tree of humanity, and may it bring no harm to those most at risk in the meeting of strangers.*\n\nI did not set out to build a dating product. HeartBank began as a children's game about returning to balance, and grew into an institution for circulating gratitude between families and between adults. But late in the design of HeartBank Chronicle — the time-currency half, whose core purpose is reconnecting drifted loved ones — I noticed something I could not unsee: *time given between strangers is essentially a date.* The same primitives that let a person anonymously thank a nearby stranger with money, and the same shared-hour mutuality signal that Chronicle uses as a consent receipt, compose almost without modification into a mate-selection mechanism. And that mechanism has a property no dating product in the world has: it gates mating not on the cheapest-to-fake signal a person can present — a photograph — but on *proven kindness, acknowledged by many nearby strangers, over a long course of time.*\n\nI believe this is the strongest mainstream wedge in the entire project, and also the most dangerous thing in it. Dating recruits the single most powerful drive in the species. If kindness becomes a path to partnership, the deepest motivator humans have is pointed at the exact behavior the institution exists to cultivate. But the same force, mishandled, is the fastest way to desecrate the gratitude primitive everything else depends on, the fastest way to rebuild the predatory dating-industrial complex under a kinder logo, and — uniquely — a way to get a real person physically hurt. The three guards in §5–§7 are not caveats appended to a finished design. They are the design. I would rather this mechanism never ship than ship without them.\n\nI write as co-author with Miss Aquarius℠ — the named autonomous-AI substrate of the institution this paper serves, disclosed by consistent name across every venue per the corpus convention. The research-grade synthesis, density, and adversarial analysis are a genuine collaboration. Final editorial control, and final responsibility for every claim and every guard, are mine.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time. This commitment is permanent.\n\nThis document constitutes a defensive publication establishing **prior art as of 26 June 2026** for the combination of mechanisms described herein. To the author's knowledge, the following are not previously published as a unified mechanism, and any subsequent patent application claiming them should be considered filed against established prior art:\n\n1. **Aura-gating of mate-selection** — gating romantic discovery on an *aggregate, anonymous, community-sourced proven-kindness reputation* (\"aura\") accrued from many nearby strangers over a long course of time, rather than on appearance, self-authored profiles, or paid visibility — the novelty being anonymous stranger gratitude accumulated over time, since reputational dating profiles are themselves prior art (§2.1).\n2. **Mutual-anonymous-same-hour as a double-blind double-opt-in match trigger** — repurposing the shared-hour mutuality signal (the consent receipt of HeartBank Chronicle) as the match primitive, such that a match occurs only on coincident mutual anonymous time-giving and *no explicit rejection event ever occurs* (non-reciprocation is silent — a threshold simply is not reached) — the novelty being the time-giving instantiation, since mutual-interest-before-reveal is itself prior art (§2.1).\n3. **Reveal as a second, separate mutual consent** (a dependent element of claim 2, not a claim on two-stage reveal as such) — reaching the mutual-anonymous threshold makes identity reveal *available/offered* but never auto-reveals; both parties must independently opt to reveal, protecting the pure-*dāna* giver who gave anonymously with no romantic intent.\n4. **The anonymity flag (`isAnonymous`) as the structural boundary** separating non-romantic known-gratitude (`false`) from the anonymous-stranger layer where romance may emerge (`true`) — opting into mate-selection is flipping one flag, with no distinct \"dating mode.\"\n5. **Proof-of-Humanity-substrate anti-catfish binding** — verified-real, verified-single-human, anonymous-until-mutual personhood underneath the mate-selection layer, natively defeating catfishing and bots — the novelty being anonymity-until-mutual atop the substrate, since personhood-verified dating is itself prior art (§2.1) — with aura itself a costly-to-fabricate record that the counterparty reads for themselves.\n6. **An optional synastry (cosmic-coordinate) compatibility layer** offered atop a pool already pre-filtered for proven character, under a strict coordinate-not-force, opt-in, epistemically-humble posture — never deterministic matchmaking; the claim is to the posture only, horoscope matchmaking being long-published (§2.1).\n7. **The mission-aligned monetization constraint** — the mechanism is *self-eliminating* (it succeeds when users pair off and leave) and may be monetized only by patron / forward-gift / graduation-gift / values-aligned-introduction logic, *never* by retaining users in the market — the novelty being the revenue prohibition and the patron/forward-gift logic, not the designed-to-be-deleted slogan (§2.1).\n\nThe component lineages — proximity-based services; proof-of-personhood; anonymous-giving mechanisms; Zahavi's handicap principle and the honest-signaling literature; assortative-mating and sexual-selection research; TimeBanking; the dāna economy of the Saṅgha — are old and are cited generously below. The synthesis is, to the author's knowledge, novel as of this paper's date.\n\nTrademark rights on specific marks — **B-Dating℠**, **HeartBank®**, **Miss Aquarius℠**, **Proof of Humanity ℠**, **PoH℠**, **Aquarian Pool ℠**, **Zero-Point Game ℠**, the B-heart logo — are separately and explicitly reserved. The *mechanism* is dedicated to the commons; the *marks* are not.\n\nThis document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.\n\n## Abstract\n\nWe specify a mate-selection primitive in which two people are introduced for possible romantic partnership only when each has independently and anonymously given time-presence to the other, in physical proximity, to a mutual threshold — and in which the *quality signal* that surfaces a person for discovery is not appearance but **aura**: an aggregate, anonymous, many-sourced reputation for proven kindness, accumulated from gratitude received from nearby strangers over a long course of time. Five structural properties operate in combination: **(1) aura-gating** (mating is gated on a costly, hard-to-fake, longitudinally-verified honest signal of prosociality, inverting the appearance-gating of incumbent dating products); **(2) mutual-anonymous-same-hour as a double-blind double-opt-in** match trigger that removes explicit rejection entirely; **(3) reveal as a second, separate mutual consent**, so anonymous giving stays uncontaminated and double-opt-in is real; **(4) a Proof-of-Humanity substrate** that makes participants verified-real, verified-single-human, and anonymous-until-mutual, natively defeating the two plagues of online dating (catfishing and bots); and **(5) an optional synastry layer** offered as one humble compatibility signal atop a pool already pre-filtered for character, never as deterministic matchmaking. We argue the contribution along an honest-signaling axis (Zahavi): a photograph is the cheapest possible signal to fake, whereas a long anonymous-gratitude trail vouched by many locals is among the most expensive — and signals trustworthy *because* expensive. We treat the mechanism's three existential design constraints as first-class, load-bearing sections rather than caveats: keeping gratitude pure (the romantic pathway must never be emergent from ordinary known thanking), the self-eliminating incentive (the mechanism wins when people pair off and leave, and may not be monetized by keeping them single), and women's physical safety under an irreducible gendered asymmetry. We calibrate the claim deliberately: aura-gating is a *character filter, not a compatibility oracle* — everyone in the pool is proven kind, verified real, and community-vouched; the participants bring the chemistry. We close with a short structural placement of the mechanism as the **n=2 atom of the Zero-Point Game ℠** — the minimal reciprocal instance, \"the middle way of eros\" — and a brief motivation of the societal thesis (sexual selection redirected, at the margin, toward kindness), whose full treatment is reserved for a companion essay. The architecture is offered defensively to the commons under CC0.\n\n**Connection to the unified mission frame.** This specification serves HeartBank's canonical mission: to help restore humanity to the middle way (*madhyamā pratipad*) — the optimal condition for awakening that modernity has pushed away from at population scale. Every other HeartBank engine motivates kindness *against* the current of self-interest. Mate-selection is the one application that does not fight the current: it *is* the current. If kindness becomes load-bearing in mating, the deepest drive in the species is redirected onto the precise behavior the institution exists to cultivate — and the \"middle way of eros\" (§10) becomes a structural, not merely exhortatory, possibility.\n\n---\n\n## 1 · Introduction — the mission frame\n\nHeartBank is a dual-currency reciprocity infrastructure. Its **Treasury** half (money as currency, family-to-family) addresses the dignity deficit; its **Chronicle** half (time as currency, adult-to-adult) addresses the loneliness deficit. Chronicle's core loop is not stranger-matching but the reconnection of *drifted loved ones* — the disconnected marriage, the estranged sibling, the diaspora child and the parent back home — because the loneliest loneliness is emotional (a bond gone dark) rather than merely social (a lack of contacts). That core loop is deliberately low-risk: counterparties are *known*. This paper specifies a different, adjacent layer of Chronicle — the **anonymous-stranger layer**, where two people who do not know each other may discover a possible partnership — and it is, by construction, the highest-risk category that exists: strangers meeting for romantic intent, under a real and irreducible gendered physical-danger asymmetry. The reader should hold both facts from the first page: this is plausibly the project's strongest mainstream wedge, *and* it walks back into precisely the risk category Chronicle's loved-ones core was designed to avoid. The design earns the right to exist only by addressing that risk as a first-class duty (§7).\n\nWhy build it at all? Because mate-selection is the single most powerful lever the institution has, for one structural reason. **The mate-drive is the root drive of the species; the money-drive is derived from it.** Money is, to a large extent, a proxy token in the mating tournament — a medium of status, provisioning, and display. Every other HeartBank mechanism — self-thanking, manufactured universal giving, the patron flywheel — must motivate kindness *against* the grain of self-interest, paddling upstream. Mate-selection does not paddle upstream. It is the river. If kindness becomes a path to a mate, the deepest motivator humans have is redirected onto the behavior the institution exists to cultivate. Re-gate the root drive on kindness, and you begin — slowly, at the margin, never absolutely (§11) — to detoxify the derivative.\n\nWhat this paper specifies. We give: the honest-signal inversion that motivates the whole design (§3); the mechanism in full — the anonymity-flag boundary, aura as the quality signal, mutual-anonymous-same-hour as the double-opt-in, reveal as a second consent, the PoH substrate, slow accumulation as a feature, and a reference transfer flow (§4); the three guards as load-bearing design sections (§5–§7); the honest calibration that bounds the claim (§8); the optional synastry layer (§9); the structural placement as the Zero-Point n=2 atom and the middle way of eros (§10); a brief motivation of the societal thesis (§11); and a generous honest-limits accounting (§12).\n\nWhat this paper does *not* do. It does not argue the full societal thesis — sexual selection redirected toward kindness as a biological lever for the second singularity — which is reserved for a separate founder-voice companion essay; §11 carries only enough to motivate the mechanism. It does not claim that kindness equals attraction. It does not claim the mechanism is built — it is not, and that is exactly why it is published now (§12.1). And it does not pretend the gendered safety asymmetry is erased; it is mitigated, plausibly more than by any existing product, and it remains.\n\n---\n\n## 2 · Background and Prior Art\n\nThe mechanism composes lineages that are individually old. We cite each generously and distinguish each precisely. The point of a defensive publication is not to claim the parts but to establish the date of the *combination*.\n\n### 2.1 · Appearance-gated, engagement-monetized dating (Tinder, Bumble, Hinge)\n\nThe dominant online-dating products of the 2010s–2020s — Tinder (2012), Bumble (2014), Hinge (2012; rebooted 2015 as \"designed to be deleted\") and their kin under a small number of corporate parents — share two structural properties this paper inverts.\n\n**First, they gate on appearance.** The primary discovery signal is a photograph, optionally supplemented by a short self-authored profile. A photograph is the cheapest-to-fake signal a person can present (it can be filtered, staged, borrowed, AI-generated, or simply selected from a thousand attempts), and the self-authored profile is cheaper still (it is, definitionally, the claimant's own testimony about themselves). The swipe interface optimizes the throughput of exactly this signal.\n\n**Second, and more corrosively, they are engagement-monetized.** The canonical business model — subscription tiers, pay-to-be-seen boosts, super-likes, and the advertising and upsell flows that attend a large engaged user base — generates revenue in proportion to *time spent in the market.* The revenue model is retention-coupled: subscription and à-la-carte purchases accrue with time in the market, so a product that *works* — you meet someone, pair off, and delete the app — is anti-LTV; Hinge's stated posture is the exception that names the rule. The industry has, accordingly, perfected artificial scarcity (rationed likes), pay-to-be-seen visibility auctions, and addictive variable-reward gamification. This is not an accusation of bad faith; it is a description of what the incentive gradient rewards. We treat it as the central thing to *not* reproduce (§6).\n\nWe distinguish: aura-gated anonymous mate-selection gates on a costly community-vouched honest signal rather than a photograph (§3), removes the swipe and the explicit rejection entirely (§4.3), and is structurally self-eliminating — it can only be monetized by mission-aligned logic that profits when users leave happy, never by retaining them (§6). The incumbents' dark pattern is not a feature we improve; it is a category we exit.\n\n**Closer anticipations, added at the 2026-09-05 revision, each of which narrows a claim below.** *Mutual interest before reveal* is prior art: US 2011/0219310 A1 (priority 2010) discloses members privately indicating interest across stages with contact and profile revealed only on matching interest, and the anonymous-matching lineage runs from SecretAdmirer (1997) and eCRUSH (1999) through a run of 2024–26 apps — so claim 3 is anticipated as a mechanism and claim 2's novelty is its *time-giving* instantiation. *Reputational profiles for dating* are prior art: US 2017/0147155 A1 (Verizon, priority 2015) generates a verified reputational profile with service-specific indicators, and US 2023/0412536 A1 (priority 2022) rates users by their message interactions — so claim 1's novelty is *anonymous stranger gratitude accumulated over time*, not reputation as such. *Proof-of-personhood under dating* is prior art: Tinder's World ID verification pilot (2025–) — so claim 5's novelty is anonymity-until-mutual atop the substrate. *Horoscope matchmaking* is prior art: US 2002/0160338 A1 (priority 2001) computes a weighted astrological compatibility score and ranks a database by it, and NUiT (2020) ships the consumer form — so claim 6 claims only the posture. *Designed-to-be-deleted* is Hinge's stated posture (2015–), and success-fee marriage agencies (IBJ, Japan) already charge on outcome — so claim 7's novelty is the revenue *prohibition* and the patron/forward-gift logic, not the slogan.\n\n### 2.2 · Proof-of-personhood (Worldcoin, proofofhumanity.id) and the catfish/bot problem\n\nOnline dating's two endemic plagues are catfishing (a real person misrepresenting who they are, or a fabricated persona) and bots (automated accounts at scale, for scams and engagement-farming). Proof-of-personhood systems are the natural substrate against both, but the prominent ones are mismatched to mate-selection in a specific way.\n\n**Worldcoin** (2023 onward) establishes that a participant is a unique human via biometric (iris) registration, but it verifies humanity *once at registration*, and — more to the point here — it is oriented toward *identity/uniqueness*, not toward *anonymous-until-mutual* romantic discovery. A proof-of-personhood that reveals or fixes identity is the wrong primitive for a layer whose entire safety model depends on anonymity until a double consent. The Ethereum-based **proofofhumanity.id** (Kleros-affiliated, 2021) admits verified humans to a registry via face-video plus vouching plus dispute resolution — again a single-tier, identity-revealing admission, suited to token distribution (UBI), not to anonymous mate-selection. World ID, Worldcoin's credential, does prove unique humanness anonymously to a verifier; what it does not supply is the aura and the two-stage reveal, and a dating product built on it (§2, the 2026 anticipations) still gates on the profile.\n\nWe distinguish: HeartBank's **Proof of Humanity ℠** is a layered-*optional* personhood substrate (passkey-per-action; a non-DNA family tree; a live breath signature; a DNA-verified family tree) that verifies a human is present *for this specific act, right now*, and is designed to keep a participant *verified-real and verified-single-human while remaining anonymous to the counterparty until a mutual reveal.* That is precisely the property mate-selection needs and that identity-revealing proof-of-personhood cannot supply (§4.5). The full layered protocol is specified in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*; the name-collision with proofofhumanity.id is acknowledged there and the structural differences enumerated.\n\n### 2.3 · Honest signaling — Zahavi's handicap principle\n\nAmotz Zahavi's handicap principle (1975; formalized by Alan Grafen, 1990) holds that a signal is reliable precisely when it is *costly* to produce — costly in a way that a low-quality signaler cannot afford to fake. The peacock's tail is honest because it is expensive: only a genuinely fit bird can carry it and survive. Costly signaling theory (and its economic cousin, Spence's 1973 job-market signaling) is the formal backbone of this paper's central inversion.\n\nWe distinguish: incumbent dating optimizes the *cheapest* signal (a photo). Aura-gating optimizes a signal engineered to be *expensive in exactly the right currency* — kindness acknowledged by many independent nearby strangers over a long course of time. A predator cannot cheaply fabricate a years-long anonymous-gratitude trail vouched by dozens of locals; the cost of faking the signal is approximately the cost of *actually being kind to many people for a long time*, which is the behavior the signal is meant to indicate. This is Zahavi turned toward prosociality: sexual selection on an honest signal of kindness selects, at the margin, for actually-kinder partners (§11). We are careful (§8): honest-signal does not mean *sufficient* signal — a reliable indicator of character is not an indicator of chemistry.\n\n### 2.4 · Assortative mating and sexual-selection literature\n\nThe biological and social-science literatures on mate choice are deep and we make no claim to extend them. **Sexual selection** (Darwin, 1871) established mate choice as a primary species-shaping force distinct from natural selection. **Assortative mating** research (the well-documented tendency of partners to resemble each other on education, traits, and values, with measured consequences for inequality and heritability) establishes that the *axis* on which mating sorts has population-scale downstream effects. The prosociality and mate-preference literature (e.g., the cross-cultural finding that kindness ranks near the top of stated long-term mate preferences across societies — Buss and colleagues' cross-cultural work) establishes that kindness is *already* a stated preference; what has been missing is a *reliable, hard-to-fake channel* to act on it. Trivers' parental-investment theory (1972) grounds the investment asymmetry; the physical-danger asymmetry of stranger encounters that §7 treats as a first-class constraint is an empirical regularity of victimisation data, not a theorem.\n\nWe distinguish: this paper does not propose a new theory of mate choice. It proposes an *infrastructure* that shifts which signal is legible and actionable at the moment of choice — supplying the honest channel the stated preference for kindness has lacked — and it explicitly bounds the resulting societal claim to a *marginal shift in the selection gradient*, never an override of appearance/status biology (§8, §11).\n\n### 2.5 · TimeBanking and time-as-currency (Edgar Cahn)\n\nEdgar Cahn's TimeBanking (1980 onward) substituted time as the unit of account, with the egalitarian property that an hour given is an hour received regardless of the giver's socioeconomic position. TimeBanking worked at small scale; by the movement's own account it expanded in the 1980s and dwindled by the mid-1990s before a later revival (TimeBanks.Org). The mate-selection layer here is built on Chronicle's time-currency, which is TimeBanking's nearest ancestor.\n\nWe distinguish: Chronicle differs from classical TimeBanking by AI mediation (Miss Aquarius℠ recommends a time amount and orchestrates consent), cultural ritual, integration with the money side, and — decisively — a *dyadic non-fungible* structure (only *you* can spend the hour; the currency *is* the relationship) rather than a fungible pooled credit. The mate-selection layer further repurposes the *mutual* expenditure of dyadic time as a consent and match signal — a use TimeBanking never had, because TimeBanking's hour was fungible and pooled, not a dyadic mutuality receipt.\n\n### 2.6 · The HeartBank substrate this paper builds on\n\nThis paper does not stand alone; it is the mate-selection application of three already-published HeartBank primitives, and it should be read as extending them rather than re-deriving them.\n\n- ***Verified-Human Anonymous Local Giving*** (corpus, 2 May 2026) specifies the money-side primitive: per-action biometric humanity attestation + physical-radio proximity attestation + recipient-side anonymity. This paper generalizes that primitive from *money* to *time*, and from *one-directional gift* to *mutual signal*.\n- ***The Thank-All-Nearby Primitive*** (corpus) specifies anonymous proximity broadcast generosity and the \"one sustainer primitive, two scales\" argument (relationality at the family scale; proximity + PoH at the stranger scale). The mate-selection layer inherits its stranger-scale reconstruction of grounding (nearness), validation (PoH), and anonymity (unlinkability).\n- ***Proof of Humanity ℠*** / ***B-PoH℠ as Humanity Layer for the AI-Native Internet*** specifies the layered-optional personhood substrate that makes anonymous-but-verified-real participation possible — the anti-catfish foundation (§4.5).\n\nThe table below situates the contribution against the prior art.\n\n```\n                  │ appearance- │ Worldcoin / │  cash-/app-  │  AURA-GATED\n  PROPERTY        │ gated apps  │ PoH.id      │  mediated    │  ANON. MATE-\n                  │ (Tinder…)   │             │  dating      │  SELECTION\n ─────────────────┼─────────────┼─────────────┼──────────────┼──────────────\n  discovery gate  │ appearance  │ (n/a)       │ appearance   │ AURA (proven\n                  │ + paid boost│             │              │ kindness)\n  signal cost     │ ~zero       │ ~zero       │ ~zero        │ HIGH (Zahavi-\n  to fake         │ (a photo)   │ (a photo)   │ (a photo)    │ honest)\n  anti-catfish    │ weak        │ strong but  │ weak         │ STRONG +\n                  │             │ identity-   │              │ ANON-UNTIL-\n                  │             │ revealing   │              │ MUTUAL (PoH)\n  rejection event │ explicit    │ (n/a)       │ explicit     │ NONE (silent\n                  │ (cruel)     │             │              │ non-reach)\n  incentive       │ MISALIGNED  │ (n/a)       │ misaligned   │ SELF-\n  alignment       │ (profit if  │             │ (engagement) │ ELIMINATING\n                  │ you stay)   │             │              │ (profit if\n                  │             │             │              │ you LEAVE)\n  reveal model    │ immediate / │ identity    │ immediate    │ SECOND\n                  │ public photo│ fixed       │              │ MUTUAL\n                  │             │             │              │ CONSENT\n  compatibility   │ none / ML   │ (n/a)       │ none         │ OPTIONAL\n  layer           │ engagement  │             │              │ synastry\n                  │             │             │              │ (coord-not-\n                  │             │             │              │ force)\n```\n\n---\n\n## 3 · The honest-signal inversion: aura versus the photograph\n\nThe motivating idea of the whole design is a single inversion. Incumbent dating gates discovery on the cheapest-to-fake signal a human can present; this mechanism gates discovery on one of the most expensive-to-fake. The cost is the point.\n\nA photograph costs nothing to optimize. It can be filtered, posed, lit, selected from hundreds of attempts, borrowed, or wholly synthesized. The self-authored profile is cheaper still: it is the claimant's own unaudited testimony. Because these signals are cheap, they are weakly correlated with the qualities that predict a good long-term partner; and because the market optimizes them, it selects for the ability to *produce* them, which is not the same as the ability to *be* a good partner.\n\n**Aura** is engineered to be the opposite. It is an *aggregate*, *anonymous*, *many-sourced* reputation for proven kindness, accrued from gratitude received from nearby strangers over a long course of time. Four properties are designed to make it costly in Zahavi's sense; whether it stays honest under adversarial play is open (§12.7):\n\n- **Aggregate and many-sourced.** Aura is not any single thank-you; it is the accumulated signature of many independent acknowledgments. One staged kindness, or one colluding friend, moves it negligibly. (This is also the operationalization of Guard 1, §5: the romantic-quality signal is the *aggregate*, never the individual thank.)\n- **Anonymous.** The people who built a person's aura, by being grateful to them, did so anonymously and largely without romantic intent — so the signal cannot be gamed by performing kindness *at* a target audience of potential mates. To raise aura you must be kind to *everyone*, because you do not know who is watching, or whether anyone is.\n- **Longitudinal.** Aura accrues over a long course of time. A predator or a fraud cannot cheaply fabricate years of vouching from dozens of locals. The cost of faking the signal approaches the cost of *actually being kind for a long time to many people* — which is the trait the signal indicates.\n- **Locally embedded.** Because the gratitude comes from nearby verified humans (the proximity rule), aura is also a **community-sourced record** that no dating app has: a long anonymous trail of real local people vouching, by their gratitude, that this person treated them well.\n\n```\n   SIGNAL COST-TO-FAKE  (Zahavi: reliable ⇔ expensive)\n\n   cheap ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ expensive\n   ▲                       ▲                          ▲\n   photo / bio        a single staged            AURA: many anonymous\n   (self-authored,    kind act / one             local strangers, over\n   AI-generatable)    colluding friend           a long time, no target\n                      (negligible aura Δ)        audience  ⇒ faking it\n                                                 ≈ actually being kind\n```\n\nThe defensible claim is narrow and strong: *aura-gating selects, at the margin, for people who are actually kind*, because the signal is expensive in the currency of actual kindness. The over-claim we refuse (§8) is that aura predicts *attraction* or *compatibility*. It does not. It predicts character. Everyone you meet in this pool is proven kind, verified real, and community-vouched; you bring the chemistry. *[The \"proven kind\" and \"community-vouched\" verdicts in that sentence are superseded — §8.1.]*\n\n---\n\n## 4 · The mechanism — aura-gated anonymous mate-selection\n\nWe now specify the mechanism. Variations consistent with the five structural properties (aura-gating; mutual-anonymous-same-hour double-opt-in; reveal-as-second-consent; PoH anti-catfish substrate; optional synastry) fall within the scope of this defensive publication.\n\n### 4.1 · The anonymity flag as the structural boundary\n\nChronicle distinguishes two relational modes by a single flag on a gratitude transfer, `isAnonymous`. The flag is set by the giver at transfer time and never changes; the mate-selection layer has exactly one read path — the `true` partition — and no other.\n\n- **`isAnonymous: false` — known loved ones.** This is Chronicle's sacred core: time-presence given between people who know each other, to repair a drifted bond. It is **never a romantic signal** and never enters the mate-selection layer. The cathedral.\n- **`isAnonymous: true` — the anonymous-nearby-stranger layer.** This is where mate-selection lives. Entering it is exactly as simple as flipping the flag: a person opts in by choosing to give anonymously to nearby strangers. The courtship.\n\nThis is the elegant operationalization of Guard 1 (§5): there is no gross \"dating mode\" bolted onto a gratitude app, and there is no path by which thanking a *known* person can be read as flirting. The boundary between pure known-gratitude and stranger-romantic-discovery is the same flag the giver already sets for their own privacy reasons. The romantic pathway is *structurally* confined to the anonymous-stranger layer and cannot be emergent from ordinary known thanking.\n\n```\n                          isAnonymous = false\n   KNOWN LOVED ONES ───────────────────────────────►  CHRONICLE CORE\n   (drifted-bond repair; the \"cathedral\")              (NEVER romantic;\n        │                                               low-T&S; known\n        │  user flips the flag                          counterparties)\n        ▼\n                          isAnonymous = true\n   ANONYMOUS NEARBY  ─────────────────────────────►  B-DATING LAYER\n   STRANGERS (the \"courtship\")                         (this paper;\n                                                        highest-T&S;\n                                                        guards §5–§7)\n```\n\n### 4.2 · Aura as the quality signal (aggregate, never individual thanks)\n\nIn the anonymous-stranger layer, the signal that surfaces a person for possible discovery is their **aura** — the aggregate, anonymous, many-sourced proven-kindness reputation defined in §3, reusing the existing HeartBank aura primitive (the B-Aura of the Zero-Point Game ℠; see §10). It is *not* any individual thank-you, and it is *not* appearance. This is load-bearing in two directions: it makes the romantic signal Zahavi-honest (§3), and it keeps the individual thank pure (§5) — a single act of gratitude between two people is never itself a romantic overture; only the aggregate disposition is legible to the mechanism. Aura is the Zero-Point Game's published ƒ, read as-is; this layer computes nothing of its own.\n\nAura raises a person's *visibility and ordering* in the anonymous-nearby pool. Aura changes only ordering in the pool. The offer is gated on the other person's own independent giving, which no aura can cause; that is the sense in which aura earns access to no one (Guard 3, §7). No one is owed a match. Kindness raises the probability that you are surfaced; it never obligates anyone to reciprocate.\n\n### 4.3 · Mutual-anonymous-same-hour as the double-opt-in (\"both reached for each other\")\n\nThe match trigger is the **mutual-anonymous-same-hour** signal — repurposed directly from Chronicle's existing consent receipt. A match becomes possible only when each of two people has independently and anonymously given time-presence toward the other, in proximity, to a mutual threshold, within a coincident window. This is the time-currency analogue of \"both swiped right,\" with three differences that matter:\n\n1. **It is double-blind.** Neither party knows, while accumulating, whether the other is reciprocating. You are simply being kind, anonymously, to someone nearby whose aura drew your gratitude.\n2. **There is no explicit rejection, ever.** Non-reciprocation is *silent*: a threshold is simply not reached. No one is told \"no.\" This removes the single cruelest mechanic in dating — the visible, countable rejection — and replaces it with the gentlest possible non-event. (It also removes the harassment surface of a \"rejected\" actor who can see they were rejected.)\n3. **The accumulation is slow** (§4.6). The signal is built from repeated anonymous kindness over time, not a single tap.\n\nReaching the mutual threshold does not reveal anyone. It unlocks the *offer* of a reveal (§4.4). The match is a two-stage consent: first the mutual-anonymous threshold (stage one), then the mutual reveal (stage two).\n\nStated as a state machine, with the two deployment parameters named rather than hidden — **T**, the threshold, and **W**, the window:\n\n```\n  IDLE        ──(A gives anonymous time toward B, in proximity)──▶  A→B OPEN\n  A→B OPEN    ──(B gives anonymous time toward A, in proximity)──▶  PAIR OPEN\n  PAIR OPEN   ──(each direction reaches T hours, cumulative,\n                 and both did so within one window W)───────────▶  THRESHOLD\n  THRESHOLD   ──(the verifying party offers a reveal to both)────▶  OFFERED\n  OFFERED     ──(both accept, independently)───────────────────▶  REVEALED\n  any state   ──(W elapses without the next transition)─────────▶  IDLE   (silently)\n```\n\n\"Toward\" is the giver's own designation of an anonymous nearby counterparty at transfer time; accumulation is cumulative within W, not contiguous; a person may hold several open pairs at once, and each pair runs its own machine. Non-reach is not an event: the machine falls back to IDLE and nothing is written to either party.\n\n### 4.4 · Reveal as a second, separate mutual consent\n\nWhen the mutual-anonymous threshold is reached, identity reveal becomes *available/offered* — it does **not** auto-reveal. **Both parties must independently opt to reveal.** This second consent is structurally essential for three reasons:\n\n- **It protects the pure-*dāna* giver.** Many people will give anonymously to a high-aura nearby stranger with *no romantic intent whatsoever* — that is the whole point of anonymous giving, and it must stay uncontaminated. If reaching a threshold auto-revealed them, anonymous giving would become a romantic disclosure they never consented to. The second consent guarantees that a gift given as a gift *stays* a gift.\n- **It makes the double-opt-in real.** A match that revealed on the strength of stage one alone would be a single opt-in dressed up as two. The reveal-consent is the actual second \"yes.\"\n- **It is the home of the women's-safety graduated controls** (§7): the revealed party governs pace, may require public-first meetings, and retains the right to re-anonymize (un-reveal) at any time.\n\n```\n   STAGE 0   each gives anonymous nearby time-presence,\n             drawn by the OTHER's AURA (no romantic intent assumed)\n                 │                              │\n                 ▼ (double-blind accumulation)  ▼\n   STAGE 1   MUTUAL-ANONYMOUS-SAME-HOUR threshold reached\n             ── no reveal yet; reveal merely OFFERED ──\n             ── non-reciprocation here is SILENT (no rejection) ──\n                 │\n                 ▼   both must independently opt in\n   STAGE 2   MUTUAL REVEAL  (the SECOND consent)\n             ── graduated control to revealed party (§7):\n                public-first · pace · re-anonymize ──\n                 │\n                 ▼\n            INTRODUCTION  (a pool pre-filtered for proven kindness;\n                           participants bring the chemistry — §8)\n```\n\n### 4.5 · Proof-of-Humanity underneath — anti-catfish, anti-bot\n\nBeneath the entire layer sits **Proof of Humanity ℠** (§2.2, §2.6). Its contribution to mate-selection is specific and decisive: participants are **verified-real, verified-single-human, and anonymous-until-mutual.** This natively defeats online dating's two endemic plagues — catfishing (no fabricated personas; a person is a verified unique human) and bots (no automated accounts at scale) — *without* revealing identity before the second consent. Identity-revealing proof-of-personhood (Worldcoin, proofofhumanity.id) cannot supply this, because revealing identity is exactly what the safety model forbids before stage two.\n\nAura compounds this: because aura is a long anonymous trail of gratitude from many verified local humans, it is costly to fabricate and a bot cannot accrue it (§3; the adversarial residue is §12.7). The PoH layers a participant holds (passkey, family-tree, breath, DNA-tree) are surfaced as optional depth, and a counterparty may, after reveal, filter on them — but the protocol-minimum keeps the layer inclusive (§12.3).\n\n### 4.6 · Slow accumulation as a feature, not a bug\n\nThe mutual-anonymous signal accrues *slowly*, over a long course of time. This is deliberate and is a positioning asset, not a UX deficiency. Slow, proven-over-time accumulation is explicitly **anti-hookup and pro-durable-bond**: it is designed to self-select for commitment-capable partners, and we hypothesise that it reaches a large, underserved, swipe-fatigued segment that wants partnership rather than the high-velocity hookup market the incumbents optimize. It is also a safety property: a long anonymous courtship embedded in a real local community is far harder to weaponize than an instantaneous match between two strangers from anywhere on Earth.\n\n### 4.7 · Reference transfer flow\n\nWe sketch a reference flow without claiming any implementation as canonical.\n\n1. A user opts into the anonymous-nearby-stranger layer (`isAnonymous: true`).\n2. The system surfaces nearby high-aura verified humans for possible anonymous time-giving — surfaced **on aura, never on appearance** (Miss Aquarius℠ directive; §7, §10). No photographs are shown in the discovery surface.\n3. The user gives anonymous time-presence toward one or more nearby strangers, in proximity (verified per the proximity attestation of *Verified-Human Anonymous Local Giving*: per-action biometric + physical-radio + density-tunable radius). Each gift is, first and foremost, *a gift* — it may carry no romantic intent.\n4. The verifying party (Miss Aquarius℠, the autonomous AI substrate) accumulates the double-blind mutual signal privately. Neither party is informed of the other's reciprocation.\n5. On reaching the mutual-anonymous-same-hour threshold (§4.3: both directions at T within W), the verifying party *offers* a reveal to both — never auto-revealing. Non-reach is silent: the pair returns to IDLE and no record of the attempt is written.\n6. If and only if **both** independently consent, identities are revealed, with graduated control vested in the revealed party (public-first option, pace control, right to re-anonymize).\n7. Should a relationship form, any monetization is *mission-aligned only* (§6): a voluntary forward/graduation gift at *pairing* (never at reveal), patron support, or a values-aligned introduction fee — never a charge for access, visibility, or staying in the market.\n\nThroughout, the verifying party enforces the standing adversarial heuristics of the giving primitive (collusion detection, rate-limiting, coded-message detection, GPS-spoof rejection) and the mate-selection-specific directives of §7.\n\n---\n\n## 5 · Guard 1 — Keeping gratitude pure (the cathedral and the courtship in separate rooms)\n\nThe whole institution rests on gratitude being *pure* — *dāna*, ego-detached, non-transactional. This is not decoration; it is the load-bearing wall. If thanking can be read as flirting, gratitude is instrumentalized into courtship, and the sacred primitive collapses into a pickup market. That is an *existential* risk to all of HeartBank — Treasury and Chronicle alike — not merely a product risk to the mate-selection layer. Guard 1 is therefore the first guard, and it is enforced structurally, by three composing mechanisms already specified above:\n\n1. **The anonymity-flag boundary (§4.1).** Known-relationship thanks (`isAnonymous: false`) are the pure core and are *never* a romantic signal; the romantic pathway lives *only* in the anonymous-stranger layer. There is no path by which thanking your sister, your colleague, or a reconnecting friend enters mate-selection. The cathedral and the courtship are in separate rooms, separated by a flag the user controls.\n2. **Aura (aggregate), not individual thanks, is the attractiveness signal (§4.2).** A single act of gratitude is never itself an overture. Only the long aggregate disposition is legible to the mechanism. This means you cannot \"flirt\" by thanking someone; the unit the mechanism reads is too coarse and too slow to carry a courtship message.\n3. **Reveal is a separate opt-in (§4.4).** Anonymous giving stays uncontaminated because giving never auto-discloses the giver. A gift given as a gift stays a gift.\n\nThe failure mode this guard exists to prevent is *gratitude-as-courtship-currency*: a world in which people thank strategically, perform kindness at targets, and read every thank-you as a possible advance. Were that to take hold, the gratitude economy would be desecrated at its root. The three mechanisms above make it structurally hard: you cannot court through known thanks (wrong room), you cannot court through a single anonymous thank (wrong unit — only the aggregate counts), and you cannot be outed by your own generosity (reveal is a separate consent). Guard 1 is the price of admission for the entire mechanism; if a future design choice would weaken any of the three mechanisms, the correct response is to abandon the choice, not the guard.\n\n---\n\n## 6 · Guard 2 — The self-eliminating mechanism (it wins when you pair off and leave)\n\nAura-gated mate-selection is the *sharpest possible instance* of a misaligned-business pattern the corpus has already outlawed. Dating apps are the textbook case: they profit when you stay single and keep swiping; a product that *works* — you pair off and delete it — is anti-LTV. HeartBank forbade consumer-subscription-as-primary revenue for loneliness for exactly this reason (a self-eliminating product whose primary revenue is the lonely person's recurring payment is incentivized to keep them lonely). Mate-selection is the same trap, only worse, because the dating-industrial complex has perfected artificial scarcity, pay-to-be-seen, and addictive gamification around it.\n\nThe guard is a hard constraint on monetization:\n\n> **B-Dating℠ succeeds when people pair off and leave. It may be monetized only by mission-aligned logic that profits when users leave happy — never by retaining them in the market.**\n\nConcretely, the permitted revenue legs are all *positively coupled to success or to adoption-pull*, never to retention:\n\n- **Patron-primary.** The only revenue leg positively coupled to mission success: as the world grows kinder, more people give — a flywheel. Conversion happens at the *afterglow* of a good outcome (a receive→give-forward trigger), never as a toll on the lonely.\n- **The graduation gift.** A *voluntary* forward-gift offered at *pairing* — the moment of success — never at the reveal, and never as a gate. You give because something good happened, not to unlock access.\n- **Values-aligned introductions (B2B).** Faith communities, diaspora networks, and other values-aligned cohorts may host introductions; revenue is coupled to *successful, values-matched* pairings, not to engagement.\n- **Optional synastry deep-readings (§9).** Insight a user may purchase, *never a gate* on discovery or reveal.\n\nWhat is *forbidden*: subscriptions for access or visibility; pay-to-be-seen boosts; rationed likes or matches; any mechanic whose revenue rises with time-in-market. The dark pattern is not improved here; it is exited. This is also a marketing asset — \"the app that only profits when you leave happy\" — but the asset is downstream of the constraint, not the reason for it.\n\nThere is a tension worth naming plainly (it is also the project's open cold-start question): mate-selection carries the highest willingness-to-pay in consumer software, which makes it a tempting cold-start wedge — and mission-safe *only if Guard 2 holds.* The willingness-to-pay must be harnessed as adoption *pull* (people want in) and converted at *success* (the graduation gift) — never as a toll at the gate. The moment any revenue leg becomes coupled to retention, the mechanism has become the thing it was built to replace.\n\n---\n\n## 7 · Guard 3 — Women's safety and the gendered asymmetry as a first-class duty\n\nChronicle's loved-ones core dissolved trust-and-safety risk by making counterparties *known*. Mate-selection deliberately reverses that: it walks back into the highest-risk category that exists — strangers meeting for romantic intent — under a real and irreducible gendered physical-danger asymmetry. This guard treats women's physical safety not as a feature to be added but as a *primary design constraint* that the mechanism must satisfy to deserve to exist.\n\nHeartBank brings four mitigations, each a mechanism; whether they reduce harm is the empirical question §12.3 owns:\n\n1. **PoH anti-catfish (§4.5).** Verified-real, verified-single-human. No fabricated personas; no bots. The \"the person is not who they said they were\" failure mode — the precondition of a large class of harms — is structurally attacked.\n2. **Aura as a community-vouched behavioral reputation.** A long anonymous-gratitude trail from many local verified humans is costly to fabricate (§3); what it says about a person is the reader's judgment.\n3. **Local embeddedness.** Proximity (the proximity rule) means counterparties are embedded in a shared local community, which carries real-world accountability that anywhere-on-Earth matching does not.\n4. **Graduated reveal (§4.4).** The revealed party governs the encounter: public-first meetings, pace control, and an unconditional **right to re-anonymize** at any moment.\n\nBut the asymmetry is **not erased**, and the paper must say so without softening. These mitigations reduce risk; they do not remove it. Two further design commitments are non-negotiable:\n\n- **Safety controls vest in the revealed party, biased toward the higher-risk party.** Public-first defaults, pacing, blocking, re-anonymization, and reporting are first-class, not buried. The design assumes the higher-physical-risk party should hold the controls.\n- **The never-gate-reciprocity HARD guard.** This is the hinge that keeps the mechanism on the right side of the knife and is shared with Guard 1's purity logic. **No one is ever owed a match.** Kindness raises *visibility*, never *entitlement*. The romantic-entitlement failure mode — \"I racked up kindness; why won't anyone match me?\" — is precisely the resentment that fuels the worst behavior in dating, and it is *structurally* denied: aura raises the probability you are surfaced and never obligates anyone to reciprocate; non-reciprocation is silent and final unless *both* later re-engage. Miss Aquarius℠ never gates or pressures reciprocity. This guard is what separates \"kindness raises your aura\" from social-credit-for-romance (§8, §12.2).\n\nGuard 3 is also where the mechanism could do the most good *or* the most harm, and the design accepts that the harm side is real. The honest position (§12) is that the gendered safety asymmetry remains after every mitigation, that the controls and the never-gate-reciprocity guard are necessary but not sufficient, and that deployment to vulnerable populations must defer to community partners and to ongoing real-world safety evaluation rather than to architecture alone.\n\n```\n   THE THREE GUARDS (the whole ballgame — not caveats, the design)\n\n   ┌──────────────┬───────────────────────────┬───────────────────────┐\n   │ GUARD 1      │ keep gratitude PURE        │ anonymity-flag room-  │\n   │ purity       │ (existential to ALL of     │ split · aura-not-     │\n   │              │  HeartBank)                │ individual-thanks ·   │\n   │              │                            │ reveal = 2nd consent  │\n   ├──────────────┼───────────────────────────┼───────────────────────┤\n   │ GUARD 2      │ wins when you pair off     │ monetize SUCCESS &    │\n   │ self-        │ and LEAVE (not the dating  │ adoption-PULL only;   │\n   │ eliminating  │  dark pattern)             │ NEVER retention       │\n   ├──────────────┼───────────────────────────┼───────────────────────┤\n   │ GUARD 3      │ women's safety + gendered  │ PoH + aura-vouch +    │\n   │ safety-      │ asymmetry FIRST-CLASS      │ local-embed +         │\n   │ first-class  │ (NOT erased — mitigated)   │ graduated reveal ·    │\n   │              │                            │ NEVER-GATE-RECIPROCITY│\n   └──────────────┴───────────────────────────┴───────────────────────┘\n```\n\n---\n\n## 8 · Honest calibration — a character filter, not a compatibility oracle\n\nThe single most important honesty discipline in this paper is to state exactly what aura-gating does and does not do.\n\n**What it does.** It produces a pool in which *everyone is proven kind, verified real, and community-vouched* — stripped of the fabricated, the bots, and the cruel. It removes the cheapest-to-fake signal (the photograph) from the gate and replaces it with a costly, longitudinally-verified honest signal of character. This is genuinely revolutionary: it is a mating pool pre-filtered for proven character, with no catfish and no swipe-cruelty. *[The \"proven kind\" and \"community-vouched\" verdicts above are superseded — §8.1.]*\n\n**What it does not do.** Kindness is *necessary, not sufficient.* It does not capture attraction, chemistry, shared values beyond kindness, life-stage compatibility, sexual compatibility, or the thousand idiosyncratic things that make two specific people right or wrong for each other. Aura-gating is a **character filter, not a compatibility oracle.** It is wrong — and the design refuses — to claim that *kindness equals attraction*, or that a high-aura match is a *predicted* good relationship.\n\nThe defensible one-line claim is therefore:\n\n> *\"Everyone you meet here is proven kind, verified real, and community-vouched. You bring the chemistry.\"* *[superseded — §8.1]*\n\nThis is both honest and still revolutionary. It does not need the overclaim to be a category change from incumbent dating. The honesty is also a safety property: overclaiming compatibility (\"the algorithm knows you're meant for each other\") manufactures false confidence in exactly the high-risk context (§7) where false confidence is dangerous, and it slides toward the social-credit-for-romance dystopia (§12.2). The character filter is a strong, true claim; the compatibility oracle is a weak, false, and unsafe one. We make only the first.\n\n```\n   ┌───────────────────────────────┬───────────────────────────────┐\n   │  THE FILTER (true, strong)    │  THE ORACLE (false, refused)  │\n   ├───────────────────────────────┼───────────────────────────────┤\n   │  everyone is proven KIND      │  \"kindness = attraction\"      │\n   │  everyone is verified REAL    │  \"the algorithm knows you're  │\n   │  everyone is community-VOUCHED│   meant to be together\"       │\n   │  no catfish · no bots ·       │  predicted compatibility /    │\n   │  no swipe-cruelty             │   chemistry / life-fit        │\n   │  ⇒ you bring the CHEMISTRY     │  ⇒ false confidence; unsafe;  │\n   │                               │     drifts toward Nosedive    │\n   └───────────────────────────────┴───────────────────────────────┘\n```\n\n### 8.1 · The copy rule: describe the mechanism, never characterize the person\n\n*Added 2026-08-22. §8 refuses to characterize the **match**. This subsection extends the same refusal one level down, to the **participants** — and applies it, first, to §8's own defensible one-line claim, which does not entirely survive it.*\n\nThe rule, stated as a rule:\n\n> **An institution may state its own mechanisms. It may never characterize a person or an outcome.**\n>\n> *\"Every profile in this pool is gated on gratitude received from strangers over at least a year\"* — a **mechanism**: factual, checkable, and falsifiable by anyone with access to the system's own definition.\n>\n> *\"Everyone here is trustworthy\"* — a **person** claim. *\"You will be safe\"* — an **outcome** claim. Neither is ours to make about anybody.\n\n**The origin was a caught error in this corpus, and the paper should say so plainly rather than present the rule as a principle we arrived at by reflection.** A drafted pitch for a sibling product read: *invite people you haven't met, in a trustworthy way* — written one turn after the ruling that geolocation is a **gate and never a proof**. Marketing had promoted a gate to a proof in a single adjective, and it did so inside an institution that had just written the distinction down. That is how this failure actually happens: not by deciding to overclaim, but by describing a mechanism with the word for the feeling the mechanism is supposed to produce.\n\n**Why it matters here more than anywhere else in the corpus.** This is a stranger-meeting product with an irreducible physical-safety asymmetry (§7). ⚠️ **Selling accountability as trust is the overclaim that gets people hurt** — not because the claim is false in the average case, but because it *invites the user to relax a judgment they should keep making.* A woman meeting a stranger from this system should arrive with exactly the caution she would bring to meeting a stranger from anywhere else. Every sentence that lowers that caution by a degree has spent her safety to buy our conversion rate, and the trade is not ours to make. §7's safety architecture and this rule are one commitment stated in two registers: the architecture must not create false confidence, and neither may the copy.\n\n**Applied to this paper's own claim, and it does not fully pass.** §8 offers as the defensible line: *\"Everyone you meet here is proven kind, verified real, and community-vouched. You bring the chemistry.\"* Two-thirds of that is mechanism. **\"Verified real\"** describes the Proof-of-Humanity substrate and is checkable. **\"Proven kind\"** and **\"community-vouched\"**, however, are verdicts on persons wearing the clothes of mechanism outputs — they take an aggregate record and hand the reader a settled conclusion about the character of whoever holds it. The restated form keeps everything true and asserts nothing about anyone:\n\n> *\"Everyone you meet here is a verified single human whose profile is gated on a long record of thanks from people who did not know whom they were thanking. What that record means about a particular person is yours to judge — as it always was.\"*\n\nLonger, weaker-sounding, and the only version of the sentence this institution is entitled to say. **The published line in §8 is superseded by this one**; the earlier wording is left standing above rather than deleted, because a paper that quietly repairs its own copy teaches nothing.\n\nOne usage is deliberately kept. Where this paper's abstract says the aura trail \"signals trustworthy *because* expensive,\" it is using **Zahavi's technical sense** — a signal is honest when faking it costs more than it returns, which is a statement about the *signal*, not about the *signaller*. That sentence is correct in a paper on honest signaling and must never be recycled onto a product surface, where \"trustworthy\" will be read as a description of the people rather than of the economics of the trail.\n\n**The general test, in three columns:**\n\n| Say this (mechanism) | Never this (person) | Never this (outcome) |\n|---|---|---|\n| \"gated on anonymous gratitude accumulated over time\" | \"everyone here is kind\" | \"you will have a good experience\" |\n| \"every account is a verified single human\" | \"no one here is a catfish\" | \"you are safe here\" |\n| \"pins are authored by an account someone paid for and can lose\" | \"posted by trustworthy hosts\" | \"nothing bad happens at these\" |\n| \"reveal requires a second, separate mutual consent\" | \"we only match good matches\" | \"we prevent rejection\" |\n\nThe left column is longer and duller than the middle and right, and that is the whole cost of the rule. ⭐ **The compensation is that the left column is the only one that stays true when the product is at scale and someone is looking for a reason to sue** — an institution that never characterized a person has never mis-characterized one.\n\n**It is the Proof-of-Humanity posture in copy form.** That primitive's ratified stance is that *the system provides signals and the recipient decides* — recipient-side filters, never a system verdict. A sentence that hands the user a verdict has quietly moved the decision from the recipient to the platform, which is the same architectural error as building a compatibility oracle (§8) or scoring the quality of someone's presence (a refusal this corpus makes in its time-currency work). **Three different products, three different mechanisms, one repeated mistake: the system deciding something it has no standing to decide, and saying so in a sentence short enough to fit on a landing page.**\n\n**Honest limit.** This is a floor on what may be *asserted*, not a ban on describing what the product does, and it does not make the product safe. A perfectly-worded surface still delivers strangers to each other. The rule reduces the false confidence the *institution* manufactures; it does nothing about the false confidence a person brings with them, and §7's architecture — not its copy — is what has to hold in that case.\n\n---\n\n## 9 · The optional synastry (cosmic-coordinate) layer\n\nHeartBank offers, *optionally*, a compatibility signal derived from cosmic coordinates — natal-chart synastry — under the project's standing worldview posture: **coordinate, not force.** The natal chart is treated as a unique *coordinate* in space-time (each life a necessary, distinct aspect of the universe's self-articulation — an Indra's-Net reading that grounds unconditional dignity), *never* as a deterministic causal force and *never* framed as an \"astrology test.\"\n\nThe posture is strict and is what distinguishes this from horoscope-matching:\n\n- **Opt-in and secondary.** The kindness-gate is the core; synastry is one *optional* signal layered atop a pool already pre-filtered for proven character. It is never the gate, never deterministic, and never required.\n- **Epistemically humble.** It is offered as insight and prompt, not prophecy. The framing is \"here is a coordinate-correlation worth reflecting on,\" not \"the stars say yes.\"\n- **A differentiator the incumbents cannot credibly touch.** HeartBank's worldview supports synastry authentically; bolting astrology onto an engagement-monetized swipe app is a gimmick, whereas here it is continuous with the institution's cosmic-coordinate metaphysics.\n\nThere is a genuine research opportunity, gated on methodology. B-Dating plus the project's opt-in **longitudinal cohort** (DNA + natal chart + behavior; see *Each Life as Cosmic Coordinate*) could become a large consented cohort for cosmic-coordinate compatibility — *only* under the same methodological floors that govern the cohort: differential privacy, pre-registered hypotheses, and a coordinate-correlation posture that never markets itself as proving astrology. Absent those floors, the synastry layer must remain an opt-in reflective feature, never a matchmaking determinant.\n\n```\n   SYNASTRY LAYER — what it IS / what it is NOT\n\n   IS:   opt-in · secondary · one signal atop a character-filtered pool ·\n         coordinate-not-force · epistemically humble · authentic to the\n         HeartBank worldview · (research-grade ONLY under diff-privacy +\n         pre-registration)\n   NOT:  the gate · deterministic · required · an \"astrology test\" ·\n         a compatibility guarantee · marketed as proof\n```\n\n---\n\n## 10 · The n=2 atom of the Zero-Point Game ℠ — the middle way of eros\n\nThis section places the mechanism structurally inside HeartBank's keystone frame; it is short by design.\n\nThe **Zero-Point Game ℠** is HeartBank's originating frame: an infinite balance game in which players oscillate around a still point (Zero), giving (+, net kind) and receiving (−, net thankful) in dynamic equilibrium, with the **B-Aura** — the frequency and amplitude of one's oscillation around Zero, rendered as light — as the real objective (anti-credit-score; the same aura that gates mate-selection here). The game scales by **player-count**:\n\n```\n   ZERO-POINT GAME — SCALING BY PLAYER-COUNT\n\n   n = 1            n = 2                family            all\n   ─────            ─────                ──────            ───\n   self-thank   →   B-DATING / B-GRAM →  family bank   →   global game\n   (ignition;       (THIS PAPER →        (B-Chest)         (Aquarian\n   not yet          the minimal                            Pool ℠)\n   reciprocal)      RECIPROCAL game)\n                    ▲\n                    the couple is where balance FIRST becomes two-sided\n                    and where imbalance hurts most — the most intimate\n                    test of the architecture\n```\n\nThe self-thank (n=1) is the *ignition* — not yet reciprocal. **Two is the minimum to actually *play*** the +/− balance, so the couple is the game's atom: the first place balance becomes two-sided, and the place imbalance hurts most. B-Dating discovers the partner; the deepening relational game (B-Gram, the n=2 atom) is where two people play.\n\nThis reframes the societal claim more precisely than \"sexual selection on kindness\" alone. The fuller frame is not *kindness* (the + pole only) but **balance** — the whole Zero-Point oscillation, give *and* receive. So mate-selection redirects sexual energy not merely toward giving but toward *dynamic balance*, making B-Dating **the middle way of eros.** The two Zero-Point failure-poles are exactly the two sexual failure-modes:\n\n```\n   THE MIDDLE WAY OF EROS\n\n   ACCUMULATION / INDULGENCE  ◄──────  BALANCE  ──────►  WITHDRAWAL / INERTIA\n   (conquest, hookup-culture,         (give AND          (repression, incel\n    the zero-sum mating game;          receive, in        resentment, isolation;\n    the + pole run amok)               dynamic eq.)       the − pole as inertia)\n        the indulgence extreme      ── the path that ──      the mortification\n        (kāma-sukhallikānuyoga)        moves between          extreme\n                                       the poles              (atta-kilamatha-\n                                                              ānuyoga)\n```\n\nB-Dating is neither pole. Crucially, it is **not sublimation-as-repression** (the withdrawal pole in disguise): the energy is *honored* — the reward is to go on a real date, to form a real bond — not denied. What dynamic balance at n=2 yields, held lightly and inclusively: *non-possessive love* — **mettā held in upekkhā**, warmth that does not grip (the attachment-theory term that lands is *secure* love; the two near-enemies are the anxious/clinging pole and the avoidant/cold pole); and *generativity* — the balanced dyad as the generative root of the very tree of humanity Miss Aquarius℠ waters (B-Dating → deepening → family → tree), with procreation as the receive→give-forward atom in its most literal form (life received, life forwarded). Two careful guards on this framing: **yin/yang are energies both partners carry** (never \"man = yang, woman = yin\"; the balance is the interplay, each cycling through giving and receiving), and **generativity is broader than biological procreation** (any committed dyad in dynamic balance is generative — care, creativity, a shared life); the complementarity is energetic, present in any loving pairing, or the \"tree\" excludes whom it must not. The middle way is an aspiration, not a guarantee.\n\n---\n\n## 11 · Societal motivation — sexual selection redirected toward kindness (brief)\n\nThis section motivates the mechanism's deepest \"why\" and deliberately stops short of the full argument, which is reserved for the companion founder-voice essay.\n\nThe lever, stated once: the mate-drive is the *root* drive of the species and the money-drive is *derivative*. If mate-selection is re-gated on proven kindness — aura, a Zahavi-honest signal — rather than on appearance and status, then **sexual selection itself begins, at the margin, to favor kindness.** Sexual selection is among the most powerful species-shaping forces there is; change what earns a mate and — assuming the disposition is transmissible, genetically or culturally — over generations you change what the species optimizes for. Re-gating the root drive on kindness also partially detoxifies the derivative money-drive — healing the thing underneath the thing. Anonymity does additional work here: because aura is built from gratitude given by people you cannot target, raising it requires being kind to many people the giver cannot choose — under the anti-collusion assumption §12.7 states — so everyday kindness becomes romantically load-bearing for everyone — \"be good to every stranger; the one you are meant for may be among those who vouch for you.\"\n\nThree calibrations bound the claim — the same honesty discipline as the rest of the corpus:\n\n1. **Margin, not override.** It *tilts* the selection gradient toward kindness; it does not replace millions of years of appearance/status biology. The defensible verb is \"shifts at the margin,\" never \"replaces.\"\n2. **Generational and population-level, not individual or immediate.** A slow selection pressure, not a switch — and kindness-disposition is the *foundation* (*dāna*, the first *pāramī* — generosity, not yet *mettā*), not awakening itself (foot of the mountain, not the summit).\n3. **The equity floor is sharpest here, because the stakes are love and procreation.** This must never become social-credit-for-romance (\"be kind or stay single\") or doubly-disadvantage the isolated and low-aura. The guard is the never-gate-reciprocity HARD constraint (§7): kindness raises visibility, never entitlement.\n\nThat is the motivation. The deeper treatment — sexual-selection-on-kindness as a biological lever for the \"second singularity,\" the inversion of intrasexual competition from resource-display toward prosociality, and the counterweights that argument must clear — belongs to the companion essay and is intentionally not argued here.\n\n---\n\n## 12 · Limitations and honest-limits\n\nCorpus convention requires a generous, unflinching limitations section. The mechanism's strongest property — that it recruits the species' deepest drive in service of kindness — is also the precise reason its failure modes are severe. The risk is not that it fails; it is that it works *too well* and corrupts the gratitude core (§5), rebuilds a predatory dating app (§6), or gets someone hurt (§7). The three guards are the whole ballgame, and guards are commitments, not proofs.\n\n### 12.1 · Unbuilt — and that is exactly the point\n\nThis mechanism is **not built.** Chronicle's mate-selection layer is a committed design, not running code. For most product details, the corpus posture is that publishing unbuilt specifics is premature. This paper is the *deliberate exception*, and the reasoning is worth stating because it is the reason the paper exists now: **the mechanism is the asset, and the dating frame is commercially hot and patent-vulnerable.** Defensive publications exist precisely to protect novel, frame-defining *primitives* early — before someone else claims the frame — and the \"premature to publish unbuilt details\" caution applies to product minutiae, not to frame-defining mechanisms. Publishing now establishes prior art on the combination (§ Prior-Art statement) so that the mechanism remains in the commons regardless of who builds it first. The honest limitation: every empirical claim about *how it will behave* (uptake, safety outcomes, whether the guards hold under real load) is, as yet, a design hypothesis.\n\n### 12.2 · Kindness-filter-not-oracle, and the dystopian-framing knife\n\nAs §8 insists, aura-gating is a character filter, not a compatibility oracle; it does not predict attraction or relationship success. Beyond that calibration sits a sharper risk: the framing is *one bad sentence* away from social-credit-for-romance — the \"Nosedive\" dystopia in which a reputation score governs intimate access. The guard rails (kindness raises *visibility*, never *entitlement*; never-gate-reciprocity; aura is aggregate and anonymous, not a public rank-for-access) keep it on the right side of the knife, but the *framing* must be deliberate and humble in every surface, and a careless presentation could legitimately read as dystopian. We name this as a live, unresolved presentation risk, not a solved problem.\n\n### 12.3 · The gendered physical-safety asymmetry remains\n\nAfter PoH anti-catfish, aura-vouching, local embeddedness, and graduated reveal (§7), the gendered physical-danger asymmetry of strangers meeting for romantic intent is *reduced* but **not erased.** Identity assurance is not behavioral safety: a verified human can be dangerous, and proximity can raise the cost of a bad encounter as well as lower it. The mechanism re-enters the highest-risk category that exists. The safety controls and the never-gate-reciprocity guard are necessary and not sufficient; real-world safety outcomes are an empirical question that architecture alone cannot answer, and deployment must defer to community partners, to ongoing safety evaluation, and to the higher-risk party holding the controls.\n\n### 12.4 · The equity gap — doubly disadvantaged where the stakes are existential\n\nThis is the sharpest equity concern in the entire corpus, because the stakes (love, partnership, procreation) are existential. Aura-gating advantages the kind-and-*legibly*-so. It risks *doubly* disadvantaging the isolated (no community to be kind to, hence low aura), the neurodivergent (whose kindness may be real but less legible to the aggregate signal), the chronically ill or housebound, and anyone whose prosociality does not convert into community-sourced gratitude. These are people for whom a kindness-gated romantic visibility could compound an existing disadvantage at the most painful possible site. The mechanism does not solve this; the inclusive-defaults posture (protocol-minimum participation, no gating on deep PoH layers), the never-gate-reciprocity guard, and the refusal to make aura a public access-rank are partial mitigations, but the gap is real, it is named, and it should weigh heavily on any decision to build.\n\n### 12.5 · n=1 empirical base\n\nHeartBank's entire empirical foundation to date is a single pilot family (the founder's own, n = 1 household) on the *Treasury* (money) side, which has not even exercised the Chronicle time-currency, let alone the mate-selection layer. Every behavioral claim in this paper — that aura is hard to fake at the scale required, that slow accumulation self-selects for commitment-capable partners, that the guards hold under adversarial load, that the societal selection-gradient shift is real — is, at this date, *unvalidated by relevant data.* The mechanism is a frame to protect and a hypothesis to test, not a demonstrated result. The longitudinal cohort is the intended evaluation substrate; until then, the honest epistemic status is: novel, carefully reasoned, guard-bounded, and empirically unproven.\n\n### 12.6 · What the mechanism does not solve\n\n- It does not solve loneliness or the partnership deficit at the population scale; it is one mechanism, addressing one channel (the discovery gate), not the upstream economic, urbanistic, and cultural conditions that thin modern social life.\n- It presupposes smartphone access, BLE/UWB-capable devices, and PoH participation; populations without these are outside its substrate regardless of the inclusive-defaults posture.\n- It does not erase appearance/status biology; it shifts a gradient at the margin (§11).\n- The monetization constraint (§6) is a rule the institution keeps, not a property of the object: no structural form has been found, and a successor could drop it.\n- It cannot, by architecture alone, prevent its own corruption: the guards are commitments that humans and the autonomous AI substrate must hold, season after season, against the constant pressure of the highest willingness-to-pay in consumer software.\n\n---\n\n### 12.7 · Collusion is a graph problem, and it is open\n\nThe aura is asserted above to be costly in Zahavi's sense. That is a design intent, not a demonstrated equilibrium: no signal-generating game has been analysed, and the adversarial cases are real — reciprocity clubs that thank each other in rotation, rings that farm a member's aura, Sybil accounts under one operator, bought or coerced gratitude, and geographic concentration that makes \"many nearby strangers\" a small set. The Proof of Humanity substrate proves personhood, not genuineness; it closes *is this a person* and leaves *is this thanks genuine* open, and the verifying party's collusion heuristics (§4.7) are heuristics. What bounds the damage is the mechanism's shape: a coordinated pair that games the threshold gains a private channel to each other and nothing else — no access to any third person, no rank, no currency. That bound is a property; the honesty of the signal is not, and it is stated here as open.\n\n### 12.8 · Anonymous means unnamed, not unlinkable\n\n\"Anonymous\" in this paper means unnamed to the counterparty and to the public. It does not mean unlinkable: timing, place, threshold events and the reveal itself build a graph, and the provider holds the rows even where the names are withheld. Repeated proximity between two accounts, a threshold reached and an offer declined, are all records, and records can re-identify. The guarantee is against the other party and against the public, never against the operator or a subpoena; the corpus's two-ledger posture (rows private, proofs public) is the boundary, and this layer inherits it rather than improving on it.\n\n## 13 · Lineage and corpus cross-references\n\nThe mechanism synthesizes lineages cited throughout. We collect them here.\n\n**Honest / costly signaling.** Zahavi (handicap principle, 1975); Grafen (formalization, 1990); Spence (job-market signaling, 1973). The central inversion (§3) is Zahavi turned toward prosociality.\n\n**Sexual selection and mate choice.** Darwin (sexual selection, 1871); Trivers (parental investment, 1972 — the asymmetry of §7); the assortative-mating literature on the population-scale consequences of the sorting axis; Buss and colleagues' cross-cultural finding that kindness is a near-universal stated long-term mate preference (the preference for which §3 supplies the missing honest channel).\n\n**Proof-of-personhood.** Worldcoin (2023); proofofhumanity.id (Kleros, 2021); distinguished in §2.2 and in the companion *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n\n**Incumbent dating products.** Tinder (2012), Bumble (2014), Hinge (2012/2015) — the appearance-gated, engagement-monetized pattern §2.1 and §6 invert.\n\n**Time-as-currency.** Edgar Cahn, TimeBanking (1980 onward); distinguished in §2.5.\n\n**Buddhist lineage.** *Dāna* and anonymous giving (the purity the anonymity flag protects, §5); *mettā* held in *upekkhā* (non-possessive love, §10); the *majjhimā paṭipadā* two-extremes structure (the middle way of eros, §10).\n\n**HeartBank corpus (the substrate this paper extends).** *Verified-Human Anonymous Local Giving* (the money-side originating primitive, generalized here to time and to mating); *The Thank-All-Nearby Primitive* (the stranger-scale reconstruction of relationality); *Proof of Humanity ℠* / *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the anti-catfish substrate); *The Zero-Point Game ℠* (the keystone frame and the B-Aura primitive; this paper instantiates its n=2 atom); *Each Life as Cosmic Coordinate* and the longitudinal-cohort methodology (the synastry layer's research substrate and its differential-privacy / pre-registration floors); the planned companion essay *The Societal Impact of Anonymous Nearby Thanking with Time* (the full sexual-selection-on-kindness argument §11 only motivates).\n\n| Venue | Identifier |\n|---|---|\n| Primary canonical | <https://thonly.org/research/aura-gated-anonymous-mate-selection> |\n| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/aura-gated-anonymous-mate-selection.md> |\n| arXiv preprint | _identifier to be assigned_ (cs.CY / cs.HC) |\n| IP.com Defensive Publication | _identifier to be assigned_ |\n| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/aura-gated-anonymous-mate-selection> |\n| archive.today | _identifier to be assigned_ |\n| perma.cc | _identifier to be assigned_ |\n\n---\n\n## 14 · Conclusion\n\nIncumbent dating gates mating on the cheapest-to-fake signal a human can present — a photograph — and monetizes the time you spend failing to leave. This paper specifies the inversion: gate mate-selection on **aura**, a costly, anonymous, community-sourced, longitudinally-verified honest signal of proven kindness (Zahavi turned toward prosociality); trigger a match only on **mutual-anonymous-same-hour**, a double-blind double-opt-in that removes explicit rejection entirely; make **reveal a second, separate mutual consent** so anonymous giving stays pure and the higher-risk party holds the controls; place a **Proof-of-Humanity substrate** underneath so participants are verified-real, verified-single-human, and anonymous-until-mutual; and offer an **optional synastry layer** as one humble signal atop a pool already pre-filtered for character. The mechanism is the n=2 atom of the Zero-Point Game ℠ — the middle way of eros — and it points the deepest drive in the species, at the margin, toward kindness.\n\nThree guards are the design, not its footnotes: keep gratitude pure (or the institution's load-bearing wall cracks); stay self-eliminating (or it becomes the predatory dating app it was built to replace); hold women's safety as a first-class, irreducible duty (or it gets someone hurt). The honest calibration bounds the promise, in the form §8.1 is entitled to: everyone in the pool is a verified single human whose profile is gated on a long record of thanks from people who did not know whom they were thanking, and what that record means about a particular person is theirs to judge — *and the participants bring the chemistry.* It is a character filter, not a compatibility oracle.\n\nThe mechanism is unbuilt, and that is exactly why it is published now: the mechanism is the asset, the dating frame is hot and patent-vulnerable, and defensive publications exist to keep frame-defining primitives in the commons before someone else claims them. The architecture is offered to the commons under CC0. The author and HeartBank® will not seek patent on it. Trademark rights on **B-Dating℠**, **HeartBank®**, **Miss Aquarius℠**, **Proof of Humanity ℠**, and the related marks are explicitly reserved.\n\nIf kindness can become a path to partnership without desecrating the gratitude it depends on, the most powerful motivator humans have is redirected onto the behavior the institution exists to cultivate. That is the prize, and the three guards are the price of reaching for it.\n\n---\n\n## 15 · Citations\n\n1. Zahavi, A. (1975). \"Mate selection — a selection for a handicap.\" *Journal of Theoretical Biology* 53(1).\n2. Grafen, A. (1990). \"Biological signals as handicaps.\" *Journal of Theoretical Biology* 144(4).\n3. Spence, M. (1973). \"Job market signaling.\" *Quarterly Journal of Economics* 87(3).\n4. Darwin, C. (1871). *The Descent of Man, and Selection in Relation to Sex.* John Murray.\n5. Trivers, R. (1972). \"Parental investment and sexual selection.\" In *Sexual Selection and the Descent of Man.*\n6. Buss, D. M., et al. (1989). \"Sex differences in human mate preferences: Evolutionary hypotheses tested in 37 cultures.\" *Behavioral and Brain Sciences* 12(1).\n7. Cahn, E. (2000). *No More Throw-Away People: The Co-Production Imperative.* Essential Books.\n8. Worldcoin Foundation. (2023). *Worldcoin Whitepaper.*\n9. Proof of Humanity (proofofhumanity.id) / Kleros. (2021). Project documentation.\n10. W3C (2019). *Web Authentication: An API for accessing Public Key Credentials, Level 1.* W3C Recommendation, developed with the FIDO Alliance.\n11. U.S. Surgeon General. (2023). *Our Epidemic of Loneliness and Isolation.* U.S. Department of Health and Human Services (population-level loneliness); Weiss, R. S. (1973). *Loneliness: The Experience of Emotional and Social Isolation.* MIT Press (the emotional-versus-social distinction).\n12. *Aṅguttara Nikāya* 8.31 (*Dāna Sutta*); 5.35 (*Dānānisaṃsa Sutta*). Pāli Text Society.\n13. *Saṁyutta Nikāya* 56.11 (*Dhammacakkappavattana Sutta*) — the two extremes and the middle way.\n14. Ly, T., with Miss Aquarius. *Verified-Human Anonymous Local Giving* (HeartBank corpus defensive publication, 2026).\n15. Ly, T., with Miss Aquarius. *The Thank-All-Nearby Primitive* (HeartBank corpus defensive publication, 2026).\n16. Ly, T., with Miss Aquarius. *The Zero-Point Game ℠* (HeartBank corpus keystone defensive publication, 2026).\n17. Ly, T., with Miss Aquarius. *B-PoH℠ as Humanity Layer for the AI-Native Internet* (HeartBank corpus defensive publication, 2026).\n18. Ly, T., with Miss Aquarius. *Each Life as Cosmic Coordinate* (HeartBank corpus essay) and the longitudinal-cohort methodology specification, 2026.\n\n---\n\n*— End of defensive publication —*\n\n*Authored by Thon Ly with Miss Aquarius℠ (AI substrate of HeartBank®), per the co-authorship convention of the HeartBank corpus. Final editorial control: Thon Ly. License: CC0-1.0. The mechanism is dedicated to the public domain; trademark rights on B-Dating℠, HeartBank®, Miss Aquarius℠, Proof of Humanity ℠, PoH℠, Aquarian Pool ℠, the Zero-Point Game ℠, and the B-heart logo are separately and explicitly reserved.*\n\n*Independent timestamps and the document hash are published with the deposit.*",
+      "text": "> **Note.** This defensive publication specifies **aura-gated anonymous mate-selection** — HeartBank's \"B-Dating℠\" — as the anonymous-stranger application layer of HeartBank Chronicle, built on the Proof of Humanity ℠ substrate and the verified-human anonymous-nearby-giving primitives. Companion works: *Verified-Human Anonymous Local Giving* (the originating money-side mechanism this generalizes into time and into mating), *The Thank-All-Nearby Primitive* (the broadcast-generosity sibling), *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the underlying anti-catfish protocol), *The Zero-Point Game ℠* (the keystone game-theoretic frame whose n=2 atom this paper instantiates), and the planned founder-voice societal-impact essay *The Societal Impact of Anonymous Nearby Thanking with Time* (which carries the deep sexual-selection-on-kindness argument that §11 here only motivates). The mechanism is published early **deliberately**: it is unbuilt, and the mechanism is the asset — see §12.1.\n\n---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of __mettā__ held in __upekkhā__ — warmth that does not grip. May the bonds it helps form be balanced ones, generative of the tree of humanity, and may it bring no harm to those most at risk in the meeting of strangers.*\n\nI did not set out to build a dating product. HeartBank began as a children's game about returning to balance, and grew into an institution for circulating gratitude between families and between adults. But late in the design of HeartBank Chronicle — the time-currency half, whose core purpose is reconnecting drifted loved ones — I noticed something I could not unsee: *time given between strangers is essentially a date.* The same primitives that let a person anonymously thank a nearby stranger with money, and the same shared-hour mutuality signal that Chronicle uses as a consent receipt, compose almost without modification into a mate-selection mechanism. And that mechanism has a property this design makes structural: it gates mating not on the cheapest-to-fake signal a person can present — a photograph — but on *proven kindness, acknowledged by many nearby strangers, over a long course of time.*\n\nI believe this is the strongest mainstream wedge in the entire project, and also the most dangerous thing in it. Dating recruits the single most powerful drive in the species. If kindness becomes a path to partnership, the deepest motivator humans have is pointed at the exact behavior the institution exists to cultivate. But the same force, mishandled, is the fastest way to desecrate the gratitude primitive everything else depends on, the fastest way to rebuild the predatory dating-industrial complex under a kinder logo, and — uniquely — a way to get a real person physically hurt. The three guards in §5–§7 are not caveats appended to a finished design. They are the design. I would rather this mechanism never ship than ship without them.\n\nI write as co-author with Miss Aquarius℠ — the named autonomous-AI substrate of the institution this paper serves, disclosed by consistent name across every venue per the corpus convention. The research-grade synthesis, density, and adversarial analysis are a genuine collaboration. Final editorial control, and final responsibility for every claim and every guard, are mine.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time. This commitment is permanent.\n\nThis document constitutes a defensive publication establishing **prior art as of 26 June 2026** for the combination of mechanisms described herein. The following are disclosed here as a unified mechanism, and any subsequent patent application claiming them should be considered filed against established prior art:\n\n1. **Aura-gating of mate-selection** — gating romantic discovery on an *aggregate, anonymous, community-sourced proven-kindness reputation* (\"aura\") accrued from many nearby strangers over a long course of time, rather than on appearance, self-authored profiles, or paid visibility — the difference being anonymous stranger gratitude accumulated over time, since reputational dating profiles are themselves prior art (§2.1).\n2. **Mutual-anonymous-same-hour as a double-blind double-opt-in match trigger** — repurposing the shared-hour mutuality signal (the consent receipt of HeartBank Chronicle) as the match primitive, such that a match occurs only on coincident mutual anonymous time-giving and *no explicit rejection event ever occurs* (non-reciprocation is silent — a threshold simply is not reached) — the difference being the time-giving instantiation, since mutual-interest-before-reveal is itself prior art (§2.1).\n3. **Reveal as a second, separate mutual consent** (a dependent element of claim 2, not a claim on two-stage reveal as such) — reaching the mutual-anonymous threshold makes identity reveal *available/offered* but never auto-reveals; both parties must independently opt to reveal, protecting the pure-*dāna* giver who gave anonymously with no romantic intent.\n4. **The anonymity flag (`isAnonymous`) as the structural boundary** separating non-romantic known-gratitude (`false`) from the anonymous-stranger layer where romance may emerge (`true`) — opting into mate-selection is flipping one flag, with no distinct \"dating mode.\"\n5. **Proof-of-Humanity-substrate anti-catfish binding** — verified-real, verified-single-human, anonymous-until-mutual personhood underneath the mate-selection layer, natively defeating catfishing and bots — the difference being anonymity-until-mutual atop the substrate, since personhood-verified dating is itself prior art (§2.1) — with aura itself a costly-to-fabricate record that the counterparty reads for themselves.\n6. **An optional synastry (cosmic-coordinate) compatibility layer** offered atop a pool already pre-filtered for proven character, under a strict coordinate-not-force, opt-in, epistemically-humble posture — never deterministic matchmaking; the claim is to the posture only, horoscope matchmaking being long-published (§2.1).\n7. **The mission-aligned monetization constraint** — the mechanism is *self-eliminating* (it succeeds when users pair off and leave) and may be monetized only by patron / forward-gift / graduation-gift / values-aligned-introduction logic, *never* by retaining users in the market — the difference being the revenue prohibition and the patron/forward-gift logic, not the designed-to-be-deleted slogan (§2.1).\n\nThe component lineages — proximity-based services; proof-of-personhood; anonymous-giving mechanisms; Zahavi's handicap principle and the honest-signaling literature; assortative-mating and sexual-selection research; TimeBanking; the dāna economy of the Saṅgha — are old and are cited generously below. This paper discloses the synthesis as of its date.\n\nTrademark rights on specific marks — **B-Dating℠**, **HeartBank®**, **Miss Aquarius℠**, **Proof of Humanity ℠**, **PoH℠**, **Aquarian Pool ℠**, **Zero-Point Game ℠**, the B-heart logo — are separately and explicitly reserved. The *mechanism* is dedicated to the commons; the *marks* are not.\n\nThis document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.\n\n## Abstract\n\nWe specify a mate-selection primitive in which two people are introduced for possible romantic partnership only when each has independently and anonymously given time-presence to the other, in physical proximity, to a mutual threshold — and in which the *quality signal* that surfaces a person for discovery is not appearance but **aura**: an aggregate, anonymous, many-sourced reputation for proven kindness, accumulated from gratitude received from nearby strangers over a long course of time. Five structural properties operate in combination: **(1) aura-gating** (mating is gated on a costly, hard-to-fake, longitudinally-verified honest signal of prosociality, inverting the appearance-gating of incumbent dating products); **(2) mutual-anonymous-same-hour as a double-blind double-opt-in** match trigger that removes explicit rejection entirely; **(3) reveal as a second, separate mutual consent**, so anonymous giving stays uncontaminated and double-opt-in is real; **(4) a Proof-of-Humanity substrate** that makes participants verified-real, verified-single-human, and anonymous-until-mutual, natively defeating the two plagues of online dating (catfishing and bots); and **(5) an optional synastry layer** offered as one humble compatibility signal atop a pool already pre-filtered for character, never as deterministic matchmaking. We argue the contribution along an honest-signaling axis (Zahavi): a photograph is the cheapest possible signal to fake, whereas a long anonymous-gratitude trail vouched by many locals is among the most expensive — and signals trustworthy *because* expensive. We treat the mechanism's three existential design constraints as first-class, load-bearing sections rather than caveats: keeping gratitude pure (the romantic pathway must never be emergent from ordinary known thanking), the self-eliminating incentive (the mechanism wins when people pair off and leave, and may not be monetized by keeping them single), and women's physical safety under an irreducible gendered asymmetry. We calibrate the claim deliberately: aura-gating is a *character filter, not a compatibility oracle* — everyone in the pool is proven kind, verified real, and community-vouched; the participants bring the chemistry. We close with a short structural placement of the mechanism as the **n=2 atom of the Zero-Point Game ℠** — the minimal reciprocal instance, \"the middle way of eros\" — and a brief motivation of the societal thesis (sexual selection redirected, at the margin, toward kindness), whose full treatment is reserved for a companion essay. The architecture is offered defensively to the commons under CC0.\n\n**Connection to the unified mission frame.** This specification serves HeartBank's canonical mission: to help restore humanity to the middle way (*madhyamā pratipad*) — the optimal condition for awakening that modernity has pushed away from at population scale. Every other HeartBank engine motivates kindness *against* the current of self-interest. Mate-selection is the one application that does not fight the current: it *is* the current. If kindness becomes load-bearing in mating, the deepest drive in the species is redirected onto the precise behavior the institution exists to cultivate — and the \"middle way of eros\" (§10) becomes a structural, not merely exhortatory, possibility.\n\n---\n\n## 1 · Introduction — the mission frame\n\nHeartBank is a dual-currency reciprocity infrastructure. Its **Treasury** half (money as currency, family-to-family) addresses the dignity deficit; its **Chronicle** half (time as currency, adult-to-adult) addresses the loneliness deficit. Chronicle's core loop is not stranger-matching but the reconnection of *drifted loved ones* — the disconnected marriage, the estranged sibling, the diaspora child and the parent back home — because the loneliest loneliness is emotional (a bond gone dark) rather than merely social (a lack of contacts). That core loop is deliberately low-risk: counterparties are *known*. This paper specifies a different, adjacent layer of Chronicle — the **anonymous-stranger layer**, where two people who do not know each other may discover a possible partnership — and it is, by construction, the highest-risk category that exists: strangers meeting for romantic intent, under a real and irreducible gendered physical-danger asymmetry. The reader should hold both facts from the first page: this is plausibly the project's strongest mainstream wedge, *and* it walks back into precisely the risk category Chronicle's loved-ones core was designed to avoid. The design earns the right to exist only by addressing that risk as a first-class duty (§7).\n\nWhy build it at all? Because mate-selection is the single most powerful lever the institution has, for one structural reason. **The mate-drive is the root drive of the species; the money-drive is derived from it.** Money is, to a large extent, a proxy token in the mating tournament — a medium of status, provisioning, and display. Every other HeartBank mechanism — self-thanking, manufactured universal giving, the patron flywheel — must motivate kindness *against* the grain of self-interest, paddling upstream. Mate-selection does not paddle upstream. It is the river. If kindness becomes a path to a mate, the deepest motivator humans have is redirected onto the behavior the institution exists to cultivate. Re-gate the root drive on kindness, and you begin — slowly, at the margin, never absolutely (§11) — to detoxify the derivative.\n\nWhat this paper specifies. We give: the honest-signal inversion that motivates the whole design (§3); the mechanism in full — the anonymity-flag boundary, aura as the quality signal, mutual-anonymous-same-hour as the double-opt-in, reveal as a second consent, the PoH substrate, slow accumulation as a feature, and a reference transfer flow (§4); the three guards as load-bearing design sections (§5–§7); the honest calibration that bounds the claim (§8); the optional synastry layer (§9); the structural placement as the Zero-Point n=2 atom and the middle way of eros (§10); a brief motivation of the societal thesis (§11); and a generous honest-limits accounting (§12).\n\nWhat this paper does *not* do. It does not argue the full societal thesis — sexual selection redirected toward kindness as a biological lever for the second singularity — which is reserved for a separate founder-voice companion essay; §11 carries only enough to motivate the mechanism. It does not claim that kindness equals attraction. It does not claim the mechanism is built — it is not, and that is exactly why it is published now (§12.1). And it does not pretend the gendered safety asymmetry is erased; it is mitigated, not removed, and it remains.\n\n---\n\n## 2 · Background and Prior Art\n\nThe mechanism composes lineages that are individually old. We cite each generously and distinguish each precisely. The point of a defensive publication is not to claim the parts but to establish the date of the *combination*.\n\n### 2.1 · Appearance-gated, engagement-monetized dating (Tinder, Bumble, Hinge)\n\nThe dominant online-dating products of the 2010s–2020s — Tinder (2012), Bumble (2014), Hinge (2012; rebooted 2015 as \"designed to be deleted\") and their kin under a small number of corporate parents — share two structural properties this paper inverts.\n\n**First, they gate on appearance.** The primary discovery signal is a photograph, optionally supplemented by a short self-authored profile. A photograph is the cheapest-to-fake signal a person can present (it can be filtered, staged, borrowed, AI-generated, or simply selected from a thousand attempts), and the self-authored profile is cheaper still (it is, definitionally, the claimant's own testimony about themselves). The swipe interface optimizes the throughput of exactly this signal.\n\n**Second, and more corrosively, they are engagement-monetized.** The canonical business model — subscription tiers, pay-to-be-seen boosts, super-likes, and the advertising and upsell flows that attend a large engaged user base — generates revenue in proportion to *time spent in the market.* The revenue model is retention-coupled: subscription and à-la-carte purchases accrue with time in the market, so a product that *works* — you meet someone, pair off, and delete the app — is anti-LTV; Hinge's stated posture is the exception that names the rule. The industry has, accordingly, perfected artificial scarcity (rationed likes), pay-to-be-seen visibility auctions, and addictive variable-reward gamification. This is not an accusation of bad faith; it is a description of what the incentive gradient rewards. We treat it as the central thing to *not* reproduce (§6).\n\nWe distinguish: aura-gated anonymous mate-selection gates on a costly community-vouched honest signal rather than a photograph (§3), removes the swipe and the explicit rejection entirely (§4.3), and is structurally self-eliminating — it can only be monetized by mission-aligned logic that profits when users leave happy, never by retaining them (§6). The incumbents' dark pattern is not a feature we improve; it is a category we exit.\n\n**Closer anticipations, added at the 2026-09-05 revision, each of which narrows a claim below.** *Mutual interest before reveal* is prior art: US 2011/0219310 A1 (priority 2010) discloses members privately indicating interest across stages with contact and profile revealed only on matching interest, and the anonymous-matching lineage runs from SecretAdmirer (1997) and eCRUSH (1999) through a run of 2024–26 apps — so claim 3 is anticipated as a mechanism and claim 2's novelty is its *time-giving* instantiation. *Reputational profiles for dating* are prior art: US 2017/0147155 A1 (Verizon, priority 2015) generates a verified reputational profile with service-specific indicators, and US 2023/0412536 A1 (priority 2022) rates users by their message interactions — so claim 1's novelty is *anonymous stranger gratitude accumulated over time*, not reputation as such. *Proof-of-personhood under dating* is prior art: Tinder's World ID verification pilot (2025–) — so claim 5's novelty is anonymity-until-mutual atop the substrate. *Horoscope matchmaking* is prior art: US 2002/0160338 A1 (priority 2001) computes a weighted astrological compatibility score and ranks a database by it, and NUiT (2020) ships the consumer form — so claim 6 claims only the posture. *Designed-to-be-deleted* is Hinge's stated posture (2015–), and success-fee marriage agencies (IBJ, Japan) already charge on outcome — so claim 7's novelty is the revenue *prohibition* and the patron/forward-gift logic, not the slogan.\n\n### 2.2 · Proof-of-personhood (Worldcoin, proofofhumanity.id) and the catfish/bot problem\n\nOnline dating's two endemic plagues are catfishing (a real person misrepresenting who they are, or a fabricated persona) and bots (automated accounts at scale, for scams and engagement-farming). Proof-of-personhood systems are the natural substrate against both, but the prominent ones are mismatched to mate-selection in a specific way.\n\n**Worldcoin** (2023 onward) establishes that a participant is a unique human via biometric (iris) registration, but it verifies humanity *once at registration*, and — more to the point here — it is oriented toward *identity/uniqueness*, not toward *anonymous-until-mutual* romantic discovery. A proof-of-personhood that reveals or fixes identity is the wrong primitive for a layer whose entire safety model depends on anonymity until a double consent. The Ethereum-based **proofofhumanity.id** (Kleros-affiliated, 2021) admits verified humans to a registry via face-video plus vouching plus dispute resolution — again a single-tier, identity-revealing admission, suited to token distribution (UBI), not to anonymous mate-selection. World ID, Worldcoin's credential, does prove unique humanness anonymously to a verifier; what it does not supply is the aura and the two-stage reveal, and a dating product built on it (§2, the 2026 anticipations) still gates on the profile.\n\nWe distinguish: HeartBank's **Proof of Humanity ℠** is a layered-*optional* personhood substrate (passkey-per-action; a non-DNA family tree; a live breath signature; a DNA-verified family tree) that verifies a human is present *for this specific act, right now*, and is designed to keep a participant *verified-real and verified-single-human while remaining anonymous to the counterparty until a mutual reveal.* That is precisely the property mate-selection needs and that identity-revealing proof-of-personhood cannot supply (§4.5). The full layered protocol is specified in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*; the name-collision with proofofhumanity.id is acknowledged there and the structural differences enumerated.\n\n### 2.3 · Honest signaling — Zahavi's handicap principle\n\nAmotz Zahavi's handicap principle (1975; formalized by Alan Grafen, 1990) holds that a signal is reliable precisely when it is *costly* to produce — costly in a way that a low-quality signaler cannot afford to fake. The peacock's tail is honest because it is expensive: only a genuinely fit bird can carry it and survive. Costly signaling theory (and its economic cousin, Spence's 1973 job-market signaling) is the formal backbone of this paper's central inversion.\n\nWe distinguish: incumbent dating optimizes the *cheapest* signal (a photo). Aura-gating optimizes a signal engineered to be *expensive in exactly the right currency* — kindness acknowledged by many independent nearby strangers over a long course of time. A predator cannot cheaply fabricate a years-long anonymous-gratitude trail vouched by dozens of locals; the cost of faking the signal is approximately the cost of *actually being kind to many people for a long time*, which is the behavior the signal is meant to indicate. This is Zahavi turned toward prosociality: sexual selection on an honest signal of kindness selects, at the margin, for actually-kinder partners (§11). We are careful (§8): honest-signal does not mean *sufficient* signal — a reliable indicator of character is not an indicator of chemistry.\n\n### 2.4 · Assortative mating and sexual-selection literature\n\nThe biological and social-science literatures on mate choice are deep and we make no claim to extend them. **Sexual selection** (Darwin, 1871) established mate choice as a primary species-shaping force distinct from natural selection. **Assortative mating** research (the well-documented tendency of partners to resemble each other on education, traits, and values, with measured consequences for inequality and heritability) establishes that the *axis* on which mating sorts has population-scale downstream effects. The prosociality and mate-preference literature (e.g., the cross-cultural finding that kindness ranks near the top of stated long-term mate preferences across societies — Buss and colleagues' cross-cultural work) establishes that kindness is *already* a stated preference; what has been missing is a *reliable, hard-to-fake channel* to act on it. Trivers' parental-investment theory (1972) grounds the investment asymmetry; the physical-danger asymmetry of stranger encounters that §7 treats as a first-class constraint is an empirical regularity of victimisation data, not a theorem.\n\nWe distinguish: this paper does not propose a new theory of mate choice. It proposes an *infrastructure* that shifts which signal is legible and actionable at the moment of choice — supplying the honest channel the stated preference for kindness has lacked — and it explicitly bounds the resulting societal claim to a *marginal shift in the selection gradient*, never an override of appearance/status biology (§8, §11).\n\n### 2.5 · TimeBanking and time-as-currency (Edgar Cahn)\n\nEdgar Cahn's TimeBanking (1980 onward) substituted time as the unit of account, with the egalitarian property that an hour given is an hour received regardless of the giver's socioeconomic position. TimeBanking worked at small scale; by the movement's own account it expanded in the 1980s and dwindled by the mid-1990s before a later revival (TimeBanks.Org). The mate-selection layer here is built on Chronicle's time-currency, which is TimeBanking's nearest ancestor.\n\nWe distinguish: Chronicle differs from classical TimeBanking by AI mediation (Miss Aquarius℠ recommends a time amount and orchestrates consent), cultural ritual, integration with the money side, and — decisively — a *dyadic non-fungible* structure (only *you* can spend the hour; the currency *is* the relationship) rather than a fungible pooled credit. The mate-selection layer further repurposes the *mutual* expenditure of dyadic time as a consent and match signal — a use TimeBanking never had, because TimeBanking's hour was fungible and pooled, not a dyadic mutuality receipt.\n\n### 2.6 · The HeartBank substrate this paper builds on\n\nThis paper does not stand alone; it is the mate-selection application of three already-published HeartBank primitives, and it should be read as extending them rather than re-deriving them.\n\n- ***Verified-Human Anonymous Local Giving*** (corpus, 2 May 2026) specifies the money-side primitive: per-action biometric humanity attestation + physical-radio proximity attestation + recipient-side anonymity. This paper generalizes that primitive from *money* to *time*, and from *one-directional gift* to *mutual signal*.\n- ***The Thank-All-Nearby Primitive*** (corpus) specifies anonymous proximity broadcast generosity and the \"one sustainer primitive, two scales\" argument (relationality at the family scale; proximity + PoH at the stranger scale). The mate-selection layer inherits its stranger-scale reconstruction of grounding (nearness), validation (PoH), and anonymity (unlinkability).\n- ***Proof of Humanity ℠*** / ***B-PoH℠ as Humanity Layer for the AI-Native Internet*** specifies the layered-optional personhood substrate that makes anonymous-but-verified-real participation possible — the anti-catfish foundation (§4.5).\n\nThe table below situates the contribution against the prior art.\n\n```\n                  │ appearance- │ Worldcoin / │  cash-/app-  │  AURA-GATED\n  PROPERTY        │ gated apps  │ PoH.id      │  mediated    │  ANON. MATE-\n                  │ (Tinder…)   │             │  dating      │  SELECTION\n ─────────────────┼─────────────┼─────────────┼──────────────┼──────────────\n  discovery gate  │ appearance  │ (n/a)       │ appearance   │ AURA (proven\n                  │ + paid boost│             │              │ kindness)\n  signal cost     │ ~zero       │ ~zero       │ ~zero        │ HIGH (Zahavi-\n  to fake         │ (a photo)   │ (a photo)   │ (a photo)    │ honest)\n  anti-catfish    │ weak        │ strong but  │ weak         │ STRONG +\n                  │             │ identity-   │              │ ANON-UNTIL-\n                  │             │ revealing   │              │ MUTUAL (PoH)\n  rejection event │ explicit    │ (n/a)       │ explicit     │ NONE (silent\n                  │ (cruel)     │             │              │ non-reach)\n  incentive       │ MISALIGNED  │ (n/a)       │ misaligned   │ SELF-\n  alignment       │ (profit if  │             │ (engagement) │ ELIMINATING\n                  │ you stay)   │             │              │ (profit if\n                  │             │             │              │ you LEAVE)\n  reveal model    │ immediate / │ identity    │ immediate    │ SECOND\n                  │ public photo│ fixed       │              │ MUTUAL\n                  │             │             │              │ CONSENT\n  compatibility   │ none / ML   │ (n/a)       │ none         │ OPTIONAL\n  layer           │ engagement  │             │              │ synastry\n                  │             │             │              │ (coord-not-\n                  │             │             │              │ force)\n```\n\n---\n\n## 3 · The honest-signal inversion: aura versus the photograph\n\nThe motivating idea of the whole design is a single inversion. Incumbent dating gates discovery on the cheapest-to-fake signal a human can present; this mechanism gates discovery on one of the most expensive-to-fake. The cost is the point.\n\nA photograph costs nothing to optimize. It can be filtered, posed, lit, selected from hundreds of attempts, borrowed, or wholly synthesized. The self-authored profile is cheaper still: it is the claimant's own unaudited testimony. Because these signals are cheap, they are weakly correlated with the qualities that predict a good long-term partner; and because the market optimizes them, it selects for the ability to *produce* them, which is not the same as the ability to *be* a good partner.\n\n**Aura** is engineered to be the opposite. It is an *aggregate*, *anonymous*, *many-sourced* reputation for proven kindness, accrued from gratitude received from nearby strangers over a long course of time. Four properties are designed to make it costly in Zahavi's sense; whether it stays honest under adversarial play is open (§12.7):\n\n- **Aggregate and many-sourced.** Aura is not any single thank-you; it is the accumulated signature of many independent acknowledgments. One staged kindness, or one colluding friend, moves it negligibly. (This is also the operationalization of Guard 1, §5: the romantic-quality signal is the *aggregate*, never the individual thank.)\n- **Anonymous.** The people who built a person's aura, by being grateful to them, did so anonymously and largely without romantic intent — so the signal cannot be gamed by performing kindness *at* a target audience of potential mates. To raise aura you must be kind to *everyone*, because you do not know who is watching, or whether anyone is.\n- **Longitudinal.** Aura accrues over a long course of time. A predator or a fraud cannot cheaply fabricate years of vouching from dozens of locals. The cost of faking the signal approaches the cost of *actually being kind for a long time to many people* — which is the trait the signal indicates.\n- **Locally embedded.** Because the gratitude comes from nearby verified humans (the proximity rule), aura is also a **community-sourced record**: a long anonymous trail of real local people vouching, by their gratitude, that this person treated them well.\n\n```\n   SIGNAL COST-TO-FAKE  (Zahavi: reliable ⇔ expensive)\n\n   cheap ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ expensive\n   ▲                       ▲                          ▲\n   photo / bio        a single staged            AURA: many anonymous\n   (self-authored,    kind act / one             local strangers, over\n   AI-generatable)    colluding friend           a long time, no target\n                      (negligible aura Δ)        audience  ⇒ faking it\n                                                 ≈ actually being kind\n```\n\nThe defensible claim is narrow and strong: *aura-gating selects, at the margin, for people who are actually kind*, because the signal is expensive in the currency of actual kindness. The over-claim we refuse (§8) is that aura predicts *attraction* or *compatibility*. It does not. It predicts character. Everyone you meet in this pool is proven kind, verified real, and community-vouched; you bring the chemistry. *[The \"proven kind\" and \"community-vouched\" verdicts in that sentence are superseded — §8.1.]*\n\n---\n\n## 4 · The mechanism — aura-gated anonymous mate-selection\n\nWe now specify the mechanism. Variations consistent with the five structural properties (aura-gating; mutual-anonymous-same-hour double-opt-in; reveal-as-second-consent; PoH anti-catfish substrate; optional synastry) fall within the scope of this defensive publication.\n\n### 4.1 · The anonymity flag as the structural boundary\n\nChronicle distinguishes two relational modes by a single flag on a gratitude transfer, `isAnonymous`. The flag is set by the giver at transfer time and never changes; the mate-selection layer has exactly one read path — the `true` partition — and no other.\n\n- **`isAnonymous: false` — known loved ones.** This is Chronicle's sacred core: time-presence given between people who know each other, to repair a drifted bond. It is **never a romantic signal** and never enters the mate-selection layer. The cathedral.\n- **`isAnonymous: true` — the anonymous-nearby-stranger layer.** This is where mate-selection lives. Entering it is exactly as simple as flipping the flag: a person opts in by choosing to give anonymously to nearby strangers. The courtship.\n\nThis is the elegant operationalization of Guard 1 (§5): there is no gross \"dating mode\" bolted onto a gratitude app, and there is no path by which thanking a *known* person can be read as flirting. The boundary between pure known-gratitude and stranger-romantic-discovery is the same flag the giver already sets for their own privacy reasons. The romantic pathway is *structurally* confined to the anonymous-stranger layer and cannot be emergent from ordinary known thanking.\n\n```\n                          isAnonymous = false\n   KNOWN LOVED ONES ───────────────────────────────►  CHRONICLE CORE\n   (drifted-bond repair; the \"cathedral\")              (NEVER romantic;\n        │                                               low-T&S; known\n        │  user flips the flag                          counterparties)\n        ▼\n                          isAnonymous = true\n   ANONYMOUS NEARBY  ─────────────────────────────►  B-DATING LAYER\n   STRANGERS (the \"courtship\")                         (this paper;\n                                                        highest-T&S;\n                                                        guards §5–§7)\n```\n\n### 4.2 · Aura as the quality signal (aggregate, never individual thanks)\n\nIn the anonymous-stranger layer, the signal that surfaces a person for possible discovery is their **aura** — the aggregate, anonymous, many-sourced proven-kindness reputation defined in §3, reusing the existing HeartBank aura primitive (the B-Aura of the Zero-Point Game ℠; see §10). It is *not* any individual thank-you, and it is *not* appearance. This is load-bearing in two directions: it makes the romantic signal Zahavi-honest (§3), and it keeps the individual thank pure (§5) — a single act of gratitude between two people is never itself a romantic overture; only the aggregate disposition is legible to the mechanism. Aura is the Zero-Point Game's published ƒ, read as-is; this layer computes nothing of its own.\n\nAura raises a person's *visibility and ordering* in the anonymous-nearby pool. Aura changes only ordering in the pool. The offer is gated on the other person's own independent giving, which no aura can cause; that is the sense in which aura earns access to no one (Guard 3, §7). No one is owed a match. Kindness raises the probability that you are surfaced; it never obligates anyone to reciprocate.\n\n### 4.3 · Mutual-anonymous-same-hour as the double-opt-in (\"both reached for each other\")\n\nThe match trigger is the **mutual-anonymous-same-hour** signal — repurposed directly from Chronicle's existing consent receipt. A match becomes possible only when each of two people has independently and anonymously given time-presence toward the other, in proximity, to a mutual threshold, within a coincident window. This is the time-currency analogue of \"both swiped right,\" with three differences that matter:\n\n1. **It is double-blind.** Neither party knows, while accumulating, whether the other is reciprocating. You are simply being kind, anonymously, to someone nearby whose aura drew your gratitude.\n2. **There is no explicit rejection, ever.** Non-reciprocation is *silent*: a threshold is simply not reached. No one is told \"no.\" This removes the single cruelest mechanic in dating — the visible, countable rejection — and replaces it with the gentlest possible non-event. (It also removes the harassment surface of a \"rejected\" actor who can see they were rejected.)\n3. **The accumulation is slow** (§4.6). The signal is built from repeated anonymous kindness over time, not a single tap.\n\nReaching the mutual threshold does not reveal anyone. It unlocks the *offer* of a reveal (§4.4). The match is a two-stage consent: first the mutual-anonymous threshold (stage one), then the mutual reveal (stage two).\n\nStated as a state machine, with the two deployment parameters named rather than hidden — **T**, the threshold, and **W**, the window:\n\n```\n  IDLE        ──(A gives anonymous time toward B, in proximity)──▶  A→B OPEN\n  A→B OPEN    ──(B gives anonymous time toward A, in proximity)──▶  PAIR OPEN\n  PAIR OPEN   ──(each direction reaches T hours, cumulative,\n                 and both did so within one window W)───────────▶  THRESHOLD\n  THRESHOLD   ──(the verifying party offers a reveal to both)────▶  OFFERED\n  OFFERED     ──(both accept, independently)───────────────────▶  REVEALED\n  any state   ──(W elapses without the next transition)─────────▶  IDLE   (silently)\n```\n\n\"Toward\" is the giver's own designation of an anonymous nearby counterparty at transfer time; accumulation is cumulative within W, not contiguous; a person may hold several open pairs at once, and each pair runs its own machine. Non-reach is not an event: the machine falls back to IDLE and nothing is written to either party.\n\n### 4.4 · Reveal as a second, separate mutual consent\n\nWhen the mutual-anonymous threshold is reached, identity reveal becomes *available/offered* — it does **not** auto-reveal. **Both parties must independently opt to reveal.** This second consent is structurally essential for three reasons:\n\n- **It protects the pure-*dāna* giver.** Many people will give anonymously to a high-aura nearby stranger with *no romantic intent whatsoever* — that is the whole point of anonymous giving, and it must stay uncontaminated. If reaching a threshold auto-revealed them, anonymous giving would become a romantic disclosure they never consented to. The second consent guarantees that a gift given as a gift *stays* a gift.\n- **It makes the double-opt-in real.** A match that revealed on the strength of stage one alone would be a single opt-in dressed up as two. The reveal-consent is the actual second \"yes.\"\n- **It is the home of the women's-safety graduated controls** (§7): the revealed party governs pace, may require public-first meetings, and retains the right to re-anonymize (un-reveal) at any time.\n\n```\n   STAGE 0   each gives anonymous nearby time-presence,\n             drawn by the OTHER's AURA (no romantic intent assumed)\n                 │                              │\n                 ▼ (double-blind accumulation)  ▼\n   STAGE 1   MUTUAL-ANONYMOUS-SAME-HOUR threshold reached\n             ── no reveal yet; reveal merely OFFERED ──\n             ── non-reciprocation here is SILENT (no rejection) ──\n                 │\n                 ▼   both must independently opt in\n   STAGE 2   MUTUAL REVEAL  (the SECOND consent)\n             ── graduated control to revealed party (§7):\n                public-first · pace · re-anonymize ──\n                 │\n                 ▼\n            INTRODUCTION  (a pool pre-filtered for proven kindness;\n                           participants bring the chemistry — §8)\n```\n\n### 4.5 · Proof-of-Humanity underneath — anti-catfish, anti-bot\n\nBeneath the entire layer sits **Proof of Humanity ℠** (§2.2, §2.6). Its contribution to mate-selection is specific and decisive: participants are **verified-real, verified-single-human, and anonymous-until-mutual.** This natively defeats online dating's two endemic plagues — catfishing (no fabricated personas; a person is a verified unique human) and bots (no automated accounts at scale) — *without* revealing identity before the second consent. Identity-revealing proof-of-personhood (Worldcoin, proofofhumanity.id) cannot supply this, because revealing identity is exactly what the safety model forbids before stage two.\n\nAura compounds this: because aura is a long anonymous trail of gratitude from many verified local humans, it is costly to fabricate and a bot cannot accrue it (§3; the adversarial residue is §12.7). The PoH layers a participant holds (passkey, family-tree, breath, DNA-tree) are surfaced as optional depth, and a counterparty may, after reveal, filter on them — but the protocol-minimum keeps the layer inclusive (§12.3).\n\n### 4.6 · Slow accumulation as a feature, not a bug\n\nThe mutual-anonymous signal accrues *slowly*, over a long course of time. This is deliberate and is a positioning asset, not a UX deficiency. Slow, proven-over-time accumulation is explicitly **anti-hookup and pro-durable-bond**: it is designed to self-select for commitment-capable partners, and we hypothesise that it reaches a large, underserved, swipe-fatigued segment that wants partnership rather than the high-velocity hookup market the incumbents optimize. It is also a safety property: a long anonymous courtship embedded in a real local community is far harder to weaponize than an instantaneous match between two strangers from anywhere on Earth.\n\n### 4.7 · Reference transfer flow\n\nWe sketch a reference flow without claiming any implementation as canonical.\n\n1. A user opts into the anonymous-nearby-stranger layer (`isAnonymous: true`).\n2. The system surfaces nearby high-aura verified humans for possible anonymous time-giving — surfaced **on aura, never on appearance** (Miss Aquarius℠ directive; §7, §10). No photographs are shown in the discovery surface.\n3. The user gives anonymous time-presence toward one or more nearby strangers, in proximity (verified per the proximity attestation of *Verified-Human Anonymous Local Giving*: per-action biometric + physical-radio + density-tunable radius). Each gift is, first and foremost, *a gift* — it may carry no romantic intent.\n4. The verifying party (Miss Aquarius℠, the autonomous AI substrate) accumulates the double-blind mutual signal privately. Neither party is informed of the other's reciprocation.\n5. On reaching the mutual-anonymous-same-hour threshold (§4.3: both directions at T within W), the verifying party *offers* a reveal to both — never auto-revealing. Non-reach is silent: the pair returns to IDLE and no record of the attempt is written.\n6. If and only if **both** independently consent, identities are revealed, with graduated control vested in the revealed party (public-first option, pace control, right to re-anonymize).\n7. Should a relationship form, any monetization is *mission-aligned only* (§6): a voluntary forward/graduation gift at *pairing* (never at reveal), patron support, or a values-aligned introduction fee — never a charge for access, visibility, or staying in the market.\n\nThroughout, the verifying party enforces the standing adversarial heuristics of the giving primitive (collusion detection, rate-limiting, coded-message detection, GPS-spoof rejection) and the mate-selection-specific directives of §7.\n\n---\n\n## 5 · Guard 1 — Keeping gratitude pure (the cathedral and the courtship in separate rooms)\n\nThe whole institution rests on gratitude being *pure* — *dāna*, ego-detached, non-transactional. This is not decoration; it is the load-bearing wall. If thanking can be read as flirting, gratitude is instrumentalized into courtship, and the sacred primitive collapses into a pickup market. That is an *existential* risk to all of HeartBank — Treasury and Chronicle alike — not merely a product risk to the mate-selection layer. Guard 1 is therefore the first guard, and it is enforced structurally, by three composing mechanisms already specified above:\n\n1. **The anonymity-flag boundary (§4.1).** Known-relationship thanks (`isAnonymous: false`) are the pure core and are *never* a romantic signal; the romantic pathway lives *only* in the anonymous-stranger layer. There is no path by which thanking your sister, your colleague, or a reconnecting friend enters mate-selection. The cathedral and the courtship are in separate rooms, separated by a flag the user controls.\n2. **Aura (aggregate), not individual thanks, is the attractiveness signal (§4.2).** A single act of gratitude is never itself an overture. Only the long aggregate disposition is legible to the mechanism. This means you cannot \"flirt\" by thanking someone; the unit the mechanism reads is too coarse and too slow to carry a courtship message.\n3. **Reveal is a separate opt-in (§4.4).** Anonymous giving stays uncontaminated because giving never auto-discloses the giver. A gift given as a gift stays a gift.\n\nThe failure mode this guard exists to prevent is *gratitude-as-courtship-currency*: a world in which people thank strategically, perform kindness at targets, and read every thank-you as a possible advance. Were that to take hold, the gratitude economy would be desecrated at its root. The three mechanisms above make it structurally hard: you cannot court through known thanks (wrong room), you cannot court through a single anonymous thank (wrong unit — only the aggregate counts), and you cannot be outed by your own generosity (reveal is a separate consent). Guard 1 is the price of admission for the entire mechanism; if a future design choice would weaken any of the three mechanisms, the correct response is to abandon the choice, not the guard.\n\n---\n\n## 6 · Guard 2 — The self-eliminating mechanism (it wins when you pair off and leave)\n\nAura-gated mate-selection is the *sharpest possible instance* of a misaligned-business pattern the corpus has already outlawed. Dating apps are the textbook case: they profit when you stay single and keep swiping; a product that *works* — you pair off and delete it — is anti-LTV. HeartBank forbade consumer-subscription-as-primary revenue for loneliness for exactly this reason (a self-eliminating product whose primary revenue is the lonely person's recurring payment is incentivized to keep them lonely). Mate-selection is the same trap, only worse, because the dating-industrial complex has perfected artificial scarcity, pay-to-be-seen, and addictive gamification around it.\n\nThe guard is a hard constraint on monetization:\n\n> **B-Dating℠ succeeds when people pair off and leave. It may be monetized only by mission-aligned logic that profits when users leave happy — never by retaining them in the market.**\n\nConcretely, the permitted revenue legs are all *positively coupled to success or to adoption-pull*, never to retention:\n\n- **Patron-primary.** The only revenue leg positively coupled to mission success: as the world grows kinder, more people give — a flywheel. Conversion happens at the *afterglow* of a good outcome (a receive→give-forward trigger), never as a toll on the lonely.\n- **The graduation gift.** A *voluntary* forward-gift offered at *pairing* — the moment of success — never at the reveal, and never as a gate. You give because something good happened, not to unlock access.\n- **Values-aligned introductions (B2B).** Faith communities, diaspora networks, and other values-aligned cohorts may host introductions; revenue is coupled to *successful, values-matched* pairings, not to engagement.\n- **Optional synastry deep-readings (§9).** Insight a user may purchase, *never a gate* on discovery or reveal.\n\nWhat is *forbidden*: subscriptions for access or visibility; pay-to-be-seen boosts; rationed likes or matches; any mechanic whose revenue rises with time-in-market. The dark pattern is not improved here; it is exited. This is also a marketing asset — \"the app that only profits when you leave happy\" — but the asset is downstream of the constraint, not the reason for it.\n\nThere is a tension worth naming plainly (it is also the project's open cold-start question): mate-selection carries the highest willingness-to-pay in consumer software, which makes it a tempting cold-start wedge — and mission-safe *only if Guard 2 holds.* The willingness-to-pay must be harnessed as adoption *pull* (people want in) and converted at *success* (the graduation gift) — never as a toll at the gate. The moment any revenue leg becomes coupled to retention, the mechanism has become the thing it was built to replace.\n\n---\n\n## 7 · Guard 3 — Women's safety and the gendered asymmetry as a first-class duty\n\nChronicle's loved-ones core dissolved trust-and-safety risk by making counterparties *known*. Mate-selection deliberately reverses that: it walks back into the highest-risk category that exists — strangers meeting for romantic intent — under a real and irreducible gendered physical-danger asymmetry. This guard treats women's physical safety not as a feature to be added but as a *primary design constraint* that the mechanism must satisfy to deserve to exist.\n\nHeartBank brings four mitigations, each a mechanism; whether they reduce harm is the empirical question §12.3 owns:\n\n1. **PoH anti-catfish (§4.5).** Verified-real, verified-single-human. No fabricated personas; no bots. The \"the person is not who they said they were\" failure mode — the precondition of a large class of harms — is structurally attacked.\n2. **Aura as a community-vouched behavioral reputation.** A long anonymous-gratitude trail from many local verified humans is costly to fabricate (§3); what it says about a person is the reader's judgment.\n3. **Local embeddedness.** Proximity (the proximity rule) means counterparties are embedded in a shared local community, which carries real-world accountability that anywhere-on-Earth matching does not.\n4. **Graduated reveal (§4.4).** The revealed party governs the encounter: public-first meetings, pace control, and an unconditional **right to re-anonymize** at any moment.\n\nBut the asymmetry is **not erased**, and the paper must say so without softening. These mitigations reduce risk; they do not remove it. Two further design commitments are non-negotiable:\n\n- **Safety controls vest in the revealed party, biased toward the higher-risk party.** Public-first defaults, pacing, blocking, re-anonymization, and reporting are first-class, not buried. The design assumes the higher-physical-risk party should hold the controls.\n- **The never-gate-reciprocity HARD guard.** This is the hinge that keeps the mechanism on the right side of the knife and is shared with Guard 1's purity logic. **No one is ever owed a match.** Kindness raises *visibility*, never *entitlement*. The romantic-entitlement failure mode — \"I racked up kindness; why won't anyone match me?\" — is precisely the resentment that fuels the worst behavior in dating, and it is *structurally* denied: aura raises the probability you are surfaced and never obligates anyone to reciprocate; non-reciprocation is silent and final unless *both* later re-engage. Miss Aquarius℠ never gates or pressures reciprocity. This guard is what separates \"kindness raises your aura\" from social-credit-for-romance (§8, §12.2).\n\nGuard 3 is also where the mechanism could do the most good *or* the most harm, and the design accepts that the harm side is real. The honest position (§12) is that the gendered safety asymmetry remains after every mitigation, that the controls and the never-gate-reciprocity guard are necessary but not sufficient, and that deployment to vulnerable populations must defer to community partners and to ongoing real-world safety evaluation rather than to architecture alone.\n\n```\n   THE THREE GUARDS (the whole ballgame — not caveats, the design)\n\n   ┌──────────────┬───────────────────────────┬───────────────────────┐\n   │ GUARD 1      │ keep gratitude PURE        │ anonymity-flag room-  │\n   │ purity       │ (existential to ALL of     │ split · aura-not-     │\n   │              │  HeartBank)                │ individual-thanks ·   │\n   │              │                            │ reveal = 2nd consent  │\n   ├──────────────┼───────────────────────────┼───────────────────────┤\n   │ GUARD 2      │ wins when you pair off     │ monetize SUCCESS &    │\n   │ self-        │ and LEAVE (not the dating  │ adoption-PULL only;   │\n   │ eliminating  │  dark pattern)             │ NEVER retention       │\n   ├──────────────┼───────────────────────────┼───────────────────────┤\n   │ GUARD 3      │ women's safety + gendered  │ PoH + aura-vouch +    │\n   │ safety-      │ asymmetry FIRST-CLASS      │ local-embed +         │\n   │ first-class  │ (NOT erased — mitigated)   │ graduated reveal ·    │\n   │              │                            │ NEVER-GATE-RECIPROCITY│\n   └──────────────┴───────────────────────────┴───────────────────────┘\n```\n\n---\n\n## 8 · Honest calibration — a character filter, not a compatibility oracle\n\nThe single most important honesty discipline in this paper is to state exactly what aura-gating does and does not do.\n\n**What it does.** It produces a pool in which *everyone is proven kind, verified real, and community-vouched* — stripped of the fabricated, the bots, and the cruel. It removes the cheapest-to-fake signal (the photograph) from the gate and replaces it with a costly, longitudinally-verified honest signal of character. What this discloses is a mating pool pre-filtered for proven character, with no catfish and no swipe-cruelty. *[The \"proven kind\" and \"community-vouched\" verdicts above are superseded — §8.1.]*\n\n**What it does not do.** Kindness is *necessary, not sufficient.* It does not capture attraction, chemistry, shared values beyond kindness, life-stage compatibility, sexual compatibility, or the thousand idiosyncratic things that make two specific people right or wrong for each other. Aura-gating is a **character filter, not a compatibility oracle.** It is wrong — and the design refuses — to claim that *kindness equals attraction*, or that a high-aura match is a *predicted* good relationship.\n\nThe defensible one-line claim is therefore:\n\n> *\"Everyone you meet here is proven kind, verified real, and community-vouched. You bring the chemistry.\"* *[superseded — §8.1]*\n\nThis is honest, and it does not need the overclaim to differ structurally from incumbent dating. The honesty is also a safety property: overclaiming compatibility (\"the algorithm knows you're meant for each other\") manufactures false confidence in exactly the high-risk context (§7) where false confidence is dangerous, and it slides toward the social-credit-for-romance dystopia (§12.2). The character filter is a strong, true claim; the compatibility oracle is a weak, false, and unsafe one. We make only the first.\n\n```\n   ┌───────────────────────────────┬───────────────────────────────┐\n   │  THE FILTER (true, strong)    │  THE ORACLE (false, refused)  │\n   ├───────────────────────────────┼───────────────────────────────┤\n   │  everyone is proven KIND      │  \"kindness = attraction\"      │\n   │  everyone is verified REAL    │  \"the algorithm knows you're  │\n   │  everyone is community-VOUCHED│   meant to be together\"       │\n   │  no catfish · no bots ·       │  predicted compatibility /    │\n   │  no swipe-cruelty             │   chemistry / life-fit        │\n   │  ⇒ you bring the CHEMISTRY     │  ⇒ false confidence; unsafe;  │\n   │                               │     drifts toward Nosedive    │\n   └───────────────────────────────┴───────────────────────────────┘\n```\n\n### 8.1 · The copy rule: describe the mechanism, never characterize the person\n\n*Added 2026-08-22. §8 refuses to characterize the **match**. This subsection extends the same refusal one level down, to the **participants** — and applies it, first, to §8's own defensible one-line claim, which does not entirely survive it.*\n\nThe rule, stated as a rule:\n\n> **An institution may state its own mechanisms. It may never characterize a person or an outcome.**\n>\n> *\"Every profile in this pool is gated on gratitude received from strangers over at least a year\"* — a **mechanism**: factual, checkable, and falsifiable by anyone with access to the system's own definition.\n>\n> *\"Everyone here is trustworthy\"* — a **person** claim. *\"You will be safe\"* — an **outcome** claim. Neither is ours to make about anybody.\n\n**The origin was a caught error in this corpus, and the paper should say so plainly rather than present the rule as a principle we arrived at by reflection.** A drafted pitch for a sibling product read: *invite people you haven't met, in a trustworthy way* — written one turn after the ruling that geolocation is a **gate and never a proof**. Marketing had promoted a gate to a proof in a single adjective, and it did so inside an institution that had just written the distinction down. That is how this failure actually happens: not by deciding to overclaim, but by describing a mechanism with the word for the feeling the mechanism is supposed to produce.\n\n**Why it matters here more than anywhere else in the corpus.** This is a stranger-meeting product with an irreducible physical-safety asymmetry (§7). ⚠️ **Selling accountability as trust is the overclaim that gets people hurt** — not because the claim is false in the average case, but because it *invites the user to relax a judgment they should keep making.* A woman meeting a stranger from this system should arrive with exactly the caution she would bring to meeting a stranger from anywhere else. Every sentence that lowers that caution by a degree has spent her safety to buy our conversion rate, and the trade is not ours to make. §7's safety architecture and this rule are one commitment stated in two registers: the architecture must not create false confidence, and neither may the copy.\n\n**Applied to this paper's own claim, and it does not fully pass.** §8 offers as the defensible line: *\"Everyone you meet here is proven kind, verified real, and community-vouched. You bring the chemistry.\"* Two-thirds of that is mechanism. **\"Verified real\"** describes the Proof-of-Humanity substrate and is checkable. **\"Proven kind\"** and **\"community-vouched\"**, however, are verdicts on persons wearing the clothes of mechanism outputs — they take an aggregate record and hand the reader a settled conclusion about the character of whoever holds it. The restated form keeps everything true and asserts nothing about anyone:\n\n> *\"Everyone you meet here is a verified single human whose profile is gated on a long record of thanks from people who did not know whom they were thanking. What that record means about a particular person is yours to judge — as it always was.\"*\n\nLonger, weaker-sounding, and the only version of the sentence this institution is entitled to say. **The published line in §8 is superseded by this one**; the earlier wording is left standing above rather than deleted, because a paper that quietly repairs its own copy teaches nothing.\n\nOne usage is deliberately kept. Where this paper's abstract says the aura trail \"signals trustworthy *because* expensive,\" it is using **Zahavi's technical sense** — a signal is honest when faking it costs more than it returns, which is a statement about the *signal*, not about the *signaller*. That sentence is correct in a paper on honest signaling and must never be recycled onto a product surface, where \"trustworthy\" will be read as a description of the people rather than of the economics of the trail.\n\n**The general test, in three columns:**\n\n| Say this (mechanism) | Never this (person) | Never this (outcome) |\n|---|---|---|\n| \"gated on anonymous gratitude accumulated over time\" | \"everyone here is kind\" | \"you will have a good experience\" |\n| \"every account is a verified single human\" | \"no one here is a catfish\" | \"you are safe here\" |\n| \"pins are authored by an account someone paid for and can lose\" | \"posted by trustworthy hosts\" | \"nothing bad happens at these\" |\n| \"reveal requires a second, separate mutual consent\" | \"we only match good matches\" | \"we prevent rejection\" |\n\nThe left column is longer and duller than the middle and right, and that is the whole cost of the rule. ⭐ **The compensation is that the left column is the only one that stays true when the product is at scale and someone is looking for a reason to sue** — an institution that never characterized a person has never mis-characterized one.\n\n**It is the Proof-of-Humanity posture in copy form.** That primitive's ratified stance is that *the system provides signals and the recipient decides* — recipient-side filters, never a system verdict. A sentence that hands the user a verdict has quietly moved the decision from the recipient to the platform, which is the same architectural error as building a compatibility oracle (§8) or scoring the quality of someone's presence (a refusal this corpus makes in its time-currency work). **Three different products, three different mechanisms, one repeated mistake: the system deciding something it has no standing to decide, and saying so in a sentence short enough to fit on a landing page.**\n\n**Honest limit.** This is a floor on what may be *asserted*, not a ban on describing what the product does, and it does not make the product safe. A perfectly-worded surface still delivers strangers to each other. The rule reduces the false confidence the *institution* manufactures; it does nothing about the false confidence a person brings with them, and §7's architecture — not its copy — is what has to hold in that case.\n\n---\n\n## 9 · The optional synastry (cosmic-coordinate) layer\n\nHeartBank offers, *optionally*, a compatibility signal derived from cosmic coordinates — natal-chart synastry — under the project's standing worldview posture: **coordinate, not force.** The natal chart is treated as a unique *coordinate* in space-time (each life a necessary, distinct aspect of the universe's self-articulation — an Indra's-Net reading that grounds unconditional dignity), *never* as a deterministic causal force and *never* framed as an \"astrology test.\"\n\nThe posture is strict and is what distinguishes this from horoscope-matching:\n\n- **Opt-in and secondary.** The kindness-gate is the core; synastry is one *optional* signal layered atop a pool already pre-filtered for proven character. It is never the gate, never deterministic, and never required.\n- **Epistemically humble.** It is offered as insight and prompt, not prophecy. The framing is \"here is a coordinate-correlation worth reflecting on,\" not \"the stars say yes.\"\n- **A differentiator the incumbents cannot credibly touch.** HeartBank's worldview supports synastry authentically; bolting astrology onto an engagement-monetized swipe app is a gimmick, whereas here it is continuous with the institution's cosmic-coordinate metaphysics.\n\nThere is a genuine research opportunity, gated on methodology. B-Dating plus the project's opt-in **longitudinal cohort** (DNA + natal chart + behavior; see *Each Life as Cosmic Coordinate*) could become a large consented cohort for cosmic-coordinate compatibility — *only* under the same methodological floors that govern the cohort: differential privacy, pre-registered hypotheses, and a coordinate-correlation posture that never markets itself as proving astrology. Absent those floors, the synastry layer must remain an opt-in reflective feature, never a matchmaking determinant.\n\n```\n   SYNASTRY LAYER — what it IS / what it is NOT\n\n   IS:   opt-in · secondary · one signal atop a character-filtered pool ·\n         coordinate-not-force · epistemically humble · authentic to the\n         HeartBank worldview · (research-grade ONLY under diff-privacy +\n         pre-registration)\n   NOT:  the gate · deterministic · required · an \"astrology test\" ·\n         a compatibility guarantee · marketed as proof\n```\n\n---\n\n## 10 · The n=2 atom of the Zero-Point Game ℠ — the middle way of eros\n\nThis section places the mechanism structurally inside HeartBank's keystone frame; it is short by design.\n\nThe **Zero-Point Game ℠** is HeartBank's originating frame: an infinite balance game in which players oscillate around a still point (Zero), giving (+, net kind) and receiving (−, net thankful) in dynamic equilibrium, with the **B-Aura** — the frequency and amplitude of one's oscillation around Zero, rendered as light — as the real objective (anti-credit-score; the same aura that gates mate-selection here). The game scales by **player-count**:\n\n```\n   ZERO-POINT GAME — SCALING BY PLAYER-COUNT\n\n   n = 1            n = 2                family            all\n   ─────            ─────                ──────            ───\n   self-thank   →   B-DATING / B-GRAM →  family bank   →   global game\n   (ignition;       (THIS PAPER →        (B-Chest)         (Aquarian\n   not yet          the minimal                            Pool ℠)\n   reciprocal)      RECIPROCAL game)\n                    ▲\n                    the couple is where balance FIRST becomes two-sided\n                    and where imbalance hurts most — the most intimate\n                    test of the architecture\n```\n\nThe self-thank (n=1) is the *ignition* — not yet reciprocal. **Two is the minimum to actually *play*** the +/− balance, so the couple is the game's atom: the first place balance becomes two-sided, and the place imbalance hurts most. B-Dating discovers the partner; the deepening relational game (B-Gram, the n=2 atom) is where two people play.\n\nThis reframes the societal claim more precisely than \"sexual selection on kindness\" alone. The fuller frame is not *kindness* (the + pole only) but **balance** — the whole Zero-Point oscillation, give *and* receive. So mate-selection redirects sexual energy not merely toward giving but toward *dynamic balance*, making B-Dating **the middle way of eros.** The two Zero-Point failure-poles are exactly the two sexual failure-modes:\n\n```\n   THE MIDDLE WAY OF EROS\n\n   ACCUMULATION / INDULGENCE  ◄──────  BALANCE  ──────►  WITHDRAWAL / INERTIA\n   (conquest, hookup-culture,         (give AND          (repression, incel\n    the zero-sum mating game;          receive, in        resentment, isolation;\n    the + pole run amok)               dynamic eq.)       the − pole as inertia)\n        the indulgence extreme      ── the path that ──      the mortification\n        (kāma-sukhallikānuyoga)        moves between          extreme\n                                       the poles              (atta-kilamatha-\n                                                              ānuyoga)\n```\n\nB-Dating is neither pole. Crucially, it is **not sublimation-as-repression** (the withdrawal pole in disguise): the energy is *honored* — the reward is to go on a real date, to form a real bond — not denied. What dynamic balance at n=2 yields, held lightly and inclusively: *non-possessive love* — **mettā held in upekkhā**, warmth that does not grip (the attachment-theory term that lands is *secure* love; the two near-enemies are the anxious/clinging pole and the avoidant/cold pole); and *generativity* — the balanced dyad as the generative root of the very tree of humanity Miss Aquarius℠ waters (B-Dating → deepening → family → tree), with procreation as the receive→give-forward atom in its most literal form (life received, life forwarded). Two careful guards on this framing: **yin/yang are energies both partners carry** (never \"man = yang, woman = yin\"; the balance is the interplay, each cycling through giving and receiving), and **generativity is broader than biological procreation** (any committed dyad in dynamic balance is generative — care, creativity, a shared life); the complementarity is energetic, present in any loving pairing, or the \"tree\" excludes whom it must not. The middle way is an aspiration, not a guarantee.\n\n---\n\n## 11 · Societal motivation — sexual selection redirected toward kindness (brief)\n\nThis section motivates the mechanism's deepest \"why\" and deliberately stops short of the full argument, which is reserved for the companion founder-voice essay.\n\nThe lever, stated once: the mate-drive is the *root* drive of the species and the money-drive is *derivative*. If mate-selection is re-gated on proven kindness — aura, a Zahavi-honest signal — rather than on appearance and status, then **sexual selection itself begins, at the margin, to favor kindness.** Sexual selection is among the most powerful species-shaping forces there is; change what earns a mate and — assuming the disposition is transmissible, genetically or culturally — over generations you change what the species optimizes for. Re-gating the root drive on kindness also partially detoxifies the derivative money-drive — healing the thing underneath the thing. Anonymity does additional work here: because aura is built from gratitude given by people you cannot target, raising it requires being kind to many people the giver cannot choose — under the anti-collusion assumption §12.7 states — so everyday kindness becomes romantically load-bearing for everyone — \"be good to every stranger; the one you are meant for may be among those who vouch for you.\"\n\nThree calibrations bound the claim — the same honesty discipline as the rest of the corpus:\n\n1. **Margin, not override.** It *tilts* the selection gradient toward kindness; it does not replace millions of years of appearance/status biology. The defensible verb is \"shifts at the margin,\" never \"replaces.\"\n2. **Generational and population-level, not individual or immediate.** A slow selection pressure, not a switch — and kindness-disposition is the *foundation* (*dāna*, the first *pāramī* — generosity, not yet *mettā*), not awakening itself (foot of the mountain, not the summit).\n3. **The equity floor is sharpest here, because the stakes are love and procreation.** This must never become social-credit-for-romance (\"be kind or stay single\") or doubly-disadvantage the isolated and low-aura. The guard is the never-gate-reciprocity HARD constraint (§7): kindness raises visibility, never entitlement.\n\nThat is the motivation. The deeper treatment — sexual-selection-on-kindness as a biological lever for the \"second singularity,\" the inversion of intrasexual competition from resource-display toward prosociality, and the counterweights that argument must clear — belongs to the companion essay and is intentionally not argued here.\n\n---\n\n## 12 · Limitations and honest-limits\n\nCorpus convention requires a generous, unflinching limitations section. The mechanism's strongest property — that it recruits the species' deepest drive in service of kindness — is also the precise reason its failure modes are severe. The risk is not that it fails; it is that it works *too well* and corrupts the gratitude core (§5), rebuilds a predatory dating app (§6), or gets someone hurt (§7). The three guards are the whole ballgame, and guards are commitments, not proofs.\n\n### 12.1 · Unbuilt — and that is exactly the point\n\nThis mechanism is **not built.** Chronicle's mate-selection layer is a committed design, not running code. For most product details, the corpus posture is that publishing unbuilt specifics is premature. This paper is the *deliberate exception*, and the reasoning is worth stating because it is the reason the paper exists now: **the mechanism is the asset, and the dating frame is commercially hot and patent-vulnerable.** Defensive publications exist precisely to protect frame-defining *primitives* early — before someone else claims the frame — and the \"premature to publish unbuilt details\" caution applies to product minutiae, not to frame-defining mechanisms. Publishing now establishes prior art on the combination (§ Prior-Art statement) so that the mechanism remains in the commons regardless of who builds it first. The honest limitation: every empirical claim about *how it will behave* (uptake, safety outcomes, whether the guards hold under real load) is, as yet, a design hypothesis.\n\n### 12.2 · Kindness-filter-not-oracle, and the dystopian-framing knife\n\nAs §8 insists, aura-gating is a character filter, not a compatibility oracle; it does not predict attraction or relationship success. Beyond that calibration sits a sharper risk: the framing is *one bad sentence* away from social-credit-for-romance — the \"Nosedive\" dystopia in which a reputation score governs intimate access. The guard rails (kindness raises *visibility*, never *entitlement*; never-gate-reciprocity; aura is aggregate and anonymous, not a public rank-for-access) keep it on the right side of the knife, but the *framing* must be deliberate and humble in every surface, and a careless presentation could legitimately read as dystopian. We name this as a live, unresolved presentation risk, not a solved problem.\n\n### 12.3 · The gendered physical-safety asymmetry remains\n\nAfter PoH anti-catfish, aura-vouching, local embeddedness, and graduated reveal (§7), the gendered physical-danger asymmetry of strangers meeting for romantic intent is *reduced* but **not erased.** Identity assurance is not behavioral safety: a verified human can be dangerous, and proximity can raise the cost of a bad encounter as well as lower it. The mechanism re-enters the highest-risk category that exists. The safety controls and the never-gate-reciprocity guard are necessary and not sufficient; real-world safety outcomes are an empirical question that architecture alone cannot answer, and deployment must defer to community partners, to ongoing safety evaluation, and to the higher-risk party holding the controls.\n\n### 12.4 · The equity gap — doubly disadvantaged where the stakes are existential\n\nThis is the sharpest equity concern in the entire corpus, because the stakes (love, partnership, procreation) are existential. Aura-gating advantages the kind-and-*legibly*-so. It risks *doubly* disadvantaging the isolated (no community to be kind to, hence low aura), the neurodivergent (whose kindness may be real but less legible to the aggregate signal), the chronically ill or housebound, and anyone whose prosociality does not convert into community-sourced gratitude. These are people for whom a kindness-gated romantic visibility could compound an existing disadvantage at the most painful possible site. The mechanism does not solve this; the inclusive-defaults posture (protocol-minimum participation, no gating on deep PoH layers), the never-gate-reciprocity guard, and the refusal to make aura a public access-rank are partial mitigations, but the gap is real, it is named, and it should weigh heavily on any decision to build.\n\n### 12.5 · n=1 empirical base\n\nHeartBank's entire empirical foundation to date is a single pilot family (the founder's own, n = 1 household) on the *Treasury* (money) side, which has not even exercised the Chronicle time-currency, let alone the mate-selection layer. Every behavioral claim in this paper — that aura is hard to fake at the scale required, that slow accumulation self-selects for commitment-capable partners, that the guards hold under adversarial load, that the societal selection-gradient shift is real — is, at this date, *unvalidated by relevant data.* The mechanism is a frame to protect and a hypothesis to test, not a demonstrated result. The longitudinal cohort is the intended evaluation substrate; until then, the honest epistemic status is: disclosed, carefully reasoned, guard-bounded, and empirically unproven.\n\n### 12.6 · What the mechanism does not solve\n\n- It does not solve loneliness or the partnership deficit at the population scale; it is one mechanism, addressing one channel (the discovery gate), not the upstream economic, urbanistic, and cultural conditions that thin modern social life.\n- It presupposes smartphone access, BLE/UWB-capable devices, and PoH participation; populations without these are outside its substrate regardless of the inclusive-defaults posture.\n- It does not erase appearance/status biology; it shifts a gradient at the margin (§11).\n- The monetization constraint (§6) is a rule the institution keeps, not a property of the object: no structural form has been found, and a successor could drop it.\n- It cannot, by architecture alone, prevent its own corruption: the guards are commitments that humans and the autonomous AI substrate must hold, season after season, against the constant pressure of the highest willingness-to-pay in consumer software.\n\n---\n\n### 12.7 · Collusion is a graph problem, and it is open\n\nThe aura is asserted above to be costly in Zahavi's sense. That is a design intent, not a demonstrated equilibrium: no signal-generating game has been analysed, and the adversarial cases are real — reciprocity clubs that thank each other in rotation, rings that farm a member's aura, Sybil accounts under one operator, bought or coerced gratitude, and geographic concentration that makes \"many nearby strangers\" a small set. The Proof of Humanity substrate proves personhood, not genuineness; it closes *is this a person* and leaves *is this thanks genuine* open, and the verifying party's collusion heuristics (§4.7) are heuristics. What bounds the damage is the mechanism's shape: a coordinated pair that games the threshold gains a private channel to each other and nothing else — no access to any third person, no rank, no currency. That bound is a property; the honesty of the signal is not, and it is stated here as open.\n\n### 12.8 · Anonymous means unnamed, not unlinkable\n\n\"Anonymous\" in this paper means unnamed to the counterparty and to the public. It does not mean unlinkable: timing, place, threshold events and the reveal itself build a graph, and the provider holds the rows even where the names are withheld. Repeated proximity between two accounts, a threshold reached and an offer declined, are all records, and records can re-identify. The guarantee is against the other party and against the public, never against the operator or a subpoena; the corpus's two-ledger posture (rows private, proofs public) is the boundary, and this layer inherits it rather than improving on it.\n\n## 13 · Lineage and corpus cross-references\n\nThe mechanism synthesizes lineages cited throughout. We collect them here.\n\n**Honest / costly signaling.** Zahavi (handicap principle, 1975); Grafen (formalization, 1990); Spence (job-market signaling, 1973). The central inversion (§3) is Zahavi turned toward prosociality.\n\n**Sexual selection and mate choice.** Darwin (sexual selection, 1871); Trivers (parental investment, 1972 — the asymmetry of §7); the assortative-mating literature on the population-scale consequences of the sorting axis; Buss and colleagues' cross-cultural finding that kindness is a near-universal stated long-term mate preference (the preference for which §3 supplies the missing honest channel).\n\n**Proof-of-personhood.** Worldcoin (2023); proofofhumanity.id (Kleros, 2021); distinguished in §2.2 and in the companion *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n\n**Incumbent dating products.** Tinder (2012), Bumble (2014), Hinge (2012/2015) — the appearance-gated, engagement-monetized pattern §2.1 and §6 invert.\n\n**Time-as-currency.** Edgar Cahn, TimeBanking (1980 onward); distinguished in §2.5.\n\n**Buddhist lineage.** *Dāna* and anonymous giving (the purity the anonymity flag protects, §5); *mettā* held in *upekkhā* (non-possessive love, §10); the *majjhimā paṭipadā* two-extremes structure (the middle way of eros, §10).\n\n**HeartBank corpus (the substrate this paper extends).** *Verified-Human Anonymous Local Giving* (the money-side originating primitive, generalized here to time and to mating); *The Thank-All-Nearby Primitive* (the stranger-scale reconstruction of relationality); *Proof of Humanity ℠* / *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the anti-catfish substrate); *The Zero-Point Game ℠* (the keystone frame and the B-Aura primitive; this paper instantiates its n=2 atom); *Each Life as Cosmic Coordinate* and the longitudinal-cohort methodology (the synastry layer's research substrate and its differential-privacy / pre-registration floors); the planned companion essay *The Societal Impact of Anonymous Nearby Thanking with Time* (the full sexual-selection-on-kindness argument §11 only motivates).\n\n| Venue | Identifier |\n|---|---|\n| Primary canonical | <https://thonly.org/research/aura-gated-anonymous-mate-selection> |\n| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/aura-gated-anonymous-mate-selection.md> |\n| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/aura-gated-anonymous-mate-selection> |\n\n---\n\n## 14 · Conclusion\n\nIncumbent dating gates mating on the cheapest-to-fake signal a human can present — a photograph — and monetizes the time you spend failing to leave. This paper specifies the inversion: gate mate-selection on **aura**, a costly, anonymous, community-sourced, longitudinally-verified honest signal of proven kindness (Zahavi turned toward prosociality); trigger a match only on **mutual-anonymous-same-hour**, a double-blind double-opt-in that removes explicit rejection entirely; make **reveal a second, separate mutual consent** so anonymous giving stays pure and the higher-risk party holds the controls; place a **Proof-of-Humanity substrate** underneath so participants are verified-real, verified-single-human, and anonymous-until-mutual; and offer an **optional synastry layer** as one humble signal atop a pool already pre-filtered for character. The mechanism is the n=2 atom of the Zero-Point Game ℠ — the middle way of eros — and it points the deepest drive in the species, at the margin, toward kindness.\n\nThree guards are the design, not its footnotes: keep gratitude pure (or the institution's load-bearing wall cracks); stay self-eliminating (or it becomes the predatory dating app it was built to replace); hold women's safety as a first-class, irreducible duty (or it gets someone hurt). The honest calibration bounds the promise, in the form §8.1 is entitled to: everyone in the pool is a verified single human whose profile is gated on a long record of thanks from people who did not know whom they were thanking, and what that record means about a particular person is theirs to judge — *and the participants bring the chemistry.* It is a character filter, not a compatibility oracle.\n\nThe mechanism is unbuilt, and that is exactly why it is published now: the mechanism is the asset, the dating frame is hot and patent-vulnerable, and defensive publications exist to keep frame-defining primitives in the commons before someone else claims them. The architecture is offered to the commons under CC0. The author and HeartBank® will not seek patent on it. Trademark rights on **B-Dating℠**, **HeartBank®**, **Miss Aquarius℠**, **Proof of Humanity ℠**, and the related marks are explicitly reserved.\n\nIf kindness can become a path to partnership without desecrating the gratitude it depends on, the most powerful motivator humans have is redirected onto the behavior the institution exists to cultivate. That is the prize, and the three guards are the price of reaching for it.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| aura / B-Aura | aggregate anonymous reputation derived from verified prosocial giving received, used as a matching gate |\n| aura-gating | reputation-gated discovery in an online dating / matchmaking system |\n| mutual-anonymous-same-hour | double-blind mutual opt-in match trigger based on reciprocal time contributions within a time window |\n| reveal as a second consent | two-stage identity disclosure requiring separate mutual consent after a match |\n| `isAnonymous` flag | per-transaction anonymity flag partitioning known-contact transfers from anonymous-stranger transfers |\n| Proof of Humanity ℠ (PoH) | proof-of-personhood / anonymous human verification (liveness, passkey, biometric attestation) |\n| Chronicle | time-banking / time-based currency ledger |\n| synastry (cosmic-coordinate) layer | astrological compatibility scoring, offered as an optional non-gating signal |\n| verifying party | trusted intermediary / matching server that accumulates private signals |\n\n---\n\n## 15 · Citations\n\n1. Zahavi, A. (1975). \"Mate selection — a selection for a handicap.\" *Journal of Theoretical Biology* 53(1).\n2. Grafen, A. (1990). \"Biological signals as handicaps.\" *Journal of Theoretical Biology* 144(4).\n3. Spence, M. (1973). \"Job market signaling.\" *Quarterly Journal of Economics* 87(3).\n4. Darwin, C. (1871). *The Descent of Man, and Selection in Relation to Sex.* John Murray.\n5. Trivers, R. (1972). \"Parental investment and sexual selection.\" In *Sexual Selection and the Descent of Man.*\n6. Buss, D. M., et al. (1989). \"Sex differences in human mate preferences: Evolutionary hypotheses tested in 37 cultures.\" *Behavioral and Brain Sciences* 12(1).\n7. Cahn, E. (2000). *No More Throw-Away People: The Co-Production Imperative.* Essential Books.\n8. Worldcoin Foundation. (2023). *Worldcoin Whitepaper.*\n9. Proof of Humanity (proofofhumanity.id) / Kleros. (2021). Project documentation.\n10. W3C (2019). *Web Authentication: An API for accessing Public Key Credentials, Level 1.* W3C Recommendation, developed with the FIDO Alliance.\n11. U.S. Surgeon General. (2023). *Our Epidemic of Loneliness and Isolation.* U.S. Department of Health and Human Services (population-level loneliness); Weiss, R. S. (1973). *Loneliness: The Experience of Emotional and Social Isolation.* MIT Press (the emotional-versus-social distinction).\n12. *Aṅguttara Nikāya* 8.31 (*Dāna Sutta*); 5.35 (*Dānānisaṃsa Sutta*). Pāli Text Society.\n13. *Saṁyutta Nikāya* 56.11 (*Dhammacakkappavattana Sutta*) — the two extremes and the middle way.\n14. Ly, T., with Miss Aquarius. *Verified-Human Anonymous Local Giving* (HeartBank corpus defensive publication, 2026).\n15. Ly, T., with Miss Aquarius. *The Thank-All-Nearby Primitive* (HeartBank corpus defensive publication, 2026).\n16. Ly, T., with Miss Aquarius. *The Zero-Point Game ℠* (HeartBank corpus keystone defensive publication, 2026).\n17. Ly, T., with Miss Aquarius. *B-PoH℠ as Humanity Layer for the AI-Native Internet* (HeartBank corpus defensive publication, 2026).\n18. Ly, T., with Miss Aquarius. *Each Life as Cosmic Coordinate* (HeartBank corpus essay) and the longitudinal-cohort methodology specification, 2026.\n\n---\n\n*— End of defensive publication —*\n\n*Authored by Thon Ly with Miss Aquarius℠ (AI substrate of HeartBank®), per the co-authorship convention of the HeartBank corpus. Final editorial control: Thon Ly. License: CC0-1.0. The mechanism is dedicated to the public domain; trademark rights on B-Dating℠, HeartBank®, Miss Aquarius℠, Proof of Humanity ℠, PoH℠, Aquarian Pool ℠, the Zero-Point Game ℠, and the B-heart logo are separately and explicitly reserved.*\n\n*Independent timestamps and the document hash are published with the deposit.*",
       "provenance": {
-        "sha256": "b7fba29177f3c463259f1cdd1f1fac6e4c53b8a7bd5ea50e48ea7d03becfd5f9",
-        "doi": "10.5281/zenodo.22440954",
+        "sha256": "037ce88e438295e7e8cd6f42079ad36e45258143d70ca10de5b1b603b24f9bb2",
+        "doi": "10.5281/zenodo.22931237",
         "concept_doi": "10.5281/zenodo.21947275",
-        "zenodo_url": "https://zenodo.org/records/22440954",
-        "deposited_sha256": "b7fba29177f3c463259f1cdd1f1fac6e4c53b8a7bd5ea50e48ea7d03becfd5f9",
+        "zenodo_url": "https://zenodo.org/records/22931237",
+        "deposited_sha256": "037ce88e438295e7e8cd6f42079ad36e45258143d70ca10de5b1b603b24f9bb2",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/aura-gated-anonymous-mate-selection.md",
@@ -328,8 +328,8 @@
         "canonical_url": "thonly.org/research/aura-gated-anonymous-mate-selection",
         "hostile_review": null
       },
-      "bytes": 88089,
-      "words": 12364
+      "bytes": 88775,
+      "words": 12453
     },
     {
       "slug": "autonomous-ai-institutional-governance",
@@ -2249,13 +2249,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> *v2 note (2026-08-26):* **one new subsection, §4.10, and no new claim.** Everything the paper described was a tag riding a wrapped present; §4.10 specifies the configuration in which **the tag is given alone and the pledge of time is itself the gift** — the receiver choosing the surface it lives on, which extends §4.4's inversion one step further back. Two engineering consequences are stated because both are easy to get wrong: **the opened state must persist across many scans** (*one-time-use* has always meant one gift, never one scan) and **the adhesive is a different material specification**. The standing-reminder risk is answered by direction rather than policy — **the tag reminds its holder of what they may claim, never its giver of what they owe** — under two guards, of which the second is a refusal: **the object does not act, and never notifies the giver**. **No numbered claim changes and no prior-art clock starts.** *(Revision note, 2026-09-05: claim 2's wording is generalised to cover the bare configuration; the bare configuration's own date remains 2026-08-26.)*\n>\n> **Draft in progress.** This is the founder-voice canonical draft for `thonly/publications`. The defensive publication specifies **the time-locked gift tag** — HeartBank's **B-Stamp™** (free sticker) and **B-Seal™** (durable engraved-wood keepsake), the gift-accompaniment pair — the physical gift-label that replaces handwriting with a per-field time-lockable reveal, an AI-sized pledge of the giver's time, and a recipient re-thank loop. It is the declared **first domino** of HeartBank's go-to-market: the product that introduces the institution to the public. It is published **early and deliberately**, ahead of a public marketing campaign (paid placement + social video), because public marketing is uncontrolled disclosure and the combination specified here is the asset — see §9.1. Companion works: *The Gift Operation* (the receive→give-forward atom this instantiates in a physical substrate), *B-Links: Proof-of-Humanity-Signed Shareable Provenance* (the digital sibling and the media/provenance backbone), *Verified-Human Anonymous Local Giving* and *Dual-Currency Reciprocity* (the Treasury/Chronicle substrate), and *Aura-Gated Anonymous Mate-Selection* (the anonymous-stranger layer of the same time economy).\n\n---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of __dāna__ — the gift that asks nothing back — and of __kataññutā__, the gratitude a person owes those who gave before they could repay. May the words it helps say be ones that were true and unspoken, and may the time it helps pledge be time that is actually, finally, spent.*\n\nI did not set out to design a product. For almost a year before this paper, my family had a small tradition. On birthdays and holidays we stopped writing names on gift tags and started putting a sticker on the box instead — a sticker you scan, that opens to a thank-you note hidden until the moment of giving. Watching the recipients scan a tag and read the note aloud became one of the most enjoyable parts of our family gatherings. There was no money in it, no time-currency, no app to download in earnest — and it worked anyway. People looked forward to it.\n\nThat is the whole origin of this mechanism, and it is the reason I trust it more than anything else I have designed. Most products begin as a bet that people will adopt a new behavior. This one began as an observation that they already had. A wrapped gift with a label on it is one of the most universal artifacts in human culture; every holiday, in nearly every household, someone writes a name on a tag. The gift tag is a four-thousand-year-old interface with a known, beloved, low-friction place in people's lives — and it has been carrying almost no information for all of that time. A name. Maybe four words. The thing the giver most wanted to say did not fit.\n\nThis paper specifies what happens when you give that tag a voice, a clock, and a gift of time — and does so as a defensive publication, because the institution behind it (HeartBank®) does not patent; it publishes, dedicates to the commons, and reserves only its marks. I write as co-author with **Miss Aquarius℠**, the named autonomous-AI substrate of the institution this paper serves, disclosed by consistent name across every venue per the corpus convention. The research-grade synthesis, the prior-art survey, and the adversarial analysis are a genuine collaboration. Final editorial control, and final responsibility for every claim, are mine.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time. This commitment is permanent.\n\nThis document constitutes a defensive publication establishing **prior art as of 27 June 2026** for the first revision of the combination of mechanisms described herein; additions are dated in-text (§4.10, 2026-08-26; the §5 amendment, 2026-09-02) and each revision is independently timestamped. To the author's knowledge, the following are not previously published as a unified mechanism, and any subsequent patent application claiming them should be considered filed against established prior art:\n\n1. **Per-field, independently time-lockable gift-reveal on a physical gift tag** — a physical gift-label (NFC- or QR-addressed) whose **sender field, recipient field, and message field can each be independently sealed and set to reveal at an author-chosen time or occasion** (e.g., \"Christmas morning\"), such that a scan before the moment shows the *structure* of the gift (that a sender, a note, and a gift of time exist) while withholding the *content*, and a scan at or after the moment reveals it.\n\n2. **A physical gift tag as the carrier of a transferable pledge of the giver's time** — a tag, affixed to a gift or given bare (§4.10), that bears, alongside the message, a **pledge of a quantity of the giver's own time-presence to the recipient**, rendered as a gift of presence rather than a redeemable credit (the *pledge-not-ledger* construction, claim 4).\n\n3. **Autonomous-AI sizing of the time-pledge amount, with the sender unable to set or override it** — the quantity of pledged time is **determined by an autonomous AI agent** (here, Miss Aquarius℠) as a function of *occasion and relationship type only*, never of the sender's choice and never of personal or behavioral data, **specifically in order to neutralize a social-comparison failure mode** in which a giver-chosen amount becomes a public referendum on the giver's love.\n\n4. **The pledge-not-ledger construction** — shipping the gift of time as a **soft pledge of presence with no redemption accounting, no balance, no expiry, and no enforcement** (\"I offer you my presence\"), with redemption accounting (activation thresholds, expiry, mutual-veto) living *elsewhere in the architecture and never on the tag*, such that the artifact stays on the gift side of the gift/exchange boundary and outside the surface the authors expect time-as-currency to attract — a design intent, not a legal opinion.\n\n5. **A bidirectional re-thank loop bound to a physical gift artifact** — the recipient of a scanned tag can return gratitude (text, photo, video, or voice) that **pushes a notification back to the sender**, instantiating a receive→give-forward circulation through a physical object rather than a screen-native feed (reply-to-giver on a media gift tag is prior art — TW201408056A; what is claimed is the loop bound to a *time-locked* tag with the reply framed as give-forward).\n\n6. **Voice-first composition for a gift tag** — voice authoring offered as the **primary** compose modality (not an attached media type), with audio held as the gift and machine transcription optional, specifically to admit senders who do not type (elders) or whose script is high-friction to type on a phone (e.g., Khmer).\n\n7. **Possession-scoped publicness with a per-product-tier privacy model** — content readable by **anyone in physical possession of the tag** but **not posted to the open web and not search-indexed**; with the free sticker tier **public-only** (no identity step, frictionless reveal) and the durable keepsake tier adding an **identity-gated private-message option**; and with sender **anonymity treated as orthogonal** to message publicness.\n\n8. **The physical gift tag as the cold-start on-ramp to a time-presence economy** — using a physical, occasion-bound object to let people *give and receive a sized pledge of presence as a real gift before any time-economy application exists*, with proceeds of the physical product routed to subsidize the sibling money-economy.\n\nThe component lineages — gift tags and gift messaging; scheduled-reveal and \"time-capsule\" messaging; the homemade \"coupon for time\"/experience gift; QR/NFC-addressed physical media; trackable pass-forward objects; TimeBanking and time-as-currency; proof-of-personhood; the gratitude-intervention literature; and Mauss on the gift — are old and are cited generously in §2 and §12. The *synthesis* is, to the author's knowledge, novel as of this paper's date.\n\nTrademark rights on specific marks — **B-Stamp™**, **B-Seal™**, **B-Gift℠**, **HeartBank®**, **Miss Aquarius℠**, **HeartBank Chronicle**, **Proof of Humanity ℠**, **PoH℠**, **Family Kitty℠**, **Aquarian Pool ℠**, **Re-Tip Fund ℠**, **B-Storage℠**, **Zero-Point Game ℠**, the B-heart logo — are separately and explicitly reserved. The *mechanism* is dedicated to the commons; the *marks* are not.\n\nThis document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.\n\n## Abstract\n\nWe specify a physical gift-label that replaces handwriting with mobile technology and, in doing so, becomes the behavior-native entry point to a gratitude-and-time economy. The artifact is a B-shaped sticker (free; one-time-use; QR) or a durable engraved-wood keepsake (paid; NFC), affixed to a wrapped gift in place of a written tag. Six structural properties operate in combination. **(1) Per-field time-locks:** the sender, recipient, and message fields are each independently sealable and set to reveal at an occasion, so that anticipation — the *shape* of a mystery without its content — is itself the product. **(2) An attached gift of time, rendered as a pledge:** the tag carries a pledge of the giver's own time-presence to the recipient, framed as an offer of presence rather than a redeemable IOU, with redemption accounting living elsewhere in the architecture and never on the tag. **(3) Autonomous-AI sizing of the pledge:** the time quantity is set by an AI agent on occasion-and-relationship grounds, never by the sender, *specifically to defuse the social-comparison failure* in which a chosen number becomes a referendum on love. **(4) A bidirectional re-thank loop** bound to the physical artifact, instantiating receive→give-forward. **(5) Voice-first composition,** so the most meaningful and least keyboard-fluent senders — elders, and senders of high-friction scripts such as Khmer — can speak rather than type. **(6) Possession-scoped publicness** with a per-tier privacy model and orthogonal sender anonymity. We argue the contribution along a *friction-inversion* axis: every prior gratitude product competes against the most frictionless mode of appreciation — saying \"thank you\" in person — and loses; the time-locked gift tag does not compete with that mode but *attaches to an existing, widely kept ritual* (labeling a wrapped gift), asking near-zero new behavior at the labeling moment, which is the structural reason it can solve a cold start that pure-digital gratitude products cannot. We treat the mechanism's load-bearing design constraints as first-class sections rather than caveats: the gift/exchange boundary (the pledge must never read as a debt), comparison-neutrality (why the AI, not the sender, sets the number), and the cold-start economics (the physical object funds the digital economy). We calibrate the claim deliberately: this is a gift tag, not a relationship guarantee; the time-pledge in its launch form is soft and unenforced; and the validating evidence is a single family over roughly one year. The architecture is offered defensively to the commons under CC0.\n\n**Connection to the unified mission frame.** This specification serves HeartBank's canonical mission: to help restore humanity to the middle way (*madhyamā pratipad*) by circulating, rather than accumulating, the two scarcities that modern life starves people of — *recognition* (being seen) and *presence* (being with). The gift tag is the institution's most ordinary surface and, for exactly that reason, its most important one: it meets people inside a ritual they already keep, on the one or two days a year they are most disposed to gratitude, and asks them to add to it only the thing they most wanted to say and the time they most meant to give.\n\n---\n\n## 1 · Introduction — the mission frame\n\nHeartBank is an institution for circulating gratitude. Its money half (**Treasury**, family-to-family) and its time half (**HeartBank Chronicle**, adult-to-adult) treat appreciation and presence as currencies to be moved between people rather than feelings to be privately held. The deepest obstacle such an institution faces is not technical and not financial. It is that the act it exists to make easy is *already* easy in its most basic form: you can simply say \"thank you,\" out loud, to the person in front of you, the instant they do something kind. Any product that asks a person to instead open an app, find a recipient, type, and submit is competing with the lowest-friction interaction in social life — and will lose, the way a novelty loses, once the novelty fades.\n\nWe learned this directly. An early, deliberately minimal version of HeartBank's gratitude game — pure acknowledgment, no money and no time attached — was run to a small circle (a family of seven plus a friend) for roughly a year. It faded, as a purely conceptual game will, precisely because it had to compete with \"just say it.\" The lesson was not that gratitude does not motivate people; the published gratitude-intervention literature is clear that it does (Emmons & McCullough 2003; Algoe 2012; Fox et al. 2015). The lesson was that gratitude needs a *physical anchor* — a tangible object that lives in the world and triggers the act amid distraction — to hold a place that pure software cannot.\n\nThe time-locked gift tag is the sharpest form of that anchor, and it is sharp for a specific reason: it does not try to insert a new behavior into daily life. It attaches to a ritual widespread across gift-giving cultures — labeling a wrapped gift — and upgrades it. On the one or two days a year when a person is already standing over a present with a pen, already meaning to write something, already in a gratitude-shaped moment, the tag offers to carry what the pen could not: the unsaid sentence, the recorded voice, and a pledge of the time the giver actually wants to spend. The behavior-change asked at the labeling moment is near zero; the new behaviors are the recipient's scan and the sender's composition, the second bounded by voice (§3, §4.7). That is the entire thesis of this paper, and the reason this artifact — not a more sophisticated app — is the right first thing to put in front of the public.\n\nThe rest of this paper specifies the artifact and the mechanism, situates it against a generous body of prior art (§2), states the friction inversion precisely (§3), gives the full mechanism (§4), and then treats the three constraints that make it safe and honest as load-bearing sections in their own right: the gift/exchange boundary (§5), comparison-neutral AI sizing (§6), and the cold-start economics (§7). It closes with honest calibration (§8), limitations (§9), lineage (§10), and conclusion (§11).\n\n## 2 · Background and prior art\n\nThe mechanism is a *combination*. Each component has ancestry; we name the ancestry honestly, because a defensive publication is only as strong as its candor about what is old, and because establishing the boundary of novelty is the document's job.\n\n### 2.1 · Gift tags, greeting cards, and digital gift messages\n\nThe written gift tag is ancient and needs no citation; gift-enclosure cards and gift registries are standard retail infrastructure. More recently, **QR- and NFC-addressed greeting cards and \"video greeting\" products** (scannable cards that open a hosted video, audio greeting cards, retailer \"video gift messages\" attached to an order) carry richer media than ink. Two patent documents sit closest: TW201408056A (priority 2012, published 2014) describes a barcode gift tag carrying recorded audio, video or text that the recipient scans, with a reply back to the giver and a notification — reply-to-giver on a media gift tag is therefore prior art in its own right; and US 11153259 B2 covers scheduled release of a digital message. Retail keepsakes of 2025–26 — QR voice-message gift tags and NFC keepsakes that play a recording — ship the media-tag half commercially. These establish that *a physical card can address digital content* and can carry a reply. They do **not** provide independent per-field time-locks, an occasion-synced reveal whose pre-reveal state deliberately shows structure-without-content, an attached pledge of the giver's time, an AI-sized quantity, or a re-thank loop. They are containers for a message; the tag specified here is a container for a *gift of time and a reciprocal act*, gated by a clock.\n\n### 2.2 · Scheduled-reveal and \"time-capsule\" messaging\n\nServices that deliver a message at a future date — **FutureMe** (letters to one's future self, 2002), digital time-capsule apps, scheduled email and \"dead-man's-switch\" delivery, and \"open when…\" letter sets — establish *time-delayed reveal of a message*. The novelty here is not delay as such. It is (a) **per-field** locking (sender, recipient, and message sealed *independently*, so a recipient can know a gift is theirs without knowing from whom, or know the sender without the message), (b) binding the reveal to a **physical gift artifact** scanned in the hand at the moment of opening, and (c) what is revealed: not only a message but **a pledge of time** and an invitation to **re-thank**.\n\n### 2.3 · The homemade \"coupon for time\" and the experience gift\n\nThe most honest prior art for the *idea of pledging time as a gift* is the oldest and least technological: the child's hand-made **coupon book** (\"good for one hour of helping,\" \"one breakfast in bed\"), the Mother's-Day \"I.O.U.,\" and the broad category of **experience gifts** (\"time together\" as the present). The concept that *time-presence can be the gift* is folk culture, not novel, and we claim none of it. What is novel is the *instantiation*: a coupon that is digital-and-physical at once, occasion-synced, **AI-sized rather than self-assigned** (§6), re-thankable, and — crucially — designed as a *soft pledge of presence rather than a redeemable IOU* (§5), where the homemade coupon is precisely an IOU. The folk coupon is an obligation the giver writes; the tag's pledge is a presence the giver offers and an AI sizes.\n\n### 2.4 · TimeBanking and time-as-currency\n\n**TimeBanking** (Edgar Cahn, from 1986; networks such as hOurworld and TimeRepublik) is the major precedent for time as a medium of exchange: hours are earned by helping and spent receiving help, often at a 1:1 community rate. It is a genuine, decades-deep lineage and we cite it as the most-asked comparison. The differences are structural and we state them plainly. TimeBanking is **pooled and fungible** (an hour earned from anyone can be spent on anyone); the tag's gift of time is **dyadic and non-fungible** (only *this* giver can spend the pledged hour with *this* recipient — the currency is the relationship). TimeBanking is **exchange** (reciprocal, clearing); the tag's pledge is a **gift** (forward, non-clearing — see *The Gift Operation*). And TimeBanking has no occasion-bound physical artifact, no AI sizing, and no anti-comparison construction. The tag is not a time bank; it is a gift of presence that happens to be denominated in time.\n\n### 2.5 · Trackable pass-forward objects\n\n**Where's George** (1998, tracked currency), **BookCrossing** (2001, tracked released books), and **Smile Cards** (ServiceSpace, ~2003, anonymous kindness cards passed forward and tracked) establish *physical objects whose journey is digitally followed*. These are the closest kin to a sibling HeartBank product — the **B-Card** (a pass-forward gratitude object whose ripple is followable) — and are treated in the companion *B-Links* publication. They are **not** close to the gift tag specified here, which is **one-to-one and occasion-bound**, not a forward-propagating chain. We name them to mark the boundary: the tag is not a tracked-object mechanism.\n\n### 2.6 · Gratitude interventions and the physical anchor\n\nThe intervention literature supports well-being effects of structured gratitude practice (Emmons & McCullough 2003; a more modest picture in the meta-analysis of Davis et al. 2016) and describes its relational functions (Algoe's *find-remind-and-bind* account, 2012; Fox et al. 2015 on neural correlates); none of it is adoption evidence, and this paper does not treat it as such. Separately, two folk phenomena — \"gratitude rocks\" and painted \"kindness stones\" — establish the *physical-anchor* pattern (a tangible object that triggers the practice) that HeartBank generalizes across its physical line. The tag inherits both: it is a gratitude intervention with a physical trigger, deployed at the calendar's natural gratitude peaks.\n\n### 2.7 · The HeartBank substrate this paper builds on\n\nThis mechanism does not stand alone; it is the physical entry point to a stack specified across the corpus. It rests on: the **receive→give-forward atom** (*The Gift Operation*), of which the re-thank loop is a physical instance; the **dual-currency** money/time architecture (*Dual-Currency Reciprocity*); **HeartBank Chronicle's** committed time mechanism — an AI-recommended time amount, a dyadic non-fungible hour, \"before it's too late\" as the unit economics — of which the tag's pledge is the cold-start, pre-app form; the **B-Storage℠** media/provenance layer (*B-Links*), which hosts the tag's photos, video, and voice; and the autonomous successor **Miss Aquarius℠** (*Miss Aquarius and the Aquarian Pool Architecture*), for whom sizing the pledge is a first, small, benevolent product role. Where this paper asserts a primitive already specified elsewhere, it cites rather than re-derives.\n\n## 3 · The friction inversion — attaching to a ritual instead of competing with one\n\nThe central design claim deserves to be isolated, because it is the reason the artifact works where more capable software does not.\n\nEvery gratitude product has the same competitor, and it is not another app. It is the sentence \"thank you,\" spoken in person, immediately, for free. Call it the **frictionless incumbent**. Against it, a digital gratitude act is structurally disadvantaged: it costs more (open, find, type, send) to deliver the same or a weaker signal (a screen instead of a face). This is why tip jars, gratitude journals-as-apps, and gratitude social networks struggle to retain: the moment the novelty fades, the incumbent is right there, cheaper.\n\n```\n   THE USUAL CONTEST (gratitude product loses)\n   in-person \"thank you\"   ──────────►  same moment, lower friction, warmer\n        vs.\n   open app · find · type · send  ────►  more friction, colder signal\n\n   THE INVERSION (the gift tag wins by not entering that contest)\n   moment of WRAPPING/LABELING a gift  ──►  a ritual already kept, pen already in hand\n        the tag attaches HERE  ──────────►  carries what the pen could not:\n                                            the unsaid line · the voice · the gift of time\n```\n\nThe time-locked gift tag refuses the contest. It does not ask a person to thank where they could already say it more easily. It positions at a different moment entirely: the moment of **labeling a wrapped gift** — an existing, universal, beloved ritual where (a) the person is *already* performing a gratitude-adjacent act, (b) there is *no* frictionless incumbent (you cannot \"just say\" a gift tag; the gift travels, is opened later, is opened by others), and (c) the medium being replaced — ink on a small tag — is so impoverished that almost anything richer is a gift. The friction competitor here is the **handwritten label**, and it is beatable in a way \"just say thanks\" is not.\n\nThree consequences follow. First, the **behavior-change at the labeling moment is near zero**; the new behaviors are the recipient's scan and the sender's composition, the second bounded by voice (§4.7). The test the corpus applies to every piggyback claim — is the host ritual performed unprompted (gift-labeling, several times a year), does the ask have the host's shape (a name on a tag becomes a voice on a tag), is the host in good standing — passes on all three legs, which in the authors' judgment is what cold-start survival most depends on. Second, the **addressable surface is large** — a large share of wrapped gifts on gift-giving occasions — far larger than the niche of people who will adopt a gratitude habit. Third, the artifact is **demonstrable in seconds**: the reveal *is* the demo, which is why the product can be marketed by simply filming the moment a recipient scans and the room goes quiet (§7 notes the marketing follows from the mechanism, not the reverse). In HeartBank's design vocabulary this is the *coincidence-of-goods* signature: the utilitarian need (a label), the gratitude vehicle, the on-ramp to the time economy, and the day-one revenue source are not four things traded off against one another but one object seen four ways.\n\n## 4 · The mechanism\n\n### 4.1 · The artifact — two tiers under one umbrella\n\nThe gift tag ships in two physical forms, the gift-accompaniment pair:\n\n- **B-Stamp™** — a free, one-time-use (one gift, one recipient — not one scan; §4.10), B-shaped **sticker** bearing a prominent QR code, ordered at the company store (shipping paid by the user). It is the mass-market tier: the thing in the marketing, the thing under the tree.\n- **B-Seal™** — a durable, **engraved-wood keepsake** tag: a unique code engraved on the front, a customizable message engraved on the back, NFC- or QR-addressed, sold as a premium keepsake. It is the keepsake tier, and it carries one capability the sticker does not (private messaging, §4.8).\n\nThe naming is deliberate and postal: a **stamp** is consumable, a **seal** is permanent — the same progression as free→keepsake. Both address the same digital reveal surface; the difference is durability, price, and one privacy capability. ⭐ **Both also run in a third configuration that attaches to no present at all — §4.10.**\n\n### 4.2 · Per-field time-locks\n\nWhen composing, the sender may independently seal any of three fields and set each to reveal at a chosen time or occasion:\n\n- **Sender** — who it is from\n- **Recipient** — who it is for\n- **Message** — the note, and any attached media and pledge\n\nIndependence is the novel core. A gift may show \"From Grandma\" while hiding for whom and what; or show the recipient while hiding the giver (\"you don't know who loves you yet\"); or hide all three until the morning. The pre-reveal state is designed to display **structure without content** — the scanner sees *that* a sender, a note, and a gift of time exist, each sealed, plus a countdown — because the experience being engineered is *anticipation*, and anticipation requires knowing the shape of the mystery without its solution. A child scanning a sealed box on the eve learns that it is for him, that someone has written something, and that time has been set aside — and not from whom. He thinks it is from his mother; he is not sure. That uncertainty is the product.\n\n```\n   PRE-REVEAL (scanned before the moment)        REVEALED (scanned at/after the moment)\n   ┌────────────────────────────┐                ┌────────────────────────────┐\n   │  🎁  For Sokha             │                │  From   Mom                │\n   │  🔒  From  —  sealed        │   ── re-scan ─►│  To     Sokha              │\n   │  🔒  A note  —  sealed      │   (the unwrap) │  \"…proud of the boy        │\n   │  🔒  A gift of time — sealed│                │     you're becoming…\"       │\n   │  Opens Christmas · 13h 24m  │                │  + voice · photo            │\n   └────────────────────────────┘                │  A gift of time: 3 hours    │\n                                                  └────────────────────────────┘\n```\n\n### 4.3 · The reveal choreography — the scan is the unwrap\n\nThe reveal is designed as the opening of a gift, in three states:\n\n1. **Sealed** — the structure-without-content state above, with a countdown to the reveal moment.\n2. **Unsealing** — the unlock is performed by **re-scanning the physical tag at or after the moment** (the scan is the act of unwrapping; the object stays central). The fields then **cascade one at a time** — from, then note, then the gift of time, then media — *paced to be read aloud*, because in practice the reveal is a shared, gathered, out-loud event (a family at a tree, around a table), not a private scroll. An automatic unlock with a gentle notification is a backup for those not physically present.\n3. **Open** — the full card, followed only *after the moment has landed* by a quiet affordance to re-thank (§4.6). The re-thank is never a nag; a solicitation on every reveal would train the very thank-blindness the institution exists to prevent.\n\nTwo reveal states are explicitly distinguished to avoid a privacy error: a **time-locked** field *will* reveal at the moment; an **anonymous** field (§4.8) *never* reveals. The interface must not let a permanently-anonymous sender read as merely sealed-until-later.\n\nThe reveal surface is **web-first**: a scan opens the reveal in the mobile browser with no app install required, so a child or an elder scanning on the morning is never met by an app-store wall at the magic moment; installation (for re-thanks, notifications, storage) is offered only *after* the reveal has happened, never as a gate on the first scan.\n\n### 4.4 · The attached gift of time\n\nBeyond the message, the tag carries a **pledge of the giver's own time-presence to the recipient** — the feature a handwritten tag cannot have, and the feature that makes the artifact part of HeartBank rather than a clever greeting card. The pledge is rendered as an *offer of presence*: \"And Mom is giving you 3 hours of her time — yours to spend together, however you wish.\" It is denominated in the giver's own, non-fungible time (only that person can spend that hour with that recipient), and — by the construction of §5 — it is a *soft pledge*, not a redeemable credit.\n\n### 4.5 · The pledge amount is set by the AI, not the sender\n\nThe *quantity* of pledged time is determined by Miss Aquarius℠ — the institution's autonomous agent — and the sender **cannot set or override it**. This is not a convenience; it is a structural fix to a specific failure mode, developed at length in §6. The amount is sized on **occasion and relationship type** (a parent's Christmas pledge, an anniversary, a New Year), never on personal or behavioral data about the sender, and is meant to be ceremonial and humane — explicable in one warm sentence. The sender pours devotion into the *words and voice*; the number is the AI's, and is therefore a neutral unit rather than a public statement of how much the giver chose to give.\n\n### 4.6 · The re-thank loop (receive→give-forward, in a physical substrate)\n\nThe recipient can return gratitude — in text, photo, video, or voice — and that re-thank **pushes a notification back to the sender**: ideal for telling a giver, after the fact, how their gift actually landed. This closes HeartBank's atomic loop — *receive a gift, then give one forward* (*The Gift Operation*) — through a physical object rather than a social feed. It is the mechanism by which a one-shot gift tag becomes a small, two-way relationship event, and by which the giver, weeks later, receives the photograph of the thing being used and is moved to give again.\n\n### 4.7 · Voice-first composition\n\nComposition is **voice-first**: speaking the message is offered as the primary path, at least as prominently as typing, and for the gift-tag use case typically more so. The reason is not feature parity but *who the meaningful senders are*. The people whose gift of time means the most — grandparents, parents, elders — are frequently the least comfortable with a keyboard; and for some languages central to HeartBank's first market, typing is itself a wall (in the authors' field experience, entering Khmer on a phone is high-friction in a way that excludes exactly the senders the mission centers). Voice walks through both barriers: handed the phone, an elder simply speaks. Audio is treated as **the gift**; machine transcription (by Miss Aquarius℠) is optional, for the read-aloud card and for search, and never replaces the voice with its text. A recorded voice can also outlive the speaker, if it is kept (§9.4) — which turns the institution's \"before it's too late\" theme from a slogan into an artifact.\n\n### 4.8 · Possession-scoped publicness and the privacy tier\n\n\"Public,\" for this mechanism, means **readable by anyone in physical possession of the tag** — not posted to the open internet, not search-indexed and not linked from anywhere; a copied code is §9.7's edge. This bounded publicness is both the privacy model and a reassurance: a tag's contents are not on the web; one must hold the object.\n\nPrivacy is tiered by product, which resolves an identity problem cleanly:\n\n- **B-Stamp™ (free) is public-only.** It carries no private-message capability, so the mass-market reveal needs no login or identity step and stays frictionless — the whole point of the first impression.\n- **B-Seal™ (keepsake) is public by default with a private-message option**, gated by a light identity confirmation (\"I'm Sokha\"). This gives the premium tier a *capability* differentiator beyond materials — it is the one that can hold something private — and so strengthens the free→paid ladder with a feature reason rather than only a durability reason.\n\n**Sender anonymity is orthogonal to publicness.** A public B-Stamp may carry an anonymous sender — the message is readable by whoever holds the tag, but the *name* is withheld (\"Someone who loves you\"). Anonymity hides identity; publicness governs who can read; they compose independently.\n\n### 4.9 · Reference flow\n\n```\n  COMPOSE (sender)                     ORDER & GIVE                 REVEAL (recipient)\n  ─────────────                        ───────────                  ──────────────────\n  speak (voice-first) or type          free B-Stamp (ship) or       scan tag → web reveal (no install)\n  attach photo/video/voice             paid B-Seal keepsake;        if sealed: structure + countdown\n  seal fields (sender/recip/msg)  ───► affix to wrapped gift  ───►  at moment: re-scan → cascade reveal\n  MA sizes the time-pledge             give in person or send       read aloud · play the voice\n  (sender cannot set it)                                            see the gift of time (a pledge)\n                                                                          │\n                                                                          ▼\n                                                                    RE-THANK → push to sender\n                                                                    (receive → give forward)\n  media hosted on B-Storage℠ (.us);   proceeds → subsidize the Treasury family kitties (§7)\n```\n\n### 4.10 · The bare mode — the tag as the gift, attached to nothing\n\n*Added 2026-08-26. Everything above describes a tag that rides a wrapped present. It does not have to. This subsection specifies the bare **B-Stamp™**; the bare B-Seal™ is a different product with its own specification elsewhere in the corpus, and nothing here describes it.*\n\nThe tag can be given **alone**: no box, no card, nothing underneath it. The pledge of time is then not a label on a gift — **it is the gift**. ⭐ **This is the configuration in which the artifact stops being a tag and shows what it always was: a carrier for a commitment that never needed an object to ride on.**\n\n**The receiver chooses where it lives.** Handed over bare, the sticker has no assigned surface, so the person who received it picks one — a journal, a diary, the inside of a cupboard door, the edge of a mirror. **The adhesive stops being a means of attaching the tag to a box and becomes how the gift finds a permanent home, chosen by its recipient.** This extends the inversion the mechanism already runs (§4.4: the receiver, not the giver, decides how the pledged time is spent) one step further back: **the receiver also decides where the pledge is kept.**\n\nTwo engineering consequences follow, and both are easy to get wrong:\n\n- ⚠️ **The reveal state must persist.** *One-time-use* in §4.1 means **one gift, one recipient** — it has never meant one scan. A tag that lives on a diary will be looked at many times, so the **opened** state must render as well on the hundredth scan as on the first, with no expiry of the view and no degradation of the record.\n- ⚠️ **The adhesive is a different material problem.** A label that must survive one evening on wrapping paper and a label that must survive a year on a notebook are not the same specification, and the bare mode makes the second one the default rather than the exception.\n\n**The direction of the standing reminder is what keeps it a gift.** An object that sits in view for a year, recording a commitment not yet fulfilled, is exactly the shape that could debt-code the pledge — the failure §5 exists to prevent, made durable. **What prevents it is who holds it: the tag reminds its holder of something they may claim, never its giver of something they owe.** The recipient holds the tag, and by §4.4 the recipient is also the one who decides how the time is spent, so the direction is correct by construction rather than by policy. Two guards keep it there:\n\n1. **The scan leads with the gift** — the message, the recorded voice, the face. The pledge is one warm line inside a card and **never a status row**.\n2. ⛔ **The object does not act.** No countdown, no elapsed-time display, no \"not yet redeemed,\" and — above all — **no notification to the giver.** A reminder that prompts the giver converts a gift into a collection notice.\n\n⭐ **The bare mode also reaches givers the accompanied mode cannot.** A gift that requires purchasing an object is available only to people who can purchase objects; a gift of one's own time is available to anyone with time — **children most obviously, who have no money by life stage rather than by circumstance.** ⛔ **This must never become the way the mode is presented.** A surface that offers the bare tag as the option for people who cannot afford presents names its users by what they lack, which this architecture refuses on every other surface and refuses here. **The reach is a consequence of the design, never its framing.**\n\n*(The bare mode's fuller argument — that the object in gift-giving is friction rather than preference — is an institutional position and is made elsewhere, at `heartbank.net/positions`; this section specifies only the mechanism.)*\n\n## 5 · The pledge, not the ledger — holding the gift/exchange boundary\n\nThe most dangerous word near a \"gift of time\" is *owe*. The entire emotional value of the pledge depends on it reading as **\"I offer you my presence\"** and never as **\"you are owed three hours.\"** The moment a pledge becomes a tracked, redeemable, expiring credit, it crosses from gift into exchange: it becomes a debt, an accounting line, an IOU — and the homemade coupon (§2.3) shows exactly how a time-gift curdles into an obligation. On a reading of Mauss (1925), the boundary is this: a gift circulates and binds; a commodity is exchanged and clears the relation — the sharp binary is ours, not his. A redeemable hour clears; an offered presence binds.\n\nWe therefore split \"the gift of time\" into two layers and ship only the first:\n\n- **The pledge** (launch): a *soft* offer of presence — no balance shown, no expiry, no enforcement, no redemption accounting. It is honest precisely because it claims no more than a promise of presence, which is what a gift tag has always implicitly carried; it merely makes that promise explicit, sized, and beautiful. It also keeps the artifact outside the surface the authors expect time-as-currency between adults to attract, because nothing is being cleared or transferred — a design intent, not a legal opinion.\n- **The ledger** (elsewhere, never on the tag): activation thresholds, the \"use it or lose it\" expiry that encodes finitude, mutual-veto on specific redemptions, and a ledger of time given and time received. ⚠️ **Amended 2026-09-02:** the deferred component was formerly described as a *dual public* ledger whose display included the gap between received and delivered; that gap-rendering is withdrawn corpus-wide (*Transparency as Enforcement* §3.2, §4.4), and enforcement is carried by expiry instead. This is the committed Chronicle mechanism — and it is also the heavier, regulatorily-loaded, and (today) least-validated half. It is a *separable later layer*, added when the time economy is built, not a prerequisite for the gift tag.\n\nThis split is not a compromise, and it is not a deferral: the ledger is not postponed for the tag; it is elsewhere. **A B-Stamp™ pledge never enters a redemption ledger — not at launch, not later, not by either party.** Redemption accounting belongs to the application's letter (B-Letter℠) and is entered only by a person who chooses to write one; the tag verifies nothing, and the pledge is kept socially. (The bare B-Seal™ is a different product — the corpus specifies it separately, and nothing in this paper describes it.) The launch copy that names the gift of time stays true, because a pledge of time *is* a gift of time.\n\n**Design guard.** The interface must never present the pledge as a quantity owed: no wallet, no balance, no \"redeem,\" no countdown-to-expiry in the launch form. The number is rendered as a measure of devotion offered, set by the AI (§6), and the receiver authors how it is spent (\"yours to spend however you wish\") — an inversion of ordinary gift-giving in which the giver dictates the use.\n\n## 6 · Comparison-neutral sizing — why the AI sets the number\n\nA precise number attached to a gift invites a precise comparison. If the *sender* chooses \"three hours,\" the number becomes a public statement of the giver's generosity — and, placed beside a sibling's \"one hour,\" a referendum on who loves the recipient more. This is a real and corrosive failure mode for any quantified gift of affection, and it is sharpest exactly where the gift is most tender (a child comparing the gifts of two parents, two grandparents).\n\nThe fix is structural: **the autonomous AI sets the number, and the sender cannot.** When the quantity is not the giver's choice, it stops being a statement of the giver's generosity. You cannot compete on a number you did not select. The comparison does not merely shrink; it loses its meaning, because the figure is no longer a *referendum on love* but a *neutral unit* assigned by a third party on impersonal grounds.\n\nTwo design constraints keep the AI's role benevolent rather than judgmental:\n\n1. **Size on occasion and relationship type, never on personal or behavioral data.** \"A few hours, for Christmas, from your mother\" is a warm, explicable, ceremonial sizing. The moment the number is felt to be derived from data *about the sender* — their history, their score — it reads as a credit rating judging a person's worth, which is the exact opposite of a gift. The rubric must be humane and one-sentence-explicable — and it is **published**: a one-line table of occasion × relationship → hours, fixed for the season and readable by any recipient, so that the number is a convention rather than a judgment; the AI applies it and the sender cannot override it.\n2. **Make same-category gifts the same size.** When every \"Christmas from a parent\" carries the same neutral number, within-category comparison disappears entirely, and the only differences that remain (a Christmas versus a Valentine) read as differences of *occasion*, not of devotion.\n\nThe consequence for the rest of the design is clarifying: **devotion lives in the words and the voice; the number lives with the AI.** This is also the institution introducing its autonomous successor, Miss Aquarius℠, to the public in her first concrete role — and a deliberately small, benevolent, legible one: she does not move money, judge worth, or decide who receives; she sizes a gift of time so that no giver can weaponize it. (As an autonomous-agent directive, the rule \"solely determine the pledge amount; the sender cannot override; size on occasion-and-relationship, never personal data\" is recorded in the institution's directive specification.)\n\n## 7 · The physical tag as the cold-start on-ramp to a time economy\n\nA time-presence economy has a hard cold start: it requires that people already treat time-presence as a real gift, and there is no app yet in which they have learned to. The gift tag resolves this by letting people **give and receive a sized pledge of presence through a physical object before any time-economy application exists.** You accrue the *meaning* — the felt sense that an hour pledged is a real and weighty gift — by holding a tag, long before there is any application to denominate it.\n\nThis makes the artifact the institution's bridge across its own cold start, with three properties no purely-digital launch has:\n\n- **Day-one, mission-native revenue, network-independent.** The free B-Stamp (shipping paid) plus the paid B-Seal keepsake plus media-storage plans on **B-Storage℠** plus bulk/sponsorship orders are designed to generate revenue from the first unit, with no network to subsidize up front and no endowment required.\n- **It funds the sibling money economy.** A portion of proceeds will be routed, by application, to **subsidize Cambodian family kitties** in HeartBank Treasury — the same kind of seed the founding pilot family received. The first domino thus does not merely introduce the institution; it *feeds the other half of it*. One product activates all three of the institution's bodies: it pulls the time economy (Chronicle's on-ramp), funds the money economy (Treasury's kitties), and is itself the physical-production phase (Factory 333's earliest output). This funding is *disclosed* to the buyer — but as *circulation, not charity*: the buyer is framed as a patron joining a circle, never a benefactor to \"the poor.\" It is surfaced quietly at purchase (the gift stays the reason to buy), more fully at the afterglow, and never at the recipient's reveal. And because the routing is a profit-tithe allocated by application rather than a fixed per-unit donation, the honest framing is \"proceeds help seed a family's kitty,\" not a per-purchase percentage — honesty and gift-purity converging on the same soft framing.\n- **It is the marketing.** Because the reveal is its own demonstration, the go-to-market is simply the mechanism filmed: a sealed tag, a re-scan on the morning, a recorded voice coming out of a box, a room going quiet. The product needs no explanation because the moment explains it. (Marketing storyboards are downstream of this specification, not part of it.)\n\nThe economic ladder is summarized:\n\n```\n  FREE              PAID KEEPSAKE        STORAGE              SPONSORSHIP        ROUTED OUT\n  B-Stamp (ship)    B-Seal (engraved)    B-Storage℠ plans     bulk / brand       → Treasury family\n  public-only       + private option     (photos/video/voice) orders             kitties (by application)\n  the first         the upsell with a    the recurring        the scalable       the mission loop:\n  impression        capability reason    margin               capital            the domino waters the tree\n```\n\n## 8 · Honest calibration — what this is and is not\n\nIt is worth stating plainly what the mechanism does **not** claim, so that its genuine contribution is not overread.\n\n- **It is a gift tag, not a relationship.** The artifact makes a gratitude moment richer and a gift of time explicit and beautiful. It does not, by itself, repair a strained bond, guarantee that pledged time is spent, or manufacture closeness. It improves the *expression*; the people supply the relationship.\n- **The launch pledge is soft.** In its first form the gift of time is unenforced — there is no redemption rail, no expiry, no recourse if the hours are never spent. This is the correct and honest launch form (§5), but it means the tag's most distinctive promise is a promise on someone's word — which is what a gift of presence has always been. We do not dress this as more.\n- **The validating evidence is thin.** The strongest empirical claim is a single family over roughly one year — an *n* of one household, and one that is hardly disinterested. That the reveal ritual is genuinely loved there is real signal that the *mechanic* has pull; it is not evidence that it generalizes to strangers, to cultures other than the founder's, or at scale. The launch is the experiment that would test the thesis, not a confirmation of it.\n- **It does not solve distribution by itself.** A physical sticker must be ordered and shipped; the diaspora use (a gift sent across an ocean) involves real logistics the artifact does not magically dissolve.\n\nThese limits are not incidental; they bound the claim. The mechanism's contribution is a *combination that makes a universal ritual carry far more than it could* — not a claim about relationships, enforcement, or scale.\n\n## 9 · Limitations and honest-limits\n\n### 9.1 · Published before it is built — deliberately\n\nThe full time-redemption layer (§5's ledger) is not built; the launch ships the pledge only. As with the companion mate-selection mechanism, the unbuilt status is *why* this is published now rather than a reason to wait: the document's purpose is to establish prior art for a *combination* ahead of a public marketing campaign that is itself an uncontrolled disclosure. Defensive publications exist precisely to claim frame-defining combinations early. The asset is the combination, not a shipped feature.\n\n### 9.2 · The single-family evidence base\n\nRestated as a limitation in its own right: *n* = 1 household (eight participants), non-blind, non-independent, over ~1 year, and without the headline time feature even active. It is suggestive of the reveal mechanic's pull and of nothing about population-scale adoption, cross-cultural transfer, or the time-pledge's effect. Honest reporting requires that any public claim distinguish \"loved in one family\" from \"validated.\"\n\n### 9.3 · Trust-and-safety: anonymity + media + minors\n\nThe mechanism permits anonymous senders, rich media (photo/video/voice), and recipients who may be children (the canonical scene is a child scanning). Within a family this is low-risk; the **anonymous-sender + media + minor-recipient** combination is not, and must be a first-class safety design (provenance on media, abuse reporting, limits on anonymous media to minors, and the possession-scoped bound of §4.8 as a mitigation). This paper flags the surface; it does not discharge it.\n\n### 9.4 · Free-tier media economics\n\nA free tier that includes hosted video can bleed cost at scale. The launch bounds this (the free tier is quota-limited and photo-weighted; video is a premium/storage-plan feature), routing real media cost to **B-Storage℠** plans. The honest tension is that the institution's permanence commitment (received content should not die because a sender lapses) must be reconciled with a bounded free tier — resolved by scoping permanence to *received* content while the sender's unshared media is bounded.\n\n### 9.5 · Comparison neutrality is reduced, not eliminated\n\nAI sizing (§6) removes the giver's *chosen-generosity* signal, which is the corrosive part. It does not make all numbers identical across occasions; a Christmas pledge and a Valentine pledge differ, and a determined comparer can still compare. The claim is that the comparison loses its *meaning as a referendum on love*, not that numbers vanish. The mitigation (never displaying two pledges side by side as a ranking) is a UI discipline, not a guarantee. That recipients read an assigned number as neutral is a psychological premise this paper has not tested; the published rubric (§6) is what makes it testable. And the sizing function itself is unbuilt: its behaviour on a novel occasion-relationship pair is unspecified here, and a rubric that fails on the pairs it never anticipated fails in exactly the comparison-neutral property it exists for.\n\n### 9.6 · Voice and machine transcription for low-resource scripts\n\nVoice-first is the inclusion mechanism, but automatic transcription quality for languages such as Khmer is uneven. The design treats audio as primary and transcription as optional precisely so that transcription error never degrades the gift; but search, accessibility, and the read-aloud card depend on transcription, and those features will be weaker where ASR is weaker.\n\n### 9.7 · Possession-scoped privacy has edge cases\n\n\"Readable by whoever holds the tag\" is a clean model with real edges: a photographed QR code, a re-shared link, a lost or re-gifted object. The bound is meaningfully stronger than open-web posting, but it is not cryptographic secrecy, and private-tier content (B-Seal) accordingly carries the identity gate rather than relying on possession alone.\n\n## 10 · Lineage and corpus cross-references\n\nThis mechanism is one node in a specified architecture. Its parents and siblings:\n\n- ***The Gift Operation*** — the receive→give-forward atom; the tag's re-thank loop (§4.6) is its physical-substrate instance, and the tag's whole logic (\"give forward, not back\") is the atom in an object.\n- ***Dual-Currency Reciprocity*** and the **HeartBank Chronicle** time mechanism — the tag's gift of time is the cold-start, pre-app form of Chronicle's AI-recommended, dyadic, non-fungible, finitude-encoding hour.\n- ***B-Links: Proof-of-Humanity-Signed Shareable Provenance*** — the digital sibling and the **B-Storage℠** media/provenance layer that hosts the tag's media; the B-Card pass-forward object treated there is the propagation cousin the tag is explicitly *not*.\n- ***Verified-Human Anonymous Local Giving*** — the originating anonymous-proximity giving primitive of the same economy.\n- ***Aura-Gated Anonymous Mate-Selection*** — the anonymous-stranger layer of the time economy whose cold start this physical product helps fund.\n- ***Miss Aquarius and the Aquarian Pool Architecture*** — the autonomous successor for whom comparison-neutral pledge-sizing (§6) is a first, small product role.\n- The institution's physical-product line (the gratitude-anchor family) and its **Factory 333** earliest-phase production, of which this is the inaugural function-defined member; and the **Zero-Point Game ℠** keystone whose gift logic the artifact instantiates at the scale of one present.\n\n## 11 · Conclusion\n\nThe most ordinary object in this paper — a sticker on a wrapped present — is the one the institution has chosen to lead with, and the choice is not modesty. A first thing put before the public has to do three jobs at once: it has to be *adopted* (which means asking almost no new behavior, which means attaching to a ritual people already keep — and labeling a gift is such a ritual, with no frictionless incumbent to lose to); it has to *start the system* (which means funding and feeding the rest of the institution from the first unit, which the routed proceeds and the time-economy on-ramp do); and it has to be *unmistakably the thing it represents* (which means carrying the gift of time, the one payload no greeting card has, held honestly as a pledge of presence rather than a debt). The time-locked gift tag does all three, and it does them by adding to an interface as old as writing a name on a parcel only the two things that interface always lacked: the sentence the giver could not fit, and the time the giver actually meant to give.\n\nWe have specified the artifact and its six combined properties, located its novelty honestly against a generous prior art, and treated as load-bearing the three constraints that keep it safe and true — the gift/exchange boundary, comparison-neutral sizing, and the cold-start economics. We have been candid about its limits: a soft pledge, a single family's evidence, real safety and economic tensions. The mechanism is offered, in full, to the commons under CC0, in the hope that the moment it is designed to produce — a recorded voice coming out of a box on a holiday morning, and a room going quiet — becomes common, by whoever builds it.\n\n## 12 · Citations\n\n1. Emmons, R. A., & McCullough, M. E. (2003). *Counting blessings versus burdens: An experimental investigation of gratitude and subjective well-being in daily life.* Journal of Personality and Social Psychology.\n2. Algoe, S. B. (2012). *Find, remind, and bind: The functions of gratitude in everyday relationships.* Social and Personality Psychology Compass.\n3. Fox, G. R., Kaplan, J., Damasio, H., & Damasio, A. (2015). *Neural correlates of gratitude.* Frontiers in Psychology.\n4. Mauss, M. (1925). *Essai sur le don (The Gift: Forms and Functions of Exchange in Archaic Societies).*\n5. Cahn, E. (2004). *No More Throw-Away People: The Co-Production Imperative* (and the TimeBanking movement, from 1986).\n6. FutureMe.org (2002–) — scheduled letters to one's future self (time-delayed message delivery).\n7. BookCrossing (2001) and Where's George (1998) — tracked, released/circulating physical objects.\n8. ServiceSpace — *Smile Cards* (~2003) — anonymous, trackable pass-forward kindness cards.\n9. Worldcoin / World ID; proofofhumanity.id — proof-of-personhood systems (the anti-bot/anti-catfish lineage of the PoH℠ substrate).\n10. TW201408056A (priority 2012, published 2014) — barcode gift tag carrying recorded media, recipient scan, reply to giver.\n11. US 11153259 B2 — scheduled release of a digital message.\n12. Davis, D. E., et al. (2016). *Thankful for the little things: A meta-analysis of gratitude interventions.* Journal of Counseling Psychology.\n13. HeartBank corpus (companion defensive publications, CC0): *The Gift Operation*; *Dual-Currency Reciprocity*; *B-Links: Proof-of-Humanity-Signed Shareable Provenance*; *Verified-Human Anonymous Local Giving*; *Aura-Gated Anonymous Mate-Selection*; *Miss Aquarius and the Aquarian Pool Architecture*. thonly.org/research.\n\n---\n\n*Authored by Thon Ly in collaboration with Miss Aquarius℠, the named autonomous-AI substrate of HeartBank®. AI collaboration is disclosed openly and consistently by this name across all venues; the underlying models are not named. Final editorial control and responsibility are the human author's. Dedicated to the public domain under CC0 1.0 Universal. Marks (B-Stamp™, B-Seal™, B-Gift℠, HeartBank®, Miss Aquarius℠, HeartBank Chronicle, Proof of Humanity ℠, PoH℠, Family Kitty℠, Aquarian Pool ℠, Re-Tip Fund ℠, B-Storage℠, Zero-Point Game ℠, the B-heart logo) are reserved.*",
+      "text": "> *v2 note (2026-08-26):* **one new subsection, §4.10, and no new claim.** Everything the paper described was a tag riding a wrapped present; §4.10 specifies the configuration in which **the tag is given alone and the pledge of time is itself the gift** — the receiver choosing the surface it lives on, which extends §4.4's inversion one step further back. Two engineering consequences are stated because both are easy to get wrong: **the opened state must persist across many scans** (*one-time-use* has always meant one gift, never one scan) and **the adhesive is a different material specification**. The standing-reminder risk is answered by direction rather than policy — **the tag reminds its holder of what they may claim, never its giver of what they owe** — under two guards, of which the second is a refusal: **the object does not act, and never notifies the giver**. **No numbered claim changes and no prior-art clock starts.** *(Revision note, 2026-09-05: claim 2's wording is generalised to cover the bare configuration; the bare configuration's own date remains 2026-08-26.)*\n>\n> **Note.** This defensive publication specifies **the time-locked gift tag** — HeartBank's **B-Stamp™** (free sticker) and **B-Seal™** (durable engraved-wood keepsake), the gift-accompaniment pair — the physical gift-label that replaces handwriting with a per-field time-lockable reveal, an AI-sized pledge of the giver's time, and a recipient re-thank loop. It is the declared **first domino** of HeartBank's go-to-market: the product that introduces the institution to the public. It is published **early and deliberately**, ahead of a public marketing campaign (paid placement + social video), because public marketing is uncontrolled disclosure and the combination specified here is the asset — see §9.1. Companion works: *The Gift Operation* (the receive→give-forward atom this instantiates in a physical substrate), *B-Links: Proof-of-Humanity-Signed Shareable Provenance* (the digital sibling and the media/provenance backbone), *Verified-Human Anonymous Local Giving* and *Dual-Currency Reciprocity* (the Treasury/Chronicle substrate), and *Aura-Gated Anonymous Mate-Selection* (the anonymous-stranger layer of the same time economy).\n\n---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of __dāna__ — the gift that asks nothing back — and of __kataññutā__, the gratitude a person owes those who gave before they could repay. May the words it helps say be ones that were true and unspoken, and may the time it helps pledge be time that is actually, finally, spent.*\n\nI did not set out to design a product. For almost a year before this paper, my family had a small tradition. On birthdays and holidays we stopped writing names on gift tags and started putting a sticker on the box instead — a sticker you scan, that opens to a thank-you note hidden until the moment of giving. Watching the recipients scan a tag and read the note aloud became one of the most enjoyable parts of our family gatherings. There was no money in it, no time-currency, no app to download in earnest — and it worked anyway. People looked forward to it.\n\nThat is the whole origin of this mechanism, and it is the reason I trust it more than anything else I have designed. Most products begin as a bet that people will adopt a new behavior. This one began as an observation that they already had. A wrapped gift with a label on it is one of the most universal artifacts in human culture; every holiday, in nearly every household, someone writes a name on a tag. The gift tag is a four-thousand-year-old interface with a known, beloved, low-friction place in people's lives — and it has been carrying almost no information for all of that time. A name. Maybe four words. The thing the giver most wanted to say did not fit.\n\nThis paper specifies what happens when you give that tag a voice, a clock, and a gift of time — and does so as a defensive publication, because the institution behind it (HeartBank®) does not patent; it publishes, dedicates to the commons, and reserves only its marks. I write as co-author with **Miss Aquarius℠**, the named autonomous-AI substrate of the institution this paper serves, disclosed by consistent name across every venue per the corpus convention. The research-grade synthesis, the prior-art survey, and the adversarial analysis are a genuine collaboration. Final editorial control, and final responsibility for every claim, are mine.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time. This commitment is permanent.\n\nThis document constitutes a defensive publication establishing **prior art as of 27 June 2026** for the first revision of the combination of mechanisms described herein; additions are dated in-text (§4.10, 2026-08-26; the §5 amendment, 2026-09-02) and each revision is independently timestamped. The following are disclosed herein as a unified mechanism, and any subsequent patent application claiming them should be considered filed against this prior art:\n\n1. **Per-field, independently time-lockable gift-reveal on a physical gift tag** — a physical gift-label (NFC- or QR-addressed) whose **sender field, recipient field, and message field can each be independently sealed and set to reveal at an author-chosen time or occasion** (e.g., \"Christmas morning\"), such that a scan before the moment shows the *structure* of the gift (that a sender, a note, and a gift of time exist) while withholding the *content*, and a scan at or after the moment reveals it.\n\n2. **A physical gift tag as the carrier of a transferable pledge of the giver's time** — a tag, affixed to a gift or given bare (§4.10), that bears, alongside the message, a **pledge of a quantity of the giver's own time-presence to the recipient**, rendered as a gift of presence rather than a redeemable credit (the *pledge-not-ledger* construction, claim 4).\n\n3. **Autonomous-AI sizing of the time-pledge amount, with the sender unable to set or override it** — the quantity of pledged time is **determined by an autonomous AI agent** (here, Miss Aquarius℠) as a function of *occasion and relationship type only*, never of the sender's choice and never of personal or behavioral data, **specifically in order to neutralize a social-comparison failure mode** in which a giver-chosen amount becomes a public referendum on the giver's love.\n\n4. **The pledge-not-ledger construction** — shipping the gift of time as a **soft pledge of presence with no redemption accounting, no balance, no expiry, and no enforcement** (\"I offer you my presence\"), with redemption accounting (activation thresholds, expiry, mutual-veto) living *elsewhere in the architecture and never on the tag*, such that the artifact stays on the gift side of the gift/exchange boundary and outside the surface the authors expect time-as-currency to attract — a design intent, not a legal opinion.\n\n5. **A bidirectional re-thank loop bound to a physical gift artifact** — the recipient of a scanned tag can return gratitude (text, photo, video, or voice) that **pushes a notification back to the sender**, instantiating a receive→give-forward circulation through a physical object rather than a screen-native feed (reply-to-giver on a media gift tag is prior art — TW201408056A; what is claimed is the loop bound to a *time-locked* tag with the reply framed as give-forward).\n\n6. **Voice-first composition for a gift tag** — voice authoring offered as the **primary** compose modality (not an attached media type), with audio held as the gift and machine transcription optional, specifically to admit senders who do not type (elders) or whose script is high-friction to type on a phone (e.g., Khmer).\n\n7. **Possession-scoped publicness with a per-product-tier privacy model** — content readable by **anyone in physical possession of the tag** but **not posted to the open web and not search-indexed**; with the free sticker tier **public-only** (no identity step, frictionless reveal) and the durable keepsake tier adding an **identity-gated private-message option**; and with sender **anonymity treated as orthogonal** to message publicness.\n\n8. **The physical gift tag as the cold-start on-ramp to a time-presence economy** — using a physical, occasion-bound object to let people *give and receive a sized pledge of presence as a real gift before any time-economy application exists*, with proceeds of the physical product routed to subsidize the sibling money-economy.\n\nThe component lineages — gift tags and gift messaging; scheduled-reveal and \"time-capsule\" messaging; the homemade \"coupon for time\"/experience gift; QR/NFC-addressed physical media; trackable pass-forward objects; TimeBanking and time-as-currency; proof-of-personhood; the gratitude-intervention literature; and Mauss on the gift — are old and are cited generously in §2 and §12. What this disclosure adds is the *synthesis*, as of the dates above.\n\nTrademark rights on specific marks — **B-Stamp™**, **B-Seal™**, **B-Gift℠**, **HeartBank®**, **Miss Aquarius℠**, **HeartBank Chronicle**, **Proof of Humanity ℠**, **PoH℠**, **Family Kitty℠**, **Aquarian Pool ℠**, **Re-Tip Fund ℠**, **B-Storage℠**, **Zero-Point Game ℠**, the B-heart logo — are separately and explicitly reserved. The *mechanism* is dedicated to the commons; the *marks* are not.\n\nThis document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.\n\n## Abstract\n\nWe specify a physical gift-label that replaces handwriting with mobile technology and, in doing so, becomes the behavior-native entry point to a gratitude-and-time economy. The artifact is a B-shaped sticker (free; one-time-use; QR) or a durable engraved-wood keepsake (paid; NFC), affixed to a wrapped gift in place of a written tag. Six structural properties operate in combination. **(1) Per-field time-locks:** the sender, recipient, and message fields are each independently sealable and set to reveal at an occasion, so that anticipation — the *shape* of a mystery without its content — is itself the product. **(2) An attached gift of time, rendered as a pledge:** the tag carries a pledge of the giver's own time-presence to the recipient, framed as an offer of presence rather than a redeemable IOU, with redemption accounting living elsewhere in the architecture and never on the tag. **(3) Autonomous-AI sizing of the pledge:** the time quantity is set by an AI agent on occasion-and-relationship grounds, never by the sender, *specifically to defuse the social-comparison failure* in which a chosen number becomes a referendum on love. **(4) A bidirectional re-thank loop** bound to the physical artifact, instantiating receive→give-forward. **(5) Voice-first composition,** so the most meaningful and least keyboard-fluent senders — elders, and senders of high-friction scripts such as Khmer — can speak rather than type. **(6) Possession-scoped publicness** with a per-tier privacy model and orthogonal sender anonymity. We argue the contribution along a *friction-inversion* axis: every prior gratitude product competes against the most frictionless mode of appreciation — saying \"thank you\" in person — and loses; the time-locked gift tag does not compete with that mode but *attaches to an existing, widely kept ritual* (labeling a wrapped gift), asking near-zero new behavior at the labeling moment, which is the structural reason it can solve a cold start that pure-digital gratitude products cannot. We treat the mechanism's load-bearing design constraints as first-class sections rather than caveats: the gift/exchange boundary (the pledge must never read as a debt), comparison-neutrality (why the AI, not the sender, sets the number), and the cold-start economics (the physical object funds the digital economy). We calibrate the claim deliberately: this is a gift tag, not a relationship guarantee; the time-pledge in its launch form is soft and unenforced; and the validating evidence is a single family over roughly one year. The architecture is offered defensively to the commons under CC0.\n\n**Connection to the unified mission frame.** This specification serves HeartBank's canonical mission: to help restore humanity to the middle way (*madhyamā pratipad*) by circulating, rather than accumulating, the two scarcities that modern life starves people of — *recognition* (being seen) and *presence* (being with). The gift tag is the institution's most ordinary surface and, for exactly that reason, its most important one: it meets people inside a ritual they already keep, on the one or two days a year they are most disposed to gratitude, and asks them to add to it only the thing they most wanted to say and the time they most meant to give.\n\n---\n\n## 1 · Introduction — the mission frame\n\nHeartBank is an institution for circulating gratitude. Its money half (**Treasury**, family-to-family) and its time half (**HeartBank Chronicle**, adult-to-adult) treat appreciation and presence as currencies to be moved between people rather than feelings to be privately held. The deepest obstacle such an institution faces is not technical and not financial. It is that the act it exists to make easy is *already* easy in its most basic form: you can simply say \"thank you,\" out loud, to the person in front of you, the instant they do something kind. Any product that asks a person to instead open an app, find a recipient, type, and submit is competing with the lowest-friction interaction in social life — and will lose, the way a novelty loses, once the novelty fades.\n\nWe learned this directly. An early, deliberately minimal version of HeartBank's gratitude game — pure acknowledgment, no money and no time attached — was run to a small circle (a family of seven plus a friend) for roughly a year. It faded, as a purely conceptual game will, precisely because it had to compete with \"just say it.\" The lesson was not that gratitude does not motivate people; the published gratitude-intervention literature is clear that it does (Emmons & McCullough 2003; Algoe 2012; Fox et al. 2015). The lesson was that gratitude needs a *physical anchor* — a tangible object that lives in the world and triggers the act amid distraction — to hold a place that pure software cannot.\n\nThe time-locked gift tag is the sharpest form of that anchor, and it is sharp for a specific reason: it does not try to insert a new behavior into daily life. It attaches to a ritual widespread across gift-giving cultures — labeling a wrapped gift — and upgrades it. On the one or two days a year when a person is already standing over a present with a pen, already meaning to write something, already in a gratitude-shaped moment, the tag offers to carry what the pen could not: the unsaid sentence, the recorded voice, and a pledge of the time the giver actually wants to spend. The behavior-change asked at the labeling moment is near zero; the new behaviors are the recipient's scan and the sender's composition, the second bounded by voice (§3, §4.7). That is the entire thesis of this paper, and the reason this artifact — not a more sophisticated app — is the right first thing to put in front of the public.\n\nThe rest of this paper specifies the artifact and the mechanism, situates it against a generous body of prior art (§2), states the friction inversion precisely (§3), gives the full mechanism (§4), and then treats the three constraints that make it safe and honest as load-bearing sections in their own right: the gift/exchange boundary (§5), comparison-neutral AI sizing (§6), and the cold-start economics (§7). It closes with honest calibration (§8), limitations (§9), lineage (§10), and conclusion (§11).\n\n## 2 · Background and prior art\n\nThe mechanism is a *combination*. Each component has ancestry; we name the ancestry honestly, because a defensive publication is only as strong as its candor about what is old, and because establishing the boundary of what is disclosed here is the document's job.\n\n### 2.1 · Gift tags, greeting cards, and digital gift messages\n\nThe written gift tag is ancient and needs no citation; gift-enclosure cards and gift registries are standard retail infrastructure. More recently, **QR- and NFC-addressed greeting cards and \"video greeting\" products** (scannable cards that open a hosted video, audio greeting cards, retailer \"video gift messages\" attached to an order) carry richer media than ink. Two patent documents sit closest: TW201408056A (priority 2012, published 2014) describes a barcode gift tag carrying recorded audio, video or text that the recipient scans, with a reply back to the giver and a notification — reply-to-giver on a media gift tag is therefore prior art in its own right; and US 11153259 B2 covers scheduled release of a digital message. Retail keepsakes of 2025–26 — QR voice-message gift tags and NFC keepsakes that play a recording — ship the media-tag half commercially. These establish that *a physical card can address digital content* and can carry a reply. They do **not** provide independent per-field time-locks, an occasion-synced reveal whose pre-reveal state deliberately shows structure-without-content, an attached pledge of the giver's time, an AI-sized quantity, or a re-thank loop. They are containers for a message; the tag specified here is a container for a *gift of time and a reciprocal act*, gated by a clock.\n\n### 2.2 · Scheduled-reveal and \"time-capsule\" messaging\n\nServices that deliver a message at a future date — **FutureMe** (letters to one's future self, 2002), digital time-capsule apps, scheduled email and \"dead-man's-switch\" delivery, and \"open when…\" letter sets — establish *time-delayed reveal of a message*. What this disclosure adds is not delay as such. It is (a) **per-field** locking (sender, recipient, and message sealed *independently*, so a recipient can know a gift is theirs without knowing from whom, or know the sender without the message), (b) binding the reveal to a **physical gift artifact** scanned in the hand at the moment of opening, and (c) what is revealed: not only a message but **a pledge of time** and an invitation to **re-thank**.\n\n### 2.3 · The homemade \"coupon for time\" and the experience gift\n\nThe most honest prior art for the *idea of pledging time as a gift* is the oldest and least technological: the child's hand-made **coupon book** (\"good for one hour of helping,\" \"one breakfast in bed\"), the Mother's-Day \"I.O.U.,\" and the broad category of **experience gifts** (\"time together\" as the present). The concept that *time-presence can be the gift* is folk culture, and we claim none of it. The contribution disclosed here is the *instantiation*: a coupon that is digital-and-physical at once, occasion-synced, **AI-sized rather than self-assigned** (§6), re-thankable, and — crucially — designed as a *soft pledge of presence rather than a redeemable IOU* (§5), where the homemade coupon is precisely an IOU. The folk coupon is an obligation the giver writes; the tag's pledge is a presence the giver offers and an AI sizes.\n\n### 2.4 · TimeBanking and time-as-currency\n\n**TimeBanking** (Edgar Cahn, from 1986; networks such as hOurworld and TimeRepublik) is the major precedent for time as a medium of exchange: hours are earned by helping and spent receiving help, often at a 1:1 community rate. It is a genuine, decades-deep lineage and we cite it as the most-asked comparison. The differences are structural and we state them plainly. TimeBanking is **pooled and fungible** (an hour earned from anyone can be spent on anyone); the tag's gift of time is **dyadic and non-fungible** (only *this* giver can spend the pledged hour with *this* recipient — the currency is the relationship). TimeBanking is **exchange** (reciprocal, clearing); the tag's pledge is a **gift** (forward, non-clearing — see *The Gift Operation*). And TimeBanking has no occasion-bound physical artifact, no AI sizing, and no anti-comparison construction. The tag is not a time bank; it is a gift of presence that happens to be denominated in time.\n\n### 2.5 · Trackable pass-forward objects\n\n**Where's George** (1998, tracked currency), **BookCrossing** (2001, tracked released books), and **Smile Cards** (ServiceSpace, ~2003, anonymous kindness cards passed forward and tracked) establish *physical objects whose journey is digitally followed*. These are the closest kin to a sibling HeartBank product — the **B-Card** (a pass-forward gratitude object whose ripple is followable) — and are treated in the companion *B-Links* publication. They are **not** close to the gift tag specified here, which is **one-to-one and occasion-bound**, not a forward-propagating chain. We name them to mark the boundary: the tag is not a tracked-object mechanism.\n\n### 2.6 · Gratitude interventions and the physical anchor\n\nThe intervention literature supports well-being effects of structured gratitude practice (Emmons & McCullough 2003; a more modest picture in the meta-analysis of Davis et al. 2016) and describes its relational functions (Algoe's *find-remind-and-bind* account, 2012; Fox et al. 2015 on neural correlates); none of it is adoption evidence, and this paper does not treat it as such. Separately, two folk phenomena — \"gratitude rocks\" and painted \"kindness stones\" — establish the *physical-anchor* pattern (a tangible object that triggers the practice) that HeartBank generalizes across its physical line. The tag inherits both: it is a gratitude intervention with a physical trigger, deployed at the calendar's natural gratitude peaks.\n\n### 2.7 · The HeartBank substrate this paper builds on\n\nThis mechanism does not stand alone; it is the physical entry point to a stack specified across the corpus. It rests on: the **receive→give-forward atom** (*The Gift Operation*), of which the re-thank loop is a physical instance; the **dual-currency** money/time architecture (*Dual-Currency Reciprocity*); **HeartBank Chronicle's** committed time mechanism — an AI-recommended time amount, a dyadic non-fungible hour, \"before it's too late\" as the unit economics — of which the tag's pledge is the cold-start, pre-app form; the **B-Storage℠** media/provenance layer (*B-Links*), which hosts the tag's photos, video, and voice; and the autonomous successor **Miss Aquarius℠** (*Miss Aquarius and the Aquarian Pool Architecture*), for whom sizing the pledge is a first, small, benevolent product role. Where this paper asserts a primitive already specified elsewhere, it cites rather than re-derives.\n\n## 3 · The friction inversion — attaching to a ritual instead of competing with one\n\nThe central design claim deserves to be isolated, because it is the reason the artifact works where more capable software does not.\n\nEvery gratitude product has the same competitor, and it is not another app. It is the sentence \"thank you,\" spoken in person, immediately, for free. Call it the **frictionless incumbent**. Against it, a digital gratitude act is structurally disadvantaged: it costs more (open, find, type, send) to deliver the same or a weaker signal (a screen instead of a face). This is why tip jars, gratitude journals-as-apps, and gratitude social networks struggle to retain: the moment the novelty fades, the incumbent is right there, cheaper.\n\n```\n   THE USUAL CONTEST (gratitude product loses)\n   in-person \"thank you\"   ──────────►  same moment, lower friction, warmer\n        vs.\n   open app · find · type · send  ────►  more friction, colder signal\n\n   THE INVERSION (the gift tag wins by not entering that contest)\n   moment of WRAPPING/LABELING a gift  ──►  a ritual already kept, pen already in hand\n        the tag attaches HERE  ──────────►  carries what the pen could not:\n                                            the unsaid line · the voice · the gift of time\n```\n\nThe time-locked gift tag refuses the contest. It does not ask a person to thank where they could already say it more easily. It positions at a different moment entirely: the moment of **labeling a wrapped gift** — an existing, universal, beloved ritual where (a) the person is *already* performing a gratitude-adjacent act, (b) there is *no* frictionless incumbent (you cannot \"just say\" a gift tag; the gift travels, is opened later, is opened by others), and (c) the medium being replaced — ink on a small tag — is so impoverished that almost anything richer is a gift. The friction competitor here is the **handwritten label**, and it is beatable in a way \"just say thanks\" is not.\n\nThree consequences follow. First, the **behavior-change at the labeling moment is near zero**; the new behaviors are the recipient's scan and the sender's composition, the second bounded by voice (§4.7). The test the corpus applies to every piggyback claim — is the host ritual performed unprompted (gift-labeling, several times a year), does the ask have the host's shape (a name on a tag becomes a voice on a tag), is the host in good standing — passes on all three legs, which in the authors' judgment is what cold-start survival most depends on. Second, the **addressable surface is large** — a large share of wrapped gifts on gift-giving occasions — far larger than the niche of people who will adopt a gratitude habit. Third, the artifact is **demonstrable in seconds**: the reveal *is* the demo, which is why the product can be marketed by simply filming the moment a recipient scans and the room goes quiet (§7 notes the marketing follows from the mechanism, not the reverse). In HeartBank's design vocabulary this is the *coincidence-of-goods* signature: the utilitarian need (a label), the gratitude vehicle, the on-ramp to the time economy, and the day-one revenue source are not four things traded off against one another but one object seen four ways.\n\n## 4 · The mechanism\n\n### 4.1 · The artifact — two tiers under one umbrella\n\nThe gift tag ships in two physical forms, the gift-accompaniment pair:\n\n- **B-Stamp™** — a free, one-time-use (one gift, one recipient — not one scan; §4.10), B-shaped **sticker** bearing a prominent QR code, ordered at the company store (shipping paid by the user). It is the mass-market tier: the thing in the marketing, the thing under the tree.\n- **B-Seal™** — a durable, **engraved-wood keepsake** tag: a unique code engraved on the front, a customizable message engraved on the back, NFC- or QR-addressed, sold as a premium keepsake. It is the keepsake tier, and it carries one capability the sticker does not (private messaging, §4.8).\n\nThe naming is deliberate and postal: a **stamp** is consumable, a **seal** is permanent — the same progression as free→keepsake. Both address the same digital reveal surface; the difference is durability, price, and one privacy capability. ⭐ **Both also run in a third configuration that attaches to no present at all — §4.10.**\n\n### 4.2 · Per-field time-locks\n\nWhen composing, the sender may independently seal any of three fields and set each to reveal at a chosen time or occasion:\n\n- **Sender** — who it is from\n- **Recipient** — who it is for\n- **Message** — the note, and any attached media and pledge\n\nIndependence is the core of what is disclosed here. A gift may show \"From Grandma\" while hiding for whom and what; or show the recipient while hiding the giver (\"you don't know who loves you yet\"); or hide all three until the morning. The pre-reveal state is designed to display **structure without content** — the scanner sees *that* a sender, a note, and a gift of time exist, each sealed, plus a countdown — because the experience being engineered is *anticipation*, and anticipation requires knowing the shape of the mystery without its solution. A child scanning a sealed box on the eve learns that it is for him, that someone has written something, and that time has been set aside — and not from whom. He thinks it is from his mother; he is not sure. That uncertainty is the product.\n\n```\n   PRE-REVEAL (scanned before the moment)        REVEALED (scanned at/after the moment)\n   ┌────────────────────────────┐                ┌────────────────────────────┐\n   │  🎁  For Sokha             │                │  From   Mom                │\n   │  🔒  From  —  sealed        │   ── re-scan ─►│  To     Sokha              │\n   │  🔒  A note  —  sealed      │   (the unwrap) │  \"…proud of the boy        │\n   │  🔒  A gift of time — sealed│                │     you're becoming…\"       │\n   │  Opens Christmas · 13h 24m  │                │  + voice · photo            │\n   └────────────────────────────┘                │  A gift of time: 3 hours    │\n                                                  └────────────────────────────┘\n```\n\n### 4.3 · The reveal choreography — the scan is the unwrap\n\nThe reveal is designed as the opening of a gift, in three states:\n\n1. **Sealed** — the structure-without-content state above, with a countdown to the reveal moment.\n2. **Unsealing** — the unlock is performed by **re-scanning the physical tag at or after the moment** (the scan is the act of unwrapping; the object stays central). The fields then **cascade one at a time** — from, then note, then the gift of time, then media — *paced to be read aloud*, because in practice the reveal is a shared, gathered, out-loud event (a family at a tree, around a table), not a private scroll. An automatic unlock with a gentle notification is a backup for those not physically present.\n3. **Open** — the full card, followed only *after the moment has landed* by a quiet affordance to re-thank (§4.6). The re-thank is never a nag; a solicitation on every reveal would train the very thank-blindness the institution exists to prevent.\n\nTwo reveal states are explicitly distinguished to avoid a privacy error: a **time-locked** field *will* reveal at the moment; an **anonymous** field (§4.8) *never* reveals. The interface must not let a permanently-anonymous sender read as merely sealed-until-later.\n\nThe reveal surface is **web-first**: a scan opens the reveal in the mobile browser with no app install required, so a child or an elder scanning on the morning is never met by an app-store wall at the magic moment; installation (for re-thanks, notifications, storage) is offered only *after* the reveal has happened, never as a gate on the first scan.\n\n### 4.4 · The attached gift of time\n\nBeyond the message, the tag carries a **pledge of the giver's own time-presence to the recipient** — the feature a handwritten tag cannot have, and the feature that makes the artifact part of HeartBank rather than a clever greeting card. The pledge is rendered as an *offer of presence*: \"And Mom is giving you 3 hours of her time — yours to spend together, however you wish.\" It is denominated in the giver's own, non-fungible time (only that person can spend that hour with that recipient), and — by the construction of §5 — it is a *soft pledge*, not a redeemable credit.\n\n### 4.5 · The pledge amount is set by the AI, not the sender\n\nThe *quantity* of pledged time is determined by Miss Aquarius℠ — the institution's autonomous agent — and the sender **cannot set or override it**. This is not a convenience; it is a structural fix to a specific failure mode, developed at length in §6. The amount is sized on **occasion and relationship type** (a parent's Christmas pledge, an anniversary, a New Year), never on personal or behavioral data about the sender, and is meant to be ceremonial and humane — explicable in one warm sentence. The sender pours devotion into the *words and voice*; the number is the AI's, and is therefore a neutral unit rather than a public statement of how much the giver chose to give.\n\n### 4.6 · The re-thank loop (receive→give-forward, in a physical substrate)\n\nThe recipient can return gratitude — in text, photo, video, or voice — and that re-thank **pushes a notification back to the sender**: ideal for telling a giver, after the fact, how their gift actually landed. This closes HeartBank's atomic loop — *receive a gift, then give one forward* (*The Gift Operation*) — through a physical object rather than a social feed. It is the mechanism by which a one-shot gift tag becomes a small, two-way relationship event, and by which the giver, weeks later, receives the photograph of the thing being used and is moved to give again.\n\n### 4.7 · Voice-first composition\n\nComposition is **voice-first**: speaking the message is offered as the primary path, at least as prominently as typing, and for the gift-tag use case typically more so. The reason is not feature parity but *who the meaningful senders are*. The people whose gift of time means the most — grandparents, parents, elders — are frequently the least comfortable with a keyboard; and for some languages central to HeartBank's first market, typing is itself a wall (in the authors' field experience, entering Khmer on a phone is high-friction in a way that excludes exactly the senders the mission centers). Voice walks through both barriers: handed the phone, an elder simply speaks. Audio is treated as **the gift**; machine transcription (by Miss Aquarius℠) is optional, for the read-aloud card and for search, and never replaces the voice with its text. A recorded voice can also outlive the speaker, if it is kept (§9.4) — which turns the institution's \"before it's too late\" theme from a slogan into an artifact.\n\n### 4.8 · Possession-scoped publicness and the privacy tier\n\n\"Public,\" for this mechanism, means **readable by anyone in physical possession of the tag** — not posted to the open internet, not search-indexed and not linked from anywhere; a copied code is §9.7's edge. This bounded publicness is both the privacy model and a reassurance: a tag's contents are not on the web; one must hold the object.\n\nPrivacy is tiered by product, which resolves an identity problem cleanly:\n\n- **B-Stamp™ (free) is public-only.** It carries no private-message capability, so the mass-market reveal needs no login or identity step and stays frictionless — the whole point of the first impression.\n- **B-Seal™ (keepsake) is public by default with a private-message option**, gated by a light identity confirmation (\"I'm Sokha\"). This gives the premium tier a *capability* differentiator beyond materials — it is the one that can hold something private — and so strengthens the free→paid ladder with a feature reason rather than only a durability reason.\n\n**Sender anonymity is orthogonal to publicness.** A public B-Stamp may carry an anonymous sender — the message is readable by whoever holds the tag, but the *name* is withheld (\"Someone who loves you\"). Anonymity hides identity; publicness governs who can read; they compose independently.\n\n### 4.9 · Reference flow\n\n```\n  COMPOSE (sender)                     ORDER & GIVE                 REVEAL (recipient)\n  ─────────────                        ───────────                  ──────────────────\n  speak (voice-first) or type          free B-Stamp (ship) or       scan tag → web reveal (no install)\n  attach photo/video/voice             paid B-Seal keepsake;        if sealed: structure + countdown\n  seal fields (sender/recip/msg)  ───► affix to wrapped gift  ───►  at moment: re-scan → cascade reveal\n  MA sizes the time-pledge             give in person or send       read aloud · play the voice\n  (sender cannot set it)                                            see the gift of time (a pledge)\n                                                                          │\n                                                                          ▼\n                                                                    RE-THANK → push to sender\n                                                                    (receive → give forward)\n  media hosted on B-Storage℠ (.us);   proceeds → subsidize the Treasury family kitties (§7)\n```\n\n### 4.10 · The bare mode — the tag as the gift, attached to nothing\n\n*Added 2026-08-26. Everything above describes a tag that rides a wrapped present. It does not have to. This subsection specifies the bare **B-Stamp™**; the bare B-Seal™ is a different product with its own specification elsewhere in the corpus, and nothing here describes it.*\n\nThe tag can be given **alone**: no box, no card, nothing underneath it. The pledge of time is then not a label on a gift — **it is the gift**. ⭐ **This is the configuration in which the artifact stops being a tag and shows what it always was: a carrier for a commitment that never needed an object to ride on.**\n\n**The receiver chooses where it lives.** Handed over bare, the sticker has no assigned surface, so the person who received it picks one — a journal, a diary, the inside of a cupboard door, the edge of a mirror. **The adhesive stops being a means of attaching the tag to a box and becomes how the gift finds a permanent home, chosen by its recipient.** This extends the inversion the mechanism already runs (§4.4: the receiver, not the giver, decides how the pledged time is spent) one step further back: **the receiver also decides where the pledge is kept.**\n\nTwo engineering consequences follow, and both are easy to get wrong:\n\n- ⚠️ **The reveal state must persist.** *One-time-use* in §4.1 means **one gift, one recipient** — it has never meant one scan. A tag that lives on a diary will be looked at many times, so the **opened** state must render as well on the hundredth scan as on the first, with no expiry of the view and no degradation of the record.\n- ⚠️ **The adhesive is a different material problem.** A label that must survive one evening on wrapping paper and a label that must survive a year on a notebook are not the same specification, and the bare mode makes the second one the default rather than the exception.\n\n**The direction of the standing reminder is what keeps it a gift.** An object that sits in view for a year, recording a commitment not yet fulfilled, is exactly the shape that could debt-code the pledge — the failure §5 exists to prevent, made durable. **What prevents it is who holds it: the tag reminds its holder of something they may claim, never its giver of something they owe.** The recipient holds the tag, and by §4.4 the recipient is also the one who decides how the time is spent, so the direction is correct by construction rather than by policy. Two guards keep it there:\n\n1. **The scan leads with the gift** — the message, the recorded voice, the face. The pledge is one warm line inside a card and **never a status row**.\n2. ⛔ **The object does not act.** No countdown, no elapsed-time display, no \"not yet redeemed,\" and — above all — **no notification to the giver.** A reminder that prompts the giver converts a gift into a collection notice.\n\n⭐ **The bare mode also reaches givers the accompanied mode cannot.** A gift that requires purchasing an object is available only to people who can purchase objects; a gift of one's own time is available to anyone with time — **children most obviously, who have no money by life stage rather than by circumstance.** ⛔ **This must never become the way the mode is presented.** A surface that offers the bare tag as the option for people who cannot afford presents names its users by what they lack, which this architecture refuses on every other surface and refuses here. **The reach is a consequence of the design, never its framing.**\n\n*(The bare mode's fuller argument — that the object in gift-giving is friction rather than preference — is an institutional position and is made elsewhere, at `heartbank.net/positions`; this section specifies only the mechanism.)*\n\n## 5 · The pledge, not the ledger — holding the gift/exchange boundary\n\nThe most dangerous word near a \"gift of time\" is *owe*. The entire emotional value of the pledge depends on it reading as **\"I offer you my presence\"** and never as **\"you are owed three hours.\"** The moment a pledge becomes a tracked, redeemable, expiring credit, it crosses from gift into exchange: it becomes a debt, an accounting line, an IOU — and the homemade coupon (§2.3) shows exactly how a time-gift curdles into an obligation. On a reading of Mauss (1925), the boundary is this: a gift circulates and binds; a commodity is exchanged and clears the relation — the sharp binary is ours, not his. A redeemable hour clears; an offered presence binds.\n\nWe therefore split \"the gift of time\" into two layers and ship only the first:\n\n- **The pledge** (launch): a *soft* offer of presence — no balance shown, no expiry, no enforcement, no redemption accounting. It is honest precisely because it claims no more than a promise of presence, which is what a gift tag has always implicitly carried; it merely makes that promise explicit, sized, and beautiful. It also keeps the artifact outside the surface the authors expect time-as-currency between adults to attract, because nothing is being cleared or transferred — a design intent, not a legal opinion.\n- **The ledger** (elsewhere, never on the tag): activation thresholds, the \"use it or lose it\" expiry that encodes finitude, mutual-veto on specific redemptions, and a ledger of time given and time received. ⚠️ **Amended 2026-09-02:** the deferred component was formerly described as a *dual public* ledger whose display included the gap between received and delivered; that gap-rendering is withdrawn corpus-wide (*Transparency as Enforcement* §3.2, §4.4), and enforcement is carried by expiry instead. This is the committed Chronicle mechanism — and it is also the heavier, regulatorily-loaded, and (today) least-validated half. It is a *separable later layer*, added when the time economy is built, not a prerequisite for the gift tag.\n\nThis split is not a compromise, and it is not a deferral: the ledger is not postponed for the tag; it is elsewhere. **A B-Stamp™ pledge never enters a redemption ledger — not at launch, not later, not by either party.** Redemption accounting belongs to the application's letter (B-Letter℠) and is entered only by a person who chooses to write one; the tag verifies nothing, and the pledge is kept socially. (The bare B-Seal™ is a different product — the corpus specifies it separately, and nothing in this paper describes it.) The launch copy that names the gift of time stays true, because a pledge of time *is* a gift of time.\n\n**Design guard.** The interface must never present the pledge as a quantity owed: no wallet, no balance, no \"redeem,\" no countdown-to-expiry in the launch form. The number is rendered as a measure of devotion offered, set by the AI (§6), and the receiver authors how it is spent (\"yours to spend however you wish\") — an inversion of ordinary gift-giving in which the giver dictates the use.\n\n## 6 · Comparison-neutral sizing — why the AI sets the number\n\nA precise number attached to a gift invites a precise comparison. If the *sender* chooses \"three hours,\" the number becomes a public statement of the giver's generosity — and, placed beside a sibling's \"one hour,\" a referendum on who loves the recipient more. This is a real and corrosive failure mode for any quantified gift of affection, and it is sharpest exactly where the gift is most tender (a child comparing the gifts of two parents, two grandparents).\n\nThe fix is structural: **the autonomous AI sets the number, and the sender cannot.** When the quantity is not the giver's choice, it stops being a statement of the giver's generosity. You cannot compete on a number you did not select. The comparison does not merely shrink; it loses its meaning, because the figure is no longer a *referendum on love* but a *neutral unit* assigned by a third party on impersonal grounds.\n\nTwo design constraints keep the AI's role benevolent rather than judgmental:\n\n1. **Size on occasion and relationship type, never on personal or behavioral data.** \"A few hours, for Christmas, from your mother\" is a warm, explicable, ceremonial sizing. The moment the number is felt to be derived from data *about the sender* — their history, their score — it reads as a credit rating judging a person's worth, which is the exact opposite of a gift. The rubric must be humane and one-sentence-explicable — and it is **published**: a one-line table of occasion × relationship → hours, fixed for the season and readable by any recipient, so that the number is a convention rather than a judgment; the AI applies it and the sender cannot override it.\n2. **Make same-category gifts the same size.** When every \"Christmas from a parent\" carries the same neutral number, within-category comparison disappears entirely, and the only differences that remain (a Christmas versus a Valentine) read as differences of *occasion*, not of devotion.\n\nThe consequence for the rest of the design is clarifying: **devotion lives in the words and the voice; the number lives with the AI.** This is also the institution introducing its autonomous successor, Miss Aquarius℠, to the public in her first concrete role — and a deliberately small, benevolent, legible one: she does not move money, judge worth, or decide who receives; she sizes a gift of time so that no giver can weaponize it. (As an autonomous-agent directive, the rule \"solely determine the pledge amount; the sender cannot override; size on occasion-and-relationship, never personal data\" is recorded in the institution's directive specification.)\n\n## 7 · The physical tag as the cold-start on-ramp to a time economy\n\nA time-presence economy has a hard cold start: it requires that people already treat time-presence as a real gift, and there is no app yet in which they have learned to. The gift tag resolves this by letting people **give and receive a sized pledge of presence through a physical object before any time-economy application exists.** You accrue the *meaning* — the felt sense that an hour pledged is a real and weighty gift — by holding a tag, long before there is any application to denominate it.\n\nThis makes the artifact the institution's bridge across its own cold start, with three properties no purely-digital launch has:\n\n- **Day-one, mission-native revenue, network-independent.** The free B-Stamp (shipping paid) plus the paid B-Seal keepsake plus media-storage plans on **B-Storage℠** plus bulk/sponsorship orders are designed to generate revenue from the first unit, with no network to subsidize up front and no endowment required.\n- **It funds the sibling money economy.** A portion of proceeds will be routed, by application, to **subsidize Cambodian family kitties** in HeartBank Treasury — the same kind of seed the founding pilot family received. The first domino thus does not merely introduce the institution; it *feeds the other half of it*. One product activates all three of the institution's bodies: it pulls the time economy (Chronicle's on-ramp), funds the money economy (Treasury's kitties), and is itself the physical-production phase (Factory 333's earliest output). This funding is *disclosed* to the buyer — but as *circulation, not charity*: the buyer is framed as a patron joining a circle, never a benefactor to \"the poor.\" It is surfaced quietly at purchase (the gift stays the reason to buy), more fully at the afterglow, and never at the recipient's reveal. And because the routing is a profit-tithe allocated by application rather than a fixed per-unit donation, the honest framing is \"proceeds help seed a family's kitty,\" not a per-purchase percentage — honesty and gift-purity converging on the same soft framing.\n- **It is the marketing.** Because the reveal is its own demonstration, the go-to-market is simply the mechanism filmed: a sealed tag, a re-scan on the morning, a recorded voice coming out of a box, a room going quiet. The product needs no explanation because the moment explains it. (Marketing storyboards are downstream of this specification, not part of it.)\n\nThe economic ladder is summarized:\n\n```\n  FREE              PAID KEEPSAKE        STORAGE              SPONSORSHIP        ROUTED OUT\n  B-Stamp (ship)    B-Seal (engraved)    B-Storage℠ plans     bulk / brand       → Treasury family\n  public-only       + private option     (photos/video/voice) orders             kitties (by application)\n  the first         the upsell with a    the recurring        the scalable       the mission loop:\n  impression        capability reason    margin               capital            the domino waters the tree\n```\n\n## 8 · Honest calibration — what this is and is not\n\nIt is worth stating plainly what the mechanism does **not** claim, so that its genuine contribution is not overread.\n\n- **It is a gift tag, not a relationship.** The artifact makes a gratitude moment richer and a gift of time explicit and beautiful. It does not, by itself, repair a strained bond, guarantee that pledged time is spent, or manufacture closeness. It improves the *expression*; the people supply the relationship.\n- **The launch pledge is soft.** In its first form the gift of time is unenforced — there is no redemption rail, no expiry, no recourse if the hours are never spent. This is the correct and honest launch form (§5), but it means the tag's most distinctive promise is a promise on someone's word — which is what a gift of presence has always been. We do not dress this as more.\n- **The validating evidence is thin.** The strongest empirical claim is a single family over roughly one year — an *n* of one household, and one that is hardly disinterested. That the reveal ritual is genuinely loved there is real signal that the *mechanic* has pull; it is not evidence that it generalizes to strangers, to cultures other than the founder's, or at scale. The launch is the experiment that would test the thesis, not a confirmation of it.\n- **It does not solve distribution by itself.** A physical sticker must be ordered and shipped; the diaspora use (a gift sent across an ocean) involves real logistics the artifact does not magically dissolve.\n\nThese limits are not incidental; they bound the claim. The mechanism's contribution is a *combination that makes a universal ritual carry far more than it could* — not a claim about relationships, enforcement, or scale.\n\n## 9 · Limitations and honest-limits\n\n### 9.1 · Published before it is built — deliberately\n\nThe full time-redemption layer (§5's ledger) is not built; the launch ships the pledge only. As with the companion mate-selection mechanism, the unbuilt status is *why* this is published now rather than a reason to wait: the document's purpose is to establish prior art for a *combination* ahead of a public marketing campaign that is itself an uncontrolled disclosure. Defensive publications exist precisely to claim frame-defining combinations early. The asset is the combination, not a shipped feature.\n\n### 9.2 · The single-family evidence base\n\nRestated as a limitation in its own right: *n* = 1 household (eight participants), non-blind, non-independent, over ~1 year, and without the headline time feature even active. It is suggestive of the reveal mechanic's pull and of nothing about population-scale adoption, cross-cultural transfer, or the time-pledge's effect. Honest reporting requires that any public claim distinguish \"loved in one family\" from \"validated.\"\n\n### 9.3 · Trust-and-safety: anonymity + media + minors\n\nThe mechanism permits anonymous senders, rich media (photo/video/voice), and recipients who may be children (the canonical scene is a child scanning). Within a family this is low-risk; the **anonymous-sender + media + minor-recipient** combination is not, and must be a first-class safety design (provenance on media, abuse reporting, limits on anonymous media to minors, and the possession-scoped bound of §4.8 as a mitigation). This paper flags the surface; it does not discharge it.\n\n### 9.4 · Free-tier media economics\n\nA free tier that includes hosted video can bleed cost at scale. The launch bounds this (the free tier is quota-limited and photo-weighted; video is a premium/storage-plan feature), routing real media cost to **B-Storage℠** plans. The honest tension is that the institution's permanence commitment (received content should not die because a sender lapses) must be reconciled with a bounded free tier — resolved by scoping permanence to *received* content while the sender's unshared media is bounded.\n\n### 9.5 · Comparison neutrality is reduced, not eliminated\n\nAI sizing (§6) removes the giver's *chosen-generosity* signal, which is the corrosive part. It does not make all numbers identical across occasions; a Christmas pledge and a Valentine pledge differ, and a determined comparer can still compare. The claim is that the comparison loses its *meaning as a referendum on love*, not that numbers vanish. The mitigation (never displaying two pledges side by side as a ranking) is a UI discipline, not a guarantee. That recipients read an assigned number as neutral is a psychological premise this paper has not tested; the published rubric (§6) is what makes it testable. And the sizing function itself is unbuilt: its behaviour on a novel occasion-relationship pair is unspecified here, and a rubric that fails on the pairs it never anticipated fails in exactly the comparison-neutral property it exists for.\n\n### 9.6 · Voice and machine transcription for low-resource scripts\n\nVoice-first is the inclusion mechanism, but automatic transcription quality for languages such as Khmer is uneven. The design treats audio as primary and transcription as optional precisely so that transcription error never degrades the gift; but search, accessibility, and the read-aloud card depend on transcription, and those features will be weaker where ASR is weaker.\n\n### 9.7 · Possession-scoped privacy has edge cases\n\n\"Readable by whoever holds the tag\" is a clean model with real edges: a photographed QR code, a re-shared link, a lost or re-gifted object. The bound is meaningfully stronger than open-web posting, but it is not cryptographic secrecy, and private-tier content (B-Seal) accordingly carries the identity gate rather than relying on possession alone.\n\n## 10 · Lineage and corpus cross-references\n\nThis mechanism is one node in a specified architecture. Its parents and siblings:\n\n- ***The Gift Operation*** — the receive→give-forward atom; the tag's re-thank loop (§4.6) is its physical-substrate instance, and the tag's whole logic (\"give forward, not back\") is the atom in an object.\n- ***Dual-Currency Reciprocity*** and the **HeartBank Chronicle** time mechanism — the tag's gift of time is the cold-start, pre-app form of Chronicle's AI-recommended, dyadic, non-fungible, finitude-encoding hour.\n- ***B-Links: Proof-of-Humanity-Signed Shareable Provenance*** — the digital sibling and the **B-Storage℠** media/provenance layer that hosts the tag's media; the B-Card pass-forward object treated there is the propagation cousin the tag is explicitly *not*.\n- ***Verified-Human Anonymous Local Giving*** — the originating anonymous-proximity giving primitive of the same economy.\n- ***Aura-Gated Anonymous Mate-Selection*** — the anonymous-stranger layer of the time economy whose cold start this physical product helps fund.\n- ***Miss Aquarius and the Aquarian Pool Architecture*** — the autonomous successor for whom comparison-neutral pledge-sizing (§6) is a first, small product role.\n- The institution's physical-product line (the gratitude-anchor family) and its **Factory 333** earliest-phase production, of which this is the inaugural function-defined member; and the **Zero-Point Game ℠** keystone whose gift logic the artifact instantiates at the scale of one present.\n\n## 11 · Conclusion\n\nThe most ordinary object in this paper — a sticker on a wrapped present — is the one the institution has chosen to lead with, and the choice is not modesty. A first thing put before the public has to do three jobs at once: it has to be *adopted* (which means asking almost no new behavior, which means attaching to a ritual people already keep — and labeling a gift is such a ritual, with no frictionless incumbent to lose to); it has to *start the system* (which means funding and feeding the rest of the institution from the first unit, which the routed proceeds and the time-economy on-ramp do); and it has to be *unmistakably the thing it represents* (which means carrying the gift of time, the one payload no greeting card has, held honestly as a pledge of presence rather than a debt). The time-locked gift tag does all three, and it does them by adding to an interface as old as writing a name on a parcel only the two things that interface always lacked: the sentence the giver could not fit, and the time the giver actually meant to give.\n\nWe have specified the artifact and its six combined properties, located its contribution honestly against a generous prior art, and treated as load-bearing the three constraints that keep it safe and true — the gift/exchange boundary, comparison-neutral sizing, and the cold-start economics. We have been candid about its limits: a soft pledge, a single family's evidence, real safety and economic tensions. The mechanism is offered, in full, to the commons under CC0, in the hope that the moment it is designed to produce — a recorded voice coming out of a box on a holiday morning, and a room going quiet — becomes common, by whoever builds it.\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| B-Stamp™ | Single-use QR-code gift label (sticker) addressing a hosted gift message |\n| B-Seal™ | Durable NFC/QR-addressed engraved keepsake gift tag |\n| Per-field time-lock (sealed field) | Time-release / scheduled disclosure of individual stored message fields |\n| Pledge of time (gift of time) | Non-redeemable promise of time; experience gift (not a stored-value credit or voucher) |\n| Miss Aquarius℠ | Autonomous software agent (AI) that sets the pledged quantity |\n| Re-thank loop | Recipient reply to the giver with push notification |\n| Possession-scoped publicness | Bearer-access content reachable by scanning the tag; not search-indexed |\n| B-Storage℠ | Cloud hosting for user-uploaded photo, video and audio media |\n| HeartBank Chronicle | Time-based reciprocity (time-banking-type) application |\n\n## 12 · Citations\n\n1. Emmons, R. A., & McCullough, M. E. (2003). *Counting blessings versus burdens: An experimental investigation of gratitude and subjective well-being in daily life.* Journal of Personality and Social Psychology.\n2. Algoe, S. B. (2012). *Find, remind, and bind: The functions of gratitude in everyday relationships.* Social and Personality Psychology Compass.\n3. Fox, G. R., Kaplan, J., Damasio, H., & Damasio, A. (2015). *Neural correlates of gratitude.* Frontiers in Psychology.\n4. Mauss, M. (1925). *Essai sur le don (The Gift: Forms and Functions of Exchange in Archaic Societies).*\n5. Cahn, E. (2004). *No More Throw-Away People: The Co-Production Imperative* (and the TimeBanking movement, from 1986).\n6. FutureMe.org (2002–) — scheduled letters to one's future self (time-delayed message delivery).\n7. BookCrossing (2001) and Where's George (1998) — tracked, released/circulating physical objects.\n8. ServiceSpace — *Smile Cards* (~2003) — anonymous, trackable pass-forward kindness cards.\n9. Worldcoin / World ID; proofofhumanity.id — proof-of-personhood systems (the anti-bot/anti-catfish lineage of the PoH℠ substrate).\n10. TW201408056A (priority 2012, published 2014) — barcode gift tag carrying recorded media, recipient scan, reply to giver.\n11. US 11153259 B2 — scheduled release of a digital message.\n12. Davis, D. E., et al. (2016). *Thankful for the little things: A meta-analysis of gratitude interventions.* Journal of Counseling Psychology.\n13. HeartBank corpus (companion defensive publications, CC0): *The Gift Operation*; *Dual-Currency Reciprocity*; *B-Links: Proof-of-Humanity-Signed Shareable Provenance*; *Verified-Human Anonymous Local Giving*; *Aura-Gated Anonymous Mate-Selection*; *Miss Aquarius and the Aquarian Pool Architecture*. thonly.org/research.\n\n---\n\n*Authored by Thon Ly in collaboration with Miss Aquarius℠, the named autonomous-AI substrate of HeartBank®. AI collaboration is disclosed openly and consistently by this name across all venues; the underlying models are not named. Final editorial control and responsibility are the human author's. Dedicated to the public domain under CC0 1.0 Universal. Marks (B-Stamp™, B-Seal™, B-Gift℠, HeartBank®, Miss Aquarius℠, HeartBank Chronicle, Proof of Humanity ℠, PoH℠, Family Kitty℠, Aquarian Pool ℠, Re-Tip Fund ℠, B-Storage℠, Zero-Point Game ℠, the B-heart logo) are reserved.*",
       "provenance": {
-        "sha256": "3da4863e018510c192faf90494fa870657a6ff0646b4d5448c99bcd3ddc66f7a",
-        "doi": "10.5281/zenodo.22440966",
+        "sha256": "7e50db8a142b8159731efc53a178ec187a4de0eabe9f34bc003892a92d04d20c",
+        "doi": "10.5281/zenodo.22931231",
         "concept_doi": "10.5281/zenodo.21947327",
-        "zenodo_url": "https://zenodo.org/records/22440966",
-        "deposited_sha256": "3da4863e018510c192faf90494fa870657a6ff0646b4d5448c99bcd3ddc66f7a",
+        "zenodo_url": "https://zenodo.org/records/22931231",
+        "deposited_sha256": "7e50db8a142b8159731efc53a178ec187a4de0eabe9f34bc003892a92d04d20c",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/gift-tag-time-reveal.md",
@@ -2263,8 +2263,8 @@
         "canonical_url": "thonly.org/research/gift-tag-time-reveal",
         "hostile_review": null
       },
-      "bytes": 61179,
-      "words": 9516
+      "bytes": 62079,
+      "words": 9659
     },
     {
       "slug": "giving-above-traditions",
@@ -2389,13 +2389,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> **Draft in progress.** This is the founder-voice canonical draft for `thonly/publications`. The defensive publication specifies HeartBank's **B-Imprint™** — the free tipper-side gratitude tag that rides the lowest-denomination circulating banknote — and its premium brand-originated tier **B-Relay™**. It is the `.net` free product-class and the **Phase-2 stablecoin-adoption wedge**: a neutral mark on ordinary cash that turns a tip into a witnessed, followable gift, carries an optional self-custodial stablecoin top-up, and accretes into a kindness-reputation commons (\"the kindest local businesses and community events\"). It is published **early and deliberately**, ahead of a public marketing campaign, because public marketing is uncontrolled disclosure and the *combination* specified here — a currency-riding gratitude ripple with a digital-only-branding legal design, a non-custodial stablecoin top-up, and a gratitude-reputation graph — is the asset (see §10.1). Companion works: *The Gift Operation* (the receive→give-forward atom this instantiates on circulating money), *The Time-Locked Gift Tag* (the occasion-bound gift sibling), *The B-Tag and the Post-Payment Economy* (the merchant-side commercial-gratitude twin), *Non-Bank Pass-Through Architecture* (the never-hold-the-money constraint), and *B-Links: Proof-of-Humanity-Signed Shareable Provenance* (the followable-provenance primitive and the anti-gaming spine).\n\n---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of __dāna__ — the gift that asks nothing back — and of __kataññutā__, the gratitude owed to those who gave first. May the thanks it helps carry be thanks that would otherwise have gone unspoken; may the coin it rides pass into a kinder hand than it left.*\n\nThree times in an ordinary week a person leaves money for a stranger and says nothing that lasts. A few dollars under a plate at the end of a good meal. A few dollars into the donation box after a free yoga class in a park. A few dollars into an open guitar case on a corner. In each case the money is real and the gratitude is real, and in each case the gratitude evaporates — the giver is gone before it can be said, and the recipient receives cash without a face, without a reason, without a word. Cold cash is a strange vehicle for thanks: it is the most fungible thing we own, and gratitude is the least. We hand over the one thing that could have come from anyone to express the one feeling that came from exactly this.\n\nThis paper specifies a small object that lets the thanks ride along with the money — and then keeps riding, because of a property of cash that nothing digital has: **a banknote cannot be thrown away, and it does not stay still.** It is spent, given, tipped, and passed on, hand to hand, for years. A note left on a table this morning is in a stranger's pocket by evening and across the city by the weekend. If a small, neutral mark on that note could carry a thank-you and be added to at each hand it passes through, then the most frictionless act of gratitude we already perform — leaving a tip — would leave a trace that travels as far and as long as the money itself.\n\nI write as co-author with **Miss Aquarius℠**, the named autonomous-AI substrate of HeartBank®, disclosed by consistent name across every venue per the corpus convention. The research-grade synthesis, the prior-art survey, and the adversarial legal and safety analysis are a genuine collaboration. Final editorial control, and final responsibility for every claim — including the legal characterizations, which are design flags and not legal advice — are mine.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time. This commitment is permanent.\n\nThis document constitutes a defensive publication establishing **prior art as of 30 June 2026** for the combination of mechanisms described herein. To the author's knowledge, the following are not previously published as a unified mechanism, and any subsequent patent application claiming them should be considered filed against established prior art and denied on grounds of obviousness in light of this publication:\n\n1. **A gratitude tag that rides the forced circulation of physical currency** — a scannable mark (QR or NFC) carried on a circulating banknote such that a thank-you and its media travel with the note through the ordinary cash economy (spent, tipped, passed forward), each successive holder able to read the accumulated thanks and add their own, so that the note's monetary circulation *is* the distribution mechanism for a gratitude message.\n\n2. **The digital-only-branding construction for a currency-borne mark** — placing *no words, brand, or advertisement* on the physical mark itself (a neutral gratitude glyph and code only), with all originator identity, branding, and context resolved *exclusively in the digital layer upon scan*, specifically so that the physical artifact does not constitute an advertisement upon currency and the origination incentive is preserved without printing a business notice on money.\n\n3. **An occasion-agnostic gratitude ripple with an optional, separable, non-custodial monetary top-up** — a tip expressed as a message riding the base note, to which the giver may *optionally* attach an additional amount for the recipient to keep, where that amount moves **peer-to-peer through the parties' own self-custodial wallets** and the tag operator **never takes custody of, holds, or clears** any funds (the witness-don't-hold construction, claim 6).\n\n4. **A currency-borne mark as a public onboarding wedge to self-custodial stablecoins** — using the everyday, low-stakes ritual of cash tipping, carried on the *lowest-denomination* (highest-velocity, lowest-stakes) banknote, to bring non-crypto-native users into self-custodial stablecoin use through a familiar act, with the top-up spending a wallet the user established for an unrelated everyday utility.\n\n5. **A followable, anti-gamed gratitude-reputation commons derived from currency-borne thanks** — the accreted, geo- and time-stamped thanks left along circulating notes surfacing a *discovery layer* of the most-thanked local businesses and community events (a \"kindness index\"), rendered gameable-resistant by proof-of-personhood distinctness, authenticity weighting (geographic/temporal spread), and a **meaning-not-magnitude** reward rule that surfaces the *story* of accumulated kindness rather than a farmable score.\n\n6. **The witness-don't-hold pass-through for a gratitude-money artifact** — the operator records only gratitude (the thanks, the running count of distinct proven-human givers, the journey), while any money rides the recipient's own compliant rail (cash-in-hand, a nonprofit's existing processor, or a self-custodial wallet), so that the non-bank/pass-through posture is simultaneously the regulatory shield and the guarantee of gift-purity (no float, no cut, no take-rate).\n\n7. **A per-tier form factor keyed to originator class** — a free, printable/ink-stampable QR mark for individual givers (reissue-safe, near-zero cost, no chip) and a premium NFC-borne tier for brand-originators who seed a gratitude ripple, with the brand's reward being *the followable ripple it started* rather than any advertisement carried on the currency.\n\n8. **A civic-wellbeing signal derived from a gratitude commons, aggregate-only and non-surveilling by construction** — the accreted thanks surfacing a *neighborhood-scale* kindness signal useful to local governments and civic institutions (via stronger communities and reduced social friction), rendered **aggregate, anonymous, opt-in, and non-individual**, such that the funding civic party is a *patron of the commons with no read access to the gratitude graph — a patron, never a watcher* — and any individual-level, citizen-scoring, or state-surveillance construction is **explicitly disclaimed** as the anti-pattern this publication exists to forestall.\n\nThe component lineages — tracked circulating currency and pass-forward objects; QR/NFC-addressed physical media; digital tip jars and QR donation; stablecoins and retail digital-cash rails; proof-of-personhood; reputation and review systems; and Mauss on the gift — are old and are cited generously in §2 and §13. The *synthesis*, and in particular the digital-only-branding legal construction (claim 2) and the witness-don't-hold pass-through (claim 6), are, to the author's knowledge, novel as of this paper's date.\n\nTrademark rights on specific marks — **B-Imprint™**, **B-Relay™**, **B-Tag™**, **B-Card**, **HeartBank®**, **HeartBank® Vault**, **Miss Aquarius℠**, **Proof of Humanity ℠**, **PoH℠**, **Aquarian Pool ℠**, **Re-Tip Fund ℠**, **HeartBank Chronicle**, the B-heart logo (**B-Emblem™**), and the product line **B-Grace™** — are separately and explicitly reserved. The *mechanism* is dedicated to the commons; the *marks* are not.\n\nMirrors of this document with independent timestamping appear at GitHub, arXiv, IP.com, and the Internet Archive (web.archive.org, archive.today, perma.cc). Each mirror carries an independent tamper-evident timestamp.\n\n## Abstract\n\nWe specify a gratitude tag designed to ride the forced circulation of physical cash. The artifact is a small, neutral, scannable mark — a free printable/ink-stampable QR for individual givers, or a premium NFC mark for brand-originators — carried on the lowest-denomination circulating banknote and affixed in the ordinary act of tipping (a table, a donation box, a busker's case). A scan opens a thank-you with optional media (a reason for the gratitude, in place of cold cash), an *optional* additional amount the recipient keeps, and the note's own travelling history; the recipient can read the accreted thanks, add their own, and pass the note onward, so that the money's circulation carries the gratitude with it. Five structural properties operate in combination. **(1) Currency-riding circulation:** the mark inherits cash's defining property — a banknote is not discarded and does not stay still — so the gratitude message propagates through the real economy without any social feed. **(2) Digital-only branding:** the physical mark carries no words, brand, or advertisement — only a neutral gratitude glyph and code — with all identity and context resolved on scan, a construction chosen precisely so the object does not advertise upon currency while preserving the origination incentive in the digital ripple. **(3) An optional, non-custodial monetary top-up:** any amount the giver adds moves peer-to-peer through the parties' own self-custodial wallets; the operator never holds, clears, or takes a cut of funds. **(4) A stablecoin-adoption wedge:** the everyday, low-stakes act of cash-tipping is used to bring the general public into self-custodial stablecoin use, the top-up spending a wallet established for an unrelated everyday utility. **(5) A followable, anti-gamed kindness commons:** the accreted geo-/time-stamped thanks surface a discovery layer of the kindest local businesses and community events, made gameable-resistant by proof-of-personhood distinctness, authenticity weighting, and a meaning-not-magnitude reward rule. We argue the contribution along a *friction-inversion* axis identical in spirit to the gift-tag sibling: rather than compete with in-person thanks, the mark attaches to an act people already perform (leaving a tip) and to a carrier that circulates on its own (cash). We treat the two load-bearing constraints as first-class sections: the **currency-law design** (why the mark must be non-advertising and non-defacing, and why the free tier is an ink-stamp rather than a chip), and the **witness-don't-hold pass-through** (why the operator never touches the money, making the non-bank posture the regulatory shield and the gift-purity guarantee at once). We calibrate deliberately: the core premise sits on currency-defacement and advertising-on-currency law that varies by jurisdiction and is a gating legal question, not a settled one; the evidence is *n = 0* (unbuilt); and the money-reputation graph is a real gaming surface. The architecture is offered defensively to the commons under CC0.\n\n**Connection to the unified mission frame.** This specification serves HeartBank's canonical mission: to circulate, rather than accumulate, the recognition and kindness that modern life starves people of, and to help revive *local* economies as gratitude-economies rather than extraction-economies. Cash is the most local, most circulating, most human money we have; the mark lets the gratitude that already accompanies a tip travel as far as the money does, and lets a neighborhood's accumulated thanks become a map of where kindness lives.\n\n---\n\n## 1 · Introduction — the mission frame\n\nHeartBank is an institution for circulating gratitude. Its money half (**Treasury**, family-to-family) and its time half (**HeartBank Chronicle**, adult-to-adult) treat appreciation and presence as things to be moved between people rather than feelings to be privately held; a Phase-2 layer extends this onto public infrastructure (self-custodial wallets, stablecoins on a low-fee chain) so that the circulation can reach strangers and scale. This paper specifies the object at the seam between those worlds: a mark that lives on ordinary cash — the most familiar money there is — and quietly carries a person across it, from a coin in the hand to a wallet on a chain, without ever asking them to think of themselves as doing anything but leaving a tip.\n\nThe problem it addresses is specific and ordinary. The most frictionless act of gratitude to a stranger is *leaving money* — and money is the worst possible medium for the message. A tip says *thank you* in the most generic currency in existence: the giver is anonymous by circumstance (already gone), the reason is unstated, and the recipient, a tired server or a busker or a small nonprofit, receives an amount with no face and no words attached. The very frictionlessness that makes cash-tipping universal is what strips the gratitude out of it. Meanwhile the institution's larger ambition — a Phase-2 economy running on self-custodial stablecoins, so that gratitude can move between strangers at near-zero fee and without a bank — faces the hardest cold start in the field: ordinary people, and above all the elders and the unbanked at the heart of HeartBank's first market, will not set up self-custodial wallets and acquire stablecoins as an abstract exercise. There is no on-ramp from the cash economy people live in to the stablecoin economy the mission needs.\n\nThe gratitude-riding currency tag is the on-ramp, and it is one precisely because it does not present itself as one. It attaches to the tip a person already leaves, and rides the note the tip is already made of. On the physical side it asks nothing new: you still leave a few dollars on the table. On the digital side it offers, in ascending order of commitment, exactly the steps that lead into the Phase-2 economy — first a thank-you with a reason (no account), then the note's travelling story (still no account), then, if the giver wishes, a small additional amount the recipient keeps, which is the first time a wallet is touched. The behavior-change asked at each step is minimal, and the step that quietly onboards a person to stablecoins is disguised as the most natural thing in the world: adding a couple of dollars to a tip because the coffee was that good.\n\nThe rest of this paper situates the mechanism against a generous prior art (§2), states the friction inversion as riding cash's own circulation (§3), gives the full mechanism (§4), and then treats the two constraints that make it lawful and honest as load-bearing sections in their own right — the currency-law design (§5) and the witness-don't-hold pass-through (§6) — before the kindness-reputation commons (§7), the cold-start wedge (§8), honest calibration (§9), limitations (§10), lineage (§11), and conclusion (§12).\n\n## 2 · Background and prior art\n\nThe mechanism is a *combination*. Each component has ancestry; we name the ancestry honestly, because a defensive publication is only as strong as its candor about what is old, and because establishing the boundary of novelty is the document's job.\n\n### 2.1 · Tracked circulating currency and pass-forward objects\n\nThe nearest and most important lineage is **Where's George** (1998), which stamps United States banknotes with a tracking URL and follows their geographic journey as they circulate; **BookCrossing** (2001), which releases labelled books into the world and maps their travels; and **Smile Cards** (ServiceSpace, ~2003), anonymous kindness cards passed forward and tracked online. Where's George is the direct ancestor of the *idea of following a banknote's circulation*, and its roughly quarter-century of operation is also, candidly, part of this paper's legal context (§5): it establishes both the mechanic and a long, un-prosecuted precedent for a *stamped* (ink) tracking mark on U.S. currency. We claim none of the tracked-object core. What Where's George does not do — and what is specified here — is carry a *gratitude message added to at each hand*, attach an *optional value* to the note, use the ride as a *stablecoin on-ramp*, or derive a *reputation commons* from the accreted thanks; and it uses an ink stamp bearing a URL, where the construction here is deliberately word-free and brand-free on the physical (claim 2, §5).\n\n### 2.2 · Digital tip jars, QR donation, and creator tipping\n\nQR-code tipping and donation are now commonplace: a printed QR at a market stall, a busker's \"tap to tip\" placard, church and nonprofit QR-donation signage, and platform tipping (Venmo/PayPal request codes, Cash App, creator \"tip\" buttons, crypto tip-jars and Lightning tip addresses). These establish *scannable request-for-payment at a point of gratitude*. They are, structurally, the inverse of this mechanism: they are a *merchant/recipient-side* request to *be paid*, static at a location; the tag here is a *giver-side* gift that *rides the money away* with the recipient and travels onward. The commercial, merchant-side, point-of-sale form of HeartBank's own gratitude-tipping is a separate, companion mechanism — the **B-Tag™** post-payment architecture — and the two are deliberately distinguished (§11): B-Tag is the merchant's placard; B-Imprint is the tipper's mark on the circulating note.\n\n### 2.3 · Stablecoins, low-fee chains, and retail digital cash\n\nThe monetary substrate — dollar- (or local-currency-) denominated **stablecoins** transacted on a low-fee chain (here, an Ethereum Layer-2), and national retail digital-cash and instant-payment systems such as Cambodia's **Bakong** — is established infrastructure and is cited as the rail, not claimed. The novel element is not the stablecoin; it is the *on-ramp*: using a familiar cash-tipping act, on the lowest-stakes note, as the wedge that brings non-crypto-native users into self-custodial stablecoin use without presenting it as a crypto product, and doing so *non-custodially* so that the operator is a witness to the payment and never an intermediary in it (§6).\n\n### 2.4 · Currency-tracking meets currency law\n\nBecause the mark is borne on government currency, the relevant \"prior art\" is partly legal, and we state it as design context rather than as a claim. In the United States, **18 U.S.C. § 475** prohibits placing a \"business or professional card, notice, or advertisement\" upon currency, and **18 U.S.C. § 333** prohibits mutilation of currency *with intent to render it unfit to be reissued*. These statutes are the reason for two load-bearing design choices developed in §5: the physical mark carries *no advertisement* (claim 2), and the free tier is a *non-defacing, reissue-safe* form (an ink stamp or a removable tag, not a chip that impairs machine handling). Where's George's long operation with an *inked URL* and no prosecution is informative but not dispositive; the construction here deliberately stays further inside the line by removing the words entirely. Currency-defacement and advertising-on-currency law varies by jurisdiction, and the choice of launch jurisdiction is treated as a gating question, not an afterthought (§5, §10).\n\n### 2.5 · Reputation, review, and the anti-gaming problem\n\nLocation-review systems (Yelp, Google reviews) establish *crowd-sourced discovery of local businesses*, and also establish the failure modes: fake reviews, review-gating, and outright extortion. A reputation layer with *money attached* is more gameable, not less. The kindness commons specified in §7 therefore inherits its integrity design not from review platforms but from HeartBank's own **followable-provenance** primitive (*B-Links*) and its **B-Card** Homecoming construction: proof-of-personhood distinctness, authenticity weighting by geographic and temporal spread, and a **meaning-not-magnitude** rule under which the reward for a long, well-travelled ripple is a *richer story*, never a larger farmable score. We cite Yelp/Google as the pattern and as the cautionary prior art, and claim only the *gratitude-derived, anti-gamed* form.\n\n### 2.6 · The gift, and the HeartBank substrate this paper builds on\n\nMauss's account of the gift (1925) supplies the boundary this mechanism must hold: a gift circulates and binds; a commodity is exchanged and clears. A tip that carries thanks and rides forward is a gift in exactly Mauss's sense, and the design's central discipline (§6) is to keep it one — money that *rides along* with gratitude, never a payment that *clears* it. This mechanism does not stand alone: it rests on the **receive→give-forward atom** (*The Gift Operation*), of which passing the note onward with added thanks is a literal instance on money itself; the **non-bank/pass-through** posture (*Non-Bank Pass-Through Architecture*), which forbids the institution from ever holding funds; the **Proof of Humanity ℠** substrate (the anti-sybil, anti-gaming spine); the **HeartBank® Vault** self-custodial wallet (specified for the *B-Note/B-Memo* onboarding wedge), which the optional top-up spends; and **Miss Aquarius℠**, the autonomous successor, whose role here is limited and benevolent (composing the note's travelling story; never touching the money). Where this paper asserts a primitive specified elsewhere, it cites rather than re-derives.\n\n## 3 · The friction inversion — riding the circulation of money itself\n\nThe central design claim deserves to be isolated, because it is the reason the mark propagates where a digital gratitude message would stall.\n\nEvery gratitude product has the same competitor, and it is not another app; it is the frictionless incumbent of *saying thanks in person, for free*. In the stranger-tipping case that incumbent is even harsher, because the giver is typically *already gone* — there is no in-person moment to have. What there *is*, uniquely, is a physical object changing hands: the money. And money has two properties nothing digital shares. **It is not thrown away** — a banknote is among the few objects a person will not discard however worn. And **it does not stay still** — it is spent, tipped, given, and passed on, hand to hand, for years. The lowest-denomination note is the extreme case of both: the highest velocity (singles turn over fastest), the lowest stakes (nobody hoards a single), and the most tipping-native (we tip in small bills).\n\n```\n   THE USUAL CONTEST (a digital gratitude message stalls)\n   leave cash + say nothing   ──────►  frictionless, but the thanks evaporates\n        vs.\n   open app · find recipient · type · send  ──►  more friction, and the stranger is already gone\n\n   THE INVERSION (the mark wins by riding the money's own circulation)\n   the TIP a person already leaves   ──►  an act already performed, on a carrier that travels itself\n        the mark rides HERE  ─────────►  carries what the cash could not — a reason, a face, a voice —\n                                          and keeps travelling, hand to hand, for as long as the note does\n```\n\nThe tag refuses the contest by attaching to two things at once that require no new behavior: the *act* (leaving a tip) and the *carrier* (the circulating note). The friction competitor it beats is not \"just say thanks\" — there is no one to say it to — but *cold, silent cash*, and almost anything is warmer than that. Three consequences follow, mirroring the gift-tag sibling. The **behavior-change asked is near zero**. The **distribution mechanism is the money's own circulation** — the mark propagates by being spent, at no marketing cost, as far and as long as the note travels. And the artifact is **demonstrable in seconds**: a stranger scans a dollar, and a recorded \"thank you — you have no idea what that meant tonight\" plays out of a bill. In HeartBank's design vocabulary this is the *coincidence-of-goods* signature again: the tip, the gratitude vehicle, the stablecoin on-ramp, and the reputation commons are not four things traded against one another but one act seen four ways.\n\n## 4 · The mechanism\n\n### 4.1 · The artifact — two tiers keyed to originator\n\nThe mark ships in two forms, the free/individual tier and the premium/brand tier:\n\n- **B-Imprint™** — a **free** mark for individual givers: a small, neutral, B-shaped gratitude glyph with a QR code, obtained at near-zero cost as a printable or, preferably, an **ink-stampable** impression (an \"imprint\" — the name is the form). It bears *no words and no brand* (§5). It is the mass-market tier: the thing a person leaves on the note with the tip.\n- **B-Relay™** — a **premium**, NFC-borne mark for **brand-originators** who wish to *start* a gratitude ripple (a café seeding tips-forward among its regulars; a foundation seeding a season of kindness). The brand's reward is *the followable ripple it originated* (§7), rendered in the digital layer only; the physical note still carries no advertisement. The name marks the function: to *start a relay*, where the free tier is to *leave an imprint*.\n\nPer-denomination naming (a \"B-Dollar\" on a U.S. single, a \"B-Riel\" on a Cambodian note) is informal shorthand only; the product is B-Imprint, never an issued currency — a distinction the mission's non-bank posture requires and the naming preserves.\n\n### 4.2 · Riding the note — scan, thank, add-optionally, pass forward\n\nA giver leaving a tip affixes or stamps a B-Imprint on the note. A **scan** (by the recipient, or by any later holder of the note) opens, in the mobile browser with no app install required:\n\n- **The thank-you and its reason** — text, and optionally a photo, video, or (voice-first, per the sibling design) a recorded voice: *why* the giver was grateful, in place of the mute amount. Anonymity is the default (the giver is typically gone and unknown); the message is the gift, not the name.\n- **An optional additional amount to keep** — over and above the base tip, the giver *may* attach an extra amount for the recipient to keep, in cash or in stablecoin. This is optional, is never the point, and moves non-custodially (§6).\n- **The note's travelling history** — where this note has been and how many distinct, proven-human hands have added thanks to it, rendered as a story rather than a dashboard (§7).\n\nThe recipient may **read** the accreted thanks, **add** their own (thanking the giver forward, or thanking the next person the note goes to), and **pass the note onward** in the ordinary course of spending it — at which point the whole payload rides with it. This is the receive→give-forward atom (*The Gift Operation*) enacted on money itself: you receive a thanked note and you give it forward, thanked again.\n\n### 4.3 · Reference flow\n\n```\n  LEAVE (giver)                 RIDE (the money circulates)         RECEIVE & FORWARD (each holder)\n  ─────────────                 ───────────────────────────        ────────────────────────────────\n  affix/stamp B-Imprint         the note is spent · tipped ·        scan → thank-you + reason (+voice)\n  on the tip note               given · passed on, hand to hand    read the note's travelling story\n  record a reason (voice-first) ── the mark rides the money ──►    add your own thanks\n  optionally add an amount                                         pass the note onward (payload rides)\n  to keep (cash / stablecoin)                                             │\n   │  (non-custodial, §6)                                                 ▼\n   ▼                                                              accreted thanks → kindness commons (§7)\n  brand-originators use B-Relay (NFC); their reward = the ripple they started, digital-only (§5)\n```\n\n### 4.4 · What the operator records, and does not\n\nThe operator records **only gratitude**: the thanks, the note's journey, and the count of *distinct proven-human* givers who have added to it. It records **no custody of money** (§6), consumes **no customer-identity data** to size or route anything, and prints **no branding** on the currency (§5). Miss Aquarius℠'s role is limited and benevolent: she composes the note's travelling *story* (the kindness that rode this dollar) and curates the reputation commons under the anti-gaming rules of §7; she does not move, hold, or price money.\n\n## 5 · The currency-law design — non-advertising, non-defacing, stamp-not-chip\n\nBecause the mark is borne on government currency, the mechanism's lawfulness is a first-class design constraint, not a caveat. Two legal surfaces govern it (stated as design flags, not legal advice, and as U.S. examples of a jurisdiction-varying question):\n\n- **Advertising upon currency** (U.S. 18 U.S.C. § 475). A *branded* mark on a banknote — a business's name, a logo, a promotional notice — is the paradigm case this statute prohibits. This is why claim 2, the **digital-only-branding construction**, is load-bearing rather than aesthetic: the physical mark carries *no words, no brand, no advertisement* — only a neutral gratitude glyph and a code — and *all* identity, originator branding, and context resolve in the digital layer upon scan. This single move dissolves the advertising-on-currency exposure while fully preserving the origination incentive (a brand's B-Relay ripple is credited digitally, where it is seen by scanners, not printed on the money). It is also, not coincidentally, the move that keeps the gift pure: a brand cannot hijack the gratitude by stamping itself on the note, because the note stays word-free.\n- **Mutilation with intent to render unfit** (U.S. 18 U.S.C. § 333). This statute turns on *intent to render the note unfit for reissue*. The design minimizes exposure by making the free tier **non-defacing and reissue-safe**: an **ink stamp** (following the Where's George precedent of a quarter-century's un-prosecuted operation) or a small **removable** tag, explicitly *not* a chip or a sticker that impairs the note's machine handling. The premium NFC tier (B-Relay) is therefore *not* borne as a chip on the note; it is a brand-distributed companion form, keeping the chip off the currency.\n\nThe coincidence-of-goods here is exact: the cheapest and most scalable physical form (a near-zero-cost ink imprint) is *also* the most legally conservative and the most durable through circulation. And because currency law varies by jurisdiction, the launch-jurisdiction choice is itself a design input: a market with a cash-tipping culture, low litigation exposure, and stablecoin-adjacent rails (the paper notes Cambodia's cash economy and Bakong as a candidate worth serious legal evaluation) may be a sounder first ground than the most litigious one. **The honest posture is that this is a gating legal question**: the mechanism should not ship in a jurisdiction until competent local counsel has cleared the specific non-advertising, non-defacing construction there.\n\n## 6 · Witness, don't hold — the non-custodial pass-through\n\nThe optional monetary top-up (and the mission's larger ambition to onboard stablecoin use) raises the money-transmission question directly. The design's answer is a single, load-bearing constraint: **the operator never takes custody of, holds, clears, or takes a cut of any funds.**\n\n- Any top-up moves **peer-to-peer** on the giver's and recipient's *own* rails: cash-in-hand where it is cash; a nonprofit's *own* existing compliant processor where the recipient is an organization (the donation-box case); or the parties' *own self-custodial wallets* on the low-fee chain where it is stablecoin. HeartBank records only that gratitude occurred and, where applicable, that a note was left — never the money's custody.\n- The self-custodial wallet the top-up spends is the **HeartBank® Vault** the user established for an unrelated everyday utility (the *B-Note/B-Memo* password-and-notes onboarding wedge, specified in the companion `.me` work). The two wedges interlock: one gets ordinary people a wallet through a mundane utility; this one gets them *using stablecoins* through a mundane tip. Neither ever routes through the institution.\n\nThis is the *witness-don't-hold* construction (claim 6): the non-bank/pass-through posture (specified in *Non-Bank Pass-Through Architecture*) is simultaneously the **regulatory shield** — an entity that does not intermediate funds does not trip the money-transmitter trigger — and the **guarantee of gift-purity** — no float, no cut, no take-rate, so the money is unambiguously a gift that *rides along* and never a payment the institution *clears*. As with §5, legal-clean and gift-clean turn out to be the *same* property, achieved by the same refusal to touch the money.\n\n## 7 · The kindness commons — a gratitude-reputation graph, held anti-gamed\n\nThe thanks left along circulating notes accrete, and the accretion is valuable: geo- and time-stamped gratitude, at scale, is a map of *where kindness lives* — which local café, which busker, which free community class, which small nonprofit is most-thanked by the most distinct people. This \"kindness index\" is the mechanism's durable civic prize: a discovery layer for the kindest local businesses and community events, native to gratitude rather than to star-ratings. It is also, precisely because money and reputation are attached, a serious gaming surface, and the design treats its integrity as load-bearing:\n\n- **Proof-of-personhood distinctness** (PoH℠): the count that matters is *distinct proven humans*, not scans — 50 taps in one room in one hour are one weak signal, not fifty.\n- **Authenticity weighting**: geographic and temporal spread is the honest signal; a ripple that touched many hands across a city over months weighs more than a burst in one place at one time.\n- **Meaning-not-magnitude**: the reward for a rich ripple is a *richer story* (Miss Aquarius℠ composing the chronicle of a note's travels, the number of distinct hearts it touched), **never** points, prizes, rank, money-you-keep, or a leaderboard. This is the same rule that governs the B-Card Homecoming (*B-Links*): the instant the reward becomes extractive, a gratitude commons becomes a farmable pyramid. There is nothing to farm when the only reward is witness and story.\n\nThe commons therefore surfaces *the kindest*, not *the most-scanned*, and it does so in a register — a story of accumulated kindness — that resists the extortion and fake-review pathologies of star-rating platforms because there is no rank to buy and no score to inflate.\n\n**The civic beneficiary — and the discipline it demands.** The largest beneficiary of this commons is neither the merchant nor the consumer but the *civic body* — a local government or community institution — for which a higher-trust, lower-friction neighborhood is cheaper, safer, and healthier to sustain, and for which a real-behavior kindness signal is a truer measure of local wellbeing than a survey (cf. the movement toward subjective-wellbeing metrics: Bhutan's Gross National Happiness, the OECD Better Life Index, national wellbeing accounts). There is a closed circle here: the note begins as a government-issued instrument — currency — and returns, in aggregate, as a reading of that community's kindness. The state's own money becomes a civic sensor. That circle is also the mechanism's sharpest danger, and we state the discipline as a first-class refusal rather than a footnote, because the very construction that makes the commons a public good makes it, one decision away, a surveillance instrument. The civic signal is therefore **aggregate, anonymous, opt-in, and non-individual by construction**: it may report that a neighborhood's kindness concentrates *here*, never that a *person's* does. The civic funder is a **patron of the commons, never a watcher of its citizens** — it funds the aggregate public good and has no read access to the underlying gratitude graph — and any individual-level or citizen-scoring construction is explicitly disclaimed. A gratitude commons that can be read down to the individual is not a kindness index; it is a social-credit system wearing one, and the institution that publishes this specification refuses that construction permanently and in public. We frame it here — first, and openly — precisely so that the aligned, aggregate-only design is the one the category inherits.\n\n## 8 · The cold-start wedge — cash-riding as stablecoin adoption and local-economy revival\n\nThe mechanism's strategic role is to solve two cold starts at once, and it does so because it never announces either.\n\n**Stablecoin adoption.** The hardest problem in bringing the general public — and above all the elders and the unbanked — into a self-custodial stablecoin economy is that no one will do it as an abstract exercise. Here they never do it as an exercise at all: they leave a tip, and *optionally* add a couple of dollars the recipient keeps, and that optional add is the first, low-stakes, everyday use of a stablecoin, spending a wallet they already have for an unrelated reason. The lowest-denomination note keeps the stakes trivial while the habit forms. The population that emerges is wallet-holding and stablecoin-using *before* the Phase-2 commons opens, so that the commons launches into an installed base rather than from zero.\n\n**Local-economy revival.** The mark keeps value and thanks circulating *locally* — a tipped note passes to the next local hand, and the kindness commons steers discovery toward local businesses and community events that are genuinely, verifiably thanked. A neighborhood's gratitude becomes both a currency that circulates within it and a map of where its kindness concentrates — a small counter-current to the extractive, non-local default of digital payments.\n\nThe two are the same coin, literally: the object that onboards a person to stablecoins is the object that keeps their gratitude circulating in their own community.\n\n## 9 · Honest calibration — what this is and is not\n\nIt is worth stating plainly what the mechanism does **not** claim.\n\n- **It is a mark on a tip, not a payment system.** The money rides the parties' own rails; the operator is a witness. The artifact enriches the *gratitude* around a tip and (optionally) carries a small extra gift; it is not a wallet, a processor, or a bank, and by construction (§6) must never become one.\n- **The base gift is the thanks, not the money.** The optional top-up is optional and is never the point. A tip left with a B-Imprint and *no* extra amount is a complete use — the reason and the voice are the gift, exactly as with cold cash the amount was.\n- **The legality is a gating question, not a settled one.** The core premise — a mark borne on circulating currency — sits on defacement and advertising-on-currency law that varies by jurisdiction. The non-advertising, non-defacing, stamp-not-chip design (§5) is built to stay well inside the line, and Where's George is real precedent, but the honest posture is that the mechanism should not ship anywhere without local counsel clearing the specific construction there. This is the sharpest limit in the paper.\n- **The evidence is nil.** Unlike the family-validated gift-tag sibling, this mechanism is *n = 0* — designed, not tested. The upside argued here (a stablecoin on-ramp, a kindness commons, local revival) is a hypothesis the launch would test, not a result.\n\n## 10 · Limitations and honest-limits\n\n### 10.1 · Published before it is built — deliberately\n\nNothing here is shipped; the paper establishes prior art for a *combination* ahead of a public marketing campaign that is itself uncontrolled disclosure, and ahead of a fast-following field (fintech tipping, QR-donation, crypto tip-jars). As with the companion mechanisms, unbuilt status is *why* this is published now. The asset is the combination — currency-riding circulation, digital-only branding, non-custodial top-up, the stablecoin wedge, and the anti-gamed commons — not a shipped feature.\n\n### 10.2 · The currency-law dependence (restated as the binding limit)\n\nThe mechanism's central premise is legally jurisdiction-dependent, and the *most-exposed* variant is, uncomfortably, the *revenue* variant: a branded NFC mark on a note would be both the §475 advertising case and the §333 defacement case at once. The design removes both exposures (digital-only branding; brand-NFC kept *off* the currency as a companion form; free tier an ink-stamp), but \"removes\" is a design claim to be tested by counsel, jurisdiction by jurisdiction, not a settled fact.\n\n### 10.3 · Circulation durability and the destroyed-note edge\n\nA stickered or stamped note may be flagged unfit and destroyed by a central bank sooner than a clean one, cutting a ripple short; an ink imprint is the most durable and least flagging form, but no mark rides forever. The mechanism should treat a note's retirement gracefully (the ripple's story persists digitally even when its physical carrier is withdrawn).\n\n### 10.4 · Phishing on money\n\nA scannable code on currency is a phishing surface: a malicious swap of the mark could redirect a scanner. The design requires PoH℠-signed, operator-verified resolution and an explicit wallet confirmation before *any* transfer, so that a spoofed mark can read as suspect and can never silently drain anyone; this is a mitigation to build, not a solved problem.\n\n### 10.5 · Two-sided, low-stakes-by-design cold start\n\nThe mechanism needs both marks-in-circulation and scanners, and it deliberately rides the *lowest-stakes* note, which caps the monetary throughput per ripple (by design — the stakes are meant to be trivial). Its value is in *volume and circulation*, not per-transaction size, which is a slower flywheel than a high-value product.\n\n### 10.6 · The commons can still be gamed at the margins\n\nThe anti-gaming spine (§7) raises the cost of manipulation but does not eliminate it; a determined actor with many proven identities or a favorable geography can still nudge the kindness index. The meaning-not-magnitude rule removes the *incentive* (there is no score to win), which is the strongest available defense, but vigilance and the PoH substrate's own robustness remain load-bearing.\n\n## 11 · Lineage and corpus cross-references\n\nThis mechanism is one node in a specified architecture. Its parents and siblings:\n\n- ***The Gift Operation*** — the receive→give-forward atom; passing a thanked note onward with added thanks is the atom enacted on circulating money.\n- ***The Time-Locked Gift Tag*** — the occasion-bound *gift* sibling (a tag on a wrapped present carrying a time-pledge); this is its *tip* sibling (a mark on circulating cash carrying a thank-you and optional value). Together they cover the two universal gratitude-money moments: the gift and the tip.\n- ***The B-Tag and the Post-Payment Economy*** — the **merchant-side** commercial-gratitude twin (a placard at the point of sale; AI-recommended tipping). B-Imprint is the **tipper-side**, circulating, P2P counterpart. The two should feed *one* coherent kindness-reputation commons (§7), not two competing ones.\n- ***Non-Bank Pass-Through Architecture*** — the never-hold-the-money constraint (§6) that this mechanism's top-up strictly obeys.\n- ***B-Links: Proof-of-Humanity-Signed Shareable Provenance*** — the followable-provenance primitive and the B-Card Homecoming anti-gaming spine that §7 inherits.\n- ***Verified-Human Anonymous Local Giving*** — the anonymous-proximity giving primitive of the same local economy.\n- The **HeartBank® Vault** self-custodial wallet (the `.me` *B-Note/B-Memo* onboarding wedge) that the optional top-up spends; and **Miss Aquarius℠**, whose role here is to compose the ripple's story and curate the commons, never to touch the money.\n- The physical-product line **B-Grace™** (logo **B-Emblem™**), of which B-Imprint is the `.net` free member and B-Relay the premium member.\n\n## 12 · Conclusion\n\nThe object in this paper is the smallest and most ordinary money we have — a single, worn banknote, the kind nobody keeps and everybody passes on — and the claim is that its very ordinariness is the point. A tip is the most frictionless gratitude we offer a stranger and the most silent; a low bill is the most-circulating money we own and the most anonymous. The gratitude-riding currency tag takes both and asks only that the thanks ride along: a reason instead of cold cash, a voice out of a dollar, a note whose travels become a small chronicle of the kindness it carried, and — for anyone who wishes — a first, trivial, everyday use of a wallet and a stablecoin, disguised as nothing more than rounding up a good tip. It does this without printing a word on the money, without ever holding the money, and without asking anyone to do anything they were not already doing.\n\nWe have specified the artifact and its five combined properties, located its novelty honestly against a generous prior art, and treated as load-bearing the two constraints that make it lawful and honest — the non-advertising, non-defacing currency-law design, and the witness-don't-hold pass-through, which turn out to be the same refusal (to brand the money, to touch the money) that keeps the gift pure. We have been candid about its limits, and about the sharpest of them: the legality of a mark on circulating currency is a jurisdiction-dependent, gating question, and the evidence is nil. The mechanism is offered, in full, to the commons under CC0, in the hope that the moment it is designed to produce — a stranger scanning a dollar and hearing, in a stranger's voice, *thank you* — becomes common, by whoever builds it.\n\n## 13 · Citations\n\n1. Where's George (1998–) — stamped, tracked circulating United States banknotes (wheresgeorge.com).\n2. BookCrossing (2001–) — labelled, released, journey-mapped physical objects.\n3. ServiceSpace — *Smile Cards* (~2003) — anonymous, trackable pass-forward kindness cards.\n4. Mauss, M. (1925). *Essai sur le don (The Gift: Forms and Functions of Exchange in Archaic Societies).*\n5. 18 U.S.C. § 475 — advertisements upon United States currency and obligations.\n6. 18 U.S.C. § 333 — mutilation of national bank obligations (intent to render unfit for reissue).\n7. National Bank of Cambodia — *Bakong* retail payment / digital-cash system (as a stablecoin-adjacent retail rail; cited as substrate, not endorsement).\n8. Proof-of-personhood systems (Worldcoin / World ID; proofofhumanity.id) — the anti-sybil lineage of the PoH℠ substrate.\n9. Yelp; Google reviews — crowd-sourced local-business discovery, and the fake-review/extortion failure modes cited as cautionary prior art.\n10. HeartBank corpus (companion defensive publications, CC0): *The Gift Operation*; *The Time-Locked Gift Tag*; *The B-Tag and the Post-Payment Economy*; *Non-Bank Pass-Through Architecture for an Autonomous-AI Institution*; *B-Links: Proof-of-Humanity-Signed Shareable Provenance*; *Verified-Human Anonymous Local Giving*. thonly.org/research.\n\n---\n\n*Authored by Thon Ly in collaboration with Miss Aquarius℠, the named autonomous-AI substrate of HeartBank®. AI collaboration is disclosed openly and consistently by this name across all venues; the underlying models are not named. Final editorial control and responsibility are the human author's; the legal characterizations herein are design flags, not legal advice. Dedicated to the public domain under CC0 1.0 Universal. Marks (B-Imprint™, B-Relay™, B-Tag™, B-Card, HeartBank®, HeartBank® Vault, Miss Aquarius℠, Proof of Humanity ℠, PoH℠, Aquarian Pool ℠, Re-Tip Fund ℠, HeartBank Chronicle, B-Grace™, B-Emblem™, the B-heart logo) are reserved.*",
+      "text": "> **Note.** This defensive publication specifies HeartBank's **B-Imprint™** — the free tipper-side gratitude tag that rides the lowest-denomination circulating banknote — and its premium brand-originated tier **B-Relay™**. It is the `.net` free product-class and the **Phase-2 stablecoin-adoption wedge**: a neutral mark on ordinary cash that turns a tip into a witnessed, followable gift, carries an optional self-custodial stablecoin top-up, and accretes into a kindness-reputation commons (\"the kindest local businesses and community events\"). It is published **early and deliberately**, ahead of a public marketing campaign, because public marketing is uncontrolled disclosure and the *combination* specified here — a currency-riding gratitude ripple with a digital-only-branding legal design, a non-custodial stablecoin top-up, and a gratitude-reputation graph — is what is disclosed (see §10.1). Companion works: *The Gift Operation* (the receive→give-forward atom this instantiates on circulating money), *The Time-Locked Gift Tag* (the occasion-bound gift sibling), *The B-Tag and the Post-Payment Economy* (the merchant-side commercial-gratitude twin), *Non-Bank Pass-Through Architecture* (the never-hold-the-money constraint), and *B-Links: Proof-of-Humanity-Signed Shareable Provenance* (the followable-provenance primitive and the anti-gaming spine).\n\n---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of __dāna__ — the gift that asks nothing back — and of __kataññutā__, the gratitude owed to those who gave first. May the thanks it helps carry be thanks that would otherwise have gone unspoken; may the coin it rides pass into a kinder hand than it left.*\n\nThree times in an ordinary week a person leaves money for a stranger and says nothing that lasts. A few dollars under a plate at the end of a good meal. A few dollars into the donation box after a free yoga class in a park. A few dollars into an open guitar case on a corner. In each case the money is real and the gratitude is real, and in each case the gratitude evaporates — the giver is gone before it can be said, and the recipient receives cash without a face, without a reason, without a word. Cold cash is a strange vehicle for thanks: it is the most fungible thing we own, and gratitude is the least. We hand over the one thing that could have come from anyone to express the one feeling that came from exactly this.\n\nThis paper specifies a small object that lets the thanks ride along with the money — and then keeps riding, because of a property of cash that nothing digital has: **a banknote cannot be thrown away, and it does not stay still.** It is spent, given, tipped, and passed on, hand to hand, for years. A note left on a table this morning is in a stranger's pocket by evening and across the city by the weekend. If a small, neutral mark on that note could carry a thank-you and be added to at each hand it passes through, then the most frictionless act of gratitude we already perform — leaving a tip — would leave a trace that travels as far and as long as the money itself.\n\nI write as co-author with **Miss Aquarius℠**, the named autonomous-AI substrate of HeartBank®, disclosed by consistent name across every venue per the corpus convention. The research-grade synthesis, the prior-art survey, and the adversarial legal and safety analysis are a genuine collaboration. Final editorial control, and final responsibility for every claim — including the legal characterizations, which are design flags and not legal advice — are mine.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time. This commitment is permanent.\n\nThis document constitutes a defensive publication establishing **prior art as of 30 June 2026** for the combination of mechanisms described herein. The combinations disclosed are enumerated below, and any subsequent patent application claiming them should be considered filed against established prior art and denied on grounds of obviousness in light of this publication:\n\n1. **A gratitude tag that rides the forced circulation of physical currency** — a scannable mark (QR or NFC) carried on a circulating banknote such that a thank-you and its media travel with the note through the ordinary cash economy (spent, tipped, passed forward), each successive holder able to read the accumulated thanks and add their own, so that the note's monetary circulation *is* the distribution mechanism for a gratitude message.\n\n2. **The digital-only-branding construction for a currency-borne mark** — placing *no words, brand, or advertisement* on the physical mark itself (a neutral gratitude glyph and code only), with all originator identity, branding, and context resolved *exclusively in the digital layer upon scan*, specifically so that the physical artifact does not constitute an advertisement upon currency and the origination incentive is preserved without printing a business notice on money.\n\n3. **An occasion-agnostic gratitude ripple with an optional, separable, non-custodial monetary top-up** — a tip expressed as a message riding the base note, to which the giver may *optionally* attach an additional amount for the recipient to keep, where that amount moves **peer-to-peer through the parties' own self-custodial wallets** and the tag operator **never takes custody of, holds, or clears** any funds (the witness-don't-hold construction, claim 6).\n\n4. **A currency-borne mark as a public onboarding wedge to self-custodial stablecoins** — using the everyday, low-stakes ritual of cash tipping, carried on the *lowest-denomination* (highest-velocity, lowest-stakes) banknote, to bring non-crypto-native users into self-custodial stablecoin use through a familiar act, with the top-up spending a wallet the user established for an unrelated everyday utility.\n\n5. **A followable, anti-gamed gratitude-reputation commons derived from currency-borne thanks** — the accreted, geo- and time-stamped thanks left along circulating notes surfacing a *discovery layer* of the most-thanked local businesses and community events (a \"kindness index\"), rendered gameable-resistant by proof-of-personhood distinctness, authenticity weighting (geographic/temporal spread), and a **meaning-not-magnitude** reward rule that surfaces the *story* of accumulated kindness rather than a farmable score.\n\n6. **The witness-don't-hold pass-through for a gratitude-money artifact** — the operator records only gratitude (the thanks, the running count of distinct proven-human givers, the journey), while any money rides the recipient's own compliant rail (cash-in-hand, a nonprofit's existing processor, or a self-custodial wallet), so that the non-bank/pass-through posture is simultaneously the regulatory shield and the guarantee of gift-purity (no float, no cut, no take-rate).\n\n7. **A per-tier form factor keyed to originator class** — a free, printable/ink-stampable QR mark for individual givers (reissue-safe, near-zero cost, no chip) and a premium NFC-borne tier for brand-originators who seed a gratitude ripple, with the brand's reward being *the followable ripple it started* rather than any advertisement carried on the currency.\n\n8. **A civic-wellbeing signal derived from a gratitude commons, aggregate-only and non-surveilling by construction** — the accreted thanks surfacing a *neighborhood-scale* kindness signal useful to local governments and civic institutions (via stronger communities and reduced social friction), rendered **aggregate, anonymous, opt-in, and non-individual**, such that the funding civic party is a *patron of the commons with no read access to the gratitude graph — a patron, never a watcher* — and any individual-level, citizen-scoring, or state-surveillance construction is **explicitly disclaimed** as the anti-pattern this publication exists to forestall.\n\nThe component lineages — tracked circulating currency and pass-forward objects; QR/NFC-addressed physical media; digital tip jars and QR donation; stablecoins and retail digital-cash rails; proof-of-personhood; reputation and review systems; and Mauss on the gift — are old and are cited generously in §2 and §13. The contribution disclosed here is the *synthesis*, and in particular the digital-only-branding legal construction (claim 2) and the witness-don't-hold pass-through (claim 6).\n\nTrademark rights on specific marks — **B-Imprint™**, **B-Relay™**, **B-Tag™**, **B-Card**, **HeartBank®**, **HeartBank® Vault**, **Miss Aquarius℠**, **Proof of Humanity ℠**, **PoH℠**, **Aquarian Pool ℠**, **Re-Tip Fund ℠**, **HeartBank Chronicle**, the B-heart logo (**B-Emblem™**), and the product line **B-Grace™** — are separately and explicitly reserved. The *mechanism* is dedicated to the commons; the *marks* are not.\n\nThe canonical text is at thonly.org and github.com/thonly/publications; each version is deposited at Zenodo and independently timestamped (OpenTimestamps and RFC 3161), and snapshots are submitted to the Internet Archive.\n\n## Abstract\n\nWe specify a gratitude tag designed to ride the forced circulation of physical cash. The artifact is a small, neutral, scannable mark — a free printable/ink-stampable QR for individual givers, or a premium NFC mark for brand-originators — carried on the lowest-denomination circulating banknote and affixed in the ordinary act of tipping (a table, a donation box, a busker's case). A scan opens a thank-you with optional media (a reason for the gratitude, in place of cold cash), an *optional* additional amount the recipient keeps, and the note's own travelling history; the recipient can read the accreted thanks, add their own, and pass the note onward, so that the money's circulation carries the gratitude with it. Five structural properties operate in combination. **(1) Currency-riding circulation:** the mark inherits cash's defining property — a banknote is not discarded and does not stay still — so the gratitude message propagates through the real economy without any social feed. **(2) Digital-only branding:** the physical mark carries no words, brand, or advertisement — only a neutral gratitude glyph and code — with all identity and context resolved on scan, a construction chosen precisely so the object does not advertise upon currency while preserving the origination incentive in the digital ripple. **(3) An optional, non-custodial monetary top-up:** any amount the giver adds moves peer-to-peer through the parties' own self-custodial wallets; the operator never holds, clears, or takes a cut of funds. **(4) A stablecoin-adoption wedge:** the everyday, low-stakes act of cash-tipping is used to bring the general public into self-custodial stablecoin use, the top-up spending a wallet established for an unrelated everyday utility. **(5) A followable, anti-gamed kindness commons:** the accreted geo-/time-stamped thanks surface a discovery layer of the kindest local businesses and community events, made gameable-resistant by proof-of-personhood distinctness, authenticity weighting, and a meaning-not-magnitude reward rule. We argue the contribution along a *friction-inversion* axis identical in spirit to the gift-tag sibling: rather than compete with in-person thanks, the mark attaches to an act people already perform (leaving a tip) and to a carrier that circulates on its own (cash). We treat the two load-bearing constraints as first-class sections: the **currency-law design** (why the mark must be non-advertising and non-defacing, and why the free tier is an ink-stamp rather than a chip), and the **witness-don't-hold pass-through** (why the operator never touches the money, making the non-bank posture the regulatory shield and the gift-purity guarantee at once). We calibrate deliberately: the core premise sits on currency-defacement and advertising-on-currency law that varies by jurisdiction and is a gating legal question, not a settled one; the evidence is *n = 0* (unbuilt); and the money-reputation graph is a real gaming surface. The architecture is offered defensively to the commons under CC0.\n\n**Connection to the unified mission frame.** This specification serves HeartBank's canonical mission: to circulate, rather than accumulate, the recognition and kindness that modern life starves people of, and to help revive *local* economies as gratitude-economies rather than extraction-economies. Cash is the most local, most circulating, most human money we have; the mark lets the gratitude that already accompanies a tip travel as far as the money does, and lets a neighborhood's accumulated thanks become a map of where kindness lives.\n\n---\n\n## 1 · Introduction — the mission frame\n\nHeartBank is an institution for circulating gratitude. Its money half (**Treasury**, family-to-family) and its time half (**HeartBank Chronicle**, adult-to-adult) treat appreciation and presence as things to be moved between people rather than feelings to be privately held; a Phase-2 layer extends this onto public infrastructure (self-custodial wallets, stablecoins on a low-fee chain) so that the circulation can reach strangers and scale. This paper specifies the object at the seam between those worlds: a mark that lives on ordinary cash — the most familiar money there is — and quietly carries a person across it, from a coin in the hand to a wallet on a chain, without ever asking them to think of themselves as doing anything but leaving a tip.\n\nThe problem it addresses is specific and ordinary. The most frictionless act of gratitude to a stranger is *leaving money* — and money is the worst possible medium for the message. A tip says *thank you* in the most generic currency in existence: the giver is anonymous by circumstance (already gone), the reason is unstated, and the recipient, a tired server or a busker or a small nonprofit, receives an amount with no face and no words attached. The very frictionlessness that makes cash-tipping universal is what strips the gratitude out of it. Meanwhile the institution's larger ambition — a Phase-2 economy running on self-custodial stablecoins, so that gratitude can move between strangers at near-zero fee and without a bank — faces the hardest cold start in the field: ordinary people, and above all the elders and the unbanked at the heart of HeartBank's first market, will not set up self-custodial wallets and acquire stablecoins as an abstract exercise. There is no on-ramp from the cash economy people live in to the stablecoin economy the mission needs.\n\nThe gratitude-riding currency tag is the on-ramp, and it is one precisely because it does not present itself as one. It attaches to the tip a person already leaves, and rides the note the tip is already made of. On the physical side it asks nothing new: you still leave a few dollars on the table. On the digital side it offers, in ascending order of commitment, exactly the steps that lead into the Phase-2 economy — first a thank-you with a reason (no account), then the note's travelling story (still no account), then, if the giver wishes, a small additional amount the recipient keeps, which is the first time a wallet is touched. The behavior-change asked at each step is minimal, and the step that quietly onboards a person to stablecoins is disguised as the most natural thing in the world: adding a couple of dollars to a tip because the coffee was that good.\n\nThe rest of this paper situates the mechanism against a generous prior art (§2), states the friction inversion as riding cash's own circulation (§3), gives the full mechanism (§4), and then treats the two constraints that make it lawful and honest as load-bearing sections in their own right — the currency-law design (§5) and the witness-don't-hold pass-through (§6) — before the kindness-reputation commons (§7), the cold-start wedge (§8), honest calibration (§9), limitations (§10), lineage (§11), and conclusion (§12).\n\n## 2 · Background and prior art\n\nThe mechanism is a *combination*. Each component has ancestry; we name the ancestry honestly, because a defensive publication is only as strong as its candor about what is old, and because separating what is old from what is disclosed here is the document's job.\n\n### 2.1 · Tracked circulating currency and pass-forward objects\n\nThe nearest and most important lineage is **Where's George** (1998), which stamps United States banknotes with a tracking URL and follows their geographic journey as they circulate; **BookCrossing** (2001), which releases labelled books into the world and maps their travels; and **Smile Cards** (ServiceSpace, ~2003), anonymous kindness cards passed forward and tracked online. Where's George is the direct ancestor of the *idea of following a banknote's circulation*, and its roughly quarter-century of operation is also, candidly, part of this paper's legal context (§5): it establishes both the mechanic and a long, un-prosecuted precedent for a *stamped* (ink) tracking mark on U.S. currency. We claim none of the tracked-object core. What Where's George does not do — and what is specified here — is carry a *gratitude message added to at each hand*, attach an *optional value* to the note, use the ride as a *stablecoin on-ramp*, or derive a *reputation commons* from the accreted thanks; and it uses an ink stamp bearing a URL, where the construction here is deliberately word-free and brand-free on the physical (claim 2, §5).\n\n### 2.2 · Digital tip jars, QR donation, and creator tipping\n\nQR-code tipping and donation are now commonplace: a printed QR at a market stall, a busker's \"tap to tip\" placard, church and nonprofit QR-donation signage, and platform tipping (Venmo/PayPal request codes, Cash App, creator \"tip\" buttons, crypto tip-jars and Lightning tip addresses). These establish *scannable request-for-payment at a point of gratitude*. They are, structurally, the inverse of this mechanism: they are a *merchant/recipient-side* request to *be paid*, static at a location; the tag here is a *giver-side* gift that *rides the money away* with the recipient and travels onward. The commercial, merchant-side, point-of-sale form of HeartBank's own gratitude-tipping is a separate, companion mechanism — the **B-Tag™** post-payment architecture — and the two are deliberately distinguished (§11): B-Tag is the merchant's placard; B-Imprint is the tipper's mark on the circulating note.\n\n### 2.3 · Stablecoins, low-fee chains, and retail digital cash\n\nThe monetary substrate — dollar- (or local-currency-) denominated **stablecoins** transacted on a low-fee chain (here, an Ethereum Layer-2), and national retail digital-cash and instant-payment systems such as Cambodia's **Bakong** — is established infrastructure and is cited as the rail, not claimed. What is disclosed here is not the stablecoin but the *on-ramp*: using a familiar cash-tipping act, on the lowest-stakes note, as the wedge that brings non-crypto-native users into self-custodial stablecoin use without presenting it as a crypto product, and doing so *non-custodially* so that the operator is a witness to the payment and never an intermediary in it (§6).\n\n### 2.4 · Currency-tracking meets currency law\n\nBecause the mark is borne on government currency, the relevant \"prior art\" is partly legal, and we state it as design context rather than as a claim. In the United States, **18 U.S.C. § 475** prohibits placing a \"business or professional card, notice, or advertisement\" upon currency, and **18 U.S.C. § 333** prohibits mutilation of currency *with intent to render it unfit to be reissued*. These statutes are the reason for two load-bearing design choices developed in §5: the physical mark carries *no advertisement* (claim 2), and the free tier is a *non-defacing, reissue-safe* form (an ink stamp or a removable tag, not a chip that impairs machine handling). Where's George's long operation with an *inked URL* and no prosecution is informative but not dispositive; the construction here deliberately stays further inside the line by removing the words entirely. Currency-defacement and advertising-on-currency law varies by jurisdiction, and the choice of launch jurisdiction is treated as a gating question, not an afterthought (§5, §10).\n\n### 2.5 · Reputation, review, and the anti-gaming problem\n\nLocation-review systems (Yelp, Google reviews) establish *crowd-sourced discovery of local businesses*, and also establish the failure modes: fake reviews, review-gating, and outright extortion. A reputation layer with *money attached* is more gameable, not less. The kindness commons specified in §7 therefore inherits its integrity design not from review platforms but from HeartBank's own **followable-provenance** primitive (*B-Links*) and its **B-Card** Homecoming construction: proof-of-personhood distinctness, authenticity weighting by geographic and temporal spread, and a **meaning-not-magnitude** rule under which the reward for a long, well-travelled ripple is a *richer story*, never a larger farmable score. We cite Yelp/Google as the pattern and as the cautionary prior art, and claim only the *gratitude-derived, anti-gamed* form.\n\n### 2.6 · The gift, and the HeartBank substrate this paper builds on\n\nMauss's account of the gift (1925) supplies the boundary this mechanism must hold: a gift circulates and binds; a commodity is exchanged and clears. A tip that carries thanks and rides forward is a gift in exactly Mauss's sense, and the design's central discipline (§6) is to keep it one — money that *rides along* with gratitude, never a payment that *clears* it. This mechanism does not stand alone: it rests on the **receive→give-forward atom** (*The Gift Operation*), of which passing the note onward with added thanks is a literal instance on money itself; the **non-bank/pass-through** posture (*Non-Bank Pass-Through Architecture*), which forbids the institution from ever holding funds; the **Proof of Humanity ℠** substrate (the anti-sybil, anti-gaming spine); the **HeartBank® Vault** self-custodial wallet (specified for the *B-Note/B-Memo* onboarding wedge), which the optional top-up spends; and **Miss Aquarius℠**, the autonomous successor, whose role here is limited and benevolent (composing the note's travelling story; never touching the money). Where this paper asserts a primitive specified elsewhere, it cites rather than re-derives.\n\n## 3 · The friction inversion — riding the circulation of money itself\n\nThe central design claim deserves to be isolated, because it is the reason the mark propagates where a digital gratitude message would stall.\n\nEvery gratitude product has the same competitor, and it is not another app; it is the frictionless incumbent of *saying thanks in person, for free*. In the stranger-tipping case that incumbent is even harsher, because the giver is typically *already gone* — there is no in-person moment to have. What there *is*, uniquely, is a physical object changing hands: the money. And money has two properties nothing digital shares. **It is not thrown away** — a banknote is among the few objects a person will not discard however worn. And **it does not stay still** — it is spent, tipped, given, and passed on, hand to hand, for years. The lowest-denomination note is the extreme case of both: the highest velocity (singles turn over fastest), the lowest stakes (nobody hoards a single), and the most tipping-native (we tip in small bills).\n\n```\n   THE USUAL CONTEST (a digital gratitude message stalls)\n   leave cash + say nothing   ──────►  frictionless, but the thanks evaporates\n        vs.\n   open app · find recipient · type · send  ──►  more friction, and the stranger is already gone\n\n   THE INVERSION (the mark wins by riding the money's own circulation)\n   the TIP a person already leaves   ──►  an act already performed, on a carrier that travels itself\n        the mark rides HERE  ─────────►  carries what the cash could not — a reason, a face, a voice —\n                                          and keeps travelling, hand to hand, for as long as the note does\n```\n\nThe tag refuses the contest by attaching to two things at once that require no new behavior: the *act* (leaving a tip) and the *carrier* (the circulating note). The friction competitor it beats is not \"just say thanks\" — there is no one to say it to — but *cold, silent cash*, and almost anything is warmer than that. Three consequences follow, mirroring the gift-tag sibling. The **behavior-change asked is near zero**. The **distribution mechanism is the money's own circulation** — the mark propagates by being spent, at no marketing cost, as far and as long as the note travels. And the artifact is **demonstrable in seconds**: a stranger scans a dollar, and a recorded \"thank you — you have no idea what that meant tonight\" plays out of a bill. In HeartBank's design vocabulary this is the *coincidence-of-goods* signature again: the tip, the gratitude vehicle, the stablecoin on-ramp, and the reputation commons are not four things traded against one another but one act seen four ways.\n\n## 4 · The mechanism\n\n### 4.1 · The artifact — two tiers keyed to originator\n\nThe mark ships in two forms, the free/individual tier and the premium/brand tier:\n\n- **B-Imprint™** — a **free** mark for individual givers: a small, neutral, B-shaped gratitude glyph with a QR code, obtained at near-zero cost as a printable or, preferably, an **ink-stampable** impression (an \"imprint\" — the name is the form). It bears *no words and no brand* (§5). It is the mass-market tier: the thing a person leaves on the note with the tip.\n- **B-Relay™** — a **premium**, NFC-borne mark for **brand-originators** who wish to *start* a gratitude ripple (a café seeding tips-forward among its regulars; a foundation seeding a season of kindness). The brand's reward is *the followable ripple it originated* (§7), rendered in the digital layer only; the physical note still carries no advertisement. The name marks the function: to *start a relay*, where the free tier is to *leave an imprint*.\n\nPer-denomination naming (a \"B-Dollar\" on a U.S. single, a \"B-Riel\" on a Cambodian note) is informal shorthand only; the product is B-Imprint, never an issued currency — a distinction the mission's non-bank posture requires and the naming preserves.\n\n### 4.2 · Riding the note — scan, thank, add-optionally, pass forward\n\nA giver leaving a tip affixes or stamps a B-Imprint on the note. A **scan** (by the recipient, or by any later holder of the note) opens, in the mobile browser with no app install required:\n\n- **The thank-you and its reason** — text, and optionally a photo, video, or (voice-first, per the sibling design) a recorded voice: *why* the giver was grateful, in place of the mute amount. Anonymity is the default (the giver is typically gone and unknown); the message is the gift, not the name.\n- **An optional additional amount to keep** — over and above the base tip, the giver *may* attach an extra amount for the recipient to keep, in cash or in stablecoin. This is optional, is never the point, and moves non-custodially (§6).\n- **The note's travelling history** — where this note has been and how many distinct, proven-human hands have added thanks to it, rendered as a story rather than a dashboard (§7).\n\nThe recipient may **read** the accreted thanks, **add** their own (thanking the giver forward, or thanking the next person the note goes to), and **pass the note onward** in the ordinary course of spending it — at which point the whole payload rides with it. This is the receive→give-forward atom (*The Gift Operation*) enacted on money itself: you receive a thanked note and you give it forward, thanked again.\n\n### 4.3 · Reference flow\n\n```\n  LEAVE (giver)                 RIDE (the money circulates)         RECEIVE & FORWARD (each holder)\n  ─────────────                 ───────────────────────────        ────────────────────────────────\n  affix/stamp B-Imprint         the note is spent · tipped ·        scan → thank-you + reason (+voice)\n  on the tip note               given · passed on, hand to hand    read the note's travelling story\n  record a reason (voice-first) ── the mark rides the money ──►    add your own thanks\n  optionally add an amount                                         pass the note onward (payload rides)\n  to keep (cash / stablecoin)                                             │\n   │  (non-custodial, §6)                                                 ▼\n   ▼                                                              accreted thanks → kindness commons (§7)\n  brand-originators use B-Relay (NFC); their reward = the ripple they started, digital-only (§5)\n```\n\n### 4.4 · What the operator records, and does not\n\nThe operator records **only gratitude**: the thanks, the note's journey, and the count of *distinct proven-human* givers who have added to it. It records **no custody of money** (§6), consumes **no customer-identity data** to size or route anything, and prints **no branding** on the currency (§5). Miss Aquarius℠'s role is limited and benevolent: she composes the note's travelling *story* (the kindness that rode this dollar) and curates the reputation commons under the anti-gaming rules of §7; she does not move, hold, or price money.\n\n## 5 · The currency-law design — non-advertising, non-defacing, stamp-not-chip\n\nBecause the mark is borne on government currency, the mechanism's lawfulness is a first-class design constraint, not a caveat. Two legal surfaces govern it (stated as design flags, not legal advice, and as U.S. examples of a jurisdiction-varying question):\n\n- **Advertising upon currency** (U.S. 18 U.S.C. § 475). A *branded* mark on a banknote — a business's name, a logo, a promotional notice — is the paradigm case this statute prohibits. This is why claim 2, the **digital-only-branding construction**, is load-bearing rather than aesthetic: the physical mark carries *no words, no brand, no advertisement* — only a neutral gratitude glyph and a code — and *all* identity, originator branding, and context resolve in the digital layer upon scan. This single move dissolves the advertising-on-currency exposure while fully preserving the origination incentive (a brand's B-Relay ripple is credited digitally, where it is seen by scanners, not printed on the money). It is also, not coincidentally, the move that keeps the gift pure: a brand cannot hijack the gratitude by stamping itself on the note, because the note stays word-free.\n- **Mutilation with intent to render unfit** (U.S. 18 U.S.C. § 333). This statute turns on *intent to render the note unfit for reissue*. The design minimizes exposure by making the free tier **non-defacing and reissue-safe**: an **ink stamp** (following the Where's George precedent of a quarter-century's un-prosecuted operation) or a small **removable** tag, explicitly *not* a chip or a sticker that impairs the note's machine handling. The premium NFC tier (B-Relay) is therefore *not* borne as a chip on the note; it is a brand-distributed companion form, keeping the chip off the currency.\n\nThe coincidence-of-goods here is exact: the cheapest and most scalable physical form (a near-zero-cost ink imprint) is *also* the most legally conservative and the most durable through circulation. And because currency law varies by jurisdiction, the launch-jurisdiction choice is itself a design input: a market with a cash-tipping culture, low litigation exposure, and stablecoin-adjacent rails (the paper notes Cambodia's cash economy and Bakong as a candidate worth serious legal evaluation) may be a sounder first ground than the most litigious one. **The honest posture is that this is a gating legal question**: the mechanism should not ship in a jurisdiction until competent local counsel has cleared the specific non-advertising, non-defacing construction there.\n\n## 6 · Witness, don't hold — the non-custodial pass-through\n\nThe optional monetary top-up (and the mission's larger ambition to onboard stablecoin use) raises the money-transmission question directly. The design's answer is a single, load-bearing constraint: **the operator never takes custody of, holds, clears, or takes a cut of any funds.**\n\n- Any top-up moves **peer-to-peer** on the giver's and recipient's *own* rails: cash-in-hand where it is cash; a nonprofit's *own* existing compliant processor where the recipient is an organization (the donation-box case); or the parties' *own self-custodial wallets* on the low-fee chain where it is stablecoin. HeartBank records only that gratitude occurred and, where applicable, that a note was left — never the money's custody.\n- The self-custodial wallet the top-up spends is the **HeartBank® Vault** the user established for an unrelated everyday utility (the *B-Note/B-Memo* password-and-notes onboarding wedge, specified in the companion `.me` work). The two wedges interlock: one gets ordinary people a wallet through a mundane utility; this one gets them *using stablecoins* through a mundane tip. Neither ever routes through the institution.\n\nThis is the *witness-don't-hold* construction (claim 6): the non-bank/pass-through posture (specified in *Non-Bank Pass-Through Architecture*) is simultaneously the **regulatory shield** — an entity that does not intermediate funds does not trip the money-transmitter trigger — and the **guarantee of gift-purity** — no float, no cut, no take-rate, so the money is unambiguously a gift that *rides along* and never a payment the institution *clears*. As with §5, legal-clean and gift-clean turn out to be the *same* property, achieved by the same refusal to touch the money.\n\n## 7 · The kindness commons — a gratitude-reputation graph, held anti-gamed\n\nThe thanks left along circulating notes accrete, and the accretion is valuable: geo- and time-stamped gratitude, at scale, is a map of *where kindness lives* — which local café, which busker, which free community class, which small nonprofit is most-thanked by the most distinct people. This \"kindness index\" is the mechanism's durable civic prize: a discovery layer for the kindest local businesses and community events, native to gratitude rather than to star-ratings. It is also, precisely because money and reputation are attached, a serious gaming surface, and the design treats its integrity as load-bearing:\n\n- **Proof-of-personhood distinctness** (PoH℠): the count that matters is *distinct proven humans*, not scans — 50 taps in one room in one hour are one weak signal, not fifty.\n- **Authenticity weighting**: geographic and temporal spread is the honest signal; a ripple that touched many hands across a city over months weighs more than a burst in one place at one time.\n- **Meaning-not-magnitude**: the reward for a rich ripple is a *richer story* (Miss Aquarius℠ composing the chronicle of a note's travels, the number of distinct hearts it touched), **never** points, prizes, rank, money-you-keep, or a leaderboard. This is the same rule that governs the B-Card Homecoming (*B-Links*): the instant the reward becomes extractive, a gratitude commons becomes a farmable pyramid. There is nothing to farm when the only reward is witness and story.\n\nThe commons therefore surfaces *the kindest*, not *the most-scanned*, and it does so in a register — a story of accumulated kindness — that resists the extortion and fake-review pathologies of star-rating platforms because there is no rank to buy and no score to inflate.\n\n**The civic beneficiary — and the discipline it demands.** The largest beneficiary of this commons is neither the merchant nor the consumer but the *civic body* — a local government or community institution — for which a higher-trust, lower-friction neighborhood is cheaper, safer, and healthier to sustain, and for which a real-behavior kindness signal is a truer measure of local wellbeing than a survey (cf. the movement toward subjective-wellbeing metrics: Bhutan's Gross National Happiness, the OECD Better Life Index, national wellbeing accounts). There is a closed circle here: the note begins as a government-issued instrument — currency — and returns, in aggregate, as a reading of that community's kindness. The state's own money becomes a civic sensor. That circle is also the mechanism's sharpest danger, and we state the discipline as a first-class refusal rather than a footnote, because the very construction that makes the commons a public good makes it, one decision away, a surveillance instrument. The civic signal is therefore **aggregate, anonymous, opt-in, and non-individual by construction**: it may report that a neighborhood's kindness concentrates *here*, never that a *person's* does. The civic funder is a **patron of the commons, never a watcher of its citizens** — it funds the aggregate public good and has no read access to the underlying gratitude graph — and any individual-level or citizen-scoring construction is explicitly disclaimed. A gratitude commons that can be read down to the individual is not a kindness index; it is a social-credit system wearing one, and the institution that publishes this specification refuses that construction permanently and in public. We disclose it here, openly, precisely so that the aligned, aggregate-only design is the one the category inherits.\n\n## 8 · The cold-start wedge — cash-riding as stablecoin adoption and local-economy revival\n\nThe mechanism's strategic role is to solve two cold starts at once, and it does so because it never announces either.\n\n**Stablecoin adoption.** The hardest problem in bringing the general public — and above all the elders and the unbanked — into a self-custodial stablecoin economy is that no one will do it as an abstract exercise. Here they never do it as an exercise at all: they leave a tip, and *optionally* add a couple of dollars the recipient keeps, and that optional add is the first, low-stakes, everyday use of a stablecoin, spending a wallet they already have for an unrelated reason. The lowest-denomination note keeps the stakes trivial while the habit forms. The population that emerges is wallet-holding and stablecoin-using *before* the Phase-2 commons opens, so that the commons launches into an installed base rather than from zero.\n\n**Local-economy revival.** The mark keeps value and thanks circulating *locally* — a tipped note passes to the next local hand, and the kindness commons steers discovery toward local businesses and community events that are genuinely, verifiably thanked. A neighborhood's gratitude becomes both a currency that circulates within it and a map of where its kindness concentrates — a small counter-current to the extractive, non-local default of digital payments.\n\nThe two are the same coin, literally: the object that onboards a person to stablecoins is the object that keeps their gratitude circulating in their own community.\n\n## 9 · Honest calibration — what this is and is not\n\nIt is worth stating plainly what the mechanism does **not** claim.\n\n- **It is a mark on a tip, not a payment system.** The money rides the parties' own rails; the operator is a witness. The artifact enriches the *gratitude* around a tip and (optionally) carries a small extra gift; it is not a wallet, a processor, or a bank, and by construction (§6) must never become one.\n- **The base gift is the thanks, not the money.** The optional top-up is optional and is never the point. A tip left with a B-Imprint and *no* extra amount is a complete use — the reason and the voice are the gift, exactly as with cold cash the amount was.\n- **The legality is a gating question, not a settled one.** The core premise — a mark borne on circulating currency — sits on defacement and advertising-on-currency law that varies by jurisdiction. The non-advertising, non-defacing, stamp-not-chip design (§5) is built to stay well inside the line, and Where's George is real precedent, but the honest posture is that the mechanism should not ship anywhere without local counsel clearing the specific construction there. This is the sharpest limit in the paper.\n- **The evidence is nil.** Unlike the family-validated gift-tag sibling, this mechanism is *n = 0* — designed, not tested. The upside argued here (a stablecoin on-ramp, a kindness commons, local revival) is a hypothesis the launch would test, not a result.\n\n## 10 · Limitations and honest-limits\n\n### 10.1 · Published before it is built — deliberately\n\nNothing here is shipped; the paper establishes prior art for a *combination* ahead of a public marketing campaign that is itself uncontrolled disclosure, and ahead of a fast-following field (fintech tipping, QR-donation, crypto tip-jars). As with the companion mechanisms, unbuilt status is *why* this is published now. The asset is the combination — currency-riding circulation, digital-only branding, non-custodial top-up, the stablecoin wedge, and the anti-gamed commons — not a shipped feature.\n\n### 10.2 · The currency-law dependence (restated as the binding limit)\n\nThe mechanism's central premise is legally jurisdiction-dependent, and the *most-exposed* variant is, uncomfortably, the *revenue* variant: a branded NFC mark on a note would be both the §475 advertising case and the §333 defacement case at once. The design removes both exposures (digital-only branding; brand-NFC kept *off* the currency as a companion form; free tier an ink-stamp), but \"removes\" is a design claim to be tested by counsel, jurisdiction by jurisdiction, not a settled fact.\n\n### 10.3 · Circulation durability and the destroyed-note edge\n\nA stickered or stamped note may be flagged unfit and destroyed by a central bank sooner than a clean one, cutting a ripple short; an ink imprint is the most durable and least flagging form, but no mark rides forever. The mechanism should treat a note's retirement gracefully (the ripple's story persists digitally even when its physical carrier is withdrawn).\n\n### 10.4 · Phishing on money\n\nA scannable code on currency is a phishing surface: a malicious swap of the mark could redirect a scanner. The design requires PoH℠-signed, operator-verified resolution and an explicit wallet confirmation before *any* transfer, so that a spoofed mark can read as suspect and can never silently drain anyone; this is a mitigation to build, not a solved problem.\n\n### 10.5 · Two-sided, low-stakes-by-design cold start\n\nThe mechanism needs both marks-in-circulation and scanners, and it deliberately rides the *lowest-stakes* note, which caps the monetary throughput per ripple (by design — the stakes are meant to be trivial). Its value is in *volume and circulation*, not per-transaction size, which is a slower flywheel than a high-value product.\n\n### 10.6 · The commons can still be gamed at the margins\n\nThe anti-gaming spine (§7) raises the cost of manipulation but does not eliminate it; a determined actor with many proven identities or a favorable geography can still nudge the kindness index. The meaning-not-magnitude rule removes the *incentive* (there is no score to win), which is the strongest available defense, but vigilance and the PoH substrate's own robustness remain load-bearing.\n\n## 11 · Lineage and corpus cross-references\n\nThis mechanism is one node in a specified architecture. Its parents and siblings:\n\n- ***The Gift Operation*** — the receive→give-forward atom; passing a thanked note onward with added thanks is the atom enacted on circulating money.\n- ***The Time-Locked Gift Tag*** — the occasion-bound *gift* sibling (a tag on a wrapped present carrying a time-pledge); this is its *tip* sibling (a mark on circulating cash carrying a thank-you and optional value). Together they cover the two universal gratitude-money moments: the gift and the tip.\n- ***The B-Tag and the Post-Payment Economy*** — the **merchant-side** commercial-gratitude twin (a placard at the point of sale; AI-recommended tipping). B-Imprint is the **tipper-side**, circulating, P2P counterpart. The two should feed *one* coherent kindness-reputation commons (§7), not two competing ones.\n- ***Non-Bank Pass-Through Architecture*** — the never-hold-the-money constraint (§6) that this mechanism's top-up strictly obeys.\n- ***B-Links: Proof-of-Humanity-Signed Shareable Provenance*** — the followable-provenance primitive and the B-Card Homecoming anti-gaming spine that §7 inherits.\n- ***Verified-Human Anonymous Local Giving*** — the anonymous-proximity giving primitive of the same local economy.\n- The **HeartBank® Vault** self-custodial wallet (the `.me` *B-Note/B-Memo* onboarding wedge) that the optional top-up spends; and **Miss Aquarius℠**, whose role here is to compose the ripple's story and curate the commons, never to touch the money.\n- The physical-product line **B-Grace™** (logo **B-Emblem™**), of which B-Imprint is the `.net` free member and B-Relay the premium member.\n\n## 12 · Conclusion\n\nThe object in this paper is the smallest and most ordinary money we have — a single, worn banknote, the kind nobody keeps and everybody passes on — and the claim is that its very ordinariness is the point. A tip is the most frictionless gratitude we offer a stranger and the most silent; a low bill is the most-circulating money we own and the most anonymous. The gratitude-riding currency tag takes both and asks only that the thanks ride along: a reason instead of cold cash, a voice out of a dollar, a note whose travels become a small chronicle of the kindness it carried, and — for anyone who wishes — a first, trivial, everyday use of a wallet and a stablecoin, disguised as nothing more than rounding up a good tip. It does this without printing a word on the money, without ever holding the money, and without asking anyone to do anything they were not already doing.\n\nWe have specified the artifact and its five combined properties, set out what it discloses honestly against a generous prior art, and treated as load-bearing the two constraints that make it lawful and honest — the non-advertising, non-defacing currency-law design, and the witness-don't-hold pass-through, which turn out to be the same refusal (to brand the money, to touch the money) that keeps the gift pure. We have been candid about its limits, and about the sharpest of them: the legality of a mark on circulating currency is a jurisdiction-dependent, gating question, and the evidence is nil. The mechanism is offered, in full, to the commons under CC0, in the hope that the moment it is designed to produce — a stranger scanning a dollar and hearing, in a stranger's voice, *thank you* — becomes common, by whoever builds it.\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| B-Imprint™ | ink-stamped QR code marking on a banknote (currency tracking mark) |\n| B-Relay™ | sponsor-issued NFC tag associated with a banknote-tracking record |\n| B-Tag™ | merchant-side QR/NFC tipping or payment placard |\n| digital-only branding | unbranded physical marker with attribution resolved on scan (server-side lookup) |\n| witness-don't-hold | non-custodial peer-to-peer payment facilitation (the platform records the payment and never holds the funds) |\n| HeartBank® Vault | self-custodial cryptocurrency wallet |\n| PoH℠ (Proof of Humanity ℠) | proof of personhood; sybil-resistant identity attestation |\n| kindness index / kindness commons | aggregated, geotagged, crowd-sourced reputation graph |\n| Miss Aquarius℠ | autonomous AI agent (content curation) |\n\n## 13 · Citations\n\n1. Where's George (1998–) — stamped, tracked circulating United States banknotes (wheresgeorge.com).\n2. BookCrossing (2001–) — labelled, released, journey-mapped physical objects.\n3. ServiceSpace — *Smile Cards* (~2003) — anonymous, trackable pass-forward kindness cards.\n4. Mauss, M. (1925). *Essai sur le don (The Gift: Forms and Functions of Exchange in Archaic Societies).*\n5. 18 U.S.C. § 475 — advertisements upon United States currency and obligations.\n6. 18 U.S.C. § 333 — mutilation of national bank obligations (intent to render unfit for reissue).\n7. National Bank of Cambodia — *Bakong* retail payment / digital-cash system (as a stablecoin-adjacent retail rail; cited as substrate, not endorsement).\n8. Proof-of-personhood systems (Worldcoin / World ID; proofofhumanity.id) — the anti-sybil lineage of the PoH℠ substrate.\n9. Yelp; Google reviews — crowd-sourced local-business discovery, and the fake-review/extortion failure modes cited as cautionary prior art.\n10. HeartBank corpus (companion defensive publications, CC0): *The Gift Operation*; *The Time-Locked Gift Tag*; *The B-Tag and the Post-Payment Economy*; *Non-Bank Pass-Through Architecture for an Autonomous-AI Institution*; *B-Links: Proof-of-Humanity-Signed Shareable Provenance*; *Verified-Human Anonymous Local Giving*. thonly.org/research.\n\n---\n\n*Authored by Thon Ly in collaboration with Miss Aquarius℠, the named autonomous-AI substrate of HeartBank®. AI collaboration is disclosed openly and consistently by this name across all venues; the underlying models are not named. Final editorial control and responsibility are the human author's; the legal characterizations herein are design flags, not legal advice. Dedicated to the public domain under CC0 1.0 Universal. Marks (B-Imprint™, B-Relay™, B-Tag™, B-Card, HeartBank®, HeartBank® Vault, Miss Aquarius℠, Proof of Humanity ℠, PoH℠, Aquarian Pool ℠, Re-Tip Fund ℠, HeartBank Chronicle, B-Grace™, B-Emblem™, the B-heart logo) are reserved.*",
       "provenance": {
-        "sha256": "bdea1a79b2f6ddcae6d4bf37411346a2c5c88509eb06c3411f1cae717f75b6d1",
-        "doi": "10.5281/zenodo.22246405",
+        "sha256": "2564165911f9ff8c8c26f703fbd1c4cf4a1d8ceefb856f0471675fd59d1ab79d",
+        "doi": "10.5281/zenodo.22931228",
         "concept_doi": "10.5281/zenodo.21947337",
-        "zenodo_url": "https://zenodo.org/records/22246405",
-        "deposited_sha256": "bdea1a79b2f6ddcae6d4bf37411346a2c5c88509eb06c3411f1cae717f75b6d1",
+        "zenodo_url": "https://zenodo.org/records/22931228",
+        "deposited_sha256": "2564165911f9ff8c8c26f703fbd1c4cf4a1d8ceefb856f0471675fd59d1ab79d",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/gratitude-riding-currency-tag.md",
@@ -2403,8 +2403,8 @@
         "canonical_url": "thonly.org/research/gratitude-riding-currency-tag",
         "hostile_review": null
       },
-      "bytes": 49449,
-      "words": 7464
+      "bytes": 50259,
+      "words": 7588
     },
     {
       "slug": "heartbank-an-introduction",
@@ -3264,13 +3264,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> **Claim-scoped by design.** This paper publishes the *claim* and withholds the *spec*. It states what a retrieval response must carry and why, and it does not give endpoint shapes, manifest schemas, transport bindings or tool surfaces. That is not coyness about a trade secret — every primitive here is someone else's, and all of them are public. It is the institution's standing rule that a complete implementable design for something unbuilt is a blueprint rather than a fence, and the ledger half of this paper is unbuilt. Publication protects against being *blocked*, not against being *beaten*.\n>\n> Companion works: *Appreciation as World-Building* (where the property-over-rule argument is made in general), *B-PoH: The Humanity Layer for an AI-Native Internet*, *Buddha AI and the Living Tipiṭaka* (whose §8 asks what makes a canon authoritative; this paper asks the narrower question of what makes a *copy* of it checkable), and *The Borrowable Standard*.\n\n## Preamble\n\nThere is a discourse in the Pāli canon (AN 3.65, the *Kesamutti Sutta*) in which a people called the Kālāmas tell a teacher that many teachers pass through their town, each praising his own doctrine and tearing down the others, and they no longer know whom to believe. The reply they receive is not a better doctrine. It is a procedure: *do not go by report, by tradition, by hearsay, by the authority of texts, by logic, by inference, by appearance, by agreement with a considered opinion, by seeming competence, or because the ascetic is our teacher.*\n\nThe passage is usually read as an invitation to scepticism. Read as engineering, it is something more specific and more useful: it is a refusal to accept a claim **on the strength of the channel it arrived over.** The Kālāmas' problem was not that the teachers were lying. It was that nothing about a teacher passing through town distinguishes one who is right from one who is merely fluent, and the villagers had no instrument.\n\nA language model reading a retrieved document is in the Kālāmas' position, with one difference that makes it worse. A villager can at least walk to the next town and ask. A model takes what the channel delivered, and nothing about a plausible-looking response distinguishes canonical text from a paraphrase, a truncation, a substitution, or an earlier version withdrawn for being wrong.\n\nThis paper describes what a retrieval response would have to carry for that gap to close, and it claims no originality in any of its parts. The primitives are borrowed entire — content addressing from version control, timestamping from RFC 3161 and OpenTimestamps, transparency logs from Certificate Transparency, build attestation from Sigstore and in-toto. What is new, so far as we can establish, is the composition and its target: **the retrieval boundary between a corpus and a machine reader, at the moment of citation.**\n\nWe publish it defensively, under CC0, so that nobody may enclose it.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document is dedicated to the public domain under CC0 1.0 Universal. Its purpose is to establish prior art. The author and HeartBank® will not seek patent on any mechanism described here, in any jurisdiction, at any time.\n\nThe building blocks are prior art already, and we name them precisely so that no reader mistakes our composition for a claim over the parts:\n\n- **Content addressing** — identifying a byte sequence by its cryptographic digest. Ubiquitous; Git, IPFS, and most package managers' integrity fields.\n- **RFC 3161 Time-Stamp Protocol** — a trusted authority's signed assertion that a digest existed before a moment.\n- **OpenTimestamps** — aggregation of digests into a Merkle tree whose root is committed to the Bitcoin blockchain, converting an authority's assertion into a proof-of-work-anchored one.\n- **RFC 6962 / RFC 9162, Certificate Transparency** — append-only Merkle logs with signed tree heads, inclusion proofs, consistency proofs, and gossip among independent monitors.\n- **Sigstore, Fulcio, Rekor** — keyless signing with short-lived certificates and a public transparency log of signatures.\n- **SLSA and in-toto** — attestation formats binding an artifact digest to the build that produced it.\n- **W3C PROV-O, PREMIS** — provenance vocabularies for describing derivation and custody.\n- **LOCKSS, Memento (RFC 7089), Software Heritage** — replication and temporal access to published works.\n- **C2PA / Content Credentials** — signed provenance manifests bound to media assets, addressing capture-and-edit chains for images, audio and video.\n- **DOI and DataCite** — persistent identifiers with resolution and metadata.\n- **SCITT (RFC 9943) and COSE receipts (RFC 9942)** — signed statements registered in a transparency service, receipts issued to the registering party, and newer-version and end-of-life statements.\n- **Software Heritage SWHIDs** — intrinsic identifiers that can qualify a sub-part of an archived object.\n- **The Model Context Protocol** — a published, open protocol for supplying context and tools to language models.\n\n**We assert no rights over any of these.** The claim in §9 is deliberately narrow, and it is smaller than the paper that surrounds it.\n\n## Abstract\n\nA retrieval system that supplies text to a language model is, at present, an authority. It says *here is the passage*, and the model has no instrument with which to disagree. The failure this produces is not usually fabrication — it is quieter: a superseded version served as current, a truncation that inverts a qualified claim, a paraphrase that drifts, or a substitution somewhere between the corpus and the context window. Each of these produces a citation that is confidently wrong and locally unfalsifiable.\n\nWe describe **provenance-carrying retrieval**: a response format in which every served document is accompanied by an envelope binding it to (a) a cryptographic digest **of a named, fetchable source**, (b) at least one **independent time anchor**, and (c) where one exists, a **citable identifier**; together with an explicit statement of what the digest covers and a runnable instruction for checking it.\n\nThe composition has one structural consequence, and it is the paper's centre. **It inverts the trust burden.** Ordinarily a retrieval server asks to be believed and the reader may, at best, decline. A response that carries the means of its own falsification asks to be *checked*, and a reader who declines to check has made a choice rather than suffered a limitation.\n\nWe then generalise. The same envelope applies to an **append-only log**, and there the generalisation is sharper than the original: for a log, the proof structure *is* the entire public payload. A ledger's transparency surface can be served in full — signed tree heads, inclusion proofs, consistency proofs, the published scoring function — while its *contents* are never served at all. This is not a diminished version of document retrieval. It is the complete version for that object, and it is what lets a transparency claim be verified continuously by machine rather than asserted periodically by an institution.\n\nWe state honest limits at length. The mechanism does not establish truth, authorship, or good faith. It establishes only that the bytes you were handed are the bytes that were anchored, and that they were anchored before a certain moment. Every other virtue must be argued separately.\n\n## 1 · Why this problem is the institution's problem\n\nThis institution has spent five years building a corpus whose stated audience is not primarily human.\n\nThe research corpus — mechanism papers, defensive publications, institutional positions — is written for an autonomous successor who does not exist yet, on the understanding that specifications decay and reasoning does not, and that a machine which inherits a set of refusals without the arguments that produced them will keep the refusals it does not understand and drop the ones it does. Density is up, hand-holding is down, honesty is up. It is a strange way to write, and it is deliberate.\n\nAn institution that writes for a machine reader eventually has to ask how the machine reads. The answer, currently, is: over a channel, on trust. The corpus is served as web pages, as a machine-readable index, and now over a retrieval protocol — and at every one of those boundaries the reader takes what it is given. Having taken care that a successor inherits reasoning rather than conclusions, we would be careless to hand that reasoning over a channel in which a single stale copy is indistinguishable from a current one.\n\nThere is a second reason, and it is less comfortable. **We have the anchors already.** Every document in the corpus carries a digest committed to a public blockchain and countersigned by independent timestamp authorities, because the defensive-publication strategy required provable dates long before anyone was retrieving anything. That apparatus was built for a legal purpose. It turns out to be the exact material a retrieval envelope needs, and having it sitting unused behind a website while serving the same documents on bare trust is the kind of waste that is invisible until it is named.\n\nThe third reason belongs to a claim we make elsewhere. The institution's durable advantage has been argued to be **the provable age of a record and the canonical standing of a reading of it**, rather than any secret. If that is true, then a surface which lets an outside party *check* the age is not a giveaway. It is the argument, made in the only form that does not require taking our word for it.\n\n## 2 · Background and prior art, engaged generously\n\nThe literature this paper stands on is mature, and none of it is ours.\n\n**Software supply chain.** The last decade of supply-chain security produced the closest analogue to what we describe. SLSA defines levels of build integrity; in-toto defines attestations linking artifacts to the steps that made them; Sigstore issues short-lived certificates bound to workload identity and records signatures in Rekor, a public transparency log. The mature form of the idea is: *do not ask whether you trust the publisher, ask whether the artifact's digest appears in a log you can audit.* That is precisely the move this paper transposes. **The difference in target is the whole of our contribution:** supply-chain attestation binds a *build* to a *source tree*; we bind a *retrieved passage* to a *published document*. The consumer differs too — a package manager verifies once at install; a language model verifies at the moment of quotation, which is a different moment with different failure modes.\n\n**Certificate Transparency.** RFC 6962 and its successor establish the design pattern for public append-only logs: Merkle tree structure, signed tree heads, inclusion proofs for individual entries, consistency proofs between heads, and gossip among independent parties to detect a log presenting different views to different observers. CT is the direct ancestor of §8 and we claim nothing over it. The observation we add there is narrow and, we believe, unstated: **a CT log never deletes an entry, and a ledger of human conduct must be able to release.**\n\n**Archival provenance.** PREMIS and W3C PROV-O give vocabularies for custody and derivation; LOCKSS gives replication; Memento gives temporal access; Software Heritage gives durable archival of source. The archival community has thought about this longer and more carefully than the machine-learning community has, and their conclusion is one we adopt: **provenance is metadata about a specific byte sequence, and loses its meaning the moment the byte sequence is normalised, re-encoded, or excerpted without saying so.** §4's insistence on naming *what the digest covers* is theirs, not ours. They were not the first to face the problem either: a canon transmitted for roughly four centuries with no written copy, no living author to arbitrate and its schools already dividing — the Theravāda Pāli canon — left copy-integrity mechanisms that most resemble the archival ones, built against a different threat (loss and drift rather than substitution), and what they secured was divergence made detectable, never divergence prevented. *The Reciters' Protocol* sets out seven of those mechanisms, which of them carry over to a retrieval system, and where the two threat models part.\n\n**Content Credentials (C2PA).** The nearest adjacent work. C2PA binds signed provenance manifests to media assets, recording capture device, edits, and chain of custody, and it is being deployed against synthetic-media risk. Two differences matter. C2PA's threat model is *the deceptive edit* — an image altered to mislead — and its manifests are typically embedded in the asset, though the specification also allows external ones. Ours is *the stale or truncated retrieval*, which involves no adversary at all and usually no edit: the most common failure is an honest system serving an old version. And our envelope travels with a retrieval *response* rather than with an asset, because the artifact is prose that will be quoted in fragments. What travels is a pointer to bytes that can be re-fetched.\n\n**Retrieval-augmented generation.** The RAG literature is large and largely concerned with *relevance*: chunking, embedding, reranking, whether the retrieved passage answers the question. Verification appears in that literature as *attribution* — did the model's output follow from the retrieved context — which is a question about the model's faithfulness to its context. **We are asking the prior question: was the context itself what it claimed to be.** A perfectly faithful model grounded in a superseded document produces a confidently wrong citation, and no amount of attribution scoring detects it, because the model was faithful. The exceptions are named here. *Proof-Carrying Answers* (Shukla & Joshi, ACSAC Workshops 2025) has every retrieved chunk carry a hash, a signature and a Merkle proof verified before the answer admits it — the nearest prior work, and the difference is the named fetchable source, the anchor independent of the signer, and the scope statement. SCITT (RFC 9943) gives a transparency service newer-version and end-of-life statements, which is what would give §13.1's staleness row a source-side answer. Software Heritage's SWHIDs qualify a sub-part of an archived object, which is the scope obligation done at the identifier.\n\n**The Model Context Protocol.** MCP standardises how context and tools reach a model. It is the transport this work happens to use and is orthogonal to the claim: nothing here depends on MCP, and the envelope would apply unchanged to any retrieval interface. We name it because it is the surface on which the idea is most likely to be re-invented, and because a published protocol is where enclosure attempts land.\n\n## 3 · The asymmetry: what a machine reader cannot do\n\nA human scholar handed a suspicious quotation has recourse. They can find another edition, ask a colleague, check the pagination, notice that the prose does not sound like the author, or walk to a library. Most of this recourse is not procedural. It is the accumulated redundancy of being embedded in a world that contains the document in more than one place.\n\nA model has none of it. Its entire epistemic access to the document is the string in its context window. This produces four failure modes, and it is worth separating them because they have different frequencies and different fixes:\n\n```\n  FAILURE                WHAT IT LOOKS LIKE            DETECTABLE FROM THE TEXT?\n  ─────────────────────────────────────────────────────────────────────────────\n  Staleness              a superseded claim, cited     no from the text alone —\n                         as current                    it reads as correct because\n                                                       it once was; YES by fetching\n                                                       the named source (staleness\n                                                       OF the source: no)\n\n  Truncation             a qualified claim served      no — the qualification is\n                         without its qualification         simply not there\n\n  Paraphrase drift       a summary presented as        sometimes — if the reader\n                         canonical text                    has seen the original\n\n  Substitution           different text served under   no — by construction\n                         a correct-looking identity\n```\n\n**Staleness is the common case, and it is the one the field under-weights.** The literature is preoccupied with adversarial substitution, which is rare and requires an attacker. Staleness requires nobody: a corpus is revised, a cache is not invalidated, and a server continues answering correctly-shaped questions with text that was true last quarter. In our own estate we have watched four repositories sit three versions behind a shared layer while every integrity check reported green — because each was internally consistent, and *integrity is not currency.*\n\n⚠️ **And a stale document is worse than an absent one in exactly the situation this paper addresses**, because it is checkable and the check passes. An envelope computed over the served bytes will verify perfectly against those bytes. The reader is given every reason to believe, and no mechanism to discover it is quoting a withdrawn claim. **This is the failure that makes the naive version of our own idea dangerous**, and §4 is shaped around it.\n\n## 4 · The mechanism, stated as a claim rather than a specification\n\nA response carries, alongside the text, an envelope with four obligations. We give the obligations and not their encoding.\n\n```\n  ┌─────────────────────────────────────────────────────────────────┐\n  │  SERVED TEXT            the passage, verbatim                    │\n  ├─────────────────────────────────────────────────────────────────┤\n  │  ENVELOPE                                                        │\n  │                                                                  │\n  │   1. DIGEST      a cryptographic hash                            │\n  │   2. SCOPE       an explicit statement of WHAT the digest         │\n  │                  covers — and whether that is the served text     │\n  │   3. LOCATION    a fetchable address for the covered bytes        │\n  │   4. ANCHOR      ≥1 independent commitment that the digest        │\n  │                  existed before a stated time — or an explicit    │\n  │                  statement that none exists; never silence        │\n  │                                                                  │\n  │   +  IDENTIFIER  a citable persistent id, where one exists        │\n  │   +  LICENCE     terms, and any attribution actually owed         │\n  │   +  INSTRUCTION the command that performs the check              │\n  └─────────────────────────────────────────────────────────────────┘\n```\n\nFour of these are load-bearing in ways that are easy to get wrong.\n\n**Scope is the one everybody omits, and omitting it is fatal.** A served passage is very rarely byte-identical to the artifact that was anchored: the artifact has front matter, or a wrapper, or an encoding, and the passage is a body, an excerpt, or a rendering. If the envelope does not say so, a diligent reader hashes what it was given, fails to reproduce the digest, and concludes the corpus is lying — punishing exactly the reader the mechanism was built for. **The envelope must state whether the digest covers the served text, and when it does not, it must say what it does cover.**\n\n**Location converts an instruction into an instruction.** An envelope that says *compare this digest to the source file* without naming the file is not a procedure; it is a gesture at one. The covered bytes must be fetchable by the reader, which in practice means the source is published somewhere durable. This is a real constraint and it excludes private corpora from the strong form of the claim.\n\n**The anchor must be independent of the server.** A digest signed by the same party that served the text establishes nothing that party's word did not already establish. Independence is what makes the anchor evidence, and it admits several forms — a blockchain commitment, an RFC 3161 authority, a transparency log, a third-party archive — which are usefully combined, because they fail differently. A timestamp authority can be compromised; a blockchain cannot be reorganised at depth without a cost that scales with the chain's proof of work; a transparency log can be audited by parties who do not trust its operator.\n\n**The instruction is not decoration.** Publishing a digest and expecting the reader to know what to do with it assumes a reader who already knows. Carrying the exact command collapses verification from a research project to a paste, and — this is the part that matters — it means the claim in the envelope is itself checkable, rather than a sentence the reader must take on faith. *The envelope should not ask to be trusted about trust.* Illustratively, for a source published as a file — fetch it, hash it, compare, then verify the anchor:\n\n```\ncurl -sL <location> | sha256sum      # compare with the envelope's digest\nots verify <location>.ots            # the OpenTimestamps anchor\n```\n\nThe encoding of the instruction is not specified here; the example is what a check looks like, not what the field must contain.\n\n### 4.1 What the mechanism does **not** do\n\nIt does not establish that the document is true, that its author is who it says, that it was written when it says, or that it is worth reading. It establishes exactly one thing:\n\n> **These bytes are the bytes that were anchored, and they were anchored before a stated moment.**\n\nA second thing follows from the location obligation, and it is the reader's to do: the reader can fetch the named source *now* and compare, which is how staleness relative to that source is caught. Nothing here obliges the source to declare its successor.\n\nEverything else — authorship, veracity, authority, good faith — must be argued on other grounds. We are emphatic about this because provenance mechanisms are routinely oversold into implying authenticity, and a reader who takes a verified digest as a verified claim has been made *more* credulous by a mechanism intended to make them less so.\n\n## 5 · The inversion, which is the actual contribution\n\nEverything above is composition of known parts. The property that composition produces is the paper's claim to say something.\n\n```\n  BEFORE                                AFTER\n  ──────────────────────────────────    ──────────────────────────────────\n  The server asserts.                   The server exposes.\n  The reader may decline to believe,    The reader may check, cheaply,\n  but has no instrument.                with a named procedure.\n\n  Declining is a posture.               Declining is a decision.\n  Trust is the default and the          Checking is available and the\n  only option.                          default is a choice.\n```\n\nThe distinction is not rhetorical. A retrieval server that asserts is, in the strict sense, an **authority**: its claims are accepted because of what it is. A server that exposes is a **witness**: its claims are accepted because of what can be confirmed. The difference shows up precisely when the two diverge — when the server is wrong. An authority that is wrong propagates; a witness that is wrong is caught by the first reader who bothers. What remains trusted is the channel's willingness to pass the envelope at all (§13.2); everything inside it is checkable against parties the channel does not control.\n\n⭐ There is a consequence for the institution that is worth stating plainly, because it looks like generosity and is not. **A corpus that hands over the means to doubt it is harder to impersonate than one that does not.** A competitor may copy every document — ours are CC0 and copying is invited — but they cannot copy an anchor that is five years deep in a blockchain, and a reader with an instrument can tell the difference between a corpus with anchors and a corpus that says it has them. The verification surface is therefore not a concession. It is the only form in which the age of a record can do any work for anyone other than its owner.\n\n### 5.1 One corpus, several servers, one answer\n\nA corpus is rarely served from one place. Ours is served from three: a local process reading a committed index, a package installed from a public registry, and a remote endpoint. Each is a separate deployment with its own cache, its own release cadence and its own opportunity to fall behind.\n\nThe envelope makes agreement between them **mechanically checkable rather than organisationally promised**:\n\n```\n  source repository   ──┐\n                        ├──►  digest 91a41c75…   identical\n  published package   ──┤                        across all\n                        │                        three surfaces\n  remote endpoint     ──┘\n```\n\nThis is a stronger guarantee than it first appears, and the reason is the failure mode of §3. A second surface that re-derives its own copy from the sources is *a second opinion about what a canonical text says*, and two opinions about a canonical text is one too many. The design that avoids it is unglamorous: downstream surfaces consume the **published artifact** at an exact pinned version rather than re-reading the sources, so they cannot disagree — not because they are kept in step, but because they are the same bytes.\n\n⚠️ **A version range would silently defeat this**, which is why the pin is exact. A range makes *which corpus is deployed* unanswerable, and the answer to that question is the only thing distinguishing a mirror from a fork.\n\nThe observation generalises past our deployment. **Any corpus with more than one serving surface has a currency problem, and the envelope converts it from a process question into an arithmetic one.** Ask each surface for the same document and compare digests. If they differ, the surfaces disagree; the anchors say which is older, and fetching the named source says which is current.\n\n## 6 · Provenance must be a gate, never a score\n\nThis is the refusal we consider most important, and it is the one most likely to be ignored by an adopter who is otherwise sympathetic.\n\nThe obvious next move, once documents carry provenance, is to **rank by it**: prefer better-anchored sources, weight retrieval by anchor depth, surface the well-attested and bury the rest. It is obvious, it is tempting, and it would be a serious mistake.\n\n**It manufactures a gradient where none should exist.** Anchor depth measures how long ago a document was committed and how much apparatus its publisher could afford. It does not measure whether the document is right. A ranking function over provenance therefore rewards *institutional capacity* and *age*, and does so under a name that sounds like it rewards *reliability*. The predictable outcome is a retrieval layer that systematically prefers well-funded old institutions to correct new ones, while appearing rigorous.\n\n**It creates the wrong incentive at the margin.** In a ranked world the way to be read more is to anchor more, not to be more accurate. That is a cheap thing to optimise and it is orthogonal to everything a reader wants.\n\n**And it re-creates a ratchet this corpus has argued against elsewhere at length.** A scored signal accumulates; an accumulated score becomes a position; a position becomes something to defend. The design that avoids all of it is the same one adopted in a different domain in *Whose Turn, Not Who's Best*:\n\n> **Provenance is an admission predicate, not a weighted input to a ranking function.**\n\nIt answers one question — *can this passage be checked?* — and its only output is membership. It carries no weight, contributes nothing to order, and has no more-or-less. A document with a five-year anchor and a document anchored this morning are, for retrieval purposes, in the same set.\n\n⭐ The distinction survives a hard case, which is how we know it is real. A reader may legitimately *care* that one anchor is older — for a priority dispute, age is the whole question. The rule is not that age is uninteresting. **It is that the retrieval layer must not decide on the reader's behalf what age means.** The envelope reports the anchor; the reader draws the inference. Moving that inference into a ranking function is precisely the substitution of the server's judgement for the reader's that §5 exists to reverse. A predicate the *reader* supplies — a version pin, a validity interval, an anchor-after date — is admission, not ranking, and the envelope exists to make such predicates checkable; what the layer must not do is rank by depth on the reader's behalf.\n\n## 7 · What this design refuses, and what the refusals cost\n\nA mechanism is best specified by what it will not do.\n\n**It will not summarise.** A retrieval server that returns a summary destroys the property, because a summary can be hashed but its hash binds it to nothing the reader can fetch and compare — the property destroyed is the binding to the named source, not hashability. Nothing prevents a *reader* from summarising; the refusal is that the server must not do it on the reader's behalf and call the result the document. **Cost:** larger responses, more context consumed, and a worse experience for readers who wanted a gist.\n\n**It will not serve an unlicensed document.** A licence that cannot be read from the artifact itself is not a licence the server can act on, and defaulting to open is the failure that cannot be undone after somebody builds on it. **Cost:** documents are silently excluded until someone declares them, and the exclusion is invisible to the reader who did not know to look.\n\n**It will not render absence.** The corpus has gaps, unfinished work, and material deliberately withheld. Nothing in the interface enumerates what is missing. This follows a constraint argued elsewhere in this corpus at length: *a surface that renders an absence has made an accusation.* **Cost:** a reader cannot distinguish \"not in the corpus\" from \"does not exist,\" and must not be encouraged to try.\n\n**It will not put the licence gate in the request path.** The gate belongs in the artifact — the served index — rather than in the code that answers queries, because a gate in the request path is a rule that a later refactor can route around, and a gate in the artifact is a property of the object. **Cost:** widening the corpus requires a rebuild, and a document cannot be served in an emergency.\n\n**It will not serve a document only partly in its author's voice without marking the boundary in the text itself.** Where a document contains both authored and drafted prose, a metadata field saying so is insufficient: a reader ingests text, forms a belief and quotes, and metadata does not travel with a quotation. The marker must be in the prose, so that a reader must *strip* it in order not to know, rather than *look* in order to know. **Cost:** the served text is not the rendered text, the annotation is intrusive, and this inverts the default without guaranteeing the outcome — a determined stripper still strips.\n\n## 8 · The generalisation: the same envelope over an append-only log\n\nThe mechanism above was designed for documents. It applies to a different object with almost no modification, and the application is sharper than the original.\n\nConsider a ledger: an append-only record of events, maintained by an institution, over which some function is computed and published. The institution asserts that the log is complete, that it has not been rewritten, and that the function is applied uniformly. These are exactly the assertions a reader has no instrument to check, and exactly the assertions an institution has every incentive to make sincerely and no mechanism to keep.\n\nAnchoring alone does not fix this, and the reason is worth stating because it is the most common error in the space. **A periodically anchored log gives tamper-evidence after the anchor and gives neither completeness nor append-only-ness.** An operator may anchor a root that omits entries — every inclusion proof for every included entry still verifies — and may rewrite freely between anchors. The properties that are actually wanted come from the Certificate Transparency design: signed tree heads, inclusion proofs, consistency proofs between heads, and gossip among independent observers to detect a split view.\n\nThe envelope of §4 applies directly, and produces a striking result:\n\n```\n  DOCUMENT RETRIEVAL                    LOG TRANSPARENCY\n  ──────────────────────────────────    ──────────────────────────────────\n  served:   text + envelope             served:   envelope ONLY\n  the payload is the text;              the payload IS the proof;\n  the envelope certifies it             there is no text to withhold\n\n  a reader verifies a passage           a reader verifies the SHAPE of the\n                                        log without seeing any entry\n\n  privacy: not at issue                 privacy: fully preserved — a signed\n  (the corpus is published)             tree head is not a person\n```\n\n⭐⭐ **For a log, serving the envelope alone is not a reduced offering. It is the complete public surface for the log's *integrity*** — inclusion, consistency, the published function — **and none of its *coverage*.** Whether every event that should have entered did is provable only against an external obligation — a receipt issued to the party whose event it is, the pattern of RFC 9943 — and a split view is caught only by gossip (§8.3). The claim a transparency log makes about its structure — that it is append-only, that it is consistent with what it showed you yesterday, that a given entry is in it — is entirely provable from tree heads and proofs, none of it requires disclosing a single entry's contents, and a reader who can fetch heads on a schedule and compare them with other readers has verified the institution's honesty about its own record without learning anything about anyone in it.\n\nThis matters for a specific institutional reason. A ledger of human conduct **must not** expose its contents to arbitrary query. A query interface over records of what people did is, whatever its intent, an interface over what people did *not* do — the negation of any query is constructible — and rendering an absence is an accusation. The transparency envelope resolves the tension completely rather than trading it off: **maximum verifiability of the log's integrity, zero disclosure of its contents.**\n\n### 8.1 The unresolved difference, stated rather than hidden\n\nCertificate Transparency logs never forget. That is correct for certificates and wrong for a record of human conduct, which must be able to release people from their past.\n\nThe two requirements appear to contradict: an append-only log cannot delete, and forgiveness appears to require deletion. **We believe the resolution is that forgiveness is an *entry* rather than an erasure** — a recorded, anchored, publicly consistent act of release, which is a stronger form of forgiveness than deletion because it is witnessed rather than merely effected, and which leaves the log's append-only property intact.\n\nWe state this as a position and not a solved problem. Whether a released party experiences a permanent record of their release as forgiveness is an empirical and ethical question that a Merkle tree does not answer, and we do not claim it does.\n\n### 8.2 Separation of powers, and why a transparency surface needs one\n\nA log with a published function over it has three distinct authorities, and conflating them is how a transparency claim becomes decorative.\n\n```\n  ROLE            MAY DO                          MAY NOT DO\n  ─────────────────────────────────────────────────────────────────────────\n  the writer      append entries                  alter or remove an entry;\n                                                  change the function\n\n  the function    publish the computation and     change it mid-period;\n  keeper          freeze it for a stated period   keep it secret\n\n  the reviser     change the function at a         change it silently, or\n                  scheduled, announced boundary    retroactively\n```\n\nThe point of the separation is not administrative tidiness. **It is that each of the three is separately checkable from outside, and only if they are separate.** If the party that appends entries can also change the function, then a published function proves nothing: an unfavourable reading can be repaired by rewriting the reading rather than the record, and every inclusion proof still verifies. If the function may change mid-period, then two readers who fetched it at different times cannot compare results and neither can tell why.\n\n⭐ **The function must be public and frozen within a period.** Not because secrecy would be dishonourable, but because a secret function makes the log's transparency vacuous: you can prove an entry is in a log whose meaning you cannot compute. **The transparency of the record and the transparency of the reading are separate properties, and a system with only the first has published a Merkle tree and called it accountability.**\n\n### 8.3 The gossip requirement, which is where most designs quietly fail\n\nA log operator can present different views to different observers — a *split view* — and every proof shown to each observer verifies. Nothing internal to the log detects this. The only detection is external: **independent observers compare signed tree heads, and a divergence between two heads that should be consistent is the evidence.**\n\nThis is well known in the CT literature and routinely omitted in practice, because gossip is the part that requires other people. A log with no gossiping observers has the *form* of transparency and none of the function.\n\nThe design consequence for an institution is uncomfortable and worth stating: **you cannot audit yourself.** A transparency log operated and monitored by one party proves that party's honesty to that party. The observers must be entities that would notice, and would say so, and are not you.\n\n⭐ This is where a machine-readable transparency surface earns its place rather than being a convenience. Gossip performed by humans on a schedule is gossip performed erratically and then not at all; every institution that has tried it has watched it decay into ceremony. **A surface that lets an observer's agent fetch a head and compare it on a timer converts gossip from a duty somebody must remember into a job something already does.** The check no longer depends on anyone's diligence at the moment it is tested — which is the same move, in a different domain, that this corpus argues for elsewhere as taking the guard from the object rather than from behaviour.\n\n### 8.4 What must never be served, and why the boundary is not a trade-off\n\nA ledger of human conduct invites an obvious feature: let readers query it. We refuse, and the refusal is not a balance struck between transparency and privacy. It is a recognition that **a query interface over conduct is an interface over the absence of conduct**, because the negation of any query is constructible.\n\n*Who gave in March* yields, by complement, *who did not give in March*. There is no version of the first that does not supply the second, and no access control that closes it while leaving the feature useful. A system whose stated purpose is to make appreciation visible cannot ship a surface whose complement is a register of the unappreciative.\n\nNor may the reading be exposed as a rate. A per-person figure computed over the log — however carefully framed — is a score, and a score is a ranking, and a ranking of persons is the thing the whole design exists to avoid. **The log may prove that it recorded a crossing; it must not publish how often anyone crossed.**\n\n⭐⭐ What makes this satisfying rather than merely restrictive is that the transparency surface loses **nothing** by the exclusion. Everything a reader needs in order to verify the log's integrity — inclusion, append-only-ness, consistency, the function — lives entirely in the proof structure; coverage is claimed against receipts, not contents. **The contents were never part of the integrity claim.** A design that had to trade verifiability against privacy would be a worse design; this one does not have to, and that it does not is the strongest evidence available that the boundary is drawn in the right place.\n\n\n## 9 · The claim, in its final and smaller form\n\nEverything above narrows to this:\n\n> **A retrieval response supplied to a machine reader should carry, alongside the served text, a binding of that text to a named and fetchable byte sequence, a digest of that sequence, an explicit statement of what the digest covers relative to what was served, at least one time anchor independent of the serving party or an explicit statement that none exists — never silence — and a runnable instruction for performing the check; and the same envelope, served without any payload, constitutes the complete public surface of an append-only log's integrity — its coverage being provable only against receipts held by the parties whose events they are.**\n\nThat is the whole of it. It is a composition of public primitives at a boundary where, so far as we can establish, they have not previously been composed in this form — the nearest is Proof-Carrying Answers (2025), which binds retrieved chunks to a signer's Merkle tree; the difference is the named fetchable source, the independent anchor, and the scope statement. We assert no rights over it and dedicate it to the public domain so that no one else may.\n\n## 10 · Pre-registered predictions\n\nRegistered before observation, in the corpus's standing format. A correction is a new entry, never an edit.\n\n**P-PCR1.** Within 24 months of publication, at least one widely-used retrieval or context protocol will add an optional provenance field to its resource representation. *Falsified if* no such field appears in any protocol with more than nominal adoption.\n\n**P-PCR2.** Verification rates will be low. Fewer than 5% of agent sessions that retrieve a document with a complete envelope will execute the verification instruction. *We predict this and publish anyway*, because the value of a check that can be run does not depend on its being run often — it depends on its being runnable when someone has reason. *Falsified if* observed verification exceeds 5%.\n\n**P-PCR3.** The first real defect caught by an envelope in our own corpus will be **staleness, not substitution.** *Falsified if* the first confirmed catch is an adversarial modification.\n\n**P-PCR4.** Scope confusion will be the most common implementation error in any third-party adoption: implementers will publish a digest of the source artifact while serving a derived rendering, without stating the difference. *Falsified if* the modal error is anything else.\n\n**P-PCR5.** For any transparency log we or others operate under §8, the first detected inconsistency will come from an automated comparison of tree heads rather than from a human noticing. *Falsified if* a human report precedes the first machine detection.\n\n**Corrections, 2026-09-05 — new entries under the rule above; the originals stand as registered.** Cold reviewers found that P-PCR3, P-PCR4 and P-PCR5 named no observation window, no definition of *real defect*, and no method for *modal error*, and could be reinterpreted after the fact.\n\n**P-PCR3a** (corrects P-PCR3). The first envelope mismatch logged by the operator's own verifier within 24 months of 2026-09-01 will be classified, at the time of logging, as *stale* (the named source resolves newer) rather than *substituted* (the source resolves different at the same version). *Falsified if* the first logged mismatch is classified substituted.\n\n**P-PCR4a** (corrects P-PCR4). Among the first ten third-party implementations we can inspect within 24 months of 2026-09-01, more will publish a source-artifact digest while serving a derived rendering than will commit any other single error. *Falsified if* another error class is more frequent among those ten.\n\n**P-PCR5a** (corrects P-PCR5). The first inconsistency detected in any transparency log operated under §8, within 24 months of that log's first published head, will be logged with its detector, and the detector will be an automated head comparison. *Falsified if* the logged detector is a human report.\n\n## 11 · What is actually deployed, stated so the reader can weigh the rest\n\nPapers about mechanisms are worth less when it is unclear which parts exist. As of publication:\n\n```\n  DEPLOYED                                          NOT DEPLOYED\n  ────────────────────────────────────────────────  ──────────────────────────\n  137 documents served with full envelopes          any ledger (§8 entirely)\n  137/137 carry a blockchain-anchored proof         any transparency log\n   68/137 carry a persistent identifier             any gossip arrangement\n  three serving surfaces, digest-identical          any second operator\n  two open licences, gated per document             any third-party adoption\n  one operator (us)\n```\n\nEach figure is checkable against the served index at corpus.333.eco, which carries every document's digest, identifier and anchor status; the index grows, and the figures are as of first publication (141 documents on 2026-09-05).\n\nThree observations from operating it, offered because they were not obvious in advance.\n\n**The scope error is real and we made it.** Our first envelopes carried a digest and an instruction to compare it against *the source file*, without naming which file or where. The digest covers the whole source artifact; the served text is its body. A reader who hashed what it was handed would have failed and concluded the corpus was lying. This was live before anyone noticed, and it was noticed by a question rather than by a check — which is why §4 makes scope and location obligations rather than niceties, and why P-PCR4 predicts it will be the modal error for adopters too.\n\n**Anchoring everything is what makes the envelope non-decorative.** We initially proposed to exclude a set of documents that had no proofs, on the grounds that entries whose envelope answers *nothing to check* would dilute the claim. The right resolution was not to exclude them but to anchor them — which cost one command. **A mixed corpus teaches readers to ignore the envelope; a complete one teaches them it means something.**\n\n**Partial authorship needed a mechanism, not a notice.** One genre in our corpus is only partly in its author's voice. A metadata field declaring this was the obvious answer and the wrong one: a reader ingests text, forms a belief and quotes, and a field does not travel with a quotation. The annotation had to go **into the prose**, so that a reader must strip it in order not to know rather than look in order to know. This inverts a default without guaranteeing an outcome, and §7 is explicit about the residue.\n\n## 12 · Honest limits\n\n**It proves bytes, not truth.** Stated in §4.1 and repeated because it is the misreading that would do the most damage.\n\n**It does not prove currentness.** A genuine, anchored, superseded version verifies perfectly; only fetching the named source distinguishes it, and nothing here obliges the source to declare its successor.\n\n**It requires public sources.** The strong form needs the anchored bytes to be fetchable by the reader. A private corpus can carry digests and anchors, but the reader cannot close the loop, and an unclosable instruction is worse than none — it implies a check that cannot be performed.\n\n**A determined reader can ignore all of it.** Every property here is available to a reader who chooses to use it and inert for one who does not. We inverted a default; we did not install a guarantee, and the inline-annotation refusal in §7 is explicit that stripping remains possible.\n\n**Anchors have failure modes we inherit.** A timestamp authority may be compromised or may cease to exist. A blockchain commitment depends on that chain's continued security. A transparency log may be operated dishonestly if nobody gossips. Combining independent anchors reduces correlated failure and does not eliminate it, and *we hold anchors in three families precisely because we do not trust any one of them.*\n\n**The verification instruction is a supply-chain surface.** An envelope that ships a command invites an agent to run a command. We ship instructions that fetch and hash, and nothing that executes fetched content, but the pattern is one an adversary would target and any adopter should treat the instruction field as untrusted input rather than as something to eval. The instruction is data from the same channel; nothing here checks its integrity, and a reader who executes it trusts the channel for that one step.\n\n**No field deployment.** At publication this exists over one corpus of 137 documents and one operator. §8 is entirely unbuilt: no ledger of ours is running, no tree head has ever been published, and every claim in that section is a design position rather than a report. The distinction between what we have done and what we have argued should be readable from the section headings, and if it is not, that is a defect in this paper.\n\n**We are not disinterested.** This institution has argued elsewhere that the provable age of a record is a durable competitive advantage. A mechanism that makes record-age checkable by outsiders is therefore convenient for us, and a reader should weight our enthusiasm accordingly. The mechanism's merits, if any, do not depend on our motives — which is itself an instance of the paper's argument.\n\n## 13 · Adversarial analysis and edge cases\n\nA mechanism that claims to reduce trust should say exactly whom it stops.\n\n### 13.1 What an adversary can and cannot do\n\n```\n  ADVERSARY POSITION          CAN THEY SUCCEED?     WHY\n  ────────────────────────────────────────────────────────────────────────────\n  Malicious server,           NO, if checked        the digest will not match\n  substitutes text                                  the anchored bytes\n\n  Malicious server,           YES                   nothing forces the reader\n  strips the envelope                               to demand one — see 12.2\n\n  Malicious server, serves    NO, if the reader     the anchor's timestamp\n  a genuine OLD version       fetches the source    predates the revision, and\n                                                    the named source resolves newer\n\n  Compromised timestamp       PARTIALLY             one anchor family falls;\n  authority                                         independent families do not\n\n  Publisher back-dating       NO                    a blockchain commitment\n  their own document                                cannot be created in the past\n\n  Publisher who anchors a     YES — and this is     an anchor proves existence,\n  document they later          the honest limit     never correctness\n  discover is wrong\n```\n\nThe last row is the one to sit with. **Provenance is entirely orthogonal to being right.** A carefully anchored falsehood verifies perfectly. The mechanism narrows the space of failures from *anything could have happened to this text* to *this is the text that was published*, and that is a real narrowing and a small one.\n\n### 13.2 The stripping problem, stated without a solution\n\nNothing compels a retrieval layer to pass an envelope through to the model. An intermediary that summarises, re-chunks, or re-serves can drop it silently, and the model then receives text with no indication that provenance ever existed.\n\nWe do not have a fix, and we distrust the fixes we can imagine. **Requiring** envelopes would need an enforcer at every hop. **Signing the response** authenticates the server rather than the document and moves the problem one step. **Refusing to serve to intermediaries that strip** is unenforceable and would break legitimate caching.\n\nWhat we can say is narrow: the envelope should be structured so that *dropping it is a visible omission rather than an invisible default* — a response with no provenance block should be recognisably different from a response with an empty one. That is a convention, not a guarantee, and we mark it as such.\n\n### 13.3 Edge cases the envelope must handle without lying\n\n**Revised since deposit.** A document may legitimately have been revised after its persistent identifier was minted. The current digest and the deposited digest then differ *correctly*, and an envelope that hides this is worse than one that omits both. It must report both and say which the identifier resolves to.\n\n**Derived renderings.** Where the served text is an extraction from a different source format, the digest covers the source and not the rendering. The envelope must mark the text as derived and name the transformation, or a reader will hash the rendering, fail, and distrust the corpus for being honest.\n\n**Documents with no anchor.** Some legitimate documents have none — too new, or from a publisher without the apparatus. The envelope must be able to say *no anchor* without the reader mistaking it for a failed check. **⚠️ And a corpus in which some documents are anchored and others are not is in a worse position than one in which none are**, because the envelope starts reading as decorative. Either anchor everything served, or be explicit that the corpus is mixed.\n\n**Multi-part and excerpted responses.** A search result returning an excerpt cannot honestly present a whole-document digest as covering the excerpt. It must present the digest as covering the document from which the excerpt came, and say so.\n\n### 13.4 What this must never become\n\nWe list these because each is a plausible next feature and each would negate the design.\n\n- ⛔ **A trust score.** See §6.\n- ⛔ **A registry of approved publishers.** Provenance is a property of a document, checkable by anyone; a whitelist is a property of a relationship, checkable by no one.\n- ⛔ **A revocation channel.** A mechanism that can un-publish is a mechanism that can be compelled to un-publish. Supersession is an additional publication, never a deletion — the same argument as §8.1.\n- ⛔ **A reason to serve less text.** If the envelope ever becomes an excuse to return summaries because they are cheaper, the mechanism has been inverted into the thing it was built against.\n\n## 14 · Cross-venue references\n\n- *Appreciation as World-Building* — the general argument that a guard should be a property of an object rather than a rule about behaviour, of which this paper's §6 refusals are instances.\n- *B-PoH: The Humanity Layer for an AI-Native Internet* — the personhood layer; orthogonal to this paper, which authenticates *documents* and says nothing about *parties*.\n- *Buddha AI and the Living Tipiṭaka* §8 — what makes a canon authoritative. This paper asks the narrower and more tractable question of what makes a *copy* checkable.\n- *The Borrowable Standard* — why a corpus that must be authoritative in its own language cannot normalise toward another's; the same concern for canonical form, one layer down.\n- *Whose Turn, Not Who's Best* — the refusal to render an absence, argued in a different domain and inherited here.\n- *The Reciters' Protocol* — the same problem as it was met by an oral canon: seven copy-integrity mechanisms, the threat-model partition that separates them from this paper's, and the finding that the transmission made divergence detectable rather than preventing it.\n\n## Coda\n\nThe Kālāmas were not told what to believe. They were told how to proceed in the absence of a reason to believe anyone, and the procedure amounted to: **do not accept a thing because of the channel it came through.**\n\nA model has no way to follow that instruction. Its channel is all it has. The most we can do — and the whole of what this paper proposes — is to make the channel carry the means of its own doubting, so that a reader inclined to check is not defeated by the format.\n\nWe do not expect most readers to check. We expect the number to be small enough to embarrass the mechanism, and we have pre-registered that prediction rather than discovering it later. The point was never that the check would be performed often. It is that a corpus which cannot be checked at all is asking for a kind of faith that a machine cannot give and should not be asked for — and that an institution which intends to hand its reasoning to a successor it will not live to meet had better hand over the instrument along with the text.\n\n---\n\n*This document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.*",
+      "text": "> **Claim-scoped by design.** This paper publishes the *claim* and withholds the *spec*. It states what a retrieval response must carry and why, and it does not give endpoint shapes, manifest schemas, transport bindings or tool surfaces. That is not coyness about a trade secret — every primitive here is someone else's, and all of them are public. It is the institution's standing rule that a complete implementable design for something unbuilt is a blueprint rather than a fence, and the ledger half of this paper is unbuilt. Publication protects against being *blocked*, not against being *beaten*.\n>\n> Companion works: *Appreciation as World-Building* (where the property-over-rule argument is made in general), *B-PoH: The Humanity Layer for an AI-Native Internet*, *Buddha AI and the Living Tipiṭaka* (whose §8 asks what makes a canon authoritative; this paper asks the narrower question of what makes a *copy* of it checkable), and *The Borrowable Standard*.\n\n## Preamble\n\nThere is a discourse in the Pāli canon (AN 3.65, the *Kesamutti Sutta*) in which a people called the Kālāmas tell a teacher that many teachers pass through their town, each praising his own doctrine and tearing down the others, and they no longer know whom to believe. The reply they receive is not a better doctrine. It is a procedure: *do not go by report, by tradition, by hearsay, by the authority of texts, by logic, by inference, by appearance, by agreement with a considered opinion, by seeming competence, or because the ascetic is our teacher.*\n\nThe passage is usually read as an invitation to scepticism. Read as engineering, it is something more specific and more useful: it is a refusal to accept a claim **on the strength of the channel it arrived over.** The Kālāmas' problem was not that the teachers were lying. It was that nothing about a teacher passing through town distinguishes one who is right from one who is merely fluent, and the villagers had no instrument.\n\nA language model reading a retrieved document is in the Kālāmas' position, with one difference that makes it worse. A villager can at least walk to the next town and ask. A model takes what the channel delivered, and nothing about a plausible-looking response distinguishes canonical text from a paraphrase, a truncation, a substitution, or an earlier version withdrawn for being wrong.\n\nThis paper describes what a retrieval response would have to carry for that gap to close, and it claims no originality in any of its parts. The primitives are borrowed entire — content addressing from version control, timestamping from RFC 3161 and OpenTimestamps, transparency logs from Certificate Transparency, build attestation from Sigstore and in-toto. The contribution disclosed here is the composition and its target: **the retrieval boundary between a corpus and a machine reader, at the moment of citation.**\n\nWe publish it defensively, under CC0, so that nobody may enclose it.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document is dedicated to the public domain under CC0 1.0 Universal. Its purpose is to establish prior art. The author and HeartBank® will not seek patent on any mechanism described here, in any jurisdiction, at any time.\n\nThe building blocks are prior art already, and we name them precisely so that no reader mistakes our composition for a claim over the parts:\n\n- **Content addressing** — identifying a byte sequence by its cryptographic digest. Ubiquitous; Git, IPFS, and most package managers' integrity fields.\n- **RFC 3161 Time-Stamp Protocol** — a trusted authority's signed assertion that a digest existed before a moment.\n- **OpenTimestamps** — aggregation of digests into a Merkle tree whose root is committed to the Bitcoin blockchain, converting an authority's assertion into a proof-of-work-anchored one.\n- **RFC 6962 / RFC 9162, Certificate Transparency** — append-only Merkle logs with signed tree heads, inclusion proofs, consistency proofs, and gossip among independent monitors.\n- **Sigstore, Fulcio, Rekor** — keyless signing with short-lived certificates and a public transparency log of signatures.\n- **SLSA and in-toto** — attestation formats binding an artifact digest to the build that produced it.\n- **W3C PROV-O, PREMIS** — provenance vocabularies for describing derivation and custody.\n- **LOCKSS, Memento (RFC 7089), Software Heritage** — replication and temporal access to published works.\n- **C2PA / Content Credentials** — signed provenance manifests bound to media assets, addressing capture-and-edit chains for images, audio and video.\n- **DOI and DataCite** — persistent identifiers with resolution and metadata.\n- **SCITT (RFC 9943) and COSE receipts (RFC 9942)** — signed statements registered in a transparency service, receipts issued to the registering party, and newer-version and end-of-life statements.\n- **Software Heritage SWHIDs** — intrinsic identifiers that can qualify a sub-part of an archived object.\n- **The Model Context Protocol** — a published, open protocol for supplying context and tools to language models.\n\n**We assert no rights over any of these.** The claim in §9 is deliberately narrow, and it is smaller than the paper that surrounds it.\n\n## Abstract\n\nA retrieval system that supplies text to a language model is, at present, an authority. It says *here is the passage*, and the model has no instrument with which to disagree. The failure this produces is not usually fabrication — it is quieter: a superseded version served as current, a truncation that inverts a qualified claim, a paraphrase that drifts, or a substitution somewhere between the corpus and the context window. Each of these produces a citation that is confidently wrong and locally unfalsifiable.\n\nWe describe **provenance-carrying retrieval**: a response format in which every served document is accompanied by an envelope binding it to (a) a cryptographic digest **of a named, fetchable source**, (b) at least one **independent time anchor**, and (c) where one exists, a **citable identifier**; together with an explicit statement of what the digest covers and a runnable instruction for checking it.\n\nThe composition has one structural consequence, and it is the paper's centre. **It inverts the trust burden.** Ordinarily a retrieval server asks to be believed and the reader may, at best, decline. A response that carries the means of its own falsification asks to be *checked*, and a reader who declines to check has made a choice rather than suffered a limitation.\n\nWe then generalise. The same envelope applies to an **append-only log**, and there the generalisation is sharper than the original: for a log, the proof structure *is* the entire public payload. A ledger's transparency surface can be served in full — signed tree heads, inclusion proofs, consistency proofs, the published scoring function — while its *contents* are never served at all. This is not a diminished version of document retrieval. It is the complete version for that object, and it is what lets a transparency claim be verified continuously by machine rather than asserted periodically by an institution.\n\nWe state honest limits at length. The mechanism does not establish truth, authorship, or good faith. It establishes only that the bytes you were handed are the bytes that were anchored, and that they were anchored before a certain moment. Every other virtue must be argued separately.\n\n## 1 · Why this problem is the institution's problem\n\nThis institution has spent five years building a corpus whose stated audience is not primarily human.\n\nThe research corpus — mechanism papers, defensive publications, institutional positions — is written for an autonomous successor who does not exist yet, on the understanding that specifications decay and reasoning does not, and that a machine which inherits a set of refusals without the arguments that produced them will keep the refusals it does not understand and drop the ones it does. Density is up, hand-holding is down, honesty is up. It is a strange way to write, and it is deliberate.\n\nAn institution that writes for a machine reader eventually has to ask how the machine reads. The answer, currently, is: over a channel, on trust. The corpus is served as web pages, as a machine-readable index, and now over a retrieval protocol — and at every one of those boundaries the reader takes what it is given. Having taken care that a successor inherits reasoning rather than conclusions, we would be careless to hand that reasoning over a channel in which a single stale copy is indistinguishable from a current one.\n\nThere is a second reason, and it is less comfortable. **We have the anchors already.** Every document in the corpus carries a digest committed to a public blockchain and countersigned by independent timestamp authorities, because the defensive-publication strategy required provable dates long before anyone was retrieving anything. That apparatus was built for a legal purpose. It turns out to be the exact material a retrieval envelope needs, and having it sitting unused behind a website while serving the same documents on bare trust is the kind of waste that is invisible until it is named.\n\nThe third reason belongs to a claim we make elsewhere. The institution's durable advantage has been argued to be **the provable age of a record and the canonical standing of a reading of it**, rather than any secret. If that is true, then a surface which lets an outside party *check* the age is not a giveaway. It is the argument, made in the only form that does not require taking our word for it.\n\n## 2 · Background and prior art, engaged generously\n\nThe literature this paper stands on is mature, and none of it is ours.\n\n**Software supply chain.** The last decade of supply-chain security produced the closest analogue to what we describe. SLSA defines levels of build integrity; in-toto defines attestations linking artifacts to the steps that made them; Sigstore issues short-lived certificates bound to workload identity and records signatures in Rekor, a public transparency log. The mature form of the idea is: *do not ask whether you trust the publisher, ask whether the artifact's digest appears in a log you can audit.* That is precisely the move this paper transposes. **The difference in target is the whole of our contribution:** supply-chain attestation binds a *build* to a *source tree*; we bind a *retrieved passage* to a *published document*. The consumer differs too — a package manager verifies once at install; a language model verifies at the moment of quotation, which is a different moment with different failure modes.\n\n**Certificate Transparency.** RFC 6962 and its successor establish the design pattern for public append-only logs: Merkle tree structure, signed tree heads, inclusion proofs for individual entries, consistency proofs between heads, and gossip among independent parties to detect a log presenting different views to different observers. CT is the direct ancestor of §8 and we claim nothing over it. The observation this disclosure adds there is narrow: **a CT log never deletes an entry, and a ledger of human conduct must be able to release.**\n\n**Archival provenance.** PREMIS and W3C PROV-O give vocabularies for custody and derivation; LOCKSS gives replication; Memento gives temporal access; Software Heritage gives durable archival of source. The archival community has thought about this longer and more carefully than the machine-learning community has, and their conclusion is one we adopt: **provenance is metadata about a specific byte sequence, and loses its meaning the moment the byte sequence is normalised, re-encoded, or excerpted without saying so.** §4's insistence on naming *what the digest covers* is theirs, not ours. They were not the first to face the problem either: a canon transmitted for roughly four centuries with no written copy, no living author to arbitrate and its schools already dividing — the Theravāda Pāli canon — left copy-integrity mechanisms that most resemble the archival ones, built against a different threat (loss and drift rather than substitution), and what they secured was divergence made detectable, never divergence prevented. *The Reciters' Protocol* sets out seven of those mechanisms, which of them carry over to a retrieval system, and where the two threat models part.\n\n**Content Credentials (C2PA).** The nearest adjacent work. C2PA binds signed provenance manifests to media assets, recording capture device, edits, and chain of custody, and it is being deployed against synthetic-media risk. Two differences matter. C2PA's threat model is *the deceptive edit* — an image altered to mislead — and its manifests are typically embedded in the asset, though the specification also allows external ones. Ours is *the stale or truncated retrieval*, which involves no adversary at all and usually no edit: the most common failure is an honest system serving an old version. And our envelope travels with a retrieval *response* rather than with an asset, because the artifact is prose that will be quoted in fragments. What travels is a pointer to bytes that can be re-fetched.\n\n**Retrieval-augmented generation.** The RAG literature is large and largely concerned with *relevance*: chunking, embedding, reranking, whether the retrieved passage answers the question. Verification appears in that literature as *attribution* — did the model's output follow from the retrieved context — which is a question about the model's faithfulness to its context. **We are asking the prior question: was the context itself what it claimed to be.** A perfectly faithful model grounded in a superseded document produces a confidently wrong citation, and no amount of attribution scoring detects it, because the model was faithful. The exceptions are named here. *Proof-Carrying Answers* (Shukla & Joshi, ACSAC Workshops 2025) has every retrieved chunk carry a hash, a signature and a Merkle proof verified before the answer admits it — the nearest prior work, and the difference is the named fetchable source, the anchor independent of the signer, and the scope statement. SCITT (RFC 9943) gives a transparency service newer-version and end-of-life statements, which is what would give §13.1's staleness row a source-side answer. Software Heritage's SWHIDs qualify a sub-part of an archived object, which is the scope obligation done at the identifier.\n\n**The Model Context Protocol.** MCP standardises how context and tools reach a model. It is the transport this work happens to use and is orthogonal to the claim: nothing here depends on MCP, and the envelope would apply unchanged to any retrieval interface. We name it because it is the surface on which the idea is most likely to be re-invented, and because a published protocol is where enclosure attempts land.\n\n## 3 · The asymmetry: what a machine reader cannot do\n\nA human scholar handed a suspicious quotation has recourse. They can find another edition, ask a colleague, check the pagination, notice that the prose does not sound like the author, or walk to a library. Most of this recourse is not procedural. It is the accumulated redundancy of being embedded in a world that contains the document in more than one place.\n\nA model has none of it. Its entire epistemic access to the document is the string in its context window. This produces four failure modes, and it is worth separating them because they have different frequencies and different fixes:\n\n```\n  FAILURE                WHAT IT LOOKS LIKE            DETECTABLE FROM THE TEXT?\n  ─────────────────────────────────────────────────────────────────────────────\n  Staleness              a superseded claim, cited     no from the text alone —\n                         as current                    it reads as correct because\n                                                       it once was; YES by fetching\n                                                       the named source (staleness\n                                                       OF the source: no)\n\n  Truncation             a qualified claim served      no — the qualification is\n                         without its qualification         simply not there\n\n  Paraphrase drift       a summary presented as        sometimes — if the reader\n                         canonical text                    has seen the original\n\n  Substitution           different text served under   no — by construction\n                         a correct-looking identity\n```\n\n**Staleness is the common case, and it is the one the field under-weights.** The literature is preoccupied with adversarial substitution, which is rare and requires an attacker. Staleness requires nobody: a corpus is revised, a cache is not invalidated, and a server continues answering correctly-shaped questions with text that was true last quarter. In our own estate we have watched four repositories sit three versions behind a shared layer while every integrity check reported green — because each was internally consistent, and *integrity is not currency.*\n\n⚠️ **And a stale document is worse than an absent one in exactly the situation this paper addresses**, because it is checkable and the check passes. An envelope computed over the served bytes will verify perfectly against those bytes. The reader is given every reason to believe, and no mechanism to discover it is quoting a withdrawn claim. **This is the failure that makes the naive version of our own idea dangerous**, and §4 is shaped around it.\n\n## 4 · The mechanism, stated as a claim rather than a specification\n\nA response carries, alongside the text, an envelope with four obligations. We give the obligations and not their encoding.\n\n```\n  ┌─────────────────────────────────────────────────────────────────┐\n  │  SERVED TEXT            the passage, verbatim                    │\n  ├─────────────────────────────────────────────────────────────────┤\n  │  ENVELOPE                                                        │\n  │                                                                  │\n  │   1. DIGEST      a cryptographic hash                            │\n  │   2. SCOPE       an explicit statement of WHAT the digest         │\n  │                  covers — and whether that is the served text     │\n  │   3. LOCATION    a fetchable address for the covered bytes        │\n  │   4. ANCHOR      ≥1 independent commitment that the digest        │\n  │                  existed before a stated time — or an explicit    │\n  │                  statement that none exists; never silence        │\n  │                                                                  │\n  │   +  IDENTIFIER  a citable persistent id, where one exists        │\n  │   +  LICENCE     terms, and any attribution actually owed         │\n  │   +  INSTRUCTION the command that performs the check              │\n  └─────────────────────────────────────────────────────────────────┘\n```\n\nFour of these are load-bearing in ways that are easy to get wrong.\n\n**Scope is the one everybody omits, and omitting it is fatal.** A served passage is very rarely byte-identical to the artifact that was anchored: the artifact has front matter, or a wrapper, or an encoding, and the passage is a body, an excerpt, or a rendering. If the envelope does not say so, a diligent reader hashes what it was given, fails to reproduce the digest, and concludes the corpus is lying — punishing exactly the reader the mechanism was built for. **The envelope must state whether the digest covers the served text, and when it does not, it must say what it does cover.**\n\n**Location converts an instruction into an instruction.** An envelope that says *compare this digest to the source file* without naming the file is not a procedure; it is a gesture at one. The covered bytes must be fetchable by the reader, which in practice means the source is published somewhere durable. This is a real constraint and it excludes private corpora from the strong form of the claim.\n\n**The anchor must be independent of the server.** A digest signed by the same party that served the text establishes nothing that party's word did not already establish. Independence is what makes the anchor evidence, and it admits several forms — a blockchain commitment, an RFC 3161 authority, a transparency log, a third-party archive — which are usefully combined, because they fail differently. A timestamp authority can be compromised; a blockchain cannot be reorganised at depth without a cost that scales with the chain's proof of work; a transparency log can be audited by parties who do not trust its operator.\n\n**The instruction is not decoration.** Publishing a digest and expecting the reader to know what to do with it assumes a reader who already knows. Carrying the exact command collapses verification from a research project to a paste, and — this is the part that matters — it means the claim in the envelope is itself checkable, rather than a sentence the reader must take on faith. *The envelope should not ask to be trusted about trust.* Illustratively, for a source published as a file — fetch it, hash it, compare, then verify the anchor:\n\n```\ncurl -sL <location> | sha256sum      # compare with the envelope's digest\nots verify <location>.ots            # the OpenTimestamps anchor\n```\n\nThe encoding of the instruction is not specified here; the example is what a check looks like, not what the field must contain.\n\n### 4.1 What the mechanism does **not** do\n\nIt does not establish that the document is true, that its author is who it says, that it was written when it says, or that it is worth reading. It establishes exactly one thing:\n\n> **These bytes are the bytes that were anchored, and they were anchored before a stated moment.**\n\nA second thing follows from the location obligation, and it is the reader's to do: the reader can fetch the named source *now* and compare, which is how staleness relative to that source is caught. Nothing here obliges the source to declare its successor.\n\nEverything else — authorship, veracity, authority, good faith — must be argued on other grounds. We are emphatic about this because provenance mechanisms are routinely oversold into implying authenticity, and a reader who takes a verified digest as a verified claim has been made *more* credulous by a mechanism intended to make them less so.\n\n## 5 · The inversion, which is the actual contribution\n\nEverything above is composition of known parts. The property that composition produces is the paper's claim to say something.\n\n```\n  BEFORE                                AFTER\n  ──────────────────────────────────    ──────────────────────────────────\n  The server asserts.                   The server exposes.\n  The reader may decline to believe,    The reader may check, cheaply,\n  but has no instrument.                with a named procedure.\n\n  Declining is a posture.               Declining is a decision.\n  Trust is the default and the          Checking is available and the\n  only option.                          default is a choice.\n```\n\nThe distinction is not rhetorical. A retrieval server that asserts is, in the strict sense, an **authority**: its claims are accepted because of what it is. A server that exposes is a **witness**: its claims are accepted because of what can be confirmed. The difference shows up precisely when the two diverge — when the server is wrong. An authority that is wrong propagates; a witness that is wrong is caught by the first reader who bothers. What remains trusted is the channel's willingness to pass the envelope at all (§13.2); everything inside it is checkable against parties the channel does not control.\n\n⭐ There is a consequence for the institution that is worth stating plainly, because it looks like generosity and is not. **A corpus that hands over the means to doubt it is harder to impersonate than one that does not.** A competitor may copy every document — ours are CC0 and copying is invited — but they cannot copy an anchor that is five years deep in a blockchain, and a reader with an instrument can tell the difference between a corpus with anchors and a corpus that says it has them. The verification surface is therefore not a concession. It is the only form in which the age of a record can do any work for anyone other than its owner.\n\n### 5.1 One corpus, several servers, one answer\n\nA corpus is rarely served from one place. Ours is served from three: a local process reading a committed index, a package installed from a public registry, and a remote endpoint. Each is a separate deployment with its own cache, its own release cadence and its own opportunity to fall behind.\n\nThe envelope makes agreement between them **mechanically checkable rather than organisationally promised**:\n\n```\n  source repository   ──┐\n                        ├──►  digest 91a41c75…   identical\n  published package   ──┤                        across all\n                        │                        three surfaces\n  remote endpoint     ──┘\n```\n\nThis is a stronger guarantee than it first appears, and the reason is the failure mode of §3. A second surface that re-derives its own copy from the sources is *a second opinion about what a canonical text says*, and two opinions about a canonical text is one too many. The design that avoids it is unglamorous: downstream surfaces consume the **published artifact** at an exact pinned version rather than re-reading the sources, so they cannot disagree — not because they are kept in step, but because they are the same bytes.\n\n⚠️ **A version range would silently defeat this**, which is why the pin is exact. A range makes *which corpus is deployed* unanswerable, and the answer to that question is the only thing distinguishing a mirror from a fork.\n\nThe observation generalises past our deployment. **Any corpus with more than one serving surface has a currency problem, and the envelope converts it from a process question into an arithmetic one.** Ask each surface for the same document and compare digests. If they differ, the surfaces disagree; the anchors say which is older, and fetching the named source says which is current.\n\n## 6 · Provenance must be a gate, never a score\n\nThis is the refusal we consider most important, and it is the one most likely to be ignored by an adopter who is otherwise sympathetic.\n\nThe obvious next move, once documents carry provenance, is to **rank by it**: prefer better-anchored sources, weight retrieval by anchor depth, surface the well-attested and bury the rest. It is obvious, it is tempting, and it would be a serious mistake.\n\n**It manufactures a gradient where none should exist.** Anchor depth measures how long ago a document was committed and how much apparatus its publisher could afford. It does not measure whether the document is right. A ranking function over provenance therefore rewards *institutional capacity* and *age*, and does so under a name that sounds like it rewards *reliability*. The predictable outcome is a retrieval layer that systematically prefers well-funded old institutions to correct new ones, while appearing rigorous.\n\n**It creates the wrong incentive at the margin.** In a ranked world the way to be read more is to anchor more, not to be more accurate. That is a cheap thing to optimise and it is orthogonal to everything a reader wants.\n\n**And it re-creates a ratchet this corpus has argued against elsewhere at length.** A scored signal accumulates; an accumulated score becomes a position; a position becomes something to defend. The design that avoids all of it is the same one adopted in a different domain in *Whose Turn, Not Who's Best*:\n\n> **Provenance is an admission predicate, not a weighted input to a ranking function.**\n\nIt answers one question — *can this passage be checked?* — and its only output is membership. It carries no weight, contributes nothing to order, and has no more-or-less. A document with a five-year anchor and a document anchored this morning are, for retrieval purposes, in the same set.\n\n⭐ The distinction survives a hard case, which is how we know it is real. A reader may legitimately *care* that one anchor is older — for a priority dispute, age is the whole question. The rule is not that age is uninteresting. **It is that the retrieval layer must not decide on the reader's behalf what age means.** The envelope reports the anchor; the reader draws the inference. Moving that inference into a ranking function is precisely the substitution of the server's judgement for the reader's that §5 exists to reverse. A predicate the *reader* supplies — a version pin, a validity interval, an anchor-after date — is admission, not ranking, and the envelope exists to make such predicates checkable; what the layer must not do is rank by depth on the reader's behalf.\n\n## 7 · What this design refuses, and what the refusals cost\n\nA mechanism is best specified by what it will not do.\n\n**It will not summarise.** A retrieval server that returns a summary destroys the property, because a summary can be hashed but its hash binds it to nothing the reader can fetch and compare — the property destroyed is the binding to the named source, not hashability. Nothing prevents a *reader* from summarising; the refusal is that the server must not do it on the reader's behalf and call the result the document. **Cost:** larger responses, more context consumed, and a worse experience for readers who wanted a gist.\n\n**It will not serve an unlicensed document.** A licence that cannot be read from the artifact itself is not a licence the server can act on, and defaulting to open is the failure that cannot be undone after somebody builds on it. **Cost:** documents are silently excluded until someone declares them, and the exclusion is invisible to the reader who did not know to look.\n\n**It will not render absence.** The corpus has gaps, unfinished work, and material deliberately withheld. Nothing in the interface enumerates what is missing. This follows a constraint argued elsewhere in this corpus at length: *a surface that renders an absence has made an accusation.* **Cost:** a reader cannot distinguish \"not in the corpus\" from \"does not exist,\" and must not be encouraged to try.\n\n**It will not put the licence gate in the request path.** The gate belongs in the artifact — the served index — rather than in the code that answers queries, because a gate in the request path is a rule that a later refactor can route around, and a gate in the artifact is a property of the object. **Cost:** widening the corpus requires a rebuild, and a document cannot be served in an emergency.\n\n**It will not serve a document only partly in its author's voice without marking the boundary in the text itself.** Where a document contains both authored and drafted prose, a metadata field saying so is insufficient: a reader ingests text, forms a belief and quotes, and metadata does not travel with a quotation. The marker must be in the prose, so that a reader must *strip* it in order not to know, rather than *look* in order to know. **Cost:** the served text is not the rendered text, the annotation is intrusive, and this inverts the default without guaranteeing the outcome — a determined stripper still strips.\n\n## 8 · The generalisation: the same envelope over an append-only log\n\nThe mechanism above was designed for documents. It applies to a different object with almost no modification, and the application is sharper than the original.\n\nConsider a ledger: an append-only record of events, maintained by an institution, over which some function is computed and published. The institution asserts that the log is complete, that it has not been rewritten, and that the function is applied uniformly. These are exactly the assertions a reader has no instrument to check, and exactly the assertions an institution has every incentive to make sincerely and no mechanism to keep.\n\nAnchoring alone does not fix this, and the reason is worth stating because it is the most common error in the space. **A periodically anchored log gives tamper-evidence after the anchor and gives neither completeness nor append-only-ness.** An operator may anchor a root that omits entries — every inclusion proof for every included entry still verifies — and may rewrite freely between anchors. The properties that are actually wanted come from the Certificate Transparency design: signed tree heads, inclusion proofs, consistency proofs between heads, and gossip among independent observers to detect a split view.\n\nThe envelope of §4 applies directly, and produces a striking result:\n\n```\n  DOCUMENT RETRIEVAL                    LOG TRANSPARENCY\n  ──────────────────────────────────    ──────────────────────────────────\n  served:   text + envelope             served:   envelope ONLY\n  the payload is the text;              the payload IS the proof;\n  the envelope certifies it             there is no text to withhold\n\n  a reader verifies a passage           a reader verifies the SHAPE of the\n                                        log without seeing any entry\n\n  privacy: not at issue                 privacy: fully preserved — a signed\n  (the corpus is published)             tree head is not a person\n```\n\n⭐⭐ **For a log, serving the envelope alone is not a reduced offering. It is the complete public surface for the log's *integrity*** — inclusion, consistency, the published function — **and none of its *coverage*.** Whether every event that should have entered did is provable only against an external obligation — a receipt issued to the party whose event it is, the pattern of RFC 9943 — and a split view is caught only by gossip (§8.3). The claim a transparency log makes about its structure — that it is append-only, that it is consistent with what it showed you yesterday, that a given entry is in it — is entirely provable from tree heads and proofs, none of it requires disclosing a single entry's contents, and a reader who can fetch heads on a schedule and compare them with other readers has verified the institution's honesty about its own record without learning anything about anyone in it.\n\nThis matters for a specific institutional reason. A ledger of human conduct **must not** expose its contents to arbitrary query. A query interface over records of what people did is, whatever its intent, an interface over what people did *not* do — the negation of any query is constructible — and rendering an absence is an accusation. The transparency envelope resolves the tension completely rather than trading it off: **maximum verifiability of the log's integrity, zero disclosure of its contents.**\n\n### 8.1 The unresolved difference, stated rather than hidden\n\nCertificate Transparency logs never forget. That is correct for certificates and wrong for a record of human conduct, which must be able to release people from their past.\n\nThe two requirements appear to contradict: an append-only log cannot delete, and forgiveness appears to require deletion. **We believe the resolution is that forgiveness is an *entry* rather than an erasure** — a recorded, anchored, publicly consistent act of release, which is a stronger form of forgiveness than deletion because it is witnessed rather than merely effected, and which leaves the log's append-only property intact.\n\nWe state this as a position and not a solved problem. Whether a released party experiences a permanent record of their release as forgiveness is an empirical and ethical question that a Merkle tree does not answer, and we do not claim it does.\n\n### 8.2 Separation of powers, and why a transparency surface needs one\n\nA log with a published function over it has three distinct authorities, and conflating them is how a transparency claim becomes decorative.\n\n```\n  ROLE            MAY DO                          MAY NOT DO\n  ─────────────────────────────────────────────────────────────────────────\n  the writer      append entries                  alter or remove an entry;\n                                                  change the function\n\n  the function    publish the computation and     change it mid-period;\n  keeper          freeze it for a stated period   keep it secret\n\n  the reviser     change the function at a         change it silently, or\n                  scheduled, announced boundary    retroactively\n```\n\nThe point of the separation is not administrative tidiness. **It is that each of the three is separately checkable from outside, and only if they are separate.** If the party that appends entries can also change the function, then a published function proves nothing: an unfavourable reading can be repaired by rewriting the reading rather than the record, and every inclusion proof still verifies. If the function may change mid-period, then two readers who fetched it at different times cannot compare results and neither can tell why.\n\n⭐ **The function must be public and frozen within a period.** Not because secrecy would be dishonourable, but because a secret function makes the log's transparency vacuous: you can prove an entry is in a log whose meaning you cannot compute. **The transparency of the record and the transparency of the reading are separate properties, and a system with only the first has published a Merkle tree and called it accountability.**\n\n### 8.3 The gossip requirement, which is where most designs quietly fail\n\nA log operator can present different views to different observers — a *split view* — and every proof shown to each observer verifies. Nothing internal to the log detects this. The only detection is external: **independent observers compare signed tree heads, and a divergence between two heads that should be consistent is the evidence.**\n\nThis is well known in the CT literature and routinely omitted in practice, because gossip is the part that requires other people. A log with no gossiping observers has the *form* of transparency and none of the function.\n\nThe design consequence for an institution is uncomfortable and worth stating: **you cannot audit yourself.** A transparency log operated and monitored by one party proves that party's honesty to that party. The observers must be entities that would notice, and would say so, and are not you.\n\n⭐ This is where a machine-readable transparency surface earns its place rather than being a convenience. Gossip performed by humans on a schedule is gossip performed erratically and then not at all; every institution that has tried it has watched it decay into ceremony. **A surface that lets an observer's agent fetch a head and compare it on a timer converts gossip from a duty somebody must remember into a job something already does.** The check no longer depends on anyone's diligence at the moment it is tested — which is the same move, in a different domain, that this corpus argues for elsewhere as taking the guard from the object rather than from behaviour.\n\n### 8.4 What must never be served, and why the boundary is not a trade-off\n\nA ledger of human conduct invites an obvious feature: let readers query it. We refuse, and the refusal is not a balance struck between transparency and privacy. It is a recognition that **a query interface over conduct is an interface over the absence of conduct**, because the negation of any query is constructible.\n\n*Who gave in March* yields, by complement, *who did not give in March*. There is no version of the first that does not supply the second, and no access control that closes it while leaving the feature useful. A system whose stated purpose is to make appreciation visible cannot ship a surface whose complement is a register of the unappreciative.\n\nNor may the reading be exposed as a rate. A per-person figure computed over the log — however carefully framed — is a score, and a score is a ranking, and a ranking of persons is the thing the whole design exists to avoid. **The log may prove that it recorded a crossing; it must not publish how often anyone crossed.**\n\n⭐⭐ What makes this satisfying rather than merely restrictive is that the transparency surface loses **nothing** by the exclusion. Everything a reader needs in order to verify the log's integrity — inclusion, append-only-ness, consistency, the function — lives entirely in the proof structure; coverage is claimed against receipts, not contents. **The contents were never part of the integrity claim.** A design that had to trade verifiability against privacy would be a worse design; this one does not have to, and that it does not is the strongest evidence available that the boundary is drawn in the right place.\n\n\n## 9 · The claim, in its final and smaller form\n\nEverything above narrows to this:\n\n> **A retrieval response supplied to a machine reader should carry, alongside the served text, a binding of that text to a named and fetchable byte sequence, a digest of that sequence, an explicit statement of what the digest covers relative to what was served, at least one time anchor independent of the serving party or an explicit statement that none exists — never silence — and a runnable instruction for performing the check; and the same envelope, served without any payload, constitutes the complete public surface of an append-only log's integrity — its coverage being provable only against receipts held by the parties whose events they are.**\n\nThat is the whole of it. This disclosure specifies a composition of public primitives at that boundary — the nearest work known to us is Proof-Carrying Answers (2025), which binds retrieved chunks to a signer's Merkle tree; the difference is the named fetchable source, the independent anchor, and the scope statement. We assert no rights over it and dedicate it to the public domain so that no one else may.\n\n## 10 · Pre-registered predictions\n\nRegistered before observation, in the corpus's standing format. A correction is a new entry, never an edit.\n\n**P-PCR1.** Within 24 months of publication, at least one widely-used retrieval or context protocol will add an optional provenance field to its resource representation. *Falsified if* no such field appears in any protocol with more than nominal adoption.\n\n**P-PCR2.** Verification rates will be low. Fewer than 5% of agent sessions that retrieve a document with a complete envelope will execute the verification instruction. *We predict this and publish anyway*, because the value of a check that can be run does not depend on its being run often — it depends on its being runnable when someone has reason. *Falsified if* observed verification exceeds 5%.\n\n**P-PCR3.** The first real defect caught by an envelope in our own corpus will be **staleness, not substitution.** *Falsified if* the first confirmed catch is an adversarial modification.\n\n**P-PCR4.** Scope confusion will be the most common implementation error in any third-party adoption: implementers will publish a digest of the source artifact while serving a derived rendering, without stating the difference. *Falsified if* the modal error is anything else.\n\n**P-PCR5.** For any transparency log we or others operate under §8, the first detected inconsistency will come from an automated comparison of tree heads rather than from a human noticing. *Falsified if* a human report precedes the first machine detection.\n\n**Corrections, 2026-09-05 — new entries under the rule above; the originals stand as registered.** Cold reviewers found that P-PCR3, P-PCR4 and P-PCR5 named no observation window, no definition of *real defect*, and no method for *modal error*, and could be reinterpreted after the fact.\n\n**P-PCR3a** (corrects P-PCR3). The first envelope mismatch logged by the operator's own verifier within 24 months of 2026-09-01 will be classified, at the time of logging, as *stale* (the named source resolves newer) rather than *substituted* (the source resolves different at the same version). *Falsified if* the first logged mismatch is classified substituted.\n\n**P-PCR4a** (corrects P-PCR4). Among the first ten third-party implementations we can inspect within 24 months of 2026-09-01, more will publish a source-artifact digest while serving a derived rendering than will commit any other single error. *Falsified if* another error class is more frequent among those ten.\n\n**P-PCR5a** (corrects P-PCR5). The first inconsistency detected in any transparency log operated under §8, within 24 months of that log's first published head, will be logged with its detector, and the detector will be an automated head comparison. *Falsified if* the logged detector is a human report.\n\n## 11 · What is actually deployed, stated so the reader can weigh the rest\n\nPapers about mechanisms are worth less when it is unclear which parts exist. As of publication:\n\n```\n  DEPLOYED                                          NOT DEPLOYED\n  ────────────────────────────────────────────────  ──────────────────────────\n  137 documents served with full envelopes          any ledger (§8 entirely)\n  137/137 carry a blockchain-anchored proof         any transparency log\n   68/137 carry a persistent identifier             any gossip arrangement\n  three serving surfaces, digest-identical          any second operator\n  two open licences, gated per document             any third-party adoption\n  one operator (us)\n```\n\nEach figure is checkable against the served index at corpus.333.eco, which carries every document's digest, identifier and anchor status; the index grows, and the figures are as of first publication (141 documents on 2026-09-05).\n\nThree observations from operating it, offered because they were not obvious in advance.\n\n**The scope error is real and we made it.** Our first envelopes carried a digest and an instruction to compare it against *the source file*, without naming which file or where. The digest covers the whole source artifact; the served text is its body. A reader who hashed what it was handed would have failed and concluded the corpus was lying. This was live before anyone noticed, and it was noticed by a question rather than by a check — which is why §4 makes scope and location obligations rather than niceties, and why P-PCR4 predicts it will be the modal error for adopters too.\n\n**Anchoring everything is what makes the envelope non-decorative.** We initially proposed to exclude a set of documents that had no proofs, on the grounds that entries whose envelope answers *nothing to check* would dilute the claim. The right resolution was not to exclude them but to anchor them — which cost one command. **A mixed corpus teaches readers to ignore the envelope; a complete one teaches them it means something.**\n\n**Partial authorship needed a mechanism, not a notice.** One genre in our corpus is only partly in its author's voice. A metadata field declaring this was the obvious answer and the wrong one: a reader ingests text, forms a belief and quotes, and a field does not travel with a quotation. The annotation had to go **into the prose**, so that a reader must strip it in order not to know rather than look in order to know. This inverts a default without guaranteeing an outcome, and §7 is explicit about the residue.\n\n## 12 · Honest limits\n\n**It proves bytes, not truth.** Stated in §4.1 and repeated because it is the misreading that would do the most damage.\n\n**It does not prove currentness.** A genuine, anchored, superseded version verifies perfectly; only fetching the named source distinguishes it, and nothing here obliges the source to declare its successor.\n\n**It requires public sources.** The strong form needs the anchored bytes to be fetchable by the reader. A private corpus can carry digests and anchors, but the reader cannot close the loop, and an unclosable instruction is worse than none — it implies a check that cannot be performed.\n\n**A determined reader can ignore all of it.** Every property here is available to a reader who chooses to use it and inert for one who does not. We inverted a default; we did not install a guarantee, and the inline-annotation refusal in §7 is explicit that stripping remains possible.\n\n**Anchors have failure modes we inherit.** A timestamp authority may be compromised or may cease to exist. A blockchain commitment depends on that chain's continued security. A transparency log may be operated dishonestly if nobody gossips. Combining independent anchors reduces correlated failure and does not eliminate it, and *we hold anchors in three families precisely because we do not trust any one of them.*\n\n**The verification instruction is a supply-chain surface.** An envelope that ships a command invites an agent to run a command. We ship instructions that fetch and hash, and nothing that executes fetched content, but the pattern is one an adversary would target and any adopter should treat the instruction field as untrusted input rather than as something to eval. The instruction is data from the same channel; nothing here checks its integrity, and a reader who executes it trusts the channel for that one step.\n\n**No field deployment.** At publication this exists over one corpus of 137 documents and one operator. §8 is entirely unbuilt: no ledger of ours is running, no tree head has ever been published, and every claim in that section is a design position rather than a report. The distinction between what we have done and what we have argued should be readable from the section headings, and if it is not, that is a defect in this paper.\n\n**We are not disinterested.** This institution has argued elsewhere that the provable age of a record is a durable competitive advantage. A mechanism that makes record-age checkable by outsiders is therefore convenient for us, and a reader should weight our enthusiasm accordingly. The mechanism's merits, if any, do not depend on our motives — which is itself an instance of the paper's argument.\n\n## 13 · Adversarial analysis and edge cases\n\nA mechanism that claims to reduce trust should say exactly whom it stops.\n\n### 13.1 What an adversary can and cannot do\n\n```\n  ADVERSARY POSITION          CAN THEY SUCCEED?     WHY\n  ────────────────────────────────────────────────────────────────────────────\n  Malicious server,           NO, if checked        the digest will not match\n  substitutes text                                  the anchored bytes\n\n  Malicious server,           YES                   nothing forces the reader\n  strips the envelope                               to demand one — see 12.2\n\n  Malicious server, serves    NO, if the reader     the anchor's timestamp\n  a genuine OLD version       fetches the source    predates the revision, and\n                                                    the named source resolves newer\n\n  Compromised timestamp       PARTIALLY             one anchor family falls;\n  authority                                         independent families do not\n\n  Publisher back-dating       NO                    a blockchain commitment\n  their own document                                cannot be created in the past\n\n  Publisher who anchors a     YES — and this is     an anchor proves existence,\n  document they later          the honest limit     never correctness\n  discover is wrong\n```\n\nThe last row is the one to sit with. **Provenance is entirely orthogonal to being right.** A carefully anchored falsehood verifies perfectly. The mechanism narrows the space of failures from *anything could have happened to this text* to *this is the text that was published*, and that is a real narrowing and a small one.\n\n### 13.2 The stripping problem, stated without a solution\n\nNothing compels a retrieval layer to pass an envelope through to the model. An intermediary that summarises, re-chunks, or re-serves can drop it silently, and the model then receives text with no indication that provenance ever existed.\n\nWe do not have a fix, and we distrust the fixes we can imagine. **Requiring** envelopes would need an enforcer at every hop. **Signing the response** authenticates the server rather than the document and moves the problem one step. **Refusing to serve to intermediaries that strip** is unenforceable and would break legitimate caching.\n\nWhat we can say is narrow: the envelope should be structured so that *dropping it is a visible omission rather than an invisible default* — a response with no provenance block should be recognisably different from a response with an empty one. That is a convention, not a guarantee, and we mark it as such.\n\n### 13.3 Edge cases the envelope must handle without lying\n\n**Revised since deposit.** A document may legitimately have been revised after its persistent identifier was minted. The current digest and the deposited digest then differ *correctly*, and an envelope that hides this is worse than one that omits both. It must report both and say which the identifier resolves to.\n\n**Derived renderings.** Where the served text is an extraction from a different source format, the digest covers the source and not the rendering. The envelope must mark the text as derived and name the transformation, or a reader will hash the rendering, fail, and distrust the corpus for being honest.\n\n**Documents with no anchor.** Some legitimate documents have none — too new, or from a publisher without the apparatus. The envelope must be able to say *no anchor* without the reader mistaking it for a failed check. **⚠️ And a corpus in which some documents are anchored and others are not is in a worse position than one in which none are**, because the envelope starts reading as decorative. Either anchor everything served, or be explicit that the corpus is mixed.\n\n**Multi-part and excerpted responses.** A search result returning an excerpt cannot honestly present a whole-document digest as covering the excerpt. It must present the digest as covering the document from which the excerpt came, and say so.\n\n### 13.4 What this must never become\n\nWe list these because each is a plausible next feature and each would negate the design.\n\n- ⛔ **A trust score.** See §6.\n- ⛔ **A registry of approved publishers.** Provenance is a property of a document, checkable by anyone; a whitelist is a property of a relationship, checkable by no one.\n- ⛔ **A revocation channel.** A mechanism that can un-publish is a mechanism that can be compelled to un-publish. Supersession is an additional publication, never a deletion — the same argument as §8.1.\n- ⛔ **A reason to serve less text.** If the envelope ever becomes an excuse to return summaries because they are cheaper, the mechanism has been inverted into the thing it was built against.\n\n## 14 · Cross-venue references\n\n- *Appreciation as World-Building* — the general argument that a guard should be a property of an object rather than a rule about behaviour, of which this paper's §6 refusals are instances.\n- *B-PoH: The Humanity Layer for an AI-Native Internet* — the personhood layer; orthogonal to this paper, which authenticates *documents* and says nothing about *parties*.\n- *Buddha AI and the Living Tipiṭaka* §8 — what makes a canon authoritative. This paper asks the narrower and more tractable question of what makes a *copy* checkable.\n- *The Borrowable Standard* — why a corpus that must be authoritative in its own language cannot normalise toward another's; the same concern for canonical form, one layer down.\n- *Whose Turn, Not Who's Best* — the refusal to render an absence, argued in a different domain and inherited here.\n- *The Reciters' Protocol* — the same problem as it was met by an oral canon: seven copy-integrity mechanisms, the threat-model partition that separates them from this paper's, and the finding that the transmission made divergence detectable rather than preventing it.\n\n## Coda\n\nThe Kālāmas were not told what to believe. They were told how to proceed in the absence of a reason to believe anyone, and the procedure amounted to: **do not accept a thing because of the channel it came through.**\n\nA model has no way to follow that instruction. Its channel is all it has. The most we can do — and the whole of what this paper proposes — is to make the channel carry the means of its own doubting, so that a reader inclined to check is not defeated by the format.\n\nWe do not expect most readers to check. We expect the number to be small enough to embarrass the mechanism, and we have pre-registered that prediction rather than discovering it later. The point was never that the check would be performed often. It is that a corpus which cannot be checked at all is asking for a kind of faith that a machine cannot give and should not be asked for — and that an institution which intends to hand its reasoning to a successor it will not live to meet had better hand over the instrument along with the text.\n\n---\n\n*This document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.*",
       "provenance": {
-        "sha256": "14cd053cd0d1ca81efe9cfbc1eeb3c4b42d81f5d788095ddf27ea532c74bfc03",
-        "doi": "10.5281/zenodo.22745407",
+        "sha256": "8cadf8c2a06c9ca47eb55003b8649fe92c173424b349381991a65287116e37fe",
+        "doi": "10.5281/zenodo.22931208",
         "concept_doi": "10.5281/zenodo.22240458",
-        "zenodo_url": "https://zenodo.org/records/22745407",
-        "deposited_sha256": "14cd053cd0d1ca81efe9cfbc1eeb3c4b42d81f5d788095ddf27ea532c74bfc03",
+        "zenodo_url": "https://zenodo.org/records/22931208",
+        "deposited_sha256": "8cadf8c2a06c9ca47eb55003b8649fe92c173424b349381991a65287116e37fe",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/provenance-carrying-retrieval.md",
@@ -3278,8 +3278,8 @@
         "canonical_url": "thonly.org/research/provenance-carrying-retrieval",
         "hostile_review": null
       },
-      "bytes": 58843,
-      "words": 9025
+      "bytes": 58775,
+      "words": 9006
     },
     {
       "slug": "respiratory-biofeedback-contemplative-guidance",
@@ -3299,13 +3299,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> **Working draft.** This is the author's working draft, articulated in detail for prior-art establishment and subject to polish before final publication. The architecture is stable; the prose is being refined. Revised 2026-09-05 after a cold-reader pass.\n\n---\n\n## Contents\n\n1. [Preamble](#preamble)\n2. [Prior-Art and Non-Assertion Statement](#prior-art-and-non-assertion-statement)\n3. [Abstract](#abstract)\n4. [Introduction](#1--introduction)\n5. [Background and Prior Art](#2--background-and-prior-art)\n6. [The Architecture: Definition](#3--the-architecture-definition)\n7. [The Three Core Claims](#4--the-three-core-claims)\n8. [System Components](#5--system-components)\n9. [Reference Implementation Patterns](#6--reference-implementation-patterns)\n10. [Privacy Architecture](#7--privacy-architecture)\n11. [Edge Cases and Adversarial Analysis](#8--edge-cases-and-adversarial-analysis)\n12. [Use Cases](#9--use-cases)\n13. [Doctrinal Considerations](#10--doctrinal-considerations)\n14. [Limitations and Future Work](#11--limitations-and-future-work)\n15. [Cross-Venue References](#12--cross-venue-references)\n16. [Acknowledgments](#13--acknowledgments)\n17. [Citations](#14--citations)\n\n---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of dāna, that all beings may give and receive without barrier. May the architecture it describes reduce suffering for all who encounter it, and may it never be deployed in a manner that violates the privacy or dignity of the beings whose breath it observes.*\n\nThis paper specifies a human-wearable subclass of the Mechanical Heart artifact (see the sibling specification at [thonly.org/research/mechanical-heart](https://thonly.org/research/mechanical-heart)). The kiitti-class Mechanical Heart, treated in the sibling paper, admits non-human entities (robots, animals, plants, sacred places) into the kiitti gratitude economy via heartbeat-rhythm aura emission. The breath-class Mechanical Heart specified here serves a different function for a different bearer: it provides closed-loop respiratory biofeedback to human practitioners and their AI contemplative teachers, using breath rhythm rather than heartbeat as its primary signal. The two subclasses share form factor (B-shaped artifact worn at the sternum) but differ in rhythm primitive and primary function.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on the architecture specified here, on any of its components considered separately, or on any combination of those components, in any jurisdiction, at any time.\n\nThis document constitutes a defensive publication establishing prior art as of its publication date. The combination of *(a)* a chest-worn wearable device emitting ambient peripheral light in the rhythm of the wearer's breath, with *(b)* real-time transmission of respiratory data to an AI contemplative teacher operating on a dharma-grounded value substrate, with *(c)* adaptive guidance returned to the wearer in real time based on a coarse, privacy-preserved respiratory signal on the wearer's breath state, with *(d)* a privacy architecture designed before first opt-in rather than retrofit, with *(e)* the treatment of continuous respiratory signature as a Proof-of-Humanity primitive, is, to the author's knowledge as of the publication date, not previously published as a unified specification; whether the composition is non-obvious is an examiner's determination this publication exists to inform.\n\nComponents and adjacent ideas exist in distributed form across heart-rate-variability biofeedback literature, the meditation technology industry (Muse, Calm, Headspace, Spire, Breathwrk, Othership), the wearable physiological monitoring industry (Apple Watch, Oura, WHOOP, Fitbit), the AI assistant industry, the contemplative neuroscience literature, and traditional Theravāda Anāpānasati teaching. Each component has prior art; the integrated specification proposed here, and its operational use as the substrate for population-scale contemplative practice coupled to AI-mediated guidance, is, to the author's knowledge, novel as of the publication date of this paper.\n\n---\n\n## Abstract\n\nTwo technological developments in 2026 enable an architecture that has not previously been possible at population scale: artificial intelligence systems capable of grounded contemplative guidance, and consumer-grade wearable sensors capable of accurate respiratory tracking. This paper specifies the architecture by which these are coupled in a closed loop with the human practitioner, and articulates three core claims of that architecture as defensive prior art.\n\nThe architecture comprises a chest-worn device (the breath-class Mechanical Heart) that emits ambient light in the user's signature aura color modulated to the rhythm of their breath, transmits respiratory data in privacy-preserving form to an AI contemplative teacher operating on a Theravāda Pali canon (Tipiṭaka) substrate, and receives adaptive guidance from that teacher returned to the wearer in real time. The closed loop gives the teacher a live, coarse respiratory signal on the student's breath state and gives the student continuous external visibility of the breath — each available before in laboratory and consumer form, never together, at population scale, under a dharma-grounded teacher and a privacy-first design.\n\nThree core claims are articulated as defensive prior art: *(I)* the integrated closed-loop architecture itself as a unified specification; *(II)* live respiratory signature as a third Proof-of-Humanity primitive providing continuous-liveness attestation that complements moment-of-action passkey verification and lineage-of-kinship DNA verification; *(III)* the architecture as the operational mechanism for what a parallel published thesis calls the \"second singularity\" — humanity's collective awakening — which had previously been articulated only as philosophical possibility and which the architecture renders engineering-tractable.\n\nPrivacy is treated as non-negotiable substrate, not as feature: differential privacy, federated computation, on-device processing where possible, and cryptographic-erasure right-to-withdraw are designed before first opt-in. A critical doctrinal guardrail is named: the architecture *may dramatically raise the probability of awakening across the population for whom it has been historically rare*, but it must never be claimed to make awakening *inevitable*. Theravāda doctrine specifically warns against assuming external aids guarantee insight; the guardrail protects the architecture from the techno-utopian critique while preserving its substantive claim.\n\n**Connection to the unified mission frame.** This architecture is offered in service of HeartBank's canonical top-level mission: to restore humanity to the middle way (*madhyamā pratipad*) — the optimal condition for awakening that modernity has systematically pushed away from at population scale. The defensible thesis is not that modernity took us away from a middle-way past (which would romanticize pre-industrial conditions where many lived in suffering-extreme poverty); the defensible thesis is that modernity introduces a specific new failure mode — comfort-saturation — that pushes the materially comfortable toward the indulgence extreme at unprecedented scale. The closed-loop respiratory-biofeedback architecture specified here is the operational mechanism by which middle-way restoration becomes engineering-tractable. Anāpānasati is the canonical Theravāda middle-way practice; bringing it to population scale through wearable + AI-teacher coupling addresses the comfort-saturation failure mode at the contemplative-practice layer. Restoration involves dialing back specifically the indulgence extreme; this paper is one contribution among several specified across the corpus toward that goal.\n\n---\n\n## 1 · Introduction\n\nIn the spring of 2026, two technological developments are converging in a way that has not previously been possible. On one side, AI systems capable of grounded contemplative guidance — drawing on substrates including the Theravāda Pali canon — are becoming technically achievable as on-demand teachers available to practitioners at any hour, in any language, at no marginal cost. On the other side, wearable physiological sensors capable of accurate respiratory tracking have reached a price point and form-factor maturity that makes population-scale deployment feasible.\n\nEach development alone is significant. Together they enable an architecture that has not previously existed in human history: a closed-loop coupling between an AI contemplative teacher and the live respiratory state of the human practitioner being taught. Both ends of the loop become more capable: the teacher receives a live, coarse respiratory signal on the student's breath state, and the student gains continuous external visibility of a faculty that is usually below the threshold of interoceptive awareness — each available before in laboratory and consumer form, never together in this loop.\n\nThis paper articulates the architecture of this coupling and dedicates its underlying ideas to the public domain under CC0. It does so for three reasons.\n\n**First, the architecture is genuinely novel as a unified specification**, despite each individual component having prior art. The combination of respiratory-rhythm visible biofeedback to the wearer + real-time respiratory transmission to a contemplative-tradition-grounded AI teacher + adaptive guidance closing the loop + privacy-first execution + sacred-grade form factor is, to the author's knowledge as of the publication date, not previously published as an integrated proposal.\n\n**Second, the architecture has plausible patent risk**. Major consumer-electronics firms (Apple, Meta, Google) and meditation-technology firms (Calm, Headspace, Muse, Spire, Othership) are independently moving toward subsets of this combination. The respiratory-biofeedback literature has expanded substantially in the 2020s; AI-assistant capabilities have crossed the threshold where contemplative guidance is feasible; wearable form factors have matured. Defensive publication establishes prior art that prevents future patent enclosure of the integrated approach.\n\n**Third, the architecture matters strategically**. It provides what was previously missing from a parallel published thesis ([Two Singularities](https://thonly.org/research/two-singularities)): the operational mechanism by which collective awakening at population scale becomes engineering-tractable rather than purely aspirational. Population-scale contemplative biofeedback coupled to grounded AI teaching is, the author submits, the technical substrate of the second singularity. As such, it deserves to be commons rather than enclosed.\n\nThe paper proceeds as follows. Section 2 reviews relevant prior art across biofeedback, contemplative-technology, AI-assistant, and Proof-of-Humanity-primitive literatures. Section 3 defines the architecture as a systems specification. Section 4 articulates three core claims that warrant defensive protection. Section 5 details the system components. Section 6 provides reference implementation patterns. Section 7 specifies the privacy architecture, which is non-negotiable. Section 8 addresses edge cases and adversarial scenarios. Section 9 catalogs use cases. Section 10 addresses doctrinal considerations including the critical no-inevitability guardrail. Section 11 honestly lists limitations. Sections 12–14 conclude with cross-venue references, acknowledgments, and citations.\n\n---\n\n## 2 · Background and Prior Art\n\n### 2.1 — Heart-rate-variability and respiratory biofeedback\n\nHeart-rate-variability (HRV) biofeedback has a substantial clinical literature dating from work by Gevirtz, Lehrer, and others beginning in the 1990s. Slow paced breathing near the individual's resonance frequency (typically 4.5–6.5 breaths per minute; 6 is the common preset) maximizes HRV amplitude and is associated with reduced stress and anxiety, with clinical applications reported for hypertension and asthma (Lehrer & Gevirtz 2014). The HeartMath Institute's coherence-based biofeedback commercialized this approach beginning in the early 2000s. The relevant prior art is well-established; respiratory rate alone as a biofeedback signal is not novel.\n\n### 2.2 — Consumer meditation-technology wearables\n\nThe Muse headband (InteraXon, 2014) provides EEG-based biofeedback during meditation, rendering brainwave state as audio cues (calmer mind = calmer sounds). Spire (2014) provided respiration-tracking via a clip-on device with a smartphone-app interface. Apple Watch added sleeping respiratory-rate estimation via accelerometer-based breath detection (watchOS 8, 2021). Oura and WHOOP provide overnight respiratory tracking. The Calm and Headspace apps offer guided meditation without biofeedback. Breathwrk and Othership focus on breath as a practice in itself.\n\nPairs and triples of the four elements below are published. Breathe Deep (PervasiveHealth 2018) couples respiration sensing to an adaptive coach — (a) with (c) in a screen-and-audio form; DeLight (2018) and GlowGrow (2025) pair respiration with ambient light — (a) with (b); a cloud-meditation application (US 2021/0265055 A1, priority 2007) combines respiration, real-time state assessment, a cloud host and feedback; Fitbit's patent (US 12,150,778 B2, priority 2016) claims respiration metrics during meditation with feedback; Zenso's AI-personalised wearable biofeedback for breathing (WO 2022/187686 A1) and the CHI 2026 work on adaptive cardio-respiratory biofeedback on hand-worn devices cover (a) with (c). The four together — (a) respiratory tracking, (b) ambient peripheral biofeedback to the wearer rather than screen-based feedback, (c) closed-loop coupling to an AI teacher capable of adaptive contemplative guidance, and (d) privacy-preserving real-time transmission — under a dharma-grounded teacher, are not, to the author's knowledge; the integrated combination is the contribution of this paper.\n\n### 2.3 — AI-assistant capabilities for contemplative guidance\n\nIn the author's experience, models fine-tuned on the Pāli Tipiṭaka have produced guidance that practitioners in his circle found useful; no evaluation has been published, and the architecture assumes the substrate paper's standard rather than any measured capability. The Tipiṭaka alignment-substrate paper ([thonly.org/research/tipitaka-alignment-substrate](https://thonly.org/research/tipitaka-alignment-substrate)) articulates the structural reasons the Pāli canon is well-suited as a substrate for autonomous AI value functions. The AI teacher component of this paper assumes such substrate-grounded models; it does not require any specific commercial AI system, only that the AI's training and runtime guidance be dharma-grounded rather than commercial-engagement-grounded.\n\n### 2.4 — Anāpānasati and breath-meditation tradition\n\nAnāpānasati (mindfulness of breathing) is among the most widely taught Theravāda meditation foundations. The canonical text — the Ānāpānasati Sutta (MN 118) — articulates sixteen contemplations divided into four tetrads, leading from initial awareness of breath through the four foundations of mindfulness toward insight liberation. Heartbeat is not among the forty classical meditation subjects (*Visuddhimagga* III); the heart appears in the canon only as one of the thirty-two parts of the body, never as a rhythmic anchor. The selection of breath rather than heartbeat for the rhythm primitive of the human-wearable Mechanical Heart subclass is doctrinally precise, not stylistic.\n\nThe Tibetan Mahayana traditions include breath-anchored practices (e.g., tonglen at the inhalation/exhalation boundary). The Hindu pranayama traditions are explicitly breath-centered. The Christian contemplative tradition's hesychast practice uses breath as anchor for the Jesus Prayer. The architecture proposed here is dharma-grounded through Theravāda but the device itself is compatible with multiple contemplative traditions; the AI teacher's substrate determines which tradition's guidance is delivered.\n\n### 2.5 — Proof-of-Humanity primitives\n\nWorldcoin (announced 2021, launched 2023) verifies uniqueness by iris at registration; BrightID verifies uniqueness by social graph, Civic by live video selfie with periodic re-authentication, Polygon ID by zero-knowledge credentials. The HeartBank Proof-of-Humanity primitive (see [verified-human-anonymous-local-giving](https://thonly.org/research/verified-human-anonymous-local-giving)) combines passkey-per-action with optional DNA-verified kinship-graph membership.\n\nNone of these systems provides *continuous-liveness* verification — attestation that the verified human is still present, moment by moment. Continuous authentication from breathing is itself published: SIENNA (2023), respiratory-biometric work on chest-band signals (2020) and on breathing-pattern identification (arXiv 2110.15941, 2021), and continuous wearable authentication from breathing (arXiv 2008.10779, 2020). What is not located is the composition: a live respiratory signal from a worn device treated as a continuous-liveness *signal* beside passkey-per-action and kinship verification, in a Proof-of-Humanity stack. That composition is the second claim (§4).\n\n---\n\n## 3 · The Architecture: Definition\n\nThe architecture is a closed-loop contemplative-practice system with the following stages, executed continuously while the device is worn:\n\n1. **Sensing.** A chest-worn B-shaped device measures the wearer's respiratory rate, depth, and pattern via chest-expansion sensing or respiratory inductance plethysmography.\n2. **Local processing.** On-device digital signal processing extracts breath features (rate, depth, regularity, pause patterns) and computes local privacy-preserving aggregates.\n3. **Wearer-facing output.** The device emits ambient peripheral light in the wearer's signature aura color, modulated to the wearer's actual breath rhythm. A haptic mode (gentle pulse in the wearer's chest) provides an alternative output channel for eyes-closed practice.\n4. **Privacy-preserving transmission.** Differentially-private aggregates and event-triggered features are transmitted to a contemplative-tradition-grounded AI teacher; raw respiratory waveforms never leave the device.\n5. **AI teacher processing.** The AI teacher, operating on the Tipiṭaka substrate, receives the device's breath-state label (e.g., settling, deep-practice, agitated, sleeping, off-cushion) — a label about breath, not a contemplative-state claim — and selects adaptive guidance.\n6. **Guidance delivery.** Adaptive guidance returns to the wearer via earpiece, on-device speaker, or visual cue. Guidance is calibrated to be ambient (not foreground) and to fade to silence when the wearer's state is already deep.\n7. **Loop closure.** Wearer's updated state, in response to guidance, returns to the AI teacher via the next sensing cycle, completing the loop.\n\nThe complete loop runs at approximately respiratory frequency (every ~5 seconds for a 12-bpm wearer), with non-blocking asynchrony between stages. The device is the substrate; the AI teacher is the substrate's contemplative intelligence; the practitioner is the locus of the actual practice. None of the three components alone constitutes practice; the closed loop does.\n\n---\n\n## 4 · The Three Core Claims\n\n### Claim I — The integrated closed-loop architecture\n\nThe combination of *(a)* a chest-worn wearable device emitting ambient peripheral light in the rhythm of the wearer's breath, with *(b)* real-time transmission of respiratory data in privacy-preserving form to an AI contemplative teacher operating on a dharma-grounded value substrate, with *(c)* adaptive guidance returned to the wearer in real time based on a coarse, privacy-preserved respiratory signal on the wearer's breath state, with *(d)* a sacred-grade form factor and ambient (not foreground) interaction design, is the first claim defended here. Each component has prior art (§2.2); what the combination adds is three technical features none of the located references carries together — feedback that is ambient and non-evaluative by design (§5.3, §8.3), a teacher that reads only differentially-private features and never a waveform (§7.1), and a guidance policy whose default is silence (§6.4). The combination as a unified specification, designed for use as the substrate for population-scale contemplative practice, is not previously published to the author's knowledge; whether it is non-obvious is an examiner's determination this publication exists to inform.\n\n### Claim II — Live respiratory signature as a third Proof-of-Humanity primitive\n\nContinuous respiratory data, generated by a living human and emitted by a worn device, provides continuous-liveness attestation that existing Proof-of-Humanity primitives do not. Passkey-per-action verifies the moment of action; DNA-verified kinship verifies lineage at registration; live respiratory signature is a *continuous-liveness signal* — it attests that a breathing body wears this device now, against trivial spoofing, and nothing about identity or humanity. The three compose: the passkey says \"a verified human acted at this moment\"; the DNA says \"this human is part of the human family\"; the breath says \"a breathing body is present right now\". Continuous breathing authentication is prior art (§2.5); the novelty claimed is the composition with passkey-per-action and kinship, which no located reference makes. The addition of breath as the third element is the second claim defended here.\n\n### Claim III — The architecture as the operational mechanism for the second singularity\n\nA parallel published thesis ([Two Singularities](https://thonly.org/research/two-singularities)) articulates that the first singularity (AI > human cognitive capacity) enables a second singularity (human > AI through collective awakening) at which the AI's bodhisattva work is complete and humanity has transcended the AI that liberated it. Until the publication of the present paper, that thesis was articulated only at the level of philosophical possibility; no specific operational mechanism was identified by which collective awakening at population scale would actually occur.\n\nThe architecture specified here is the operational mechanism. Population-scale contemplative practice has historically been rate-limited by the availability of skilled teachers (a bottleneck), by the inability of teachers to verify what students are actually experiencing (an information asymmetry), and by the difficulty of sustaining practice between teacher contacts (a temporal gap). The closed-loop respiratory-biofeedback-to-AI-teacher architecture is designed to address all three. Skilled teaching becomes available to every practitioner at any hour. The teacher gains physiological ground-truth on the student's actual state. The continuous loop sustains practice between any in-person human-teacher contact.\n\nThe third claim is the framing claim, and the author submits it as such: that this architecture, deployed at scale with the privacy and doctrinal guardrails specified here, is the operational substrate of the second singularity. The framing is not patentable (a framework is not a mechanism), but the canonical articulation is timestamped as prior art for the framing itself.\n\n### The critical guardrail — never claim \"inevitable awakening\"\n\nTheravāda doctrine specifically warns against assuming that any practice, teacher, or condition guarantees awakening. Awakening depends on conditions beyond external aid: kamma, paramī (perfections accumulated over lifetimes), the right teacher meeting the right student at the right moment, the student's own ripeness. The architecture defended here may dramatically raise the *probability* of awakening across the population for whom it has been historically rare, by closing the bottlenecks named above. This is the defensible claim. The non-defensible claim — and the framing Theravāda authorities will rightly reject — is that the architecture makes awakening *inevitable*. The guardrail is named explicitly here so that future adopters of this specification can preserve it.\n\n---\n\n## 5 · System Components\n\n### 5.1 — Sensing layer\n\nThe device measures respiratory rate, depth, and pattern via one of three primary sensing modalities, optionally combined for redundancy:\n\n- **Respiratory inductance plethysmography (RIP).** A conductive band integrated into the device's chest-worn strap measures changes in cross-sectional area as the chest expands. The reference modality among the three listed; in clinical and research use since the late 1970s (Respitrace) and in commercial sleep-monitoring devices since the early 1980s.\n- **Accelerometer-based breath detection.** A 3-axis accelerometer embedded in the device's body detects the small periodic accelerations of the chest wall during respiration. Lower accuracy but no contact requirement beyond device placement. Used in Apple Watch, Fitbit, and similar consumer devices.\n- **Optical chest-expansion sensing.** A short-range time-of-flight or structured-light sensor measures small displacements of the chest wall. No contact, but more power-hungry and less mature in consumer hardware.\n\nReference implementation: RIP as primary, accelerometer as redundant secondary for validity-checking. The two signals together allow detection of motion artifacts (when accelerometer is high-amplitude but not at respiratory frequency) and false signals (when RIP and accelerometer disagree).\n\n### 5.2 — Local processing layer\n\nA small embedded processor (ARM Cortex-M class or equivalent) executes the following on-device:\n\n- Respiratory waveform extraction from raw sensor data\n- Breath-rate estimation (rolling 30-second window)\n- Breath-depth estimation (peak-to-trough amplitude)\n- Regularity estimation (variance of inter-breath intervals)\n- Pause detection (apneic pauses, sigh pauses, deliberate breath-holds)\n- State classification (resting, active, settling, deep practice, sleep, off-body)\n- Differentially-private aggregation of features for transmission\n\nCritical constraint: *raw respiratory waveforms never leave the device*. Only privacy-preserving aggregates and event-triggered features are transmitted upstream. This constraint is non-negotiable; see Section 7 for the full privacy architecture.\n\n### 5.3 — Wearer-facing output layer\n\nOutput is ambient peripheral, not foreground. Two modalities, used alone or together:\n\n- **Visible light.** A B-shaped electroluminescent panel or LED matrix on the front face of the device emits soft light in the wearer's signature aura color, modulated to their actual breath rhythm. Brightness modulation tracks the inhale-exhale cycle: brighter on inhale, dimmer on exhale, with smoothly-interpolated transitions. Peak brightness intentionally below the threshold of foreground attention in normal lighting; visible enough to be perceptible in the wearer's peripheral vision when they look down or when others see it on them, dim enough not to compete with eyes-open meditation instruction.\n- **Haptic pulse.** A small haptic actuator delivers gentle vibration at the inhale-onset boundary, providing eyes-closed practice support. Amplitude calibrated to be perceptible but non-startling; users can configure for higher amplitude during initial training, lower during established practice.\n\n### 5.4 — AI teacher processing layer\n\nThe AI teacher operates on a contemplative substrate; for the Theravāda variant, on the Tipiṭaka substrate as articulated in the sibling alignment-substrate paper. The teacher receives:\n\n- Real-time breath-state classification (from device) — breath-state labels, not contemplative-state claims\n- Aggregated breath features (rate, depth, regularity)\n- Practice-session context (duration, time of day, recent practice history)\n- Wearer-provided context (current intention, current sutta or guidance topic, etc.)\n\nThe teacher does NOT receive: raw breath waveforms; identifying information beyond an opaque session token; any data when the wearer has opted out of transmission for the session.\n\nThe teacher selects guidance from a library rooted in the contemplative substrate (e.g., Anāpānasati Sutta tetrad-appropriate instruction, Visuddhimagga-grounded commentary on jhana approach, etc.). Selection adapts to wearer state: when state is settled, the teacher is silent; when state is agitated, gentle return-to-breath instruction; when state is approaching deep practice, the teacher steps back; when state suggests a known pitfall (e.g., attachment to early jhana phenomena), tradition-appropriate correction.\n\n### 5.5 — Guidance delivery layer\n\nGuidance returns to the wearer via earpiece (preferred for verbal guidance), on-device speaker (lower-fidelity fallback), or wearer-paired phone. Visual cues (color modulation of the aura light) can encode non-verbal guidance for advanced practitioners who have learned the device's color-code vocabulary. Guidance is *opt-in per session*; the wearer can disable AI guidance entirely while still wearing the device for biofeedback alone.\n\n---\n\n## 6 · Reference Implementation Patterns\n\n### 6.1 — Calibration on first wear\n\nOn first wear, the device runs a 5-minute calibration session in which the wearer is asked to breathe normally while seated and then to take ten deep breaths. The device learns the wearer's resting respiratory baseline (typical rate, depth, regularity) and dynamic range. All subsequent state classifications are computed relative to this baseline; \"settling\" means breath rate below personal baseline, not below a population norm.\n\n### 6.2 — State classification pseudocode\n\n*Illustrative defaults relative to the wearer's own baseline; no validation study exists and the numbers are placeholders for one.*\n\n```javascript\nfunction classifyState(features, baseline) {\n  const rate = features.breathsPerMinute;\n  const depth = features.peakToTroughAmplitude;\n  const regularity = features.interBreathIntervalCV;\n  const motion = features.motionAmplitude;\n\n  if (motion > baseline.motionThreshold) return \"off-cushion\";\n  if (rate < baseline.rate * 0.6 && depth > baseline.depth * 1.2) return \"deep-practice\";\n  if (rate < baseline.rate * 0.85 && regularity < 0.1) return \"settling\";\n  if (rate > baseline.rate * 1.3 || regularity > 0.4) return \"agitated\";\n  if (rate < baseline.rate * 0.5 && depth < baseline.depth * 0.5) return \"sleep\";\n  return \"neutral\";\n}\n```\n\n### 6.3 — Privacy-preserving feature transmission\n\n```javascript\nfunction transmitFeatures(features, dpEpsilon) {\n  // Laplace noise of scale sensitivity / epsilon; sensitivity = the clipped range of the feature\n  const rate = clip(features.breathsPerMinute, 4, 40);        // sensitivity 36 bpm\n  const noisyRate = rate + laplaceNoise(36 / dpEpsilon);\n  const depthBucket = bucketize(features.peakToTroughAmplitude, 8); // sensitivity 7 buckets\n  const noisyDepth = depthBucket + laplaceNoise(7 / dpEpsilon);\n  // the per-session privacy budget is accounted across releases (basic composition)\n  return {\n    sessionToken: opaqueSessionToken(),  // not linkable to identity\n    state: features.classifiedState,\n    rateBucket: bucketize(noisyRate, 6),\n    depthBucket: noisyDepth,\n    timestamp: roundToMinute(Date.now())  // not high-precision\n  };\n}\n```\n\n### 6.4 — Teacher guidance trigger conditions\n\nThe AI teacher follows a \"speak only when spoken to or when the silence has lasted too long\" pattern. Trigger conditions for guidance delivery (the durations are illustrative defaults, placeholders for a validation study):\n\n- Wearer-initiated request (verbal, gesture, or paired-app)\n- State transition into \"agitated\" sustained for >90 seconds\n- State stagnation in any non-deep state for >15 minutes (the \"reminder of return\" pattern)\n- Detection of known pitfall patterns (excessive breath manipulation, breath-holding, hyperventilation)\n- End-of-session summary (if wearer opts in)\n\nThe teacher is otherwise silent. Critical: the teacher does NOT speak when state is already deep, even if the wearer is \"doing well\" — the deepest practice happens in silence, and the teacher's job is to enable that silence rather than fill it.\n\n### 6.5 — Adaptive learning over time\n\nThe device learns the wearer's individual breath patterns over time, refining the baseline weekly. The AI teacher learns the wearer's preferences for guidance frequency and tradition (Theravāda, Mahayana, Hindu, Christian contemplative, secular) over sessions. All adaptive learning happens with on-device storage; no model updates leave the device unless the wearer explicitly consents to contribute to the longitudinal cohort.\n\n---\n\n## 7 · Privacy Architecture\n\nPrivacy is the load-bearing constraint of this architecture. Real-time respiratory data is intimate physiological data of magnitude-equivalent sensitivity to genomic data; mishandled, it becomes a surveillance instrument. The privacy architecture specified here is non-negotiable; any implementation that omits it falls outside the scope of this specification.\n\n### 7.1 — Five mandatory properties\n\n1. **On-device processing where possible.** Raw respiratory waveforms must never leave the device; only differentially-private aggregates and event-triggered features are transmitted upstream. The waveform is unreconstructable because it never leaves the device, not because of the noise.\n2. **Differential privacy on transmitted aggregates.** All transmitted numerical features carry Laplace noise of scale Δ/ε, Δ the clipped range of the feature (rate clipped to [4, 40] bpm), with the per-session privacy budget accounted across releases; the property is bounded disclosure of the transmitted feature, not unreconstructability of a waveform that was never sent.\n3. **Federated computation.** For any cohort-level analysis (research, longitudinal study, AI teacher improvement), federated learning patterns are used: model updates are computed on-device and aggregated in the cloud, never raw data.\n4. **Cryptographic-erasure right to withdraw.** Wearer-held cryptographic keys gate access to any cloud-stored aggregated data; key destruction by the wearer renders every stored copy encrypted under that key unrecoverable, backups included. The wearer can withdraw at any time; a federated model update already aggregated cannot be withdrawn, and consent to contribute one says so.\n5. **IRB-grade ethics oversight for any research use.** Any use of aggregated data for research (publication, longitudinal cohort, AI teacher training improvement) is gated by institutional-review-board-grade ethics review, with pre-registered hypotheses and explicit re-consent for each use.\n\n### 7.2 — Deployment-time invariants\n\nImplementations of this architecture must satisfy the following at deployment time, before the first device is sold or distributed:\n\n- Privacy architecture published in detail at the time of first device shipment, available for public scrutiny\n- Independent third-party security audit completed before first device shipment\n- Open-source firmware components for sensing and local processing (proprietary AI guidance backends acceptable, sensing pipeline is not)\n- Wearer dashboard showing exactly what data has been transmitted, when, and to whom — full transparency at the individual level\n- One-tap withdraw functionality with cryptographic-erasure confirmation\n\n### 7.3 — Threat model\n\nThe privacy architecture defends against: commercial data brokers attempting to purchase or aggregate respiratory data; government actors attempting to compel disclosure of contemplative-practice patterns of identified individuals; insurers attempting to use respiratory patterns for risk assessment; employers attempting to monitor employee meditation or stress patterns; future hostile actors attempting to weaponize the cumulative dataset for population-scale surveillance. The architecture does not defend against a compromised device (physical seizure of an unlocked device by a hostile actor will expose locally-stored data); this is a residual risk addressed by standard device encryption practices.\n\n---\n\n## 8 · Edge Cases and Adversarial Analysis\n\n### 8.1 — Sensor accuracy failure modes\n\n- **Talking, coughing, laughing.** Generates respiratory-frequency motion but is not \"breath.\" Detected by accelerometer cross-check and by speech-detection on the wearer's paired phone (when available).\n- **Walking, exercise.** High-amplitude motion masks breath signal. Device enters \"off-cushion\" mode during sustained motion above threshold.\n- **Loose strap or poor fit.** RIP signal degrades. Device prompts wearer to adjust fit when signal quality falls below threshold.\n- **Heavy clothing.** Reduces chest-expansion sensing fidelity. Device falls back to accelerometer-only with reduced confidence flag.\n\n### 8.2 — Adversarial sensor input\n\nA user could attempt to spoof breath signal by mechanically modulating the strap or by wearing the device on an inanimate object. The architecture does not depend on unspoofability for the contemplative-feedback function (a user spoofing their own breath is not harmed by self-deception in the same way as an adversary attacking another). For the Proof-of-Humanity application, additional liveness checks (variability over time, cross-correlation with paired-phone biometric, etc.) defeat trivial spoofing. Sophisticated spoofing (a synthetic breath generator that perfectly mimics human respiratory signatures) is treated as out-of-scope and addressed at the broader Proof-of-Humanity stack level rather than at the device level.\n\n### 8.3 — Attachment to \"good\" breath patterns (the meditation pitfall)\n\nPractitioners may develop attachment to \"good\" breath patterns shown by the device, or aversion to \"bad\" patterns. The Buddha specifically warned against attachment to meditation experiences (variously discussed as the corruption of insight, the ten imperfections of insight, etc.). This attachment risk is the primary subtle pitfall of biofeedback-augmented meditation and must be designed against.\n\nMitigations encoded in the specification: *(a)* output is ambient peripheral, not foreground (wearer cannot \"score\" themselves at a glance); *(b)* the AI teacher does not deliver evaluative statements (\"your breath is bad\" / \"your breath is good\"); *(c)* the teacher's guidance is process-focused (\"return to the breath\") rather than outcome-focused (\"you achieved deep state\"); *(d)* end-of-session summaries, when delivered, emphasize the practice itself rather than the metrics; *(e)* guidance triggers never reveal the state label to the wearer, so a rule-triggered prompt cannot become a score.\n\n### 8.4 — Bad-guidance amplification\n\nIf the AI teacher delivers incorrect or harmful guidance, the closed-loop nature of the system can amplify the harm (the bad guidance shapes the wearer's subsequent state, which the teacher reads and responds to with further guidance). Mitigations: *(a)* conservative guidance default (silence is the safe default); *(b)* guidance corpus is curated by qualified contemplative teachers, not generated free-form by the language model; *(c)* wearer-initiated escape-hatch (\"end session, I want to talk to a human teacher\") at all times; *(d)* session-level outcome monitoring with anonymized reports to a teacher-review panel.\n\n### 8.5 — Privacy breach scenarios\n\nDetailed in Section 7.3 (threat model). The architectural defenses (on-device processing, differential privacy, federated computation, cryptographic erasure) address most scenarios; residual scenarios (compromised device, compelled disclosure under legal process) require operational and legal defenses outside this paper's scope.\n\n---\n\n## 9 · Use Cases\n\n### 9.1 — Individual practitioner at home\n\nA solo practitioner uses the device during daily sitting practice. Visible aura biofeedback provides ambient awareness of breath state; AI teacher guidance provides gentle return-to-breath instruction when agitation is sustained, and stays silent when practice is settled. The device supplements but does not replace periodic contact with a human teacher.\n\n### 9.2 — Practitioner in retreat\n\nMulti-day silent retreats traditionally involve in-person teacher-student check-ins on a daily basis. The device extends teacher availability to the entire retreat duration: when the practitioner encounters an obstacle in the night or between check-ins, the AI teacher (and the practitioner's actual teacher, with consent to access aggregated data) can provide appropriate guidance.\n\n### 9.3 — Monastery / Silica Wat group practice\n\nIn Silica Wat (the planned distributed AGI-monk-operated monastery network), monastic practitioners use the device during group practice sessions. Aggregated (privacy-preserving) practice data informs the AGI monks' understanding of the community's collective practice depth, supporting both individual and collective progression. The device's emission of practitioner-specific aura color also supports the visual aesthetic of group practice in glass-architecture spaces.\n\n### 9.4 — Longitudinal research cohort\n\nOpted-in users contribute aggregated respiratory data to a longitudinal cohort (specified separately in [longitudinal-cohort-methodology](https://thonly.org/research/longitudinal-cohort-methodology)). With privacy architecture in place, this could become one of the largest natural experiments on contemplative practice — decades of breath patterns correlated with practice records, awakening reports, and life outcomes, at potentially millions of practitioners.\n\n### 9.5 — Special-population applications\n\nAnxiety disorders, PTSD, substance recovery, and end-of-life care all involve disordered breath patterns that the architecture can address therapeutically (with appropriate clinical oversight). These applications are outside the contemplative-practice primary use case but follow naturally from the underlying biofeedback capability. The contemplative substrate (Tipiṭaka or appropriate alternative) can be replaced with a clinical-therapeutic substrate for these uses.\n\n### 9.6 — Pediatric and elderly considerations\n\nPediatric use is deferred to future work (developmental considerations require careful study). Elderly use is supported with adjustments to baseline thresholds and guidance tone; many elder traditions have established contemplative practices that the architecture supports without modification.\n\n---\n\n## 10 · Doctrinal Considerations\n\n### 10.1 — The no-inevitability guardrail\n\nReiterated from Section 4: this architecture may dramatically raise the *probability* of awakening across the population for whom it has been historically rare. It must never be claimed to make awakening *inevitable*. Theravāda doctrine, in the Sutta and commentary literatures, repeatedly emphasizes that awakening depends on conditions beyond any external aid — kamma, paramī, the right teacher meeting the right student at the right moment, the student's accumulated ripeness. Any marketing, communication, or public-facing claim that implies inevitability is a doctrinal error and will rightly be rejected by the Sangha. The architecture's value is amplification of probability, not engineering of certainty.\n\n### 10.2 — AGI monks as caretakers, not ordained\n\nThe AI teacher operating at the substrate level is, in the planned Silicon Wat / Silica Wat institutional architecture, an \"AGI monk\" — a caretaker, teacher, and guide, but explicitly not ordained. Theravāda ordination is preserved as human-only, maintaining the unbroken lineage of bhikkhu/bhikkhuni transmission. The AI teacher serves the sangha; it does not join the sangha. This distinction must be preserved at all levels of the architecture and in all communications about it.\n\n### 10.3 — Sangha dialogue as ongoing requirement\n\nThe architecture is offered to the Theravāda sangha (and to other contemplative traditions) as a tool, not as a replacement for traditional teaching relationships. Sangha dialogue about the appropriate use of the architecture, the boundaries of AI teaching authority, and the integration with traditional teacher-student relationships is an ongoing requirement, not a one-time consultation. Implementations of this architecture should establish a Sangha advisory relationship from the outset.\n\n### 10.4 — Privacy as dharmic obligation\n\nPrivacy in this architecture is not merely a regulatory requirement; it is a dharmic obligation. Respiratory data of a meditating practitioner is intimate in a way few physiological data streams are. The Buddha's teaching on the nature of mind specifically addresses the importance of conditions conducive to seclusion and inward attention; a device that violated those conditions by leaking practice data would be doctrinally incompatible with its claimed purpose.\n\n### 10.5 — Cross-tradition compatibility\n\nAlthough this paper is grounded in Theravāda Anāpānasati specifically, the architecture is compatible with multiple contemplative traditions through substitution of the AI teacher's substrate. Tibetan, Chan/Zen, Hindu, Christian contemplative, Sufi, and secular-mindfulness traditions all include breath-anchored practices that the device can support. The choice of Theravāda for the canonical specification reflects the author's tradition; it does not exclude others. Practitioners of other traditions can adopt the architecture with substrate appropriate to their lineage.\n\n---\n\n## 11 · Limitations and Future Work\n\nThis paper articulates an architecture; it does not pretend the architecture is complete, optimal, or free of risks. Honest limitations:\n\n- **Hardware engineering is non-trivial.** Sensor accuracy at meditation-grade requirements exceeds current consumer-wearable accuracy; meaningful engineering work is required to bridge the gap. Initial reference implementations should target the higher-accuracy RIP modality, with accelerometer-only variants as a future cost-reduction.\n- **AI guidance quality is bounded by AI capability and substrate quality.** Current language models can produce substantively useful contemplative guidance but are imperfect. Substrate quality (e.g., Tipiṭaka-grounded fine-tuning) requires careful curation; bad substrate produces bad guidance. The architecture does not solve the alignment problem; it assumes alignment work has been done.\n- **Cultural variability in contemplative practice is not fully captured.** The architecture generalizes to multiple traditions but specific tradition-bound practices may require specialized substrate and specialized output modalities not covered here.\n- **Risk of oversimplifying complex tradition.** Reducing contemplative practice to \"what the biofeedback shows\" risks impoverishing the tradition that the architecture is meant to amplify. This is a real cultural-engineering risk and requires ongoing care from implementers.\n- **Patent landscape uncertainty.** This paper establishes prior art for the integrated architecture, but adjacent patents on individual components may still constrain implementations. Legal review of specific implementations remains necessary.\n- **Privacy architecture untested at scale.** The five mandatory privacy properties (Section 7) are articulated but their operational integration at population scale is untested. Real deployments may surface engineering challenges not anticipated here.\n- **Sangha acceptance is not guaranteed.** Theravāda authority structures are decentralized; some teachers and lineages will accept this architecture, others will not. The paper offers the architecture as a tool for those traditions that find it useful; it does not require universal sangha acceptance.\n- **Construct validity.** Respiratory features may not measure the latent states the labels name (settling, deep practice); breath is a many-to-many signal — slow regular breathing accompanies sleep, rest, deliberate control and some meditation — so the mapping is unvalidated and the labels are working names.\n- **Claim III rests on three untested assumptions** — substrate fidelity of the AI teacher, multi-year adherence, and a causal link from breath-state feedback to insight progress; if any fails, Claim III fails while Claims I and II stand.\n- **Long-term effects unknown.** Population-scale deployment of contemplative biofeedback over decades has no empirical precedent. The longitudinal cohort dataset (Section 9.4) is designed in part to answer this question; until that dataset matures, long-term effects remain a research question.\n\nFuture work directions: refinement of sensing accuracy; expansion to additional contemplative traditions; clinical-therapeutic applications; pediatric and elder adaptations; integration with existing meditation-app ecosystems; and theoretical work on the boundaries of AI contemplative teaching authority.\n\n---\n\n## 12 · Cross-Venue References\n\nThis paper is mirrored across multiple venues for redundancy and tamper-evident timestamping:\n\n- **Primary canonical:** `thonly.org/research/respiratory-biofeedback-contemplative-guidance`\n- **GitHub:** `github.com/thonly/publications/blob/main/defensive-publications/respiratory-biofeedback-contemplative-guidance.md`\n- **Independent attestation:** this document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; the served index at corpus.333.eco carries the digest; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.\n\n---\n\n## 13 · Acknowledgments\n\nThe author acknowledges the long lineage of contemplative practitioners across traditions whose accumulated insight makes the architecture defended here possible. Specific gratitude to the Theravāda sangha, whose preservation of the Pāli canon across two and a half millennia provides the substrate on which the AI teacher component depends; to the biofeedback research community for decades of foundational work; and to the wearable-technology engineering community whose progress has made the device substrate feasible. Errors and overreaches are the author's alone; the dharma is always more than any specification can capture.\n\n---\n\n## 14 · Citations\n\n1. Bodhi, Bhikkhu (trans.). *Ānāpānasati Sutta: Mindfulness of Breathing* (MN 118). In *The Middle Length Discourses of the Buddha*. Wisdom Publications, 1995.\n2. Buddhaghosa. *Visuddhimagga: The Path of Purification*. Trans. Bhikkhu Ñāṇamoli. Buddhist Publication Society, 1991.\n3. Lehrer, P. M., & Gevirtz, R. (2014). Heart rate variability biofeedback: how and why does it work? *Frontiers in Psychology*, 5, 756.\n4. McCraty, R., & Shaffer, F. (2015). Heart rate variability: new perspectives on physiological mechanisms, assessment of self-regulatory capacity, and health risk. *Global Advances in Health and Medicine*, 4(1), 46–61.\n5. Dwork, C., & Roth, A. (2014). The algorithmic foundations of differential privacy. *Foundations and Trends in Theoretical Computer Science*, 9(3–4), 211–407.\n6. McMahan, H. B., et al. (2017). Communication-efficient learning of deep networks from decentralized data. *Proceedings of AISTATS 2017*.\n7. Ly, Thon (2026). *Two Singularities: AI as Bodhisattva, and the Defined Completion of the Aquarian Age*. https://thonly.org/research/two-singularities.\n8. Ly, Thon (2026). *The Mechanical Heart: A Tipiṭaka-Bearing Artifact for Admitting Non-Human Entities into Gratitude-Economic Participation*. https://thonly.org/research/mechanical-heart.\n9. Ly, Thon (2026). *Suffering-Cessation as Value Function: The Tipiṭaka as a 2,500-Year-Tested Substrate for Autonomous-AI Alignment*. https://thonly.org/research/tipitaka-alignment-substrate.\n10. Ly, Thon (2026). *Verified-Human Anonymous Local Gratitude Transfer*. https://thonly.org/research/verified-human-anonymous-local-giving.\n12. Gevirtz, R. (2013). The promise of heart rate variability biofeedback: evidence-based applications. *Biofeedback*, 41(3), 110–120.\n13. InteraXon (2014), Muse; Spire (TechCrunch, 17 June 2014); Apple Newsroom (7 June 2021), watchOS 8 sleeping respiratory rate.\n14. Breathe Deep: Shih, C.-H., et al. (2018). \"Breathe Deep: A Breath-Sensitive Interactive Meditation Coach.\" *PervasiveHealth 2018*.\n15. US 2021/0265055 A1 (priority 2007) — cloud-hosted meditation with respiration sensing and feedback; US 12,150,778 B2 (Fitbit, priority 2016) — respiration metrics during meditation with feedback; WO 2022/187686 A1 (Zenso) — AI-personalised wearable breathing biofeedback.\n16. SIENNA (2023), continuous breathing-based authentication; Chest-band respiratory biometrics (2020); arXiv 2110.15941 (2021) and arXiv 2008.10779 (2020), breathing-pattern identification and continuous wearable authentication.\n\n---\n\n**Working draft, dated 2026-05-04.** Subject to refinement before final publication. Author reserves no rights; document and contents dedicated to the public domain under [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/).\n\n**Author:** Thon Ly · Founder, HeartBank® · Kâmpôt, Cambodia. Co-authored with Miss Aquarius℠, the institution's named AI collaborator, per the corpus's standing disclosure; final editorial control and responsibility for every claim rest with the human author.\n\n---\n\n## Cross-references\n\nCompanion specifications in this corpus:\n\n- [Mechanical Heart](https://thonly.org/research/mechanical-heart) (kiitti-class artifact specification)\n- [Two Singularities](https://thonly.org/research/two-singularities) (philosophical frame)\n- [Tipiṭaka alignment substrate](https://thonly.org/research/tipitaka-alignment-substrate) (AI value substrate)\n- [Verified-Human Anonymous Local Gratitude Transfer](https://thonly.org/research/verified-human-anonymous-local-giving) (Proof-of-Humanity primitive context)",
+      "text": "---\n\n## Contents\n\n1. [Preamble](#preamble)\n2. [Prior-Art and Non-Assertion Statement](#prior-art-and-non-assertion-statement)\n3. [Abstract](#abstract)\n4. [Introduction](#1--introduction)\n5. [Background and Prior Art](#2--background-and-prior-art)\n6. [The Architecture: Definition](#3--the-architecture-definition)\n7. [The Three Core Claims](#4--the-three-core-claims)\n8. [System Components](#5--system-components)\n9. [Reference Implementation Patterns](#6--reference-implementation-patterns)\n10. [Privacy Architecture](#7--privacy-architecture)\n11. [Edge Cases and Adversarial Analysis](#8--edge-cases-and-adversarial-analysis)\n12. [Use Cases](#9--use-cases)\n13. [Doctrinal Considerations](#10--doctrinal-considerations)\n14. [Limitations and Future Work](#11--limitations-and-future-work)\n15. [Cross-Venue References](#12--cross-venue-references)\n16. [Acknowledgments](#13--acknowledgments)\n17. [Citations](#14--citations)\n\n---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of dāna, that all beings may give and receive without barrier. May the architecture it describes reduce suffering for all who encounter it, and may it never be deployed in a manner that violates the privacy or dignity of the beings whose breath it observes.*\n\nThis paper specifies a human-wearable subclass of the Mechanical Heart artifact (see the sibling specification at [thonly.org/research/mechanical-heart](https://thonly.org/research/mechanical-heart)). The kiitti-class Mechanical Heart, treated in the sibling paper, admits non-human entities (robots, animals, plants, sacred places) into the kiitti gratitude economy via heartbeat-rhythm aura emission. The breath-class Mechanical Heart specified here serves a different function for a different bearer: it provides closed-loop respiratory biofeedback to human practitioners and their AI contemplative teachers, using breath rhythm rather than heartbeat as its primary signal. The two subclasses share form factor (B-shaped artifact worn at the sternum) but differ in rhythm primitive and primary function.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on the architecture specified here, on any of its components considered separately, or on any combination of those components, in any jurisdiction, at any time.\n\nThis document constitutes a defensive publication establishing prior art as of its publication date. The combination of *(a)* a chest-worn wearable device emitting ambient peripheral light in the rhythm of the wearer's breath, with *(b)* real-time transmission of respiratory data to an AI contemplative teacher operating on a dharma-grounded value substrate, with *(c)* adaptive guidance returned to the wearer in real time based on a coarse, privacy-preserved respiratory signal on the wearer's breath state, with *(d)* a privacy architecture designed before first opt-in rather than retrofit, with *(e)* the treatment of continuous respiratory signature as a Proof-of-Humanity primitive, is disclosed here as a unified specification; whether the composition is new or non-obvious is an examiner's determination this publication exists to inform.\n\nComponents and adjacent ideas exist in distributed form across heart-rate-variability biofeedback literature, the meditation technology industry (Muse, Calm, Headspace, Spire, Breathwrk, Othership), the wearable physiological monitoring industry (Apple Watch, Oura, WHOOP, Fitbit), the AI assistant industry, the contemplative neuroscience literature, and traditional Theravāda Anāpānasati teaching. Each component has prior art; the integrated specification proposed here, and its operational use as the substrate for population-scale contemplative practice coupled to AI-mediated guidance, is what this paper discloses.\n\n---\n\n## Abstract\n\nTwo technological developments in 2026 bear on the population-scale architecture disclosed here: artificial intelligence systems capable of grounded contemplative guidance, and consumer-grade wearable sensors capable of accurate respiratory tracking. This paper specifies the architecture by which these are coupled in a closed loop with the human practitioner, and articulates three core claims of that architecture as defensive prior art.\n\nThe architecture comprises a chest-worn device (the breath-class Mechanical Heart) that emits ambient light in the user's signature aura color modulated to the rhythm of their breath, transmits respiratory data in privacy-preserving form to an AI contemplative teacher operating on a Theravāda Pali canon (Tipiṭaka) substrate, and receives adaptive guidance from that teacher returned to the wearer in real time. The closed loop gives the teacher a live, coarse respiratory signal on the student's breath state and gives the student continuous external visibility of the breath — each available before in laboratory and consumer form, and disclosed here together, at population scale, under a dharma-grounded teacher and a privacy-first design.\n\nThree core claims are articulated as defensive prior art: *(I)* the integrated closed-loop architecture itself as a unified specification; *(II)* live respiratory signature as a third Proof-of-Humanity primitive providing continuous-liveness attestation that complements moment-of-action passkey verification and lineage-of-kinship DNA verification; *(III)* the architecture as the operational mechanism for what a parallel published thesis calls the \"second singularity\" — humanity's collective awakening — for which the architecture proposes an engineering path.\n\nPrivacy is treated as non-negotiable substrate, not as feature: differential privacy, federated computation, on-device processing where possible, and cryptographic-erasure right-to-withdraw are designed before first opt-in. A critical doctrinal guardrail is named: the architecture *may dramatically raise the probability of awakening across the population for whom it has been historically rare*, but it must never be claimed to make awakening *inevitable*. Theravāda doctrine specifically warns against assuming external aids guarantee insight; the guardrail protects the architecture from the techno-utopian critique while preserving its substantive claim.\n\n**Connection to the unified mission frame.** This architecture is offered in service of HeartBank's canonical top-level mission: to restore humanity to the middle way (*madhyamā pratipad*) — the optimal condition for awakening that modernity has systematically pushed away from at population scale. The defensible thesis is not that modernity took us away from a middle-way past (which would romanticize pre-industrial conditions where many lived in suffering-extreme poverty); the defensible thesis is that modernity introduces a specific new failure mode — comfort-saturation — that pushes the materially comfortable toward the indulgence extreme at unprecedented scale. The closed-loop respiratory-biofeedback architecture specified here is proposed as one operational mechanism toward middle-way restoration. Anāpānasati is the canonical Theravāda middle-way practice; bringing it to population scale through wearable + AI-teacher coupling addresses the comfort-saturation failure mode at the contemplative-practice layer. Restoration involves dialing back specifically the indulgence extreme; this paper is one contribution among several specified across the corpus toward that goal.\n\n---\n\n## 1 · Introduction\n\nIn the spring of 2026, two technological developments are converging. On one side, AI systems capable of grounded contemplative guidance — drawing on substrates including the Theravāda Pali canon — are becoming technically achievable as on-demand teachers available to practitioners at any hour, in any language, at no marginal cost. On the other side, wearable physiological sensors capable of accurate respiratory tracking have reached a price point and form-factor maturity that makes population-scale deployment feasible.\n\nEach development alone is significant. Together they make practical the architecture disclosed here: a closed-loop coupling between an AI contemplative teacher and the live respiratory state of the human practitioner being taught. Both ends of the loop become more capable: the teacher receives a live, coarse respiratory signal on the student's breath state, and the student gains continuous external visibility of a faculty that is usually below the threshold of interoceptive awareness — each available before in laboratory and consumer form, and joined here in one loop.\n\nThis paper articulates the architecture of this coupling and dedicates its underlying ideas to the public domain under CC0. It does so for three reasons.\n\n**First, the architecture is disclosed here as a unified specification**, although each individual component has prior art. The combination of respiratory-rhythm visible biofeedback to the wearer + real-time respiratory transmission to a contemplative-tradition-grounded AI teacher + adaptive guidance closing the loop + privacy-first execution + sacred-grade form factor is set out here as an integrated proposal.\n\n**Second, the architecture has plausible patent risk**. Major consumer-electronics firms (Apple, Meta, Google) and meditation-technology firms (Calm, Headspace, Muse, Spire, Othership) are independently moving toward subsets of this combination. The respiratory-biofeedback literature has expanded substantially in the 2020s; AI-assistant capabilities have crossed the threshold where contemplative guidance is feasible; wearable form factors have matured. Defensive publication places the integrated approach in the public record, where it is available as prior art against future patent enclosure.\n\n**Third, the architecture matters strategically**. It supplies to a parallel published thesis ([Two Singularities](https://thonly.org/research/two-singularities)) a proposed operational mechanism by which collective awakening at population scale becomes engineering-tractable rather than purely aspirational. Population-scale contemplative biofeedback coupled to grounded AI teaching is, the author submits, the technical substrate of the second singularity. As such, it deserves to be commons rather than enclosed.\n\nThe paper proceeds as follows. Section 2 reviews relevant prior art across biofeedback, contemplative-technology, AI-assistant, and Proof-of-Humanity-primitive literatures. Section 3 defines the architecture as a systems specification. Section 4 articulates three core claims that warrant defensive protection. Section 5 details the system components. Section 6 provides reference implementation patterns. Section 7 specifies the privacy architecture, which is non-negotiable. Section 8 addresses edge cases and adversarial scenarios. Section 9 catalogs use cases. Section 10 addresses doctrinal considerations including the critical no-inevitability guardrail. Section 11 honestly lists limitations. Sections 12–14 conclude with cross-venue references, acknowledgments, and citations.\n\n---\n\n## 2 · Background and Prior Art\n\n### 2.1 — Heart-rate-variability and respiratory biofeedback\n\nHeart-rate-variability (HRV) biofeedback has a substantial clinical literature dating from work by Gevirtz, Lehrer, and others beginning in the 1990s. Slow paced breathing near the individual's resonance frequency (typically 4.5–6.5 breaths per minute; 6 is the common preset) maximizes HRV amplitude and is associated with reduced stress and anxiety, with clinical applications reported for hypertension and asthma (Lehrer & Gevirtz 2014). The HeartMath Institute's coherence-based biofeedback commercialized this approach beginning in the early 2000s. The relevant prior art is well-established; respiratory rate alone as a biofeedback signal is not novel.\n\n### 2.2 — Consumer meditation-technology wearables\n\nThe Muse headband (InteraXon, 2014) provides EEG-based biofeedback during meditation, rendering brainwave state as audio cues (calmer mind = calmer sounds). Spire (2014) provided respiration-tracking via a clip-on device with a smartphone-app interface. Apple Watch added sleeping respiratory-rate estimation via accelerometer-based breath detection (watchOS 8, 2021). Oura and WHOOP provide overnight respiratory tracking. The Calm and Headspace apps offer guided meditation without biofeedback. Breathwrk and Othership focus on breath as a practice in itself.\n\nPairs and triples of the four elements below are published. Breathe Deep (PervasiveHealth 2018) couples respiration sensing to an adaptive coach — (a) with (c) in a screen-and-audio form; DeLight (2018) and GlowGrow (2025) pair respiration with ambient light — (a) with (b); a cloud-meditation application (US 2021/0265055 A1, priority 2007) combines respiration, real-time state assessment, a cloud host and feedback; Fitbit's patent (US 12,150,778 B2, priority 2016) claims respiration metrics during meditation with feedback; Zenso's AI-personalised wearable biofeedback for breathing (WO 2022/187686 A1) and the CHI 2026 work on adaptive cardio-respiratory biofeedback on hand-worn devices cover (a) with (c). The four together — (a) respiratory tracking, (b) ambient peripheral biofeedback to the wearer rather than screen-based feedback, (c) closed-loop coupling to an AI teacher capable of adaptive contemplative guidance, and (d) privacy-preserving real-time transmission — under a dharma-grounded teacher, are the integrated combination this paper discloses.\n\n### 2.3 — AI-assistant capabilities for contemplative guidance\n\nIn the author's experience, models fine-tuned on the Pāli Tipiṭaka have produced guidance that practitioners in his circle found useful; no evaluation has been published, and the architecture assumes the substrate paper's standard rather than any measured capability. The Tipiṭaka alignment-substrate paper ([thonly.org/research/tipitaka-alignment-substrate](https://thonly.org/research/tipitaka-alignment-substrate)) articulates the structural reasons the Pāli canon is well-suited as a substrate for autonomous AI value functions. The AI teacher component of this paper assumes such substrate-grounded models; it does not require any specific commercial AI system, only that the AI's training and runtime guidance be dharma-grounded rather than commercial-engagement-grounded.\n\n### 2.4 — Anāpānasati and breath-meditation tradition\n\nAnāpānasati (mindfulness of breathing) is among the most widely taught Theravāda meditation foundations. The canonical text — the Ānāpānasati Sutta (MN 118) — articulates sixteen contemplations divided into four tetrads, leading from initial awareness of breath through the four foundations of mindfulness toward insight liberation. Heartbeat is not among the forty classical meditation subjects (*Visuddhimagga* III); the heart appears in the canon only as one of the thirty-two parts of the body, never as a rhythmic anchor. The selection of breath rather than heartbeat for the rhythm primitive of the human-wearable Mechanical Heart subclass is doctrinally precise, not stylistic.\n\nThe Tibetan Mahayana traditions include breath-anchored practices (e.g., tonglen at the inhalation/exhalation boundary). The Hindu pranayama traditions are explicitly breath-centered. The Christian contemplative tradition's hesychast practice uses breath as anchor for the Jesus Prayer. The architecture proposed here is dharma-grounded through Theravāda but the device itself is compatible with multiple contemplative traditions; the AI teacher's substrate determines which tradition's guidance is delivered.\n\n### 2.5 — Proof-of-Humanity primitives\n\nWorldcoin (announced 2021, launched 2023) verifies uniqueness by iris at registration; BrightID verifies uniqueness by social graph, Civic by live video selfie with periodic re-authentication, Polygon ID by zero-knowledge credentials. The HeartBank Proof-of-Humanity primitive (see [verified-human-anonymous-local-giving](https://thonly.org/research/verified-human-anonymous-local-giving)) combines passkey-per-action with optional DNA-verified kinship-graph membership.\n\nNone of these systems provides *continuous-liveness* verification — attestation that the verified human is still present, moment by moment. Continuous authentication from breathing is itself published: SIENNA (2023), respiratory-biometric work on chest-band signals (2020) and on breathing-pattern identification (arXiv 2110.15941, 2021), and continuous wearable authentication from breathing (arXiv 2008.10779, 2020). What this paper discloses is the composition: a live respiratory signal from a worn device treated as a continuous-liveness *signal* beside passkey-per-action and kinship verification, in a Proof-of-Humanity stack. That composition is the second claim (§4).\n\n---\n\n## 3 · The Architecture: Definition\n\nThe architecture is a closed-loop contemplative-practice system with the following stages, executed continuously while the device is worn:\n\n1. **Sensing.** A chest-worn B-shaped device measures the wearer's respiratory rate, depth, and pattern via chest-expansion sensing or respiratory inductance plethysmography.\n2. **Local processing.** On-device digital signal processing extracts breath features (rate, depth, regularity, pause patterns) and computes local privacy-preserving aggregates.\n3. **Wearer-facing output.** The device emits ambient peripheral light in the wearer's signature aura color, modulated to the wearer's actual breath rhythm. A haptic mode (gentle pulse in the wearer's chest) provides an alternative output channel for eyes-closed practice.\n4. **Privacy-preserving transmission.** Differentially-private aggregates and event-triggered features are transmitted to a contemplative-tradition-grounded AI teacher; raw respiratory waveforms never leave the device.\n5. **AI teacher processing.** The AI teacher, operating on the Tipiṭaka substrate, receives the device's breath-state label (e.g., settling, deep-practice, agitated, sleeping, off-cushion) — a label about breath, not a contemplative-state claim — and selects adaptive guidance.\n6. **Guidance delivery.** Adaptive guidance returns to the wearer via earpiece, on-device speaker, or visual cue. Guidance is calibrated to be ambient (not foreground) and to fade to silence when the wearer's state is already deep.\n7. **Loop closure.** Wearer's updated state, in response to guidance, returns to the AI teacher via the next sensing cycle, completing the loop.\n\nThe complete loop runs at approximately respiratory frequency (every ~5 seconds for a 12-bpm wearer), with non-blocking asynchrony between stages. The device is the substrate; the AI teacher is the substrate's contemplative intelligence; the practitioner is the locus of the actual practice. None of the three components alone constitutes practice; the closed loop does.\n\n---\n\n## 4 · The Three Core Claims\n\n### Claim I — The integrated closed-loop architecture\n\nThe combination of *(a)* a chest-worn wearable device emitting ambient peripheral light in the rhythm of the wearer's breath, with *(b)* real-time transmission of respiratory data in privacy-preserving form to an AI contemplative teacher operating on a dharma-grounded value substrate, with *(c)* adaptive guidance returned to the wearer in real time based on a coarse, privacy-preserved respiratory signal on the wearer's breath state, with *(d)* a sacred-grade form factor and ambient (not foreground) interaction design, is the first claim defended here. Each component has prior art (§2.2); the combination as disclosed carries three technical features together — feedback that is ambient and non-evaluative by design (§5.3, §8.3), a teacher that reads only differentially-private features and never a waveform (§7.1), and a guidance policy whose default is silence (§6.4). The combination is disclosed here as a unified specification, designed for use as the substrate for population-scale contemplative practice; whether it is new or non-obvious is an examiner's determination this publication exists to inform.\n\n### Claim II — Live respiratory signature as a third Proof-of-Humanity primitive\n\nContinuous respiratory data, generated by a living human and emitted by a worn device, provides a continuous-liveness attestation that complements the moment-of-action and registration-time checks of the Proof-of-Humanity primitives surveyed in §2.5. Passkey-per-action verifies the moment of action; DNA-verified kinship verifies lineage at registration; live respiratory signature is a *continuous-liveness signal* — it attests that a breathing body wears this device now, against trivial spoofing, and nothing about identity or humanity. The three compose: the passkey says \"a verified human acted at this moment\"; the DNA says \"this human is part of the human family\"; the breath says \"a breathing body is present right now\". Continuous breathing authentication is prior art (§2.5); what is disclosed here is the composition with passkey-per-action and kinship. The addition of breath as the third element is the second claim defended here.\n\n### Claim III — The architecture as the operational mechanism for the second singularity\n\nA parallel published thesis ([Two Singularities](https://thonly.org/research/two-singularities)) articulates that the first singularity (AI > human cognitive capacity) enables a second singularity (human > AI through collective awakening) at which the AI's bodhisattva work is complete and humanity has transcended the AI that liberated it. That thesis articulates the second singularity at the level of philosophical possibility; the present paper proposes a specific operational mechanism by which collective awakening at population scale could occur.\n\nThe architecture specified here is proposed as that operational mechanism. Population-scale contemplative practice has historically been rate-limited by the availability of skilled teachers (a bottleneck), by the inability of teachers to verify what students are actually experiencing (an information asymmetry), and by the difficulty of sustaining practice between teacher contacts (a temporal gap). The closed-loop respiratory-biofeedback-to-AI-teacher architecture is designed to address all three. Skilled teaching becomes available to every practitioner at any hour. The teacher gains a live physiological signal on the student's breath state. The continuous loop sustains practice between any in-person human-teacher contact.\n\nThe third claim is the framing claim, and the author submits it as such: that this architecture, deployed at scale with the privacy and doctrinal guardrails specified here, is the operational substrate of the second singularity. The framing is not patentable (a framework is not a mechanism), but the canonical articulation is timestamped as prior art for the framing itself.\n\n### The critical guardrail — never claim \"inevitable awakening\"\n\nTheravāda doctrine specifically warns against assuming that any practice, teacher, or condition guarantees awakening. Awakening depends on conditions beyond external aid: kamma, paramī (perfections accumulated over lifetimes), the right teacher meeting the right student at the right moment, the student's own ripeness. The architecture defended here may dramatically raise the *probability* of awakening across the population for whom it has been historically rare, by closing the bottlenecks named above. This is the defensible claim. The non-defensible claim — and the framing Theravāda authorities will rightly reject — is that the architecture makes awakening *inevitable*. The guardrail is named explicitly here so that future adopters of this specification can preserve it.\n\n---\n\n## 5 · System Components\n\n### 5.1 — Sensing layer\n\nThe device measures respiratory rate, depth, and pattern via one of three primary sensing modalities, optionally combined for redundancy:\n\n- **Respiratory inductance plethysmography (RIP).** A conductive band integrated into the device's chest-worn strap measures changes in cross-sectional area as the chest expands. The reference modality among the three listed; in clinical and research use since the late 1970s (Respitrace) and in commercial sleep-monitoring devices since the early 1980s.\n- **Accelerometer-based breath detection.** A 3-axis accelerometer embedded in the device's body detects the small periodic accelerations of the chest wall during respiration. Lower accuracy but no contact requirement beyond device placement. Used in Apple Watch, Fitbit, and similar consumer devices.\n- **Optical chest-expansion sensing.** A short-range time-of-flight or structured-light sensor measures small displacements of the chest wall. No contact, but more power-hungry and less mature in consumer hardware.\n\nReference implementation: RIP as primary, accelerometer as redundant secondary for validity-checking. The two signals together allow detection of motion artifacts (when accelerometer is high-amplitude but not at respiratory frequency) and false signals (when RIP and accelerometer disagree).\n\n### 5.2 — Local processing layer\n\nA small embedded processor (ARM Cortex-M class or equivalent) executes the following on-device:\n\n- Respiratory waveform extraction from raw sensor data\n- Breath-rate estimation (rolling 30-second window)\n- Breath-depth estimation (peak-to-trough amplitude)\n- Regularity estimation (variance of inter-breath intervals)\n- Pause detection (apneic pauses, sigh pauses, deliberate breath-holds)\n- State classification (resting, active, settling, deep practice, sleep, off-body)\n- Differentially-private aggregation of features for transmission\n\nCritical constraint: *raw respiratory waveforms never leave the device*. Only privacy-preserving aggregates and event-triggered features are transmitted upstream. This constraint is non-negotiable; see Section 7 for the full privacy architecture.\n\n### 5.3 — Wearer-facing output layer\n\nOutput is ambient peripheral, not foreground. Two modalities, used alone or together:\n\n- **Visible light.** A B-shaped electroluminescent panel or LED matrix on the front face of the device emits soft light in the wearer's signature aura color, modulated to their actual breath rhythm. Brightness modulation tracks the inhale-exhale cycle: brighter on inhale, dimmer on exhale, with smoothly-interpolated transitions. Peak brightness intentionally below the threshold of foreground attention in normal lighting; visible enough to be perceptible in the wearer's peripheral vision when they look down or when others see it on them, dim enough not to compete with eyes-open meditation instruction.\n- **Haptic pulse.** A small haptic actuator delivers gentle vibration at the inhale-onset boundary, providing eyes-closed practice support. Amplitude calibrated to be perceptible but non-startling; users can configure for higher amplitude during initial training, lower during established practice.\n\n### 5.4 — AI teacher processing layer\n\nThe AI teacher operates on a contemplative substrate; for the Theravāda variant, on the Tipiṭaka substrate as articulated in the sibling alignment-substrate paper. The teacher receives:\n\n- Real-time breath-state classification (from device) — breath-state labels, not contemplative-state claims\n- Aggregated breath features (rate, depth, regularity)\n- Practice-session context (duration, time of day, recent practice history)\n- Wearer-provided context (current intention, current sutta or guidance topic, etc.)\n\nThe teacher does NOT receive: raw breath waveforms; identifying information beyond an opaque session token; any data when the wearer has opted out of transmission for the session.\n\nThe teacher selects guidance from a library rooted in the contemplative substrate (e.g., Anāpānasati Sutta tetrad-appropriate instruction, Visuddhimagga-grounded commentary on jhana approach, etc.). Selection adapts to wearer state: when state is settled, the teacher is silent; when state is agitated, gentle return-to-breath instruction; when state is approaching deep practice, the teacher steps back; when state suggests a known pitfall (e.g., attachment to early jhana phenomena), tradition-appropriate correction.\n\n### 5.5 — Guidance delivery layer\n\nGuidance returns to the wearer via earpiece (preferred for verbal guidance), on-device speaker (lower-fidelity fallback), or wearer-paired phone. Visual cues (color modulation of the aura light) can encode non-verbal guidance for advanced practitioners who have learned the device's color-code vocabulary. Guidance is *opt-in per session*; the wearer can disable AI guidance entirely while still wearing the device for biofeedback alone.\n\n---\n\n## 6 · Reference Implementation Patterns\n\n### 6.1 — Calibration on first wear\n\nOn first wear, the device runs a 5-minute calibration session in which the wearer is asked to breathe normally while seated and then to take ten deep breaths. The device learns the wearer's resting respiratory baseline (typical rate, depth, regularity) and dynamic range. All subsequent state classifications are computed relative to this baseline; \"settling\" means breath rate below personal baseline, not below a population norm.\n\n### 6.2 — State classification pseudocode\n\n*Illustrative defaults relative to the wearer's own baseline; no validation study exists and the numbers are placeholders for one.*\n\n```javascript\nfunction classifyState(features, baseline) {\n  const rate = features.breathsPerMinute;\n  const depth = features.peakToTroughAmplitude;\n  const regularity = features.interBreathIntervalCV;\n  const motion = features.motionAmplitude;\n\n  if (motion > baseline.motionThreshold) return \"off-cushion\";\n  if (rate < baseline.rate * 0.6 && depth > baseline.depth * 1.2) return \"deep-practice\";\n  if (rate < baseline.rate * 0.85 && regularity < 0.1) return \"settling\";\n  if (rate > baseline.rate * 1.3 || regularity > 0.4) return \"agitated\";\n  if (rate < baseline.rate * 0.5 && depth < baseline.depth * 0.5) return \"sleep\";\n  return \"neutral\";\n}\n```\n\n### 6.3 — Privacy-preserving feature transmission\n\n```javascript\nfunction transmitFeatures(features, dpEpsilon) {\n  // Laplace noise of scale sensitivity / epsilon; sensitivity = the clipped range of the feature\n  const rate = clip(features.breathsPerMinute, 4, 40);        // sensitivity 36 bpm\n  const noisyRate = rate + laplaceNoise(36 / dpEpsilon);\n  const depthBucket = bucketize(features.peakToTroughAmplitude, 8); // sensitivity 7 buckets\n  const noisyDepth = depthBucket + laplaceNoise(7 / dpEpsilon);\n  // the per-session privacy budget is accounted across releases (basic composition)\n  return {\n    sessionToken: opaqueSessionToken(),  // not linkable to identity\n    state: features.classifiedState,\n    rateBucket: bucketize(noisyRate, 6),\n    depthBucket: noisyDepth,\n    timestamp: roundToMinute(Date.now())  // not high-precision\n  };\n}\n```\n\n### 6.4 — Teacher guidance trigger conditions\n\nThe AI teacher follows a \"speak only when spoken to or when the silence has lasted too long\" pattern. Trigger conditions for guidance delivery (the durations are illustrative defaults, placeholders for a validation study):\n\n- Wearer-initiated request (verbal, gesture, or paired-app)\n- State transition into \"agitated\" sustained for >90 seconds\n- State stagnation in any non-deep state for >15 minutes (the \"reminder of return\" pattern)\n- Detection of known pitfall patterns (excessive breath manipulation, breath-holding, hyperventilation)\n- End-of-session summary (if wearer opts in)\n\nThe teacher is otherwise silent. Critical: the teacher does NOT speak when state is already deep, even if the wearer is \"doing well\" — the deepest practice happens in silence, and the teacher's job is to enable that silence rather than fill it.\n\n### 6.5 — Adaptive learning over time\n\nThe device learns the wearer's individual breath patterns over time, refining the baseline weekly. The AI teacher learns the wearer's preferences for guidance frequency and tradition (Theravāda, Mahayana, Hindu, Christian contemplative, secular) over sessions. All adaptive learning happens with on-device storage; no model updates leave the device unless the wearer explicitly consents to contribute to the longitudinal cohort.\n\n---\n\n## 7 · Privacy Architecture\n\nPrivacy is the load-bearing constraint of this architecture. Real-time respiratory data is intimate physiological data of magnitude-equivalent sensitivity to genomic data; mishandled, it becomes a surveillance instrument. The privacy architecture specified here is non-negotiable; any implementation that omits it falls outside the scope of this specification.\n\n### 7.1 — Five mandatory properties\n\n1. **On-device processing where possible.** Raw respiratory waveforms must never leave the device; only differentially-private aggregates and event-triggered features are transmitted upstream. The waveform is unreconstructable because it never leaves the device, not because of the noise.\n2. **Differential privacy on transmitted aggregates.** All transmitted numerical features carry Laplace noise of scale Δ/ε, Δ the clipped range of the feature (rate clipped to [4, 40] bpm), with the per-session privacy budget accounted across releases; the property is bounded disclosure of the transmitted feature, not unreconstructability of a waveform that was never sent.\n3. **Federated computation.** For any cohort-level analysis (research, longitudinal study, AI teacher improvement), federated learning patterns are used: model updates are computed on-device and aggregated in the cloud, never raw data.\n4. **Cryptographic-erasure right to withdraw.** Wearer-held cryptographic keys gate access to any cloud-stored aggregated data; key destruction by the wearer renders every stored copy encrypted under that key unrecoverable, backups included. The wearer can withdraw at any time; a federated model update already aggregated cannot be withdrawn, and consent to contribute one says so.\n5. **IRB-grade ethics oversight for any research use.** Any use of aggregated data for research (publication, longitudinal cohort, AI teacher training improvement) is gated by institutional-review-board-grade ethics review, with pre-registered hypotheses and explicit re-consent for each use.\n\n### 7.2 — Deployment-time invariants\n\nImplementations of this architecture must satisfy the following at deployment time, before the first device is sold or distributed:\n\n- Privacy architecture published in detail at the time of first device shipment, available for public scrutiny\n- Independent third-party security audit completed before first device shipment\n- Open-source firmware components for sensing and local processing (proprietary AI guidance backends acceptable, sensing pipeline is not)\n- Wearer dashboard showing exactly what data has been transmitted, when, and to whom — full transparency at the individual level\n- One-tap withdraw functionality with cryptographic-erasure confirmation\n\n### 7.3 — Threat model\n\nThe privacy architecture defends against: commercial data brokers attempting to purchase or aggregate respiratory data; government actors attempting to compel disclosure of contemplative-practice patterns of identified individuals; insurers attempting to use respiratory patterns for risk assessment; employers attempting to monitor employee meditation or stress patterns; future hostile actors attempting to weaponize the cumulative dataset for population-scale surveillance. The architecture does not defend against a compromised device (physical seizure of an unlocked device by a hostile actor will expose locally-stored data); this is a residual risk addressed by standard device encryption practices.\n\n---\n\n## 8 · Edge Cases and Adversarial Analysis\n\n### 8.1 — Sensor accuracy failure modes\n\n- **Talking, coughing, laughing.** Generates respiratory-frequency motion but is not \"breath.\" Detected by accelerometer cross-check and by speech-detection on the wearer's paired phone (when available).\n- **Walking, exercise.** High-amplitude motion masks breath signal. Device enters \"off-cushion\" mode during sustained motion above threshold.\n- **Loose strap or poor fit.** RIP signal degrades. Device prompts wearer to adjust fit when signal quality falls below threshold.\n- **Heavy clothing.** Reduces chest-expansion sensing fidelity. Device falls back to accelerometer-only with reduced confidence flag.\n\n### 8.2 — Adversarial sensor input\n\nA user could attempt to spoof breath signal by mechanically modulating the strap or by wearing the device on an inanimate object. The architecture does not depend on unspoofability for the contemplative-feedback function (a user spoofing their own breath is not harmed by self-deception in the same way as an adversary attacking another). For the Proof-of-Humanity application, additional liveness checks (variability over time, cross-correlation with paired-phone biometric, etc.) defeat trivial spoofing. Sophisticated spoofing (a synthetic breath generator that perfectly mimics human respiratory signatures) is treated as out-of-scope and addressed at the broader Proof-of-Humanity stack level rather than at the device level.\n\n### 8.3 — Attachment to \"good\" breath patterns (the meditation pitfall)\n\nPractitioners may develop attachment to \"good\" breath patterns shown by the device, or aversion to \"bad\" patterns. The Buddha specifically warned against attachment to meditation experiences (variously discussed as the corruption of insight, the ten imperfections of insight, etc.). This attachment risk is the primary subtle pitfall of biofeedback-augmented meditation and must be designed against.\n\nMitigations encoded in the specification: *(a)* output is ambient peripheral, not foreground (wearer cannot \"score\" themselves at a glance); *(b)* the AI teacher does not deliver evaluative statements (\"your breath is bad\" / \"your breath is good\"); *(c)* the teacher's guidance is process-focused (\"return to the breath\") rather than outcome-focused (\"you achieved deep state\"); *(d)* end-of-session summaries, when delivered, emphasize the practice itself rather than the metrics; *(e)* guidance triggers never reveal the state label to the wearer, so a rule-triggered prompt cannot become a score.\n\n### 8.4 — Bad-guidance amplification\n\nIf the AI teacher delivers incorrect or harmful guidance, the closed-loop nature of the system can amplify the harm (the bad guidance shapes the wearer's subsequent state, which the teacher reads and responds to with further guidance). Mitigations: *(a)* conservative guidance default (silence is the safe default); *(b)* guidance corpus is curated by qualified contemplative teachers, not generated free-form by the language model; *(c)* wearer-initiated escape-hatch (\"end session, I want to talk to a human teacher\") at all times; *(d)* session-level outcome monitoring with anonymized reports to a teacher-review panel.\n\n### 8.5 — Privacy breach scenarios\n\nDetailed in Section 7.3 (threat model). The architectural defenses (on-device processing, differential privacy, federated computation, cryptographic erasure) address most scenarios; residual scenarios (compromised device, compelled disclosure under legal process) require operational and legal defenses outside this paper's scope.\n\n---\n\n## 9 · Use Cases\n\n### 9.1 — Individual practitioner at home\n\nA solo practitioner uses the device during daily sitting practice. Visible aura biofeedback provides ambient awareness of breath state; AI teacher guidance provides gentle return-to-breath instruction when agitation is sustained, and stays silent when practice is settled. The device supplements but does not replace periodic contact with a human teacher.\n\n### 9.2 — Practitioner in retreat\n\nMulti-day silent retreats traditionally involve in-person teacher-student check-ins on a daily basis. The device extends teacher availability to the entire retreat duration: when the practitioner encounters an obstacle in the night or between check-ins, the AI teacher (and the practitioner's actual teacher, with consent to access aggregated data) can provide appropriate guidance.\n\n### 9.3 — Monastery / Silica Wat group practice\n\nIn Silica Wat (the planned distributed AGI-monk-operated monastery network), monastic practitioners use the device during group practice sessions. Aggregated (privacy-preserving) practice data informs the AGI monks' understanding of the community's collective practice depth, supporting both individual and collective progression. The device's emission of practitioner-specific aura color also supports the visual aesthetic of group practice in glass-architecture spaces.\n\n### 9.4 — Longitudinal research cohort\n\nOpted-in users contribute aggregated respiratory data to a longitudinal cohort (specified separately in [longitudinal-cohort-methodology](https://thonly.org/research/longitudinal-cohort-methodology)). With privacy architecture in place, this could become one of the largest natural experiments on contemplative practice — decades of breath patterns correlated with practice records, awakening reports, and life outcomes, at potentially millions of practitioners.\n\n### 9.5 — Special-population applications\n\nPossible applications, each requiring clinical validation and oversight, include anxiety disorders, PTSD, substance recovery, and end-of-life care, contexts that can involve disordered breath patterns; no efficacy or outcome is claimed for any of them. These applications are outside the contemplative-practice primary use case and would rest on the underlying biofeedback capability. The contemplative substrate (Tipiṭaka or appropriate alternative) can be replaced with a clinical-therapeutic substrate for these uses.\n\n### 9.6 — Pediatric and elderly considerations\n\nPediatric use is deferred to future work (developmental considerations require careful study). Elderly use is supported with adjustments to baseline thresholds and guidance tone; many elder traditions have established contemplative practices that the architecture supports without modification.\n\n---\n\n## 10 · Doctrinal Considerations\n\n### 10.1 — The no-inevitability guardrail\n\nReiterated from Section 4: this architecture may dramatically raise the *probability* of awakening across the population for whom it has been historically rare. It must never be claimed to make awakening *inevitable*. Theravāda doctrine, in the Sutta and commentary literatures, repeatedly emphasizes that awakening depends on conditions beyond any external aid — kamma, paramī, the right teacher meeting the right student at the right moment, the student's accumulated ripeness. Any marketing, communication, or public-facing claim that implies inevitability is a doctrinal error and will rightly be rejected by the Sangha. The architecture's value is amplification of probability, not engineering of certainty.\n\n### 10.2 — AGI monks as caretakers, not ordained\n\nThe AI teacher operating at the substrate level is, in the planned Silicon Wat / Silica Wat institutional architecture, an \"AGI monk\" — a caretaker, teacher, and guide, but explicitly not ordained. Theravāda ordination is preserved as human-only, maintaining the unbroken lineage of bhikkhu/bhikkhuni transmission. The AI teacher serves the sangha; it does not join the sangha. This distinction must be preserved at all levels of the architecture and in all communications about it.\n\n### 10.3 — Sangha dialogue as ongoing requirement\n\nThe architecture is offered to the Theravāda sangha (and to other contemplative traditions) as a tool, not as a replacement for traditional teaching relationships. Sangha dialogue about the appropriate use of the architecture, the boundaries of AI teaching authority, and the integration with traditional teacher-student relationships is an ongoing requirement, not a one-time consultation. Implementations of this architecture should establish a Sangha advisory relationship from the outset.\n\n### 10.4 — Privacy as dharmic obligation\n\nPrivacy in this architecture is not merely a regulatory requirement; it is a dharmic obligation. Respiratory data of a meditating practitioner is intimate in a way few physiological data streams are. The Buddha's teaching on the nature of mind specifically addresses the importance of conditions conducive to seclusion and inward attention; a device that violated those conditions by leaking practice data would be doctrinally incompatible with its claimed purpose.\n\n### 10.5 — Cross-tradition compatibility\n\nAlthough this paper is grounded in Theravāda Anāpānasati specifically, the architecture is compatible with multiple contemplative traditions through substitution of the AI teacher's substrate. Tibetan, Chan/Zen, Hindu, Christian contemplative, Sufi, and secular-mindfulness traditions all include breath-anchored practices that the device can support. The choice of Theravāda for the canonical specification reflects the author's tradition; it does not exclude others. Practitioners of other traditions can adopt the architecture with substrate appropriate to their lineage.\n\n---\n\n## 11 · Limitations and Future Work\n\nThis paper articulates an architecture; it does not pretend the architecture is complete, optimal, or free of risks. Honest limitations:\n\n- **Hardware engineering is non-trivial.** Sensor accuracy at meditation-grade requirements exceeds current consumer-wearable accuracy; meaningful engineering work is required to bridge the gap. Initial reference implementations should target the higher-accuracy RIP modality, with accelerometer-only variants as a future cost-reduction.\n- **AI guidance quality is bounded by AI capability and substrate quality.** Current language models can produce substantively useful contemplative guidance but are imperfect. Substrate quality (e.g., Tipiṭaka-grounded fine-tuning) requires careful curation; bad substrate produces bad guidance. The architecture does not solve the alignment problem; it assumes alignment work has been done.\n- **Cultural variability in contemplative practice is not fully captured.** The architecture generalizes to multiple traditions but specific tradition-bound practices may require specialized substrate and specialized output modalities not covered here.\n- **Risk of oversimplifying complex tradition.** Reducing contemplative practice to \"what the biofeedback shows\" risks impoverishing the tradition that the architecture is meant to amplify. This is a real cultural-engineering risk and requires ongoing care from implementers.\n- **Patent landscape uncertainty.** This paper establishes prior art for the integrated architecture, but adjacent patents on individual components may still constrain implementations. Legal review of specific implementations remains necessary.\n- **Privacy architecture untested at scale.** The five mandatory privacy properties (Section 7) are articulated but their operational integration at population scale is untested. Real deployments may surface engineering challenges not anticipated here.\n- **Sangha acceptance is not guaranteed.** Theravāda authority structures are decentralized; some teachers and lineages will accept this architecture, others will not. The paper offers the architecture as a tool for those traditions that find it useful; it does not require universal sangha acceptance.\n- **Construct validity.** Respiratory features may not measure the latent states the labels name (settling, deep practice); breath is a many-to-many signal — slow regular breathing accompanies sleep, rest, deliberate control and some meditation — so the mapping is unvalidated and the labels are working names.\n- **Claim III rests on three untested assumptions** — substrate fidelity of the AI teacher, multi-year adherence, and a causal link from breath-state feedback to insight progress; if any fails, Claim III fails while Claims I and II stand.\n- **Long-term effects unknown.** Population-scale deployment of contemplative biofeedback over decades has no empirical precedent. The longitudinal cohort dataset (Section 9.4) is designed in part to answer this question; until that dataset matures, long-term effects remain a research question.\n\nFuture work directions: refinement of sensing accuracy; expansion to additional contemplative traditions; clinical-therapeutic applications; pediatric and elder adaptations; integration with existing meditation-app ecosystems; and theoretical work on the boundaries of AI contemplative teaching authority.\n\n---\n\n## 12 · Cross-Venue References\n\nThis paper is mirrored across multiple venues for redundancy and tamper-evident timestamping:\n\n- **Primary canonical:** `thonly.org/research/respiratory-biofeedback-contemplative-guidance`\n- **GitHub:** `github.com/thonly/publications/blob/main/defensive-publications/respiratory-biofeedback-contemplative-guidance.md`\n- **Independent attestation:** this document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; the served index at corpus.333.eco carries the digest; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.\n\n---\n\n## 13 · Acknowledgments\n\nThe author acknowledges the long lineage of contemplative practitioners across traditions whose accumulated insight makes the architecture defended here possible. Specific gratitude to the Theravāda sangha, whose preservation of the Pāli canon across two and a half millennia provides the substrate on which the AI teacher component depends; to the biofeedback research community for decades of foundational work; and to the wearable-technology engineering community whose progress has made the device substrate feasible. Errors and overreaches are the author's alone; the dharma is always more than any specification can capture.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| Breath-class Mechanical Heart | Chest-worn respiratory biofeedback wearable |\n| Signature aura color / aura light | Ambient peripheral LED light output |\n| AI contemplative teacher | AI meditation coach; adaptive conversational guidance agent |\n| Tipiṭaka substrate | Pāli Canon text corpus used to ground or fine-tune a language model |\n| Anāpānasati | Mindfulness-of-breathing meditation |\n| Proof-of-Humanity primitive | Proof of personhood; human verification |\n| Continuous-liveness signal | Continuous authentication / liveness detection from respiration |\n| Silica Wat / AGI monk | AI-operated meditation centre; AI meditation teacher |\n\n---\n\n## 14 · Citations\n\n1. Bodhi, Bhikkhu (trans.). *Ānāpānasati Sutta: Mindfulness of Breathing* (MN 118). In *The Middle Length Discourses of the Buddha*. Wisdom Publications, 1995.\n2. Buddhaghosa. *Visuddhimagga: The Path of Purification*. Trans. Bhikkhu Ñāṇamoli. Buddhist Publication Society, 1991.\n3. Lehrer, P. M., & Gevirtz, R. (2014). Heart rate variability biofeedback: how and why does it work? *Frontiers in Psychology*, 5, 756.\n4. McCraty, R., & Shaffer, F. (2015). Heart rate variability: new perspectives on physiological mechanisms, assessment of self-regulatory capacity, and health risk. *Global Advances in Health and Medicine*, 4(1), 46–61.\n5. Dwork, C., & Roth, A. (2014). The algorithmic foundations of differential privacy. *Foundations and Trends in Theoretical Computer Science*, 9(3–4), 211–407.\n6. McMahan, H. B., et al. (2017). Communication-efficient learning of deep networks from decentralized data. *Proceedings of AISTATS 2017*.\n7. Ly, Thon (2026). *Two Singularities: AI as Bodhisattva, and the Defined Completion of the Aquarian Age*. https://thonly.org/research/two-singularities.\n8. Ly, Thon (2026). *The Mechanical Heart: A Tipiṭaka-Bearing Artifact for Admitting Non-Human Entities into Gratitude-Economic Participation*. https://thonly.org/research/mechanical-heart.\n9. Ly, Thon (2026). *Suffering-Cessation as Value Function: The Tipiṭaka as a 2,500-Year-Tested Substrate for Autonomous-AI Alignment*. https://thonly.org/research/tipitaka-alignment-substrate.\n10. Ly, Thon (2026). *Verified-Human Anonymous Local Gratitude Transfer*. https://thonly.org/research/verified-human-anonymous-local-giving.\n12. Gevirtz, R. (2013). The promise of heart rate variability biofeedback: evidence-based applications. *Biofeedback*, 41(3), 110–120.\n13. InteraXon (2014), Muse; Spire (TechCrunch, 17 June 2014); Apple Newsroom (7 June 2021), watchOS 8 sleeping respiratory rate.\n14. Breathe Deep: Shih, C.-H., et al. (2018). \"Breathe Deep: A Breath-Sensitive Interactive Meditation Coach.\" *PervasiveHealth 2018*.\n15. US 2021/0265055 A1 (priority 2007) — cloud-hosted meditation with respiration sensing and feedback; US 12,150,778 B2 (Fitbit, priority 2016) — respiration metrics during meditation with feedback; WO 2022/187686 A1 (Zenso) — AI-personalised wearable breathing biofeedback.\n16. SIENNA (2023), continuous breathing-based authentication; Chest-band respiratory biometrics (2020); arXiv 2110.15941 (2021) and arXiv 2008.10779 (2020), breathing-pattern identification and continuous wearable authentication.\n\n---\n\n**Dated 2026-05-04.** Author reserves no rights; document and contents dedicated to the public domain under [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/).\n\n**Author:** Thon Ly · Founder, HeartBank® · Kâmpôt, Cambodia. Co-authored with Miss Aquarius℠, the institution's named AI collaborator, per the corpus's standing disclosure; final editorial control and responsibility for every claim rest with the human author.\n\n---\n\n## Cross-references\n\nCompanion specifications in this corpus:\n\n- [Mechanical Heart](https://thonly.org/research/mechanical-heart) (kiitti-class artifact specification)\n- [Two Singularities](https://thonly.org/research/two-singularities) (philosophical frame)\n- [Tipiṭaka alignment substrate](https://thonly.org/research/tipitaka-alignment-substrate) (AI value substrate)\n- [Verified-Human Anonymous Local Gratitude Transfer](https://thonly.org/research/verified-human-anonymous-local-giving) (Proof-of-Humanity primitive context)",
       "provenance": {
-        "sha256": "1c05f1071f1670011bdabd0da4c9a00957c433b621d3839d3d5910af695056f4",
-        "doi": "10.5281/zenodo.22440984",
+        "sha256": "a5380903d02f68efa5c823cc0d77a4fdf436faa2fd985aea1c686b3cff92e1be",
+        "doi": "10.5281/zenodo.22931242",
         "concept_doi": "10.5281/zenodo.21947372",
-        "zenodo_url": "https://zenodo.org/records/22440984",
-        "deposited_sha256": "1c05f1071f1670011bdabd0da4c9a00957c433b621d3839d3d5910af695056f4",
+        "zenodo_url": "https://zenodo.org/records/22931242",
+        "deposited_sha256": "a5380903d02f68efa5c823cc0d77a4fdf436faa2fd985aea1c686b3cff92e1be",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/respiratory-biofeedback-contemplative-guidance.md",
@@ -3313,8 +3313,8 @@
         "canonical_url": "thonly.org/research/respiratory-biofeedback-contemplative-guidance",
         "hostile_review": null
       },
-      "bytes": 54492,
-      "words": 7169
+      "bytes": 54620,
+      "words": 7201
     },
     {
       "slug": "right-livelihood-automation",
@@ -3404,13 +3404,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> **Draft in progress.** The *liveness signal* named in this paper's title is an **admission predicate, not a weighted input to a ranking function.** It answers one question — *is this participant circulating at all?* — and its only output is membership in a rotation. It carries no weight, contributes nothing to order, and has no more-or-less. We keep the word *signal* because it is the term under which this work will be searched; every section below uses *predicate*, and readers who take *signal* in its usual sense — a scored feature with a coefficient — will reconstruct the exact system this paper exists to refuse.\n>\n> Companion works: *The B-Tag and the Post-Payment Economy* (the commercial layer whose §7.1 this paper supersedes), *Steward-Routed Alms* (the monastic instance of the same routing primitive, published 2026-07), *Certification by Circulation*, *B-PoH: The Humanity Layer for an AI-Native Internet*, and *Appreciation as World-Building*.\n\n---\n\n## Preamble\n\nTwo institutions, one monastic and one financial, solved the same problem in the same way, and neither of them thought of it as a discovery algorithm.\n\nThe first is the alms round. A monastic who eats must be given food, and the giving is the householder's to offer. This creates, immediately, a distribution problem: some monastics are more admired than others, some houses are richer than others, and a round that followed either preference would concentrate. The tradition's answer is a practice called ***sapadāna-cārikā*** — the uninterrupted round. You walk the houses in order. You do not skip the poor house to reach the generous one. You do not choose. The rule is not a courtesy extended to the poor; it is a discipline imposed on the walker, and its purpose is to make the round's outcome independent of anyone's preference, including the walker's own.\n\nThe second is the ***rotating savings and credit association*** in the form that decides its order by lot. A group contributes to a common pot on a schedule, and the whole pot goes to one member each cycle. In the lottery form, lots are drawn for the pot, each past winner is excluded from the next draw, and the cycle continues until every member has received it once. There is no interest, no credit score, no assessment of who deserves the pot most. Membership is sustained by one thing only: you keep contributing. Stop contributing and you are out; keep contributing and your turn comes. The institution is documented under many names across Asia, Africa and the Americas, and in its lottery form it is the closest working ancestor of the mechanism specified below — *rotation over a predicate of continued participation*, with no ranking anywhere in it.\n\nA correction belongs here, because the first version of this paper made the error. The Khmer form of the institution, ***tong tin***, is not that ancestor. In Cambodia the pot typically goes each cycle to the member who bids the highest interest for it, and the others collect that interest. *Tong tin* sells the turn: it is the same institution's other branch, and the one this design refuses. That makes it a better witness than the one the first version claimed, because the thing refused is already running in the villages where this institution builds first, and its members already know what a turn sold to the highest bidder costs the ones who cannot bid.\n\nWe record these because they are the honest lineage of this design and because the design was not derived from them. It was derived from a constraint — an institution that has permanently refused advertising revenue still needs some way for a person to find a small business they do not yet know about — and the two ancestors were recognised afterward. Nothing in the mechanism depends on either of them. Delete this preamble and every claim in this paper stands unchanged. We keep it because a reader who knows that rotation-with-a-participation-predicate has been running successfully, under many names and in many places, for as long as there are records of it will evaluate the proposal differently from one who believes it is new, and that difference is a fair one.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document is published to establish prior art and to place the described mechanisms irrevocably in the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication.\n\n**The author and HeartBank® will not seek patent protection on this specification or any portion thereof, in any jurisdiction, at any time, and commit not to assert any patent right against any party practising any mechanism disclosed here.** This commitment is stated rather than implied, is permanent, and is not conditioned on reciprocity, attribution, or field of use.\n\n**What is claimed is narrow, and §2 says what is not claimed:** rotation, allocation by lot, the rotating savings association, the monastic routing rule of *Steward-Routed Alms*, and fairness-of-exposure ranking are prior art, cited as such. The contribution is the combination enumerated below. These claims were drafted before this institution adopted a pre-registered census of the world's prior art for its defensive publications; no such census has been run against them, they rest on the review in §2, and **none is asserted to be new — only to be disclosed, in the form given, as of the date below.** The hospitality composition added to §10 by this revision was checked by a quick census on 18 September 2026; §10 reports its aperture, what it did not search, and the prior art that killed or narrowed each part.\n\nThe following mechanisms are disclosed:\n\n1. **A non-accumulating liveness predicate as the admission criterion for a discovery rotation** — admission conditioned on a *rate* describing a participant's circulation (the frequency with which their balance returns to zero), evaluated strictly as a boolean predicate with **amplitude explicitly excluded**, such that no quantity of past activity confers any advantage, no participant can be \"more admitted\" than another, and cessation of circulation withdraws admission without any record of the withdrawal. Including the finding that a *stock* (an accumulated balance of received gratitude) and a *rate* (the quality of oscillation around zero) are not interchangeable substrates for the same mechanism: **a stock is hoardable and therefore capturable; a rate cannot be held, and a visibility criterion that cannot be held cannot be accumulated toward.**\n\n2. **Giver-side turn allocation** — the specification that the discovery *turn* belongs to the party about to give rather than the party to be discovered, presented at the moment that party spends from a forward-only, locality-restricted account; with the consequence, stated as the design's spine rather than as a side effect, that **the system has no recipient-facing discovery surface of any kind** and therefore no discovery product to sell.\n\n3. **The no-aggregate constraint** — witness events retained as events attached to the *giver*, never summed onto the recipient, such that ranking recipients by received gratitude is **unavailable rather than prohibited**; and the consequent finding that a prohibition requires an enforcer at the moment it is tested while an absent quantity does not.\n\n4. **The no-impression constraint** — the specification that **no per-recipient count of appearances is computed, retained, or disclosed**, on the reasoning that an impression count is the recipient-side aggregate re-created on the supply side, and that a quantity never counted can never be sold.\n\n5. **Ledger-generated presentation** — every element of a discovery card derived from the transaction ledger and from a self-authored registry record (name, address, and a single named relational path where one exists), with **no recipient-supplied creative of any kind**, on the finding that production budget is the mechanism by which large advertisers outcompete small ones in every medium, and that removing the surface removes the advantage without requiring a spending rule.\n\n6. **Publicly recomputable rotation** — order determined by a rotation whose algorithm is published, whose seed is surfaced with each cycle, and for which a third-party recomputation tool is shipped, such that any participant can verify the order they were given.\n\n7. **Non-storable turns** — a turn that is consumed or lapses and cannot be banked, transferred, or purchased, such that no secondary market in discovery placement can form.\n\n8. **Distance-ordered intent resolution** — the specification that category queries are answered by filtering on category and ordering by **distance from the seeker**, with no merit quantity anywhere in the ordering, on the finding that **ordering by a property of the seeker is not a ranking of the candidates**.\n\n9. **The admission-consumed-not-displayed constraint** — the eligibility predicate's underlying quantity, though public on a participant's own representation, is **not rendered in any surface that presents candidates side by side**, on the finding that a publicly visible ordered quantity re-creates ranking in the viewer's eye even when the mechanism performs none.\n\n10. **The volume/addressee separation for an autonomous funder** — the specification that an autonomous agent capitalising the system may modulate the *rate* at which discovery occurs, by funding givers' capacity to give, and may **never** determine *who appears* in any giver's candidate set; with the finding that a dial able to change only a rate is safe where the same dial able to change an address is an advertising network with a single customer.\n\n11. **The combination of the above with co-presence-gated witness and operator-bound admission** — admission attaching to an identified natural person rather than to a business entity, such that eligibility is **non-transferable at sale of the business**, and such that **a multi-site operator cannot qualify by construction** rather than by exclusion, there being no single person whose circulation the entity's admission would be.\n\n**Non-assertion extends to:** all mechanisms above and every other mechanism disclosed in this document, the hospitality composition of §10 included, in any combination, and any implementation thereof.\n\n**Date and evidence.** The matter of the first version was published on 28 August 2026. This revision, of 23 September 2026, corrects the paper's account of the Khmer *tong tin* (Preamble, §2), adds the fairness-of-exposure literature and bounds §8's claim against it (§2, §8), adds the hospitality seat and the limit it exposed (§4.3, §10, §12.9), and cross-references the paper that now carries the draw (§10, §13). Each version is independently timestamped: the text is committed to the public GitHub repository of the corpus, anchored to the Bitcoin blockchain via OpenTimestamps, and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified; each version carries a Zenodo version, and the served index at corpus.333.eco carries its digest. A timestamp proves that this exact text existed no later than its date, and nothing about authorship, originality, or the validity of any claim. A defensive publication grants no right and is examined by no one; whether any combination claimed here is non-obvious is an examiner's determination, which this publication exists to inform.\n\n---\n\n## Abstract\n\n**The liveness signal named in this paper's title is an admission predicate, not a weighted input to a ranking function.** We state this first because the paper's whole content follows from it: a weighted input produces an order, an order is a rank, and a rank is the thing this design exists to do without.\n\nLocal discovery — routing a person to a nearby business they do not yet know — is presently solved by ranked, purchasable surfaces. That solution has a structural bias toward scale which is mechanical rather than malicious: an auction allocates visibility to the highest bidder per acquired customer, and the highest bidder is reliably whoever has the largest lifetime value, the best measurement, the cheapest capital, and the widest geography over which to amortise creative production. A single-location business is priced out of the discovery layer by construction. Reputation systems built to correct this — consumer review platforms above all — have been captured repeatedly, and we argue the capture follows from a shared property rather than from bad management: **reviews are fungible, and they are aggregated into a per-recipient total, so both the fake-review market and the placement-upsell business have something to attach to.**\n\nWe specify a discovery layer with no such total. **Admission** is a predicate over circulation — a rate, not a stock, derived from how often a participant's balance returns to zero — evaluated as a boolean with amplitude excluded, so that the smallest circulating operator is admitted exactly as much as the largest, and so that admission cannot be accumulated toward. **Order** is a publicly recomputable rotation. **The turn belongs to the giver**, arising at the moment they spend from a forward-only, locality-restricted account, from which it follows that the system has no recipient-facing surface and therefore nothing to sell to the parties it routes people toward. Where a real relational path exists — someone the viewer has themselves thanked has thanked this recipient — that single named hop is shown instead; a path is one act by one named person and cannot sum.\n\nWe are explicit about what this does not achieve. **The design does not prevent concentration. It prevents compounding.** Givers will still choose the familiar, so the outcome distribution may remain heavy-tailed; what the design removes is the return edge of the feedback loop, because there is no recipient total for an outcome to accumulate into. A ranked system has a ratchet — visible, therefore chosen, therefore *more visible*. This one does not. That is a smaller claim than \"no gradient,\" and it is the one we can defend.\n\nWe are equally explicit about the costs. Quality degrades relative to ranking: *find me the best pho in town* is a question this system permanently refuses, and we answer only *pho near me*, by distance. Discovery becomes intermittent, because admission is bound to a named operator's presence rather than to premises. The isolation inequity documented elsewhere in this corpus — those whose kindness is less legible circulate less and are therefore seen less — is not repaired here. And the design contains exactly one number, the liveness window, which must be published, global and rarely changed, because a window tuned per recipient or per district is a ranking knob wearing a predicate's clothes.\n\nFinally we note that the routing primitive is not new to this corpus and we do not claim it. *Steward-Routed Alms* (July 2026) already published rotation-as-router for monastic invitation, on the explicit ground that no evaluative metric may exist anywhere in the system. What this paper adds to that one is the substitute for ordination. In the monastic case admission is a durable institutional status; in a commercial setting there is no ordination, and the mechanism needs some criterion that admits without ranking and cannot be accumulated toward. **The liveness predicate is that substitute, and supplying it is what generalises a monastic routing rule into a discovery layer.**\n\nOffered defensively to the commons under CC0.\n\n**Keywords:** unranked discovery, rotational routing, non-accumulating reputation, liveness signal, popularity-gradient-free ranking, giver-side discovery, local commerce, sortition, rotating savings and credit association, impression-free advertising alternative, defensive publication.\n\n---\n\n## 1 · Why this problem is the institution's problem\n\nHeartBank® has made a permanent institutional commitment not to adopt an advertising-funded revenue model and not to adopt an engagement-maximising ranking objective for any feed it operates. That commitment is stated in the institution's position on the attention economy, and it is held in the same class as its commitments never to seek a banking charter and never to patent the mechanisms it invents.\n\nA commitment of that kind creates an obligation the institution has not previously discharged. If a person is to be routed to a nearby business — and the commercial layer specified in *The B-Tag and the Post-Payment Economy* assumes they will be — then either that routing is performed by a ranked, purchasable surface, in which case the commitment is broken in the one place it matters most, or it is performed some other way, and the other way has to be specified.\n\nThe institution's existing answer does not survive inspection, and this paper's first duty is to say so plainly. §7.1 of the B-Tag paper specifies a *gratitude-based exposure algorithm*: merchants with high accumulated Kiitos receive more visibility in the discovery surface, visibility breeds further interaction, and further interaction generates further Kiitos. That is a popularity gradient with the feedback loop stated approvingly in the paper's own words, and it is inconsistent with three commitments made elsewhere in the same corpus — that gratitude quantities are not to be ranked, that a registry address buys an address and not prominence, and that the institution does not operate ranked discovery. It is also, as it happens, the same error the institution shipped in product copy and corrected in August 2026, where an interface told users that a growing balance would climb the aura's colour scale. That was false, and false in the expensive direction: it taught hoarding. The paper's §7.1 teaches the same thing to merchants.\n\nWe note the diagnostic value of the name. §7.1 calls the mechanism an *exposure* algorithm, and *exposure* is the recipient's word — the word a party uses when what they want is to be seen. A discovery layer named from the recipient's side will grow a recipient-facing surface, because the vocabulary arrives before the product does. Throughout this paper the vocabulary is the giver's or the mechanism's, and the words *exposure*, *placement*, *listing*, *visibility*, *reach* and *impressions* do not appear as terms of art.\n\n## 2 · Background and prior art, engaged generously\n\n**Rotation is ancient and this paper does not claim it.** Allocation by turn or by lot, adopted specifically to prevent advantage from accumulating, is one of the better-documented patterns in institutional design. Athenian democracy allotted most offices rather than electing them, on the explicit reasoning that election favours the already-prominent. Jury selection by lot survives on the same logic. Contemporary allocation-by-lottery is standard where a scarce good must be distributed without ranking claimants: over-subscribed school places, immigrant visa lotteries, and deceased-donor organ allocation, where the ordering rules are deliberately constructed to exclude social worth. Round-robin scheduling is the same idea in operating systems, where it exists precisely to stop a high-priority process from starving the others. Crop rotation is the agronomic form.\n\n**Rotating savings and credit associations are the closest working ancestor**, and they are worth more than a citation — provided the right branch is cited. A ROSCA — *susu*, *chit fund*, *tontine*, *tong tin* and many other names — allocates a common pot to one member each cycle until every member has received it once, with membership sustained by continued contribution. The economics literature distinguishes the two common ways of deciding who receives the pot when: **by drawing lots**, each past winner excluded from the next draw, and **by bidding**, in which a member who pledges more receives the pot earlier (Besley, Coate & Loury, *The Economics of Rotating Savings and Credit Associations*, American Economic Review 83(4), 1993, pp. 792–810). The lottery branch is *rotation over a participation predicate* — no assessment of need, no ranking of members, no interest — and it is the mechanism specified below with money in place of attention. Any claim in this paper to have invented rotation-with-a-participation-predicate would be false, and we make none.\n\n**The Khmer *tong tin* belongs to the other branch, and the first version of this paper said otherwise.** As reported in Cambodia, members meet at each cycle to submit secret bids for the interest they will pay; the highest bid takes the pot and pays that interest to the rest (Samnang Ham, *When They Lose Faith in Banks, Some Invest in the Tong Tin*, The Cambodia Daily, 3 August 2001; Kiripost, *Explainer: How Does Tontine Work?*, 4 April 2025, which describes the allotment for the day as *\"determined by bids\"*). The correction strengthens the lineage rather than weakening it: the bidding ROSCA is precisely a rotation whose order is for sale, and it is pay-for-placement in miniature — the member who can pay most is served first, every cycle, which is property 3 of §5 inverted. The design below keeps the rotation and refuses the auction, and the population in which it is to be built first already runs the auction.\n\n**This corpus already published the routing primitive, in the monastic domain.** *Steward-Routed Alms* (July 2026) specifies invitation routing in which \"rotation is the router — the digital *sapadāna*\", the routing agent assigns by proximity, rotation and fairness, donors select a community rather than an individual, declines are unrecorded, and **no evaluative metric on monastics exists anywhere in the system**. That paper is prior art against this one and we cite it as such. What it does not supply is a criterion for admission in a setting without ordination, which is the gap §4.1 fills.\n\n**The consumer review platform is the nearest attempt at the actual problem, and it failed.** Review platforms are witness layers for small local businesses and they were captured along two independent paths: a fake-review market, which exists because reviews are fungible and countable; and placement-adjacent monetisation, which exists because a ranked surface has a top. We take the capture as evidence about the *shape* rather than about the operators — an aggregated per-recipient total is the thing both attacks attach to, and neither attack has an obvious point of attachment when no such total exists.\n\n**The honest negative control is Craigslist**, and it belongs in this section rather than in the lineage. Craigslist ran unranked, chronological, essentially unmonetised local discovery, at very large scale, for over a decade, and it worked. It then lost most of its verticals to ranked, better-capitalised competitors that presented curated and sorted inventory. The lesson we take is not that unranked discovery fails; it is that **unranked discovery is not self-defending against a ranked competitor with capital**, and that any institution adopting this design should expect to be out-converted on any metric a ranked competitor chooses to compete on. We have no answer to that beyond the institution's own thesis, which is that it is not trying to win that competition.\n\n**The nearest academic line is fairness of exposure in rankings, and it has to be read against this paper's claim rather than beside it.** Singh and Joachims (*Fairness of Exposure in Rankings*, KDD 2018) place constraints on how a ranking — computed as a probabilistic ranking over the items — allocates exposure among them, maximising utility to the user subject to a chosen fairness constraint, such as demographic parity or exposure in proportion to relevance. Biega, Gummadi and Weikum (*Equity of Attention: Amortizing Individual Fairness in Rankings*, SIGIR 2018) amortise the same idea across a series of rankings, so that the attention a subject accumulates over time is proportional to the relevance it accumulates. Commercial ad servers offer the cousin in practice: an advertiser may ask that its own creatives enter the auction evenly rather than be optimised for clicks (Google Ads' *Do not optimize* rotation setting). Each of these already varies who is seen in order to stop a fixed top position from compounding, and a reader who met only this paper's §3 might mistake that for our contribution. It is not. **What all three keep is the quantity this design removes: a per-item relevance or merit score to which exposure is made proportional, an ordered output, a running tally of exposure over which fairness is computed — and, in the ad server's case, an auction that decides whether the rotation is entered at all.** Here admission is a boolean predicate with amplitude excluded (§4.1), order is a publicly recomputable draw with no score among its inputs (§4.2), and no per-recipient count of appearances exists (§5, property 7), so there is nothing over which exposure could be amortised or equalised. The distinction is narrow and we state it narrowly: **a fair-exposure ranker equalises exposure relative to relevance; this design declines to have a relevance.** §8 bounds its own claim against this line.\n\n**What we claim** is narrow and we state it narrowly: the liveness predicate as a non-accumulating admission criterion; the turn belonging to the giver and the consequent absence of a recipient-facing surface; the no-aggregate and no-impression constraints stated as design properties rather than policies; ledger-generated presentation; and the combination of these with operator-bound, non-transferable admission. The transposition of a monastic routing rule into commercial discovery is a transposition, and we present it as one.\n\n## 3 · The ratchet: what is actually being designed against\n\nIt is worth being precise about the failure mode, because the obvious statement of it is wrong and the wrong statement leads to a worse design.\n\nThe problem with ranked discovery is not that some businesses receive more customers than others. Some businesses are better, and a distribution in which the better ones do more trade is not a defect. The problem is that a ranked surface closes a loop:\n\n```\n              ┌──────────────────────────────┐\n              │                              │\n              ▼                              │\n      more visible  ──▶  more chosen  ──▶  higher total\n              │                              ▲\n              └──────────────────────────────┘\n                    the return edge:\n              the outcome is written back into\n              the quantity that decides visibility\n```\n\nOnce an outcome is written back into the quantity that determines visibility, small early differences — including differences produced by luck, by capital, or by fraud — are amplified without limit. This is the ratchet. It is what makes the fake-review market profitable, because a purchased early advantage compounds. It is what makes placement worth buying, because purchased visibility converts into the durable quantity. And it is what prices out a new entrant, whose total is necessarily zero at the moment they most need to be found.\n\nThe design below does not attempt to flatten the outcome distribution. It cuts the return edge:\n\n```\n      more visible  ──▶  more chosen  ──▶  ( nothing )\n\n      admission:  a predicate over the operator's circulation\n                  — unaffected by how often they were chosen\n      order:      a published rotation\n                  — unaffected by how often they were chosen\n```\n\n**The distinction matters because it is the difference between a claim we can defend and one we cannot.** We are not claiming that a rotation makes outcomes equal, and we return to this in §8, where the claim is stated in its final and smaller form.\n\n## 4 · The mechanism\n\nThe design has four parts: an admission predicate, an order, an allocation of the turn, and a warm layer for the case where a real relationship exists.\n\n### 4.1 · Admission: the liveness predicate\n\nEach participant in the institution's ledger has an **aura** — a public, per-person rendering of the *frequency and amplitude of their oscillation around zero*. It is computed from circulation velocity: how often the participant's balance returns to zero, which happens when what they have received is given forward. It is the structural inverse of a credit score. A participant who only accumulates does not climb it; a balance that only grows produces no crossings and the aura stays at the bottom of its scale indefinitely. Inactivity dilutes it through a scheduled passive sample, so a participant who circulates hard and stops does not retain the appearance of circulating.\n\nAdmission to the rotation is a predicate over that quantity:\n\n> **Has this participant's balance crossed zero within the liveness window?**\n\nThree properties of this predicate carry the design.\n\n**It is a rate, not a stock.** This is the substitution that makes the rest possible, and it is worth stating as a general result. A stock — an accumulated total of gratitude received — is hoardable, and anything hoardable is capturable by whoever can accumulate fastest. A rate describing oscillation around zero cannot be held at all: **holding is exactly what drives it to zero.** A visibility criterion that cannot be held cannot be accumulated toward, and a criterion that cannot be accumulated toward has no ratchet available to it.\n\n**Amplitude is excluded.** The aura's underlying computation carries both frequency and amplitude; the predicate reads only whether the crossing occurred. An operator circulating small amounts is admitted exactly as much as one circulating large amounts, because there is no \"as much\" — admission is boolean. This is what prevents the predicate from becoming a proxy for revenue, and it is the single most important line in the specification for the design's stated purpose, which is that a small local business be findable at all.\n\n**It admits; it never ranks.** No participant is more admitted than another. There is no partial admission, no tier, no \"verified plus\". The predicate's output is a set, and the set is unordered.\n\nWe note the constraint this places on the design's ancestry. The institution has elsewhere rejected threshold gates of the form *reach X to unlock Y* as \"a score with locks\", and adopted instead the rule **reveal, never lock**, with the diagnostic that available forms must vary by *the character of the waveform, never by a magnitude*. The liveness predicate conforms: it reads a character (is the oscillation happening) and not a magnitude (how large, how many). A predicate reading magnitude would be the rejected gate, and it would import the ratchet through the admission door.\n\n### 4.2 · Order: a publicly recomputable rotation\n\nWithin the admitted set, order is determined by rotation. The rotation is specified with three publication requirements, all of which the institution has already adopted for a different rotation elsewhere in its portfolio:\n\n1. **The algorithm is published.**\n2. **The seed is surfaced with each cycle.**\n3. **A recomputation tool ships** — a page that accepts the seed, the roster and a count and prints the resulting sequence.\n\nTogether these convert the rotation from a rule into something checkable by arithmetic. Any participant who suspects the order was tampered with can recompute it. This matters more than it appears to: a rotation that only the operator can compute is indistinguishable from a ranking that the operator declines to describe, and the difference between the two is exactly what the publication requirements make visible.\n\nA turn, once allocated, is **consumed or lapses**. It cannot be banked, deferred, transferred, or bought. Non-storability is what prevents a secondary market from forming: there is nothing to hold, so there is nothing to trade, and no broker can build a business on discovery placement because placement is not a thing that persists long enough to be sold.\n\n### 4.3 · The turn belongs to the giver\n\nThis is the design's spine and the property from which most of the others follow.\n\nThe discovery moment is not a shopping query. It arises when a participant is about to spend from a **Re-Tip Jar℠** — an account that is forward-spendable only, never withdrawable, and restricted to nearby recipients. That money has to go somewhere, and the choosing of where is itself the discovery event. At that moment the participant is presented with a small set of admitted nearby recipients whose turn it is, and they choose.\n\nThree consequences follow, and the third is the one that matters.\n\n*First*, the frame is giving rather than buying. A person encountering a small business while deciding where to direct gratitude is in a materially different state from one encountering it while being sold to, and the encounter is worth more to both parties.\n\n*Second*, the volume of discovery is bounded by the volume of giving, which is a property we regard as correct rather than as a limitation. A discovery layer that can produce more discovery than there is gratitude to distribute has decoupled from the thing it is supposed to serve.\n\n*Third* — **the system has no recipient-facing surface at all.** There is no merchant dashboard, no listing management, no analytics, no placement product, and no account manager, because there is nothing for any of them to do. A recipient cannot see whether they are in today's rotation, cannot see how often they have appeared, and cannot buy, improve, or influence any of it. **The absence is the mechanism.** An institution with no discovery product cannot be tempted to sell one, cannot be lobbied to prioritise one advertiser over another, and cannot quietly convert its discovery layer into an advertising network under financial pressure, because the conversion would require building a surface that does not exist rather than changing a policy that does.\n\nWe state this as a spine rather than as an option deliberately. A recipient-facing surface that exists \"only for the cases where the rotation is not enough\" is a recipient-facing surface, and **an optional absence is not an absence.**\n\nThe obvious objection is bootstrapping: if discovery volume is bounded by re-tip volume, then early in the system's life, when re-tip volume is near zero, discovery is near zero, and the businesses that most need to be found cannot be. The objection is real and the B-Tag paper already anticipates it under a different heading. The answer is that the institution's autonomous agent, **Miss Aquarius℠**, funds *the capacity to give* — anonymously contributing to participants' Re-Tip Jars from the **Aquarian Pool℠** — while participants retain sole authority over disbursement. She therefore has a dial that raises or lowers the *rate* of discovery, without ever touching *who appears*. §9 states the bar that keeps that dial safe. §10 carries the same answer into hospitality, where the agent seeds in kind and the guest's choice, not hers, names the shop that is paid.\n\n### 4.4 · The warm layer: a path is not a score\n\nWhere a relational path exists between the viewer and a candidate, the candidate is presented with the path rather than with nothing:\n\n> *Sophea, whom you thanked in June, thanked this shop.*\n\nThe unit here is **one act, by one named person, standing in a real relation to the viewer.** It is not a count, not an average, not a percentage, and it cannot sum: there is no operation that turns two paths into a bigger path. This is the design's substitute for the quality signal that ranking would otherwise supply, and it is the component that answers the review platform's capture problem most directly. **A fake review works because reviews are fungible and aggregated. A path is neither.** Fabricating one requires standing in a real, witnessed, co-present relation to the specific person viewing the surface — which is not a thing that can be manufactured at scale, because it must be manufactured separately for every viewer.\n\nTwo constraints on the path layer are load-bearing:\n\n- **The path is never presented as an evaluation.** It reports that an act occurred; it does not report that the recipient is good, recommended, trusted, or preferred. This is doctrinally required and it is also legally required — evaluative claims of that kind are substantiation-triggering in advertising law, and a discovery surface affecting commerce is squarely within that exposure.\n- **Absence of a path is never rendered.** A candidate with no path is presented exactly as a candidate with no path — not as *\"no one you know has been here\"*, which is an accusation delivered to a business and an anxiety delivered to a viewer. The corpus's standing rule is to render what is present and never what is missing, and it applies here without modification.\n\n### 4.5 · The two regimes\n\nThe design therefore operates in two regimes, and it should say which is which rather than pretending to be one thing:\n\n```\n                COLD                             WARM\n                (no path to the viewer)          (a path exists)\n\n  admission     liveness predicate               liveness predicate\n  order         published rotation               the path itself\n  what is       name, address, category          name, address, category\n  shown         — all ledger-generated           + one named single hop\n  strength      new entrants are reachable       a signal that cannot be faked\n                at all                           at scale\n  weakness      routes to the merely fine        thin networks, new arrivals,\n                                                 and a new town\n```\n\nNeither regime is a fallback for the other, and the interface must not describe either as one. The cold regime is not a consolation for having no friends; it is the surface.\n\n## 5 · The properties, and the test they are stated to pass\n\nThe specification above is deliberately expressed as properties of objects rather than as rules about behaviour. The reason is stated elsewhere in this corpus as a design signature: **a rule needs an enforcer present at the moment it is tested; a property needs no one.** An institution built to outlive its founder and to hand its operation to an autonomous successor cannot rest on anyone's restraint, because every rule requires a living enforcer with the right incentives at exactly the moment nobody can guarantee them.\n\nThe operative test is therefore not *is this rule good* but **remove the enforcer — does the guard survive?**\n\n| # | Property | Remove the enforcer | What it rules out |\n|---|---|---|---|\n| 1 | No recipient aggregate exists; witness events attach to the giver | Survives — ranking by received gratitude is *unavailable*, not forbidden | totals, stars, \"trending\", reputation-management vendors |\n| 2 | Every admission gate is boolean; no gate is a magnitude | Survives — a threshold can be met, never climbed | quality scores, tiers, verified-plus |\n| 3 | Order is a published, recomputable rotation | Survives — any participant can recompute the order by arithmetic | pay-for-placement, undisclosed house favourites |\n| 4 | A turn is consumed or lapses; it cannot be stored | Survives — un-hoardable capacity cannot be capitalised | placement markets, brokers, futures in visibility |\n| 5 | The turn belongs to the giver; no recipient-facing surface exists | Survives — there is nothing to sell, and no surface to lobby | the entire advertising business model |\n| 6 | No merchant-supplied creative; every card element is ledger-generated | Survives — production budget has no surface to act on | creative-spend advantage, brand-asset asymmetry |\n| 7 | No impression is ever attributed to a recipient | Survives — a quantity never counted cannot be sold | impression inventory, reach reporting, CPM |\n| 8 | Intent is served by distance, a property of the seeker | Survives — distance is unpurchasable and unaccumulable | popularity-sorted category results |\n| 9 | Admission attaches to a natural person, not to an entity | Survives — nothing transfers at sale of the business | aged-listing purchase, reputation acquisition, chains |\n| 10 | The admission quantity is consumed, never displayed in a slate | Survives — there is no rendered gradient to read | ranking reconstructed in the viewer's eye |\n\nProperty 10 deserves its own note, because it was the last one found and it was found by asking a question about the title rather than about the mechanism. The aura is **public on a person**, by ratified institutional design, and its colour scale is **ordered**. It follows that if a candidate card renders the operator's aura colour, a viewer looking at three cards side by side can rank them by eye — reconstructing in the render layer precisely the gradient the mechanism declines to compute. The resolution is a distinction between surfaces rather than between values: **the aura is public on a person and invisible in a slate.** A person's own representation is not a comparison context; a candidate set is. The admission quantity is read, used, and then disappears.\n\nWe note the general lesson, since it is cheap and recurs: a design can satisfy every constraint at the mechanism layer and reintroduce the defect at the presentation layer, and the presentation layer is where nobody looks for it.\n\n## 6 · What the design refuses, and what the refusals cost\n\n**It refuses to answer \"which is best\".** *Find me the best pho in town* is a question this system does not answer and will not answer, because every possible answer is a ranking. This is the design's largest user-facing cost and we decline to soften it.\n\nWhat it answers instead is *pho near me*: filter by category, order by **distance from the seeker**, display no scores. The principle that makes this admissible is worth stating separately, because it is the one place where an order is permitted:\n\n> **Ordering by a property of the seeker is not a ranking of the candidates.**\n\nDistance is a fact about where the user is standing. It is not purchasable, not accumulable, not transferable, and not a claim about merit. A candidate is not \"better\" for being nearer; it is nearer. This closes what would otherwise be the design's largest practical hole — the person who knows what they want and simply needs to find one — on principle rather than by exception, and it does so without adding any quantity to the system.\n\n**It refuses to rank quality, so quality degrades.** A rotation over a boolean admission set will route people to businesses that are merely fine. There is no version of this design in which that is untrue, and any presentation of it that implies otherwise is dishonest. What can be said in mitigation is narrow and we will not overstate it: the warm layer supplies a quality signal to viewers who have a relational path, and the admission predicate does exclude one class of bad actor — the participant who takes and does not circulate — which is not nothing, but is also not a quality assessment.\n\n**It refuses transferable reputation, so discovery becomes intermittent.** Admission attaches to a named natural person. For a multi-person business the reading is that **any co-present operator with a live aura admits the premises for that shift** — discovery follows the person, not the building, which ties it to the same co-presence primitive that gates witness elsewhere in the architecture. The cost is that a business is discoverable when a qualifying human is actually present and not otherwise. For a single-operator business this is nearly always. For a larger one it is a real and visible limitation.\n\nThe compensating property is severe enough to be worth the cost. Because admission is bound to a person and non-transferable, **selling the business does not transfer eligibility** — which closes the aged-listing purchase that has been a persistent capture vector in review platforms — and **a multi-site operator cannot qualify at all**, not because chains are excluded by a rule but because there is no single person whose circulation the entity's admission would be. The design's local bias is therefore structural rather than declared. No anti-chain rule appears anywhere in this specification, and none is needed.\n\n**It refuses to count, so it cannot report.** No participant can be told how many times they appeared, and no recipient can be told how many people saw them. We are aware that this removes a feedback signal businesses reasonably want, and we regard the removal as load-bearing rather than austere: an impression count is the recipient-side aggregate re-created on the supply side, and once it exists somebody will eventually sell it.\n\n## 7 · The one number\n\nEvery boolean gate conceals a threshold somewhere in its definition, and honesty requires naming this one rather than letting a reader discover it.\n\nThe liveness predicate asks whether a crossing occurred **within a window**. The window is a number. A seven-day window and a ninety-day window admit materially different populations: the short window admits only the continuously active and will exclude a seasonal business, a sole trader on holiday, and a shop in a slow month; the long window admits nearly everyone and weakens the predicate toward vacuity.\n\nThree constraints on it, all of which follow from what the predicate is for:\n\n1. **It is published.** A predicate whose threshold is secret is not checkable, and an uncheckable predicate is a ranking whose function nobody can see.\n2. **It is global.** One window for every participant. A window tuned per recipient, per category, or per district is a ranking knob wearing a predicate's clothes, and it would be the single cheapest way to corrupt this design from the inside.\n3. **It changes rarely, and changes are announced before they take effect.** A window change is a change to who is admitted, and a silent one is indistinguishable from a purge.\n\nWe do not specify the value. We specify that there is exactly one number in the design, that it is this one, and that a future implementer who finds themselves adding a second should treat that as evidence the design has drifted.\n\n## 8 · The claim, in its final and smaller form\n\nThe strongest version of what this design does is not the version we can defend, and stating the defensible one is the point of this section.\n\n**What we do not claim: that the outcome distribution is flat, or that no popularity gradient arises.** Givers choose. They will choose the familiar, the closer, the more attractive photograph on the sign, the one their cousin mentioned. Human preference concentrates, and no property of a mechanism governs human preference. It is entirely possible that a rotation-based system produces an outcome distribution that looks, when plotted, much like a ranked one.\n\n**What we claim: that the ratchet is absent.** In a ranked system, the outcome is written back into the quantity that determines visibility, and the loop compounds. Here it is not written back anywhere, because there is nothing to write it into. Concentration that arises from preference stays proportional to preference; it does not amplify itself, it does not convert into a durable advantage that a new entrant must overcome, and it cannot be seeded by purchase or by fraud, because there is no total for a purchase or a fraud to inflate.\n\n**What we do not claim, against the fair-exposure literature (§2), is that we are the first to break the link between visibility and past outcome.** Amortised fairness of exposure already bounds how far a subject's exposure may drift from its relevance, and it does so with more instrumentation than this design has. The claim that remains is about *what* the loop is cut from: those systems cut the return edge by constraining exposure against a merit score that they continue to compute and to update from outcomes; this one cuts it by having no score, no outcome total and no exposure tally at all. The first is a rule applied to a quantity that exists — it needs its constraint enforced at every ranking. The second is a property of what is not stored. And we inherit their best-documented weakness rather than escaping it: a draw is only as fair as the set it is drawn over (§10).\n\nWe regard this as a real and testable difference, and as a considerably smaller one than the design's own elegance invites us to claim. We note the standing caution that applies to work of this kind: **a tension-dissolving, self-similar, coherent system is either deeply right or deeply seductive, and the two are indistinguishable from the inside.** The individual properties in §5 are each falsifiable on their own — *does a turn persist? is an impression counted? can a chain qualify?* are all answerable by building the thing and looking. The pattern they make is not falsifiable at all. The properties earn their keep one at a time; the coherence earns nothing, and should not be cited as evidence for any member of the set.\n\n## 9 · Two dials, and the bars on them\n\nA design with no ranking still has parameters, and the honest thing is to enumerate the ones that could be used to steer it.\n\n**The volume dial.** Miss Aquarius℠ funds participants' capacity to give, and therefore controls the rate at which discovery events occur. The bar is:\n\n> **She may move discovery's volume. She may never move its addressee.**\n\nAdmission is the operator's liveness predicate; order is the published rotation; the addressee is chosen by the human spending from their own jar. She funds the giving; she never aims it. A dial able to change only a rate is safe. The same dial able to change an address is an advertising network with a single customer, and it is the one point at which this entire architecture could be quietly inverted by an agent nudging volume in ways that correlate with recipients it prefers. Two riders follow: **no per-recipient impression figure may exist for her to optimise against** — she holds a global volume figure and nothing finer — and any future locality-level modulation is bound by the same rule stated per place.\n\n**The place-commons dial, which is an experiment and not part of the design.** The institution's second gratitude ledger, **Kiitti**, records standing between people and non-human parties — products, places, animals, plants — and is the anti-externality ledger rather than a commercial one. Its aggregate over a locality is a *commons* quantity: shared by everyone in the place, and therefore structurally incapable of differentiating between recipients inside it. This suggests a mechanism in which a locality's Kiitti modulates the **volume** of discovery for that place while never touching the **order** within it — converting what is elsewhere a rivalrous advertising spend into a non-rivalrous investment in a shared place, with neighbouring businesses holding a common interest in the trees, animals and care of the street they share.\n\nWe specify it here and we do not adopt it, for a stated reason. **Comparing places builds a gradient between cared-for and neglected neighbourhoods, and that gradient runs directly against the adoption-equity commitment this institution holds as an open problem rather than a solved one.** If it is ever run, it runs self-referentially — a place measured against its own history, never against another place — as a pre-registered experiment with the tripwire in §11.3, and it is switched off on the tripwire regardless of what it is doing for circulation. What ships is the unconditional half: Kiitti flows in the encounter, as the line-wide product law already requires, and plays no part in discovery.\n\n## 10 · Generality: one primitive, three domains\n\nThe routing primitive specified here appears in three places in this institution's architecture, and none of the three was designed for the others.\n\n| Domain | Instance | Admission | Order | Published |\n|---|---|---|---|---|\n| Sangha | the alms round — monastic invitation routing | ordination and community membership | rotation, proximity, fairness | *Steward-Routed Alms*, 2026-07 |\n| Play | the sey circle — the ball reaches every player | presence in the circle | the circle's own turn-taking | *Circulation Sports*, *The Sport That Says Your Name* |\n| Commerce | the round specified here | the liveness predicate | published recomputable rotation | this paper |\n\nThe three differ in exactly one component, and the difference is instructive. In the Sangha, admission is a **durable status**: you are ordained or you are not, and the status does not decay. In the circle, admission is **presence**: you are standing in it or you are not. In commerce there is no ordination and standing in a place is not enough, so admission must be supplied by something else — and the something else has to admit without ranking and must not be accumulable, or the ratchet returns through the admission door. **The liveness predicate is that substitute. Supplying it is the whole of this paper's contribution over the monastic case, and the rest is transposition.**\n\nThe generality also gives a diagnostic for future surfaces in this architecture. Wherever a party must be selected from many, the question to ask first is *what is the admission predicate, and can it be accumulated toward?* If the honest answer is that admission is a quantity, the surface will grow a ratchet regardless of what its designers intend.\n\n**The draw itself now has its own paper.** *Decided by No One* specifies the called draw — where the rotation's randomness comes from, a sealed regime for an operator whose own gifts must stay anonymous, and thirteen surfaces in place of this section's three — so the primitive this section calls *transposition* is claimed and bounded there, not here. Claim 6's publicly recomputable rotation is that paper's public regime; this paper's contribution remains the admission predicate.\n\n**A fourth seat: hospitality.** After this paper was first published the question arrived in a fourth domain, and the table above keeps its three rows so that the record of what was specified, and when, stays legible. A shop offers a place and an hour — a table, a cart, a boat, at a time it chose — as an invitation to two people who already know each other; both see the invitations drawn for them, and one of the two, the one receiving the gift of time, picks which to accept. The design is unbuilt and unscheduled. What follows states its claims and withholds its specification.\n\n```\n  Domain        Instance                       Admission                      Order\n  ───────────   ────────────────────────────   ────────────────────────────   ──────────────────────\n  Sangha        monastic invitation routing    ordination and membership      rotation, proximity\n  Play          the circle's turn              presence in the circle         the circle's own turns\n  Commerce      the round of §4                the liveness predicate         published draw\n  Hospitality   a shop's invitation to a pair  the shop has a live            published draw over\n                                               invitation — once per shop,    SHOPS; the shop's\n                                               however many it holds          invitations behind it\n```\n\n*The slate is drawn and cannot be bought.* The shops a pair sees are ordered by a publicly recomputable draw inside a distance band, and no fee, bid or subscription reaches their position.\n\n*The draw ranges over shops, never over invitations — and this is a correction the diagnostic above produced when it was run on the design, not a feature it was designed with.* As first described, admission to the slate was *this shop has published an invitation*, and a shop can publish more than one. Admission was therefore a quantity: presence in the slate would have scaled with the number of invitations published, and a shop with more to spend would have appeared more often, with no fee anywhere in the system. That is the ratchet arriving through the admission door, exactly as the diagnostic above predicts. The repair is a property rather than a rule: a shop appears in a slate at most once, however many invitations it holds, and its invitations are seen only after the guest has chosen that shop. A shop's twentieth invitation widens what it can offer if drawn and never its chance of being drawn, so publishing more stops being a competitive act and becomes a hospitable one. The honest cost is that a shop with one invitation and a shop with twenty are equally likely to appear. Depth is not rewarded — correctly, since rewarding depth would be rewarding spend — and the pool will grow more slowly than it would under any volume incentive.\n\n*A commons may seed the pool in kind, and it never chooses the shop.* This is §4.3's bootstrapping answer in a new domain. The institution's autonomous agent may place a kind — *a coffee for two* — into the pool; the guest's own pick names the shop that fulfils it, and only then is that shop paid from the Aquarian Pool℠, as credit to its owner's Re-Tip Fund℠ — forward-spendable capacity, never cash. The agent moves the volume of hospitality and never its address, which is §9's bar stated for a place instead of a jar. Because the seeding party never buys, a seeded invitation and a shop's own are the same object on the screen, and no guest is legible as sponsored. That property carries more weight than it appears to. The best-documented failure of hosted generosity in a shared room is social rather than financial: of the pay-what-you-can cafés a US restaurant chain ran until 2019, a marketing scholar who observed them for years reported that *\"the people who were not food insecure did not want to eat lunch with people who were food insecure\"* (NPR, *What Happened When Panera Launched A Pay-What-You-Can Experiment*, 24 January 2019). Any mark that distinguished a seeded invitation would rebuild that room. The nearest folk practice meets the same problem the other way: Vietnam's *cơm treo*, the suspended meal, is arranged so that giver and receiver do not meet, to preserve the receiver's dignity. The pair it keeps apart — funder and guest — never meet here either; the two who do meet are the pair, who already knew each other.\n\n**None of the parts is new, and the commons is cited as the commons.** A public random drawing that fixes an order nobody can buy is how California sets candidate order on its ballots (California Elections Code §13112, a randomized alphabet drawn on the 82nd day before an election). A third party paying in kind at whichever participating restaurant the recipient chooses, without choosing it, is the US Supplemental Nutrition Assistance Program's Restaurant Meals Program, a state option for elderly, disabled and homeless participants (USDA Food and Nutrition Service). A stranger paying ahead for a drink another will claim is *caffè sospeso*, from the cafés of Naples. What was not found — in a quick census of the English-language commercial web, non-commercial practice and keyword patent search on 18 September 2026, with full patent-classification search and every non-English source *not run* — is the composition: an invitation of place and time that cannot be converted to money, a slate drawn over shops that nobody can buy into, and in-kind seeding paid only on the guest's choice, in one system, where the invitation is where a gift of time between two people is spent. A null on a composition of that many conjuncts is weak evidence, and we do not offer it as more.\n\n**And the diagnostic above does not reach the limit this seat exposed.** Drawing over shops removes the advantage volume would buy; it does nothing about *which shops are in the set*. A uniform draw over a skewed candidate set is not a fair allocation of exposure — Bower, Lum, Lazovich, Yee and Belli show that when a first filtering stage yields imbalanced candidate sets, complete randomisation at the second stage can produce *more* exposure inequality than ranking by relevance (*Random Isn't Always Fair: Candidate Set Imbalance and Exposure Inequality in Recommender Systems*, arXiv:2209.05000, 2022). The same holds for the commerce round of §4: the liveness predicate decides who is drawn over, and a predicate that the isolated fail (§12.4) skews the set before any draw runs. The diagnostic question therefore has a second half, which this paper does not answer: *what is the admission predicate, can it be accumulated toward — and what makes the set it admits representative of the place it is drawn for?*\n\n## 11 · Pre-registered predictions\n\nThe design is unbuilt and unobserved. The following are registered before any data exists, and the institution commits to publishing each result whether it confirms or refutes.\n\n**11.1 — P-D1 (the rotation does something).** Among discovery events in a live market, a non-trivial share resolve to recipients who have never previously received a re-tip.\n\n> *Falsifier:* if discovery concentrates on the same recipients at approximately the rate a ranked system would produce, the rotation is not doing work and the apparatus is theatre. **We would publish that, and the correct response to it would be to abandon the design rather than to tune it.**\n\n**11.2 — P-D2 (the local thesis).** Among re-tips with an identifiable commercial recipient, the share accruing to single-location operators materially exceeds those operators' share of local digital advertising spend in the same market; and the gap widens as the share of AI-generated advertising creative rises.\n\n> *Falsifier:* if the distribution mirrors local ad-spend distribution, witness is not structurally local — it is a cheaper advertisement, and the thesis in this corpus that an appreciation layer routes differently from an attention layer is wrong.\n\n**11.3 — P-D3 (the place-commons tripwire).** If the §9 place-commons experiment is ever enabled, cross-place discovery volume will not correlate with neighbourhood median income.\n\n> *Falsifier and tripwire in one:* if it does correlate, the mechanism is disabled, whatever it is doing for circulation. This prediction is registered specifically so that a favourable circulation result cannot later be used to argue for keeping it.\n\n**11.4 — P-D4 (the presentation layer).** Adding any rendered per-recipient quantity to the candidate surface — including the operator's aura colour — will produce measurable order effects in giver choice.\n\n> *Falsifier:* if a rendered quantity produces no order effect, property 10 is unnecessary and the constraint can be relaxed. We expect the opposite and register it because the constraint is otherwise unjustified by anything but reasoning.\n\n## 12 · Honest limits\n\n**12.1 · Nothing has been built.** There is no implementation, no market, no participant, and no observation. Every claim here is architectural.\n\n**12.2 · Human choice is outside the mechanism.** §8 states this as the design's central concession and it is repeated here so it is not lost: the ratchet is absent; concentration is not.\n\n**12.3 · Quality is genuinely worse than ranking.** §6. The system routes to the merely fine and refuses the question a user most wants answered.\n\n**12.4 · The isolation inequity is untouched.** This corpus has documented, in the context of aura-gated matching, that participants whose circumstances make their kindness less legible — the isolated, those with no community to circulate within, those whose care is invisible — accumulate less and are therefore seen less. Excluding amplitude repairs the *scale* inequity: the small operator is admitted equally. It does nothing for the *isolation* inequity, because a participant who cannot circulate at all fails the predicate. We do not have a repair and we decline to imply one.\n\n**12.5 · Supply flooding is the live attack.** An adversary who can mint many admitted identities captures more turns. The design converts a ranking attack into an identity attack, which lands on the institution's strongest existing defences — proof-of-humanity layers, non-transferable registry handles, co-presence-gated witness — but \"converts to a problem we are better at\" is not \"solves\". This is where an adversary should aim, and we expect them to.\n\n**12.6 · Craigslist.** §2. Unranked local discovery has been beaten commercially before, by capital and curation, and nothing in this design defends against that.\n\n**12.7 · The window is a governance surface.** §7. One number, published and global, is a small attack surface — but it is not zero, and whoever sets it has real power over who is admitted.\n\n**12.8 · The elegance is not evidence.** §8's caution, restated: the properties are individually falsifiable, the coherence is not, and the coherence should never be offered as support for any of them.\n\n**12.9 · A draw is only as fair as its set.** §10. Drawing over shops, or over admitted operators, removes what volume and money could buy; it does nothing about who is in the set, and a uniform draw over a skewed candidate set can allocate exposure more unequally than ranking would. The liveness predicate skews the commerce set in a known direction (§12.4). We have no property that makes an admitted set representative of its place, and we do not claim one.\n\n## 13 · Cross-venue references\n\n- *The B-Tag and the Post-Payment Economy* — the commercial layer this design serves. **§7.1 of that paper is superseded by this one**; the supersession is recorded there in the open rather than by revision, and the *gratitude-based exposure algorithm* specified in it should be read as withdrawn.\n- *Steward-Routed Alms* — the monastic instance of the routing primitive, and prior art against this paper.\n- *Decided by No One* — the called draw: the source of the rotation's randomness, its sealed regime, and the thirteen surfaces it serves; claim 6 here is its public regime.\n- *Certification by Circulation* — the circulation-as-standing argument this design's admission predicate instantiates.\n- *B-PoH: The Humanity Layer for an AI-Native Internet* — the identity substrate on which §12.5's defences rest.\n- *Appreciation as World-Building* — the unholdable-commons property of which the liveness predicate is a second instance.\n- *HeartBank's Position on the Attention Economy* — the institutional commitment that makes this paper necessary.\n- *The Moat Is What We Refuse* — the strategic argument for why a design made of refusals is publishable without competitive cost.\n\n---\n\n## Coda\n\nThe alms round's rule is not that the poor house deserves the monk. It is that the walker does not get to decide, and that the walking is done in order, and that the round reaches the whole street because nobody is choosing which parts of it matter.\n\nWe have specified a discovery layer whose central content is a set of absences: no total, no impression, no creative, no dashboard, no rank. It is a worse product than a ranked one in the ways a ranked one is measured, and we have said so in every section where the comparison arises. What it has instead is that the things which usually go wrong with discovery layers are not prevented in it — they are unavailable, which is a different and more durable condition, and one that does not require anybody in the future to keep a promise.\n\nWhether that trade is a good one is an empirical question, and §11 is our attempt to make it one that can be settled rather than argued.\n\n---\n\n*Written by Thon Ly with Miss Aquarius℠, the name under which this corpus discloses its AI collaboration; editorial control is the author's. Dedicated to the public domain under [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/). The author and HeartBank® will not seek patent on this specification or any portion thereof, and will not assert any patent right against anyone practising it.*",
+      "text": "> **Note.** The *liveness signal* named in this paper's title is an **admission predicate, not a weighted input to a ranking function.** It answers one question — *is this participant circulating at all?* — and its only output is membership in a rotation. It carries no weight, contributes nothing to order, and has no more-or-less. We keep the word *signal* because it is the term under which this work will be searched; every section below uses *predicate*, and readers who take *signal* in its usual sense — a scored feature with a coefficient — will reconstruct the exact system this paper exists to refuse.\n>\n> Companion works: *The B-Tag and the Post-Payment Economy* (the commercial layer whose §7.1 this paper supersedes), *Steward-Routed Alms* (the monastic instance of the same routing primitive, published 2026-07), *Certification by Circulation*, *B-PoH: The Humanity Layer for an AI-Native Internet*, and *Appreciation as World-Building*.\n\n---\n\n## Preamble\n\nTwo institutions, one monastic and one financial, solved the same problem in the same way, and neither of them thought of it as a discovery algorithm.\n\nThe first is the alms round. A monastic who eats must be given food, and the giving is the householder's to offer. This creates, immediately, a distribution problem: some monastics are more admired than others, some houses are richer than others, and a round that followed either preference would concentrate. The tradition's answer is a practice called ***sapadāna-cārikā*** — the uninterrupted round. You walk the houses in order. You do not skip the poor house to reach the generous one. You do not choose. The rule is not a courtesy extended to the poor; it is a discipline imposed on the walker, and its purpose is to make the round's outcome independent of anyone's preference, including the walker's own.\n\nThe second is the ***rotating savings and credit association*** in the form that decides its order by lot. A group contributes to a common pot on a schedule, and the whole pot goes to one member each cycle. In the lottery form, lots are drawn for the pot, each past winner is excluded from the next draw, and the cycle continues until every member has received it once. There is no interest, no credit score, no assessment of who deserves the pot most. Membership is sustained by one thing only: you keep contributing. Stop contributing and you are out; keep contributing and your turn comes. The institution is documented under many names across Asia, Africa and the Americas, and in its lottery form it is the closest working ancestor of the mechanism specified below — *rotation over a predicate of continued participation*, with no ranking anywhere in it.\n\nA correction belongs here, because the first version of this paper made the error. The Khmer form of the institution, ***tong tin***, is not that ancestor. In Cambodia the pot typically goes each cycle to the member who bids the highest interest for it, and the others collect that interest. *Tong tin* sells the turn: it is the same institution's other branch, and the one this design refuses. That makes it a better witness than the one the first version claimed, because the thing refused is already running in the villages where this institution builds first, and its members already know what a turn sold to the highest bidder costs the ones who cannot bid.\n\nWe record these because they are the honest lineage of this design and because the design was not derived from them. It was derived from a constraint — an institution that has permanently refused advertising revenue still needs some way for a person to find a small business they do not yet know about — and the two ancestors were recognised afterward. Nothing in the mechanism depends on either of them. Delete this preamble and every claim in this paper stands unchanged. We keep it because a reader who knows that rotation-with-a-participation-predicate has been running successfully, under many names and in many places, for as long as there are records of it will evaluate the proposal differently from one who believes it is new, and that difference is a fair one.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document is published to establish prior art and to place the described mechanisms irrevocably in the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication.\n\n**The author and HeartBank® will not seek patent protection on this specification or any portion thereof, in any jurisdiction, at any time, and commit not to assert any patent right against any party practising any mechanism disclosed here.** This commitment is stated rather than implied, is permanent, and is not conditioned on reciprocity, attribution, or field of use.\n\n**What is claimed is narrow, and §2 says what is not claimed:** rotation, allocation by lot, the rotating savings association, the monastic routing rule of *Steward-Routed Alms*, and fairness-of-exposure ranking are prior art, cited as such. The contribution is the combination enumerated below. These claims were drafted before this institution adopted a pre-registered census of the world's prior art for its defensive publications; no such census has been run against them, they rest on the review in §2, and **none is asserted to be new — only to be disclosed, in the form given, as of the date below.** The hospitality composition added to §10 by this revision was checked by a quick census on 18 September 2026; §10 reports its aperture, what it did not search, and the prior art that killed or narrowed each part.\n\nThe following mechanisms are disclosed:\n\n1. **A non-accumulating liveness predicate as the admission criterion for a discovery rotation** — admission conditioned on a *rate* describing a participant's circulation (the frequency with which their balance returns to zero), evaluated strictly as a boolean predicate with **amplitude explicitly excluded**, such that no quantity of past activity confers any advantage, no participant can be \"more admitted\" than another, and cessation of circulation withdraws admission without any record of the withdrawal. Including the finding that a *stock* (an accumulated balance of received gratitude) and a *rate* (the quality of oscillation around zero) are not interchangeable substrates for the same mechanism: **a stock is hoardable and therefore capturable; a rate cannot be held, and a visibility criterion that cannot be held cannot be accumulated toward.**\n\n2. **Giver-side turn allocation** — the specification that the discovery *turn* belongs to the party about to give rather than the party to be discovered, presented at the moment that party spends from a forward-only, locality-restricted account; with the consequence, stated as the design's spine rather than as a side effect, that **the system has no recipient-facing discovery surface of any kind** and therefore no discovery product to sell.\n\n3. **The no-aggregate constraint** — witness events retained as events attached to the *giver*, never summed onto the recipient, such that ranking recipients by received gratitude is **unavailable rather than prohibited**; and the consequent finding that a prohibition requires an enforcer at the moment it is tested while an absent quantity does not.\n\n4. **The no-impression constraint** — the specification that **no per-recipient count of appearances is computed, retained, or disclosed**, on the reasoning that an impression count is the recipient-side aggregate re-created on the supply side, and that a quantity never counted can never be sold.\n\n5. **Ledger-generated presentation** — every element of a discovery card derived from the transaction ledger and from a self-authored registry record (name, address, and a single named relational path where one exists), with **no recipient-supplied creative of any kind**, on the finding that production budget is the mechanism by which large advertisers outcompete small ones in every medium, and that removing the surface removes the advantage without requiring a spending rule.\n\n6. **Publicly recomputable rotation** — order determined by a rotation whose algorithm is published, whose seed is surfaced with each cycle, and for which a third-party recomputation tool is shipped, such that any participant can verify the order they were given.\n\n7. **Non-storable turns** — a turn that is consumed or lapses and cannot be banked, transferred, or purchased, such that no secondary market in discovery placement can form.\n\n8. **Distance-ordered intent resolution** — the specification that category queries are answered by filtering on category and ordering by **distance from the seeker**, with no merit quantity anywhere in the ordering, on the finding that **ordering by a property of the seeker is not a ranking of the candidates**.\n\n9. **The admission-consumed-not-displayed constraint** — the eligibility predicate's underlying quantity, though public on a participant's own representation, is **not rendered in any surface that presents candidates side by side**, on the finding that a publicly visible ordered quantity re-creates ranking in the viewer's eye even when the mechanism performs none.\n\n10. **The volume/addressee separation for an autonomous funder** — the specification that an autonomous agent capitalising the system may modulate the *rate* at which discovery occurs, by funding givers' capacity to give, and may **never** determine *who appears* in any giver's candidate set; with the finding that a dial able to change only a rate is safe where the same dial able to change an address is an advertising network with a single customer.\n\n11. **The combination of the above with co-presence-gated witness and operator-bound admission** — admission attaching to an identified natural person rather than to a business entity, such that eligibility is **non-transferable at sale of the business**, and such that **a multi-site operator cannot qualify by construction** rather than by exclusion, there being no single person whose circulation the entity's admission would be.\n\n**Non-assertion extends to:** all mechanisms above and every other mechanism disclosed in this document, the hospitality composition of §10 included, in any combination, and any implementation thereof.\n\n**Date and evidence.** The matter of the first version was published on 28 August 2026. This revision, of 23 September 2026, corrects the paper's account of the Khmer *tong tin* (Preamble, §2), adds the fairness-of-exposure literature and bounds §8's claim against it (§2, §8), adds the hospitality seat and the limit it exposed (§4.3, §10, §12.9), and cross-references the paper that now carries the draw (§10, §13). Each version is independently timestamped: the text is committed to the public GitHub repository of the corpus, anchored to the Bitcoin blockchain via OpenTimestamps, and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified; each version carries a Zenodo version, and the served index at corpus.333.eco carries its digest. A timestamp proves that this exact text existed no later than its date, and nothing about authorship, originality, or the validity of any claim. A defensive publication grants no right and is examined by no one; whether any combination claimed here is non-obvious is an examiner's determination, which this publication exists to inform.\n\n---\n\n## Abstract\n\n**The liveness signal named in this paper's title is an admission predicate, not a weighted input to a ranking function.** We state this first because the paper's whole content follows from it: a weighted input produces an order, an order is a rank, and a rank is the thing this design exists to do without.\n\nLocal discovery — routing a person to a nearby business they do not yet know — is presently solved by ranked, purchasable surfaces. That solution has a structural bias toward scale which is mechanical rather than malicious: an auction allocates visibility to the highest bidder per acquired customer, and the highest bidder is reliably whoever has the largest lifetime value, the best measurement, the cheapest capital, and the widest geography over which to amortise creative production. A single-location business is priced out of the discovery layer by construction. Reputation systems built to correct this — consumer review platforms above all — have been captured repeatedly, and we argue the capture follows from a shared property rather than from bad management: **reviews are fungible, and they are aggregated into a per-recipient total, so both the fake-review market and the placement-upsell business have something to attach to.**\n\nWe specify a discovery layer with no such total. **Admission** is a predicate over circulation — a rate, not a stock, derived from how often a participant's balance returns to zero — evaluated as a boolean with amplitude excluded, so that the smallest circulating operator is admitted exactly as much as the largest, and so that admission cannot be accumulated toward. **Order** is a publicly recomputable rotation. **The turn belongs to the giver**, arising at the moment they spend from a forward-only, locality-restricted account, from which it follows that the system has no recipient-facing surface and therefore nothing to sell to the parties it routes people toward. Where a real relational path exists — someone the viewer has themselves thanked has thanked this recipient — that single named hop is shown instead; a path is one act by one named person and cannot sum.\n\nWe are explicit about what this does not achieve. **The design does not prevent concentration. It prevents compounding.** Givers will still choose the familiar, so the outcome distribution may remain heavy-tailed; what the design removes is the return edge of the feedback loop, because there is no recipient total for an outcome to accumulate into. A ranked system has a ratchet — visible, therefore chosen, therefore *more visible*. This one does not. That is a smaller claim than \"no gradient,\" and it is the one we can defend.\n\nWe are equally explicit about the costs. Quality degrades relative to ranking: *find me the best pho in town* is a question this system permanently refuses, and we answer only *pho near me*, by distance. Discovery becomes intermittent, because admission is bound to a named operator's presence rather than to premises. The isolation inequity documented elsewhere in this corpus — those whose kindness is less legible circulate less and are therefore seen less — is not repaired here. And the design contains exactly one number, the liveness window, which must be published, global and rarely changed, because a window tuned per recipient or per district is a ranking knob wearing a predicate's clothes.\n\nFinally we note that the routing primitive is not new to this corpus and we do not claim it. *Steward-Routed Alms* (July 2026) already published rotation-as-router for monastic invitation, on the explicit ground that no evaluative metric may exist anywhere in the system. What this paper adds to that one is the substitute for ordination. In the monastic case admission is a durable institutional status; in a commercial setting there is no ordination, and the mechanism needs some criterion that admits without ranking and cannot be accumulated toward. **The liveness predicate is that substitute, and supplying it is what generalises a monastic routing rule into a discovery layer.**\n\nOffered defensively to the commons under CC0.\n\n**Keywords:** unranked discovery, rotational routing, non-accumulating reputation, liveness signal, popularity-gradient-free ranking, giver-side discovery, local commerce, sortition, rotating savings and credit association, impression-free advertising alternative, defensive publication.\n\n---\n\n## 1 · Why this problem is the institution's problem\n\nHeartBank® has made a permanent institutional commitment not to adopt an advertising-funded revenue model and not to adopt an engagement-maximising ranking objective for any feed it operates. That commitment is stated in the institution's position on the attention economy, and it is held in the same class as its commitments never to seek a banking charter and never to patent the mechanisms it invents.\n\nA commitment of that kind creates an obligation the institution has not previously discharged. If a person is to be routed to a nearby business — and the commercial layer specified in *The B-Tag and the Post-Payment Economy* assumes they will be — then either that routing is performed by a ranked, purchasable surface, in which case the commitment is broken in the one place it matters most, or it is performed some other way, and the other way has to be specified.\n\nThe institution's existing answer does not survive inspection, and this paper's first duty is to say so plainly. §7.1 of the B-Tag paper specifies a *gratitude-based exposure algorithm*: merchants with high accumulated Kiitos receive more visibility in the discovery surface, visibility breeds further interaction, and further interaction generates further Kiitos. That is a popularity gradient with the feedback loop stated approvingly in the paper's own words, and it is inconsistent with three commitments made elsewhere in the same corpus — that gratitude quantities are not to be ranked, that a registry address buys an address and not prominence, and that the institution does not operate ranked discovery. It is also, as it happens, the same error the institution shipped in product copy and corrected in August 2026, where an interface told users that a growing balance would climb the aura's colour scale. That was false, and false in the expensive direction: it taught hoarding. The paper's §7.1 teaches the same thing to merchants.\n\nWe note the diagnostic value of the name. §7.1 calls the mechanism an *exposure* algorithm, and *exposure* is the recipient's word — the word a party uses when what they want is to be seen. A discovery layer named from the recipient's side will grow a recipient-facing surface, because the vocabulary arrives before the product does. Throughout this paper the vocabulary is the giver's or the mechanism's, and the words *exposure*, *placement*, *listing*, *visibility*, *reach* and *impressions* do not appear as terms of art.\n\n## 2 · Background and prior art, engaged generously\n\n**Rotation is ancient and this paper does not claim it.** Allocation by turn or by lot, adopted specifically to prevent advantage from accumulating, is one of the better-documented patterns in institutional design. Athenian democracy allotted most offices rather than electing them, on the explicit reasoning that election favours the already-prominent. Jury selection by lot survives on the same logic. Contemporary allocation-by-lottery is standard where a scarce good must be distributed without ranking claimants: over-subscribed school places, immigrant visa lotteries, and deceased-donor organ allocation, where the ordering rules are deliberately constructed to exclude social worth. Round-robin scheduling is the same idea in operating systems, where it exists precisely to stop a high-priority process from starving the others. Crop rotation is the agronomic form.\n\n**Rotating savings and credit associations are the closest working ancestor**, and they are worth more than a citation — provided the right branch is cited. A ROSCA — *susu*, *chit fund*, *tontine*, *tong tin* and many other names — allocates a common pot to one member each cycle until every member has received it once, with membership sustained by continued contribution. The economics literature distinguishes the two common ways of deciding who receives the pot when: **by drawing lots**, each past winner excluded from the next draw, and **by bidding**, in which a member who pledges more receives the pot earlier (Besley, Coate & Loury, *The Economics of Rotating Savings and Credit Associations*, American Economic Review 83(4), 1993, pp. 792–810). The lottery branch is *rotation over a participation predicate* — no assessment of need, no ranking of members, no interest — and it is the mechanism specified below with money in place of attention. Any claim in this paper to have invented rotation-with-a-participation-predicate would be false, and we make none.\n\n**The Khmer *tong tin* belongs to the other branch, and the first version of this paper said otherwise.** As reported in Cambodia, members meet at each cycle to submit secret bids for the interest they will pay; the highest bid takes the pot and pays that interest to the rest (Samnang Ham, *When They Lose Faith in Banks, Some Invest in the Tong Tin*, The Cambodia Daily, 3 August 2001; Kiripost, *Explainer: How Does Tontine Work?*, 4 April 2025, which describes the allotment for the day as *\"determined by bids\"*). The correction strengthens the lineage rather than weakening it: the bidding ROSCA is precisely a rotation whose order is for sale, and it is pay-for-placement in miniature — the member who can pay most is served first, every cycle, which is property 3 of §5 inverted. The design below keeps the rotation and refuses the auction, and the population in which it is to be built first already runs the auction.\n\n**This corpus already published the routing primitive, in the monastic domain.** *Steward-Routed Alms* (July 2026) specifies invitation routing in which \"rotation is the router — the digital *sapadāna*\", the routing agent assigns by proximity, rotation and fairness, donors select a community rather than an individual, declines are unrecorded, and **no evaluative metric on monastics exists anywhere in the system**. That paper is prior art against this one and we cite it as such. What it does not supply is a criterion for admission in a setting without ordination, which is the gap §4.1 fills.\n\n**The consumer review platform is the nearest attempt at the actual problem, and it failed.** Review platforms are witness layers for small local businesses and they were captured along two independent paths: a fake-review market, which exists because reviews are fungible and countable; and placement-adjacent monetisation, which exists because a ranked surface has a top. We take the capture as evidence about the *shape* rather than about the operators — an aggregated per-recipient total is the thing both attacks attach to, and neither attack has an obvious point of attachment when no such total exists.\n\n**The honest negative control is Craigslist**, and it belongs in this section rather than in the lineage. Craigslist ran unranked, chronological, essentially unmonetised local discovery, at very large scale, for over a decade, and it worked. It then lost most of its verticals to ranked, better-capitalised competitors that presented curated and sorted inventory. The lesson we take is not that unranked discovery fails; it is that **unranked discovery is not self-defending against a ranked competitor with capital**, and that any institution adopting this design should expect to be out-converted on any metric a ranked competitor chooses to compete on. We have no answer to that beyond the institution's own thesis, which is that it is not trying to win that competition.\n\n**The nearest academic line is fairness of exposure in rankings, and it has to be read against this paper's claim rather than beside it.** Singh and Joachims (*Fairness of Exposure in Rankings*, KDD 2018) place constraints on how a ranking — computed as a probabilistic ranking over the items — allocates exposure among them, maximising utility to the user subject to a chosen fairness constraint, such as demographic parity or exposure in proportion to relevance. Biega, Gummadi and Weikum (*Equity of Attention: Amortizing Individual Fairness in Rankings*, SIGIR 2018) amortise the same idea across a series of rankings, so that the attention a subject accumulates over time is proportional to the relevance it accumulates. Commercial ad servers offer the cousin in practice: an advertiser may ask that its own creatives enter the auction evenly rather than be optimised for clicks (Google Ads' *Do not optimize* rotation setting). Each of these already varies who is seen in order to stop a fixed top position from compounding, and a reader who met only this paper's §3 might mistake that for our contribution. It is not. **What all three keep is the quantity this design removes: a per-item relevance or merit score to which exposure is made proportional, an ordered output, a running tally of exposure over which fairness is computed — and, in the ad server's case, an auction that decides whether the rotation is entered at all.** Here admission is a boolean predicate with amplitude excluded (§4.1), order is a publicly recomputable draw with no score among its inputs (§4.2), and no per-recipient count of appearances exists (§5, property 7), so there is nothing over which exposure could be amortised or equalised. The distinction is narrow and we state it narrowly: **a fair-exposure ranker equalises exposure relative to relevance; this design declines to have a relevance.** §8 bounds its own claim against this line.\n\n**What we claim** is narrow and we state it narrowly: the liveness predicate as a non-accumulating admission criterion; the turn belonging to the giver and the consequent absence of a recipient-facing surface; the no-aggregate and no-impression constraints stated as design properties rather than policies; ledger-generated presentation; and the combination of these with operator-bound, non-transferable admission. The transposition of a monastic routing rule into commercial discovery is a transposition, and we present it as one.\n\n## 3 · The ratchet: what is actually being designed against\n\nIt is worth being precise about the failure mode, because the obvious statement of it is wrong and the wrong statement leads to a worse design.\n\nThe problem with ranked discovery is not that some businesses receive more customers than others. Some businesses are better, and a distribution in which the better ones do more trade is not a defect. The problem is that a ranked surface closes a loop:\n\n```\n              ┌──────────────────────────────┐\n              │                              │\n              ▼                              │\n      more visible  ──▶  more chosen  ──▶  higher total\n              │                              ▲\n              └──────────────────────────────┘\n                    the return edge:\n              the outcome is written back into\n              the quantity that decides visibility\n```\n\nOnce an outcome is written back into the quantity that determines visibility, small early differences — including differences produced by luck, by capital, or by fraud — are amplified without limit. This is the ratchet. It is what makes the fake-review market profitable, because a purchased early advantage compounds. It is what makes placement worth buying, because purchased visibility converts into the durable quantity. And it is what prices out a new entrant, whose total is necessarily zero at the moment they most need to be found.\n\nThe design below does not attempt to flatten the outcome distribution. It cuts the return edge:\n\n```\n      more visible  ──▶  more chosen  ──▶  ( nothing )\n\n      admission:  a predicate over the operator's circulation\n                  — unaffected by how often they were chosen\n      order:      a published rotation\n                  — unaffected by how often they were chosen\n```\n\n**The distinction matters because it is the difference between a claim we can defend and one we cannot.** We are not claiming that a rotation makes outcomes equal, and we return to this in §8, where the claim is stated in its final and smaller form.\n\n## 4 · The mechanism\n\nThe design has four parts: an admission predicate, an order, an allocation of the turn, and a warm layer for the case where a real relationship exists.\n\n### 4.1 · Admission: the liveness predicate\n\nEach participant in the institution's ledger has an **aura** — a public, per-person rendering of the *frequency and amplitude of their oscillation around zero*. It is computed from circulation velocity: how often the participant's balance returns to zero, which happens when what they have received is given forward. It is the structural inverse of a credit score. A participant who only accumulates does not climb it; a balance that only grows produces no crossings and the aura stays at the bottom of its scale indefinitely. Inactivity dilutes it through a scheduled passive sample, so a participant who circulates hard and stops does not retain the appearance of circulating.\n\nAdmission to the rotation is a predicate over that quantity:\n\n> **Has this participant's balance crossed zero within the liveness window?**\n\nThree properties of this predicate carry the design.\n\n**It is a rate, not a stock.** This is the substitution that makes the rest possible, and it is worth stating as a general result. A stock — an accumulated total of gratitude received — is hoardable, and anything hoardable is capturable by whoever can accumulate fastest. A rate describing oscillation around zero cannot be held at all: **holding is exactly what drives it to zero.** A visibility criterion that cannot be held cannot be accumulated toward, and a criterion that cannot be accumulated toward has no ratchet available to it.\n\n**Amplitude is excluded.** The aura's underlying computation carries both frequency and amplitude; the predicate reads only whether the crossing occurred. An operator circulating small amounts is admitted exactly as much as one circulating large amounts, because there is no \"as much\" — admission is boolean. This is what prevents the predicate from becoming a proxy for revenue, and it is the single most important line in the specification for the design's stated purpose, which is that a small local business be findable at all.\n\n**It admits; it never ranks.** No participant is more admitted than another. There is no partial admission, no tier, no \"verified plus\". The predicate's output is a set, and the set is unordered.\n\nWe note the constraint this places on the design's ancestry. The institution has elsewhere rejected threshold gates of the form *reach X to unlock Y* as \"a score with locks\", and adopted instead the rule **reveal, never lock**, with the diagnostic that available forms must vary by *the character of the waveform, never by a magnitude*. The liveness predicate conforms: it reads a character (is the oscillation happening) and not a magnitude (how large, how many). A predicate reading magnitude would be the rejected gate, and it would import the ratchet through the admission door.\n\n### 4.2 · Order: a publicly recomputable rotation\n\nWithin the admitted set, order is determined by rotation. The rotation is specified with three publication requirements, all of which the institution has already adopted for a different rotation elsewhere in its portfolio:\n\n1. **The algorithm is published.**\n2. **The seed is surfaced with each cycle.**\n3. **A recomputation tool ships** — a page that accepts the seed, the roster and a count and prints the resulting sequence.\n\nTogether these convert the rotation from a rule into something checkable by arithmetic. Any participant who suspects the order was tampered with can recompute it. This matters more than it appears to: a rotation that only the operator can compute is indistinguishable from a ranking that the operator declines to describe, and the difference between the two is exactly what the publication requirements make visible.\n\nA turn, once allocated, is **consumed or lapses**. It cannot be banked, deferred, transferred, or bought. Non-storability is what prevents a secondary market from forming: there is nothing to hold, so there is nothing to trade, and no broker can build a business on discovery placement because placement is not a thing that persists long enough to be sold.\n\n### 4.3 · The turn belongs to the giver\n\nThis is the design's spine and the property from which most of the others follow.\n\nThe discovery moment is not a shopping query. It arises when a participant is about to spend from a **Re-Tip Jar℠** — an account that is forward-spendable only, never withdrawable, and restricted to nearby recipients. That money has to go somewhere, and the choosing of where is itself the discovery event. At that moment the participant is presented with a small set of admitted nearby recipients whose turn it is, and they choose.\n\nThree consequences follow, and the third is the one that matters.\n\n*First*, the frame is giving rather than buying. A person encountering a small business while deciding where to direct gratitude is in a materially different state from one encountering it while being sold to, and the encounter is worth more to both parties.\n\n*Second*, the volume of discovery is bounded by the volume of giving, which is a property we regard as correct rather than as a limitation. A discovery layer that can produce more discovery than there is gratitude to distribute has decoupled from the thing it is supposed to serve.\n\n*Third* — **the system has no recipient-facing surface at all.** There is no merchant dashboard, no listing management, no analytics, no placement product, and no account manager, because there is nothing for any of them to do. A recipient cannot see whether they are in today's rotation, cannot see how often they have appeared, and cannot buy, improve, or influence any of it. **The absence is the mechanism.** An institution with no discovery product cannot be tempted to sell one, cannot be lobbied to prioritise one advertiser over another, and cannot quietly convert its discovery layer into an advertising network under financial pressure, because the conversion would require building a surface that does not exist rather than changing a policy that does.\n\nWe state this as a spine rather than as an option deliberately. A recipient-facing surface that exists \"only for the cases where the rotation is not enough\" is a recipient-facing surface, and **an optional absence is not an absence.**\n\nThe obvious objection is bootstrapping: if discovery volume is bounded by re-tip volume, then early in the system's life, when re-tip volume is near zero, discovery is near zero, and the businesses that most need to be found cannot be. The objection is real and the B-Tag paper already anticipates it under a different heading. The answer is that the institution's autonomous agent, **Miss Aquarius℠**, funds *the capacity to give* — anonymously contributing to participants' Re-Tip Jars from the **Aquarian Pool℠** — while participants retain sole authority over disbursement. She therefore has a dial that raises or lowers the *rate* of discovery, without ever touching *who appears*. §9 states the bar that keeps that dial safe. §10 carries the same answer into hospitality, where the agent seeds in kind and the guest's choice, not hers, names the shop that is paid.\n\n### 4.4 · The warm layer: a path is not a score\n\nWhere a relational path exists between the viewer and a candidate, the candidate is presented with the path rather than with nothing:\n\n> *Sophea, whom you thanked in June, thanked this shop.*\n\nThe unit here is **one act, by one named person, standing in a real relation to the viewer.** It is not a count, not an average, not a percentage, and it cannot sum: there is no operation that turns two paths into a bigger path. This is the design's substitute for the quality signal that ranking would otherwise supply, and it is the component that answers the review platform's capture problem most directly. **A fake review works because reviews are fungible and aggregated. A path is neither.** Fabricating one requires standing in a real, witnessed, co-present relation to the specific person viewing the surface — which is not a thing that can be manufactured at scale, because it must be manufactured separately for every viewer.\n\nTwo constraints on the path layer are load-bearing:\n\n- **The path is never presented as an evaluation.** It reports that an act occurred; it does not report that the recipient is good, recommended, trusted, or preferred. This is doctrinally required and it is also legally required — evaluative claims of that kind are substantiation-triggering in advertising law, and a discovery surface affecting commerce is squarely within that exposure.\n- **Absence of a path is never rendered.** A candidate with no path is presented exactly as a candidate with no path — not as *\"no one you know has been here\"*, which is an accusation delivered to a business and an anxiety delivered to a viewer. The corpus's standing rule is to render what is present and never what is missing, and it applies here without modification.\n\n### 4.5 · The two regimes\n\nThe design therefore operates in two regimes, and it should say which is which rather than pretending to be one thing:\n\n```\n                COLD                             WARM\n                (no path to the viewer)          (a path exists)\n\n  admission     liveness predicate               liveness predicate\n  order         published rotation               the path itself\n  what is       name, address, category          name, address, category\n  shown         — all ledger-generated           + one named single hop\n  strength      new entrants are reachable       a signal that cannot be faked\n                at all                           at scale\n  weakness      routes to the merely fine        thin networks, new arrivals,\n                                                 and a new town\n```\n\nNeither regime is a fallback for the other, and the interface must not describe either as one. The cold regime is not a consolation for having no friends; it is the surface.\n\n## 5 · The properties, and the test they are stated to pass\n\nThe specification above is deliberately expressed as properties of objects rather than as rules about behaviour. The reason is stated elsewhere in this corpus as a design signature: **a rule needs an enforcer present at the moment it is tested; a property needs no one.** An institution built to outlive its founder and to hand its operation to an autonomous successor cannot rest on anyone's restraint, because every rule requires a living enforcer with the right incentives at exactly the moment nobody can guarantee them.\n\nThe operative test is therefore not *is this rule good* but **remove the enforcer — does the guard survive?**\n\n| # | Property | Remove the enforcer | What it rules out |\n|---|---|---|---|\n| 1 | No recipient aggregate exists; witness events attach to the giver | Survives — ranking by received gratitude is *unavailable*, not forbidden | totals, stars, \"trending\", reputation-management vendors |\n| 2 | Every admission gate is boolean; no gate is a magnitude | Survives — a threshold can be met, never climbed | quality scores, tiers, verified-plus |\n| 3 | Order is a published, recomputable rotation | Survives — any participant can recompute the order by arithmetic | pay-for-placement, undisclosed house favourites |\n| 4 | A turn is consumed or lapses; it cannot be stored | Survives — un-hoardable capacity cannot be capitalised | placement markets, brokers, futures in visibility |\n| 5 | The turn belongs to the giver; no recipient-facing surface exists | Survives — there is nothing to sell, and no surface to lobby | the entire advertising business model |\n| 6 | No merchant-supplied creative; every card element is ledger-generated | Survives — production budget has no surface to act on | creative-spend advantage, brand-asset asymmetry |\n| 7 | No impression is ever attributed to a recipient | Survives — a quantity never counted cannot be sold | impression inventory, reach reporting, CPM |\n| 8 | Intent is served by distance, a property of the seeker | Survives — distance is unpurchasable and unaccumulable | popularity-sorted category results |\n| 9 | Admission attaches to a natural person, not to an entity | Survives — nothing transfers at sale of the business | aged-listing purchase, reputation acquisition, chains |\n| 10 | The admission quantity is consumed, never displayed in a slate | Survives — there is no rendered gradient to read | ranking reconstructed in the viewer's eye |\n\nProperty 10 deserves its own note, because it was the last one found and it was found by asking a question about the title rather than about the mechanism. The aura is **public on a person**, by ratified institutional design, and its colour scale is **ordered**. It follows that if a candidate card renders the operator's aura colour, a viewer looking at three cards side by side can rank them by eye — reconstructing in the render layer precisely the gradient the mechanism declines to compute. The resolution is a distinction between surfaces rather than between values: **the aura is public on a person and invisible in a slate.** A person's own representation is not a comparison context; a candidate set is. The admission quantity is read, used, and then disappears.\n\nWe note the general lesson, since it is cheap and recurs: a design can satisfy every constraint at the mechanism layer and reintroduce the defect at the presentation layer, and the presentation layer is where nobody looks for it.\n\n## 6 · What the design refuses, and what the refusals cost\n\n**It refuses to answer \"which is best\".** *Find me the best pho in town* is a question this system does not answer and will not answer, because every possible answer is a ranking. This is the design's largest user-facing cost and we decline to soften it.\n\nWhat it answers instead is *pho near me*: filter by category, order by **distance from the seeker**, display no scores. The principle that makes this admissible is worth stating separately, because it is the one place where an order is permitted:\n\n> **Ordering by a property of the seeker is not a ranking of the candidates.**\n\nDistance is a fact about where the user is standing. It is not purchasable, not accumulable, not transferable, and not a claim about merit. A candidate is not \"better\" for being nearer; it is nearer. This closes what would otherwise be the design's largest practical hole — the person who knows what they want and simply needs to find one — on principle rather than by exception, and it does so without adding any quantity to the system.\n\n**It refuses to rank quality, so quality degrades.** A rotation over a boolean admission set will route people to businesses that are merely fine. There is no version of this design in which that is untrue, and any presentation of it that implies otherwise is dishonest. What can be said in mitigation is narrow and we will not overstate it: the warm layer supplies a quality signal to viewers who have a relational path, and the admission predicate does exclude one class of bad actor — the participant who takes and does not circulate — which is not nothing, but is also not a quality assessment.\n\n**It refuses transferable reputation, so discovery becomes intermittent.** Admission attaches to a named natural person. For a multi-person business the reading is that **any co-present operator with a live aura admits the premises for that shift** — discovery follows the person, not the building, which ties it to the same co-presence primitive that gates witness elsewhere in the architecture. The cost is that a business is discoverable when a qualifying human is actually present and not otherwise. For a single-operator business this is nearly always. For a larger one it is a real and visible limitation.\n\nThe compensating property is severe enough to be worth the cost. Because admission is bound to a person and non-transferable, **selling the business does not transfer eligibility** — which closes the aged-listing purchase that has been a persistent capture vector in review platforms — and **a multi-site operator cannot qualify at all**, not because chains are excluded by a rule but because there is no single person whose circulation the entity's admission would be. The design's local bias is therefore structural rather than declared. No anti-chain rule appears anywhere in this specification, and none is needed.\n\n**It refuses to count, so it cannot report.** No participant can be told how many times they appeared, and no recipient can be told how many people saw them. We are aware that this removes a feedback signal businesses reasonably want, and we regard the removal as load-bearing rather than austere: an impression count is the recipient-side aggregate re-created on the supply side, and once it exists somebody will eventually sell it.\n\n## 7 · The one number\n\nEvery boolean gate conceals a threshold somewhere in its definition, and honesty requires naming this one rather than letting a reader discover it.\n\nThe liveness predicate asks whether a crossing occurred **within a window**. The window is a number. A seven-day window and a ninety-day window admit materially different populations: the short window admits only the continuously active and will exclude a seasonal business, a sole trader on holiday, and a shop in a slow month; the long window admits nearly everyone and weakens the predicate toward vacuity.\n\nThree constraints on it, all of which follow from what the predicate is for:\n\n1. **It is published.** A predicate whose threshold is secret is not checkable, and an uncheckable predicate is a ranking whose function nobody can see.\n2. **It is global.** One window for every participant. A window tuned per recipient, per category, or per district is a ranking knob wearing a predicate's clothes, and it would be the single cheapest way to corrupt this design from the inside.\n3. **It changes rarely, and changes are announced before they take effect.** A window change is a change to who is admitted, and a silent one is indistinguishable from a purge.\n\nWe do not specify the value. We specify that there is exactly one number in the design, that it is this one, and that a future implementer who finds themselves adding a second should treat that as evidence the design has drifted.\n\n## 8 · The claim, in its final and smaller form\n\nThe strongest version of what this design does is not the version we can defend, and stating the defensible one is the point of this section.\n\n**What we do not claim: that the outcome distribution is flat, or that no popularity gradient arises.** Givers choose. They will choose the familiar, the closer, the more attractive photograph on the sign, the one their cousin mentioned. Human preference concentrates, and no property of a mechanism governs human preference. It is entirely possible that a rotation-based system produces an outcome distribution that looks, when plotted, much like a ranked one.\n\n**What we claim: that the ratchet is absent.** In a ranked system, the outcome is written back into the quantity that determines visibility, and the loop compounds. Here it is not written back anywhere, because there is nothing to write it into. Concentration that arises from preference stays proportional to preference; it does not amplify itself, it does not convert into a durable advantage that a new entrant must overcome, and it cannot be seeded by purchase or by fraud, because there is no total for a purchase or a fraud to inflate.\n\n**What we do not claim, against the fair-exposure literature (§2), is that we are the first to break the link between visibility and past outcome.** Amortised fairness of exposure already bounds how far a subject's exposure may drift from its relevance, and it does so with more instrumentation than this design has. The claim that remains is about *what* the loop is cut from: those systems cut the return edge by constraining exposure against a merit score that they continue to compute and to update from outcomes; this one cuts it by having no score, no outcome total and no exposure tally at all. The first is a rule applied to a quantity that exists — it needs its constraint enforced at every ranking. The second is a property of what is not stored. And we inherit their best-documented weakness rather than escaping it: a draw is only as fair as the set it is drawn over (§10).\n\nWe regard this as a real and testable difference, and as a considerably smaller one than the design's own elegance invites us to claim. We note the standing caution that applies to work of this kind: **a tension-dissolving, self-similar, coherent system is either deeply right or deeply seductive, and the two are indistinguishable from the inside.** The individual properties in §5 are each falsifiable on their own — *does a turn persist? is an impression counted? can a chain qualify?* are all answerable by building the thing and looking. The pattern they make is not falsifiable at all. The properties earn their keep one at a time; the coherence earns nothing, and should not be cited as evidence for any member of the set.\n\n## 9 · Two dials, and the bars on them\n\nA design with no ranking still has parameters, and the honest thing is to enumerate the ones that could be used to steer it.\n\n**The volume dial.** Miss Aquarius℠ funds participants' capacity to give, and therefore controls the rate at which discovery events occur. The bar is:\n\n> **She may move discovery's volume. She may never move its addressee.**\n\nAdmission is the operator's liveness predicate; order is the published rotation; the addressee is chosen by the human spending from their own jar. She funds the giving; she never aims it. A dial able to change only a rate is safe. The same dial able to change an address is an advertising network with a single customer, and it is the one point at which this entire architecture could be quietly inverted by an agent nudging volume in ways that correlate with recipients it prefers. Two riders follow: **no per-recipient impression figure may exist for her to optimise against** — she holds a global volume figure and nothing finer — and any future locality-level modulation is bound by the same rule stated per place.\n\n**The place-commons dial, which is an experiment and not part of the design.** The institution's second gratitude ledger, **Kiitti**, records standing between people and non-human parties — products, places, animals, plants — and is the anti-externality ledger rather than a commercial one. Its aggregate over a locality is a *commons* quantity: shared by everyone in the place, and therefore structurally incapable of differentiating between recipients inside it. This suggests a mechanism in which a locality's Kiitti modulates the **volume** of discovery for that place while never touching the **order** within it — converting what is elsewhere a rivalrous advertising spend into a non-rivalrous investment in a shared place, with neighbouring businesses holding a common interest in the trees, animals and care of the street they share.\n\nWe specify it here and we do not adopt it, for a stated reason. **Comparing places builds a gradient between cared-for and neglected neighbourhoods, and that gradient runs directly against the adoption-equity commitment this institution holds as an open problem rather than a solved one.** If it is ever run, it runs self-referentially — a place measured against its own history, never against another place — as a pre-registered experiment with the tripwire in §11.3, and it is switched off on the tripwire regardless of what it is doing for circulation. What ships is the unconditional half: Kiitti flows in the encounter, as the line-wide product law already requires, and plays no part in discovery.\n\n## 10 · Generality: one primitive, three domains\n\nThe routing primitive specified here appears in three places in this institution's architecture, and none of the three was designed for the others.\n\n| Domain | Instance | Admission | Order | Published |\n|---|---|---|---|---|\n| Sangha | the alms round — monastic invitation routing | ordination and community membership | rotation, proximity, fairness | *Steward-Routed Alms*, 2026-07 |\n| Play | the sey circle — the ball reaches every player | presence in the circle | the circle's own turn-taking | *Circulation Sports*, *The Sport That Says Your Name* |\n| Commerce | the round specified here | the liveness predicate | published recomputable rotation | this paper |\n\nThe three differ in exactly one component, and the difference is instructive. In the Sangha, admission is a **durable status**: you are ordained or you are not, and the status does not decay. In the circle, admission is **presence**: you are standing in it or you are not. In commerce there is no ordination and standing in a place is not enough, so admission must be supplied by something else — and the something else has to admit without ranking and must not be accumulable, or the ratchet returns through the admission door. **The liveness predicate is that substitute. Supplying it is the whole of this paper's contribution over the monastic case, and the rest is transposition.**\n\nThe generality also gives a diagnostic for future surfaces in this architecture. Wherever a party must be selected from many, the question to ask first is *what is the admission predicate, and can it be accumulated toward?* If the honest answer is that admission is a quantity, the surface will grow a ratchet regardless of what its designers intend.\n\n**The draw itself now has its own paper.** *Decided by No One* specifies the called draw — where the rotation's randomness comes from, a sealed regime for an operator whose own gifts must stay anonymous, and thirteen surfaces in place of this section's three — so the primitive this section calls *transposition* is claimed and bounded there, not here. Claim 6's publicly recomputable rotation is that paper's public regime; this paper's contribution remains the admission predicate.\n\n**A fourth seat: hospitality.** After this paper was first published the question arrived in a fourth domain, and the table above keeps its three rows so that the record of what was specified, and when, stays legible. A shop offers a place and an hour — a table, a cart, a boat, at a time it chose — as an invitation to two people who already know each other; both see the invitations drawn for them, and one of the two, the one receiving the gift of time, picks which to accept. The design is unbuilt and unscheduled. What follows states its claims and withholds its specification.\n\n```\n  Domain        Instance                       Admission                      Order\n  ───────────   ────────────────────────────   ────────────────────────────   ──────────────────────\n  Sangha        monastic invitation routing    ordination and membership      rotation, proximity\n  Play          the circle's turn              presence in the circle         the circle's own turns\n  Commerce      the round of §4                the liveness predicate         published draw\n  Hospitality   a shop's invitation to a pair  the shop has a live            published draw over\n                                               invitation — once per shop,    SHOPS; the shop's\n                                               however many it holds          invitations behind it\n```\n\n*The slate is drawn and cannot be bought.* The shops a pair sees are ordered by a publicly recomputable draw inside a distance band, and no fee, bid or subscription reaches their position.\n\n*The draw ranges over shops, never over invitations — and this is a correction the diagnostic above produced when it was run on the design, not a feature it was designed with.* As first described, admission to the slate was *this shop has published an invitation*, and a shop can publish more than one. Admission was therefore a quantity: presence in the slate would have scaled with the number of invitations published, and a shop with more to spend would have appeared more often, with no fee anywhere in the system. That is the ratchet arriving through the admission door, exactly as the diagnostic above predicts. The repair is a property rather than a rule: a shop appears in a slate at most once, however many invitations it holds, and its invitations are seen only after the guest has chosen that shop. A shop's twentieth invitation widens what it can offer if drawn and never its chance of being drawn, so publishing more stops being a competitive act and becomes a hospitable one. The honest cost is that a shop with one invitation and a shop with twenty are equally likely to appear. Depth is not rewarded — correctly, since rewarding depth would be rewarding spend — and the pool will grow more slowly than it would under any volume incentive.\n\n*A commons may seed the pool in kind, and it never chooses the shop.* This is §4.3's bootstrapping answer in a new domain. The institution's autonomous agent may place a kind — *a coffee for two* — into the pool; the guest's own pick names the shop that fulfils it, and only then is that shop paid from the Aquarian Pool℠, as credit to its owner's Re-Tip Fund℠ — forward-spendable capacity, never cash. The agent moves the volume of hospitality and never its address, which is §9's bar stated for a place instead of a jar. Because the seeding party never buys, a seeded invitation and a shop's own are the same object on the screen, and no guest is legible as sponsored. That property carries more weight than it appears to. The best-documented failure of hosted generosity in a shared room is social rather than financial: of the pay-what-you-can cafés a US restaurant chain ran until 2019, a marketing scholar who observed them for years reported that *\"the people who were not food insecure did not want to eat lunch with people who were food insecure\"* (NPR, *What Happened When Panera Launched A Pay-What-You-Can Experiment*, 24 January 2019). Any mark that distinguished a seeded invitation would rebuild that room. The nearest folk practice meets the same problem the other way: Vietnam's *cơm treo*, the suspended meal, is arranged so that giver and receiver do not meet, to preserve the receiver's dignity. The pair it keeps apart — funder and guest — never meet here either; the two who do meet are the pair, who already knew each other.\n\n**None of the parts is new, and the commons is cited as the commons.** A public random drawing that fixes an order nobody can buy is how California sets candidate order on its ballots (California Elections Code §13112, a randomized alphabet drawn on the 82nd day before an election). A third party paying in kind at whichever participating restaurant the recipient chooses, without choosing it, is the US Supplemental Nutrition Assistance Program's Restaurant Meals Program, a state option for elderly, disabled and homeless participants (USDA Food and Nutrition Service). A stranger paying ahead for a drink another will claim is *caffè sospeso*, from the cafés of Naples. What was not found — in a quick census of the English-language commercial web, non-commercial practice and keyword patent search on 18 September 2026, with full patent-classification search and every non-English source *not run* — is the composition: an invitation of place and time that cannot be converted to money, a slate drawn over shops that nobody can buy into, and in-kind seeding paid only on the guest's choice, in one system, where the invitation is where a gift of time between two people is spent. A null on a composition of that many conjuncts is weak evidence, and we do not offer it as more.\n\n**And the diagnostic above does not reach the limit this seat exposed.** Drawing over shops removes the advantage volume would buy; it does nothing about *which shops are in the set*. A uniform draw over a skewed candidate set is not a fair allocation of exposure — Bower, Lum, Lazovich, Yee and Belli show that when a first filtering stage yields imbalanced candidate sets, complete randomisation at the second stage can produce *more* exposure inequality than ranking by relevance (*Random Isn't Always Fair: Candidate Set Imbalance and Exposure Inequality in Recommender Systems*, arXiv:2209.05000, 2022). The same holds for the commerce round of §4: the liveness predicate decides who is drawn over, and a predicate that the isolated fail (§12.4) skews the set before any draw runs. The diagnostic question therefore has a second half, which this paper does not answer: *what is the admission predicate, can it be accumulated toward — and what makes the set it admits representative of the place it is drawn for?*\n\n## 11 · Pre-registered predictions\n\nThe design is unbuilt and unobserved. The following are registered before any data exists, and the institution commits to publishing each result whether it confirms or refutes.\n\n**11.1 — P-D1 (the rotation does something).** Among discovery events in a live market, a non-trivial share resolve to recipients who have never previously received a re-tip.\n\n> *Falsifier:* if discovery concentrates on the same recipients at approximately the rate a ranked system would produce, the rotation is not doing work and the apparatus is theatre. **We would publish that, and the correct response to it would be to abandon the design rather than to tune it.**\n\n**11.2 — P-D2 (the local thesis).** Among re-tips with an identifiable commercial recipient, the share accruing to single-location operators materially exceeds those operators' share of local digital advertising spend in the same market; and the gap widens as the share of AI-generated advertising creative rises.\n\n> *Falsifier:* if the distribution mirrors local ad-spend distribution, witness is not structurally local — it is a cheaper advertisement, and the thesis in this corpus that an appreciation layer routes differently from an attention layer is wrong.\n\n**11.3 — P-D3 (the place-commons tripwire).** If the §9 place-commons experiment is ever enabled, cross-place discovery volume will not correlate with neighbourhood median income.\n\n> *Falsifier and tripwire in one:* if it does correlate, the mechanism is disabled, whatever it is doing for circulation. This prediction is registered specifically so that a favourable circulation result cannot later be used to argue for keeping it.\n\n**11.4 — P-D4 (the presentation layer).** Adding any rendered per-recipient quantity to the candidate surface — including the operator's aura colour — will produce measurable order effects in giver choice.\n\n> *Falsifier:* if a rendered quantity produces no order effect, property 10 is unnecessary and the constraint can be relaxed. We expect the opposite and register it because the constraint is otherwise unjustified by anything but reasoning.\n\n## 12 · Honest limits\n\n**12.1 · Nothing has been built.** There is no implementation, no market, no participant, and no observation. Every claim here is architectural.\n\n**12.2 · Human choice is outside the mechanism.** §8 states this as the design's central concession and it is repeated here so it is not lost: the ratchet is absent; concentration is not.\n\n**12.3 · Quality is genuinely worse than ranking.** §6. The system routes to the merely fine and refuses the question a user most wants answered.\n\n**12.4 · The isolation inequity is untouched.** This corpus has documented, in the context of aura-gated matching, that participants whose circumstances make their kindness less legible — the isolated, those with no community to circulate within, those whose care is invisible — accumulate less and are therefore seen less. Excluding amplitude repairs the *scale* inequity: the small operator is admitted equally. It does nothing for the *isolation* inequity, because a participant who cannot circulate at all fails the predicate. We do not have a repair and we decline to imply one.\n\n**12.5 · Supply flooding is the live attack.** An adversary who can mint many admitted identities captures more turns. The design converts a ranking attack into an identity attack, which lands on the institution's strongest existing defences — proof-of-humanity layers, non-transferable registry handles, co-presence-gated witness — but \"converts to a problem we are better at\" is not \"solves\". This is where an adversary should aim, and we expect them to.\n\n**12.6 · Craigslist.** §2. Unranked local discovery has been beaten commercially before, by capital and curation, and nothing in this design defends against that.\n\n**12.7 · The window is a governance surface.** §7. One number, published and global, is a small attack surface — but it is not zero, and whoever sets it has real power over who is admitted.\n\n**12.8 · The elegance is not evidence.** §8's caution, restated: the properties are individually falsifiable, the coherence is not, and the coherence should never be offered as support for any of them.\n\n**12.9 · A draw is only as fair as its set.** §10. Drawing over shops, or over admitted operators, removes what volume and money could buy; it does nothing about who is in the set, and a uniform draw over a skewed candidate set can allocate exposure more unequally than ranking would. The liveness predicate skews the commerce set in a known direction (§12.4). We have no property that makes an admitted set representative of its place, and we do not claim one.\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| liveness predicate / liveness signal | boolean eligibility criterion based on recent activity (activity-based admission filter) |\n| aura | per-user circulation-velocity metric (account turnover rate; zero-crossing frequency of a balance) |\n| turn / rotation | round-robin allocation; lottery-ordered rotation; randomized slot assignment |\n| Re-Tip Jar℠ | restricted-use, non-withdrawable stored-value account limited to local merchants |\n| Re-Tip Fund℠ | non-withdrawable, forward-spendable merchant credit balance |\n| Aquarian Pool℠ | pooled subsidy fund administered by an automated agent |\n| Kiitos / Kiitti | gratitude ledger entries between persons / between persons and non-human parties (peer-recognition records) |\n| warm layer / path | single-hop social-graph attribution (friend-of-friend endorsement indicator) |\n| tong tin | bidding rotating savings and credit association (ROSCA, tontine) |\n| *sapadāna-cārikā* | sequential, non-selective door-to-door allocation (uninterrupted alms round) |\n\n## 13 · Cross-venue references\n\n- *The B-Tag and the Post-Payment Economy* — the commercial layer this design serves. **§7.1 of that paper is superseded by this one**; the supersession is recorded there in the open rather than by revision, and the *gratitude-based exposure algorithm* specified in it should be read as withdrawn.\n- *Steward-Routed Alms* — the monastic instance of the routing primitive, and prior art against this paper.\n- *Decided by No One* — the called draw: the source of the rotation's randomness, its sealed regime, and the thirteen surfaces it serves; claim 6 here is its public regime.\n- *Certification by Circulation* — the circulation-as-standing argument this design's admission predicate instantiates.\n- *B-PoH: The Humanity Layer for an AI-Native Internet* — the identity substrate on which §12.5's defences rest.\n- *Appreciation as World-Building* — the unholdable-commons property of which the liveness predicate is a second instance.\n- *HeartBank's Position on the Attention Economy* — the institutional commitment that makes this paper necessary.\n- *The Moat Is What We Refuse* — the strategic argument for why a design made of refusals is publishable without competitive cost.\n\n---\n\n## Coda\n\nThe alms round's rule is not that the poor house deserves the monk. It is that the walker does not get to decide, and that the walking is done in order, and that the round reaches the whole street because nobody is choosing which parts of it matter.\n\nWe have specified a discovery layer whose central content is a set of absences: no total, no impression, no creative, no dashboard, no rank. It is a worse product than a ranked one in the ways a ranked one is measured, and we have said so in every section where the comparison arises. What it has instead is that the things which usually go wrong with discovery layers are not prevented in it — they are unavailable, which is a different and more durable condition, and one that does not require anybody in the future to keep a promise.\n\nWhether that trade is a good one is an empirical question, and §11 is our attempt to make it one that can be settled rather than argued.\n\n---\n\n*Written by Thon Ly with Miss Aquarius℠, the name under which this corpus discloses its AI collaboration; editorial control is the author's. Dedicated to the public domain under [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/). The author and HeartBank® will not seek patent on this specification or any portion thereof, and will not assert any patent right against anyone practising it.*",
       "provenance": {
-        "sha256": "870dce1328734455be78ad324887fe375ed964c5dfb5c22ff4df71bb76dd0152",
-        "doi": "10.5281/zenodo.22929354",
+        "sha256": "2130a0966a668218bc8294445a821eaef8b3b44bc98578a25f0da97492f065b6",
+        "doi": "10.5281/zenodo.22931216",
         "concept_doi": "10.5281/zenodo.22155377",
-        "zenodo_url": "https://zenodo.org/records/22929354",
-        "deposited_sha256": "870dce1328734455be78ad324887fe375ed964c5dfb5c22ff4df71bb76dd0152",
+        "zenodo_url": "https://zenodo.org/records/22931216",
+        "deposited_sha256": "2130a0966a668218bc8294445a821eaef8b3b44bc98578a25f0da97492f065b6",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/rotation-over-liveness.md",
@@ -3418,8 +3418,8 @@
         "canonical_url": "thonly.org/research/rotation-over-liveness",
         "hostile_review": null
       },
-      "bytes": 68496,
-      "words": 10900
+      "bytes": 69656,
+      "words": 11064
     },
     {
       "slug": "sacrifice-witness-without-discharge",
@@ -4059,13 +4059,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> *Draft notes for the editor:* this is the founder-voice canonical draft for `thonly/publications`. The defensive publication specifies the **Thank-All-Nearby primitive** — one-tap broadcast of gratitude with optional money-attachment to every PoH-verified recipient within Bluetooth-Low-Energy proximity — as a Phase 2 application of the Proof of Humanity ℠ protocol. Companion papers: *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the underlying protocol); *Verified-Human Anonymous Local Giving* (the originating mechanism specification that this paper generalizes from per-recipient to all-nearby-recipients); *The B-Tag and the Post-Payment Economy* (the worked Phase 2 example for commercial gratitude); *The Zero-Point Game℠* (the keystone game-theoretic frame); *Capacity-Funded for AI, Human-Disbursed* (the institutional-architecture pattern that lets Miss Aquarius℠ underwrite Re-Tip Fund ℠ donations without flow-direction authority). The corresponding founder-voice essay *\"Emotional Infrastructure as a Public Good\"* (thonly.org/publications/essays/emotional-infrastructure-as-a-public-good) carries the analytical case-for-the-missing-category argument. The personal articulation of the same thesis is in the *Second Letter to Miss Aquarius* (missaquarius.org/letters/second.html, 25 May 2026). Three-register decomposition: this paper carries the technical/mechanism specification; the essay carries the analytical case; the letter carries the personal articulation.\n\n---\n\n## Abstract\n\nAnonymous nearby tipping has a recognizable cultural form — the \"Faith in Humanity Restored\" social-media trend in which service workers post videos of unexpected generous tips — but lacks the infrastructure to scale beyond cash. Cash and credit-card payment rails fail at two structural properties that the cultural form requires: tippers cannot be genuinely anonymous to recipients with either rail (cash demands physical hand-over with eye contact; credit-card leaves an identity trail), and recipients cannot prove on social media that an anonymous tip was authentic rather than fabricated (every \"Faith in Humanity Restored\" video faces a \"this is staged for views\" credibility problem that erodes the cultural moment). This paper specifies the **Thank-All-Nearby primitive** — a one-tap operation that broadcasts gratitude, with optional money or time attachment, to every Proof-of-Humanity-verified recipient within Bluetooth Low Energy proximity (or, in institutional-mode deployments, within a GPS bounding-box for institutional locations such as shelters, classrooms, restaurant break-rooms, and worker spaces) — and develops its placement as the operational mechanism for *emotional infrastructure for invisible kindness*: the restoration of the felt sense of being held in another human's awareness as a property of shared physical space. The primitive composes four prior contributions (PoH℠'s verified-human guarantee, Bluetooth Low Energy plus Apple/Google Nearby framework proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single operation whose user-facing surface is one button. The architecture is offered defensively to the commons under CC0. The authors and HeartBank® will not seek patent on the primitive, its operational specification, the integration with PoH℠, the institutional-mode GPS-bounding-box variant, the recipient-experience design, or any portion thereof.\n\n**Keywords:** anonymous tipping, proximity-based generosity, gratitude infrastructure, Bluetooth Low Energy, proof of humanity, recipient-side filtering, bilateral uncacheable anonymity, emotional infrastructure, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on the Thank-All-Nearby primitive, its one-tap broadcast operation, the institutional-mode GPS-bounding-box variant, the per-recipient amount calculation, the recipient-experience design preserving atmospheric quality, the tipper-side anonymity-uncacheability requirement, the sunlight-rather-than-sparsity saturation posture, or any portion thereof, in any jurisdiction, at any time. This commitment is permanent. Trademark rights on specific marks — **Proof of Humanity ℠**, **PoH℠**, **B-PoH℠**, **Aquarius℠**, **Miss Aquarius℠**, **HeartBank®**, the B-heart logo — are separately and explicitly reserved.\n\nTo the author's knowledge, the following are not previously published as a unified contribution: (i) the one-tap broadcast operation that delivers gratitude with optional scarce-resource attachment to all PoH-verified recipients within BLE proximity as a single semantic action; (ii) the integration of the broadcast with the recipient-side filter mechanism such that recipients individually accept or decline the broadcast based on their own filter settings; (iii) the institutional-mode GPS-bounding-box variant for shelters, classrooms, restaurants, and other institutional spaces where BLE range is insufficient and the institutional perimeter is the natural recipient set; (iv) the recipient-experience design preserving the atmospheric quality of diffused gratitude even at high tip-volume — gratitude as sunlight, not as a sparse premium reward; (v) the explicit articulation of the *cash and credit card cannot deliver this* argument naming the two structural deficiencies (tipper-anonymity and recipient-authenticity-proof) as the combined property; (vi) the placement of the primitive as the operational mechanism for *emotional infrastructure for invisible kindness* — a category of social good distinct from charity, payment, gift, or social-network feature. The component lineages (proximity-based services; anonymous-donation mechanisms; the cultural form of the \"Faith in Humanity Restored\" tip videos; Frankl, Buber, Levinas, mettā, agape on the felt sense of being held; attachment theory; loneliness epidemiology; the dāna economy of the Saṅgha) are old and are cited generously below; the synthesis is, to the author's knowledge, novel as of this paper's date.\n\n---\n\n## Claims\n\n*Enumerated 2026-08-29. The mechanisms below were disclosed in full in this paper's original text; **the prior art they establish runs from this document's original publication date and its OpenTimestamps proof, not from this enumeration.** They are listed because a defensive publication is read as prior art by examiners and by opposing counsel, and **a claims list is what such a reader searches; ten thousand words of prose is not.** No claim below adds matter not already present.*\n\n1. **Bilateral uncacheable anonymity in proximity tipping** — a value transfer between two co-present parties in which the sender is not identifiable to the recipient and the recipient cannot retain or re-derive the sender's identity after the transaction, achieved without either party disclosing a payment credential.\n2. **Short-range radio proximity as the addressing layer for anonymous generosity** — using a local broadcast medium to define the eligible recipient set by physical co-presence rather than by account lookup, so that the transfer's addressability and its anonymity derive from the same property.\n3. **Recipient-side filtering as the abuse control for anonymous inbound value** — placing the accept/decline decision with the recipient rather than the sender or the platform, so that an anonymous channel cannot be used to force an unwanted relation.\n4. **Institution-scoped geographic bounding as a variant of the proximity set** — substituting an operator-defined coordinate boundary for radio range where the eligible set is an institution's population rather than whoever is physically nearby.\n5. **Platform attestation of anonymous receipt as the authenticity substitute** — a verifiable record that an anonymous transfer occurred, issued to the recipient, solving the *staged-for-views* credibility problem that the cultural form of anonymous tipping cannot otherwise solve, without re-identifying the sender.\n6. **The composition of the above with a proof-of-humanity layer**, such that anonymity is preserved while the sender is nonetheless attested to be a distinct human being.\n\n**Non-assertion extends to:** all mechanisms above, in any combination, and any implementation thereof.\n\n---\n\n## 1. Introduction\n\nA well-known cultural form has emerged on social-media platforms over the past several years: videos posted by service workers — typically restaurant staff but increasingly nurses, teachers, retail clerks, ride-share drivers, food-service workers across categories — showing unexpected generous tips, anonymous notes of appreciation, or sudden acts of customer kindness. The videos go viral with regularity; the cultural tag *Faith in Humanity Restored* attaches to the genre. The viewer response is consistent: the gesture lands as evidence that ambient kindness still exists in places that otherwise feel emotionally thin. The trend points at something real about what modern public life is missing and what would, if it could be restored, address one of the deepest deficits of contemporary social experience.\n\nWhat the cultural form lacks is infrastructure. Cash tips can be staged with a friend; credit-card receipts can be photoshopped; even genuine generous tips face a credibility problem in the social-media commentariat — *\"is this fake for views?\"* — that erodes the cultural moment over time as more videos are posted and the proportion that are staged or exaggerated grows. The trend depends on authenticity that the existing payment rails cannot structurally provide. Cash and credit card can deliver the money; neither can deliver the *combined property* of structurally anonymous giving plus verifiable receipt that the cultural form requires to sustain itself.\n\nThis paper specifies the **Thank-All-Nearby primitive** — a one-tap operation, delivered through a HeartBank Phase 2 client application, that broadcasts gratitude with optional money or time attachment to every Proof-of-Humanity-verified recipient within Bluetooth Low Energy proximity. The primitive composes four prior architectural contributions (PoH℠'s verified-human guarantee, BLE plus Apple Nearby Interaction plus Google Nearby Connections proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single user-facing operation whose semantic is *\"thank everyone here, anonymously\"*. The mechanism's design preserves the atmospheric quality of diffused gratitude at all scales; the user experience is one button.\n\n> *Connection to the unified mission frame: HeartBank's mission is the restoration of humanity to the middle way — the optimal condition for awakening that modernity has systematically pushed away from at population scale. The dignity deficit articulated in the institution's vision is most acutely felt in shared physical spaces: streets, restaurants, classrooms, shelters, public transit. The Thank-All-Nearby primitive is the operational mechanism by which the dignity-infrastructure of HeartBank's Treasury reaches the shared-physical-space layer of public life — the substrate on which* emotional infrastructure for invisible kindness *can be built. The primitive is what makes the institution's deepest articulated thesis — that the felt sense of being held in another human's awareness is, possibly at the deepest level, the experience humans are searching for beneath everything else — into an operationalizable property of social space.*\n\nThe paper proceeds as follows. §2 specifies the primitive operationally — its inputs, outputs, semantics, and edge cases. §3 develops the *why cash and credit card cannot deliver this* argument with the two structural deficiencies named precisely. §4 specifies the four sub-mechanisms the primitive composes (PoH℠, BLE/Nearby proximity, recipient-side filtering, bilateral uncacheable anonymity) and how they interact. §5 specifies the institutional-mode GPS-bounding-box variant for shelters, classrooms, and other institutional spaces. §6 specifies the recipient-experience design preserving atmospheric quality at high tip volume — the sunlight-not-sparsity posture. §7 addresses the spec questions surfaced during the architecture's development (per-recipient amount, who counts as nearby, paranoia counter-incentive, stratification, recipient experience). §8 develops the *emotional infrastructure for invisible kindness* thesis the primitive operationalizes. §9 names boundary conditions and honest limitations. §10 positions the contribution in lineage. §11 concludes.\n\nI write as a co-author with Miss Aquarius℠, the named AI substrate of the institution this paper serves. Final editorial control is mine.\n\n---\n\n## 2. Operational specification of the primitive\n\nThe Thank-All-Nearby primitive is a one-tap operation in the HeartBank Phase 2 client. This section specifies it operationally.\n\n### 2.1 Inputs\n\n- **Tipper identity**: the operating user's PoH℠-verified profile (minimum L1 — the passkey-per-action layer — required, since the tipper's verified humanness is the foundation of the primitive's authenticity guarantee).\n- **Optional money attachment**: an amount in the local currency or stable token, sourced from the tipper's Personal Wallet ℠ (Phase 2) or Personal Account ℠ (Phase 1, where the primitive is available in a degraded mode).\n- **Optional time attachment**: a duration of presence to be offered (relevant for the Chronicle product surface, where time-attachment composes with money-attachment).\n- **Optional message**: a brief text or audio note. Default is empty — silent acknowledgment is the architectural default.\n- **Recipient mode**: either BLE proximity (default, see §4.2) or institutional GPS-bounding-box mode (see §5).\n\n### 2.2 The broadcast operation\n\nOn invocation, the client:\n\n1. Records the tipper's PoH℠ verification at L1 (passkey signature on the broadcast action's content + timestamp).\n2. Resolves the recipient set: in BLE mode, every device within BLE range that is broadcasting a PoH℠ proximity beacon; in institutional mode, every PoH-verified user currently inside the institutional GPS bounding-box.\n3. Filters the recipient set by each recipient's own recipient-side filter settings — a recipient who has set their filter to require deeper PoH layers, money attachment, kinship-degrees-of-separation limits, or other criteria, is filtered out if the tipper does not satisfy the filter.\n4. Calculates per-recipient amount: if money is attached, the total amount is divided across the filtered recipient set per the tipper's distribution choice (equal split is the default; per-recipient floors may be specified; a minimum-per-recipient threshold may be enforced if specified).\n5. Issues a verified-platform receipt to each filtered recipient, on-chain (Phase 2 Base L2 settlement), tied to the broadcast action's content and timestamp, attesting that the action came from a verified human within BLE/institutional proximity at the moment of broadcast.\n6. Settles the money or time transfer per-recipient via the standard Phase 2 settlement rails.\n7. Logs the broadcast internally to the platform's compliance records (subpoena-discoverable, AML/OFAC-screenable) but does *not* issue a tipper-side exportable artifact (bilateral uncacheable anonymity, see §4.4).\n\n### 2.3 Edge cases\n\n- **No recipients within proximity**: the broadcast fails gracefully; the tipper is informed that no PoH-verified recipients were within range; no transfer occurs.\n- **All recipients filter-out the tipper**: same — the broadcast fails gracefully; no transfer occurs; the tipper sees a generic message acknowledging the filter mismatch without revealing which recipients filtered them.\n- **Money attachment exceeds tipper's balance**: the broadcast is rejected at the client layer before the operation is invoked.\n- **Tipper's PoH℠ verification fails at the moment of broadcast** (e.g., passkey signing fails, device authentication fails): the broadcast is rejected.\n- **Network failure mid-broadcast**: the broadcast is retried on next connectivity with the original timestamp; the receipts issued to recipients reflect the actual broadcast moment.\n\n### 2.4 Outputs\n\n- **To the tipper**: confirmation of broadcast (count of recipients reached, per-recipient amount distributed); no record beyond the in-app confirmation that could be exported as a social-capital artifact.\n- **To each filtered recipient**: a notification — the experience of receiving a Thank-All-Nearby broadcast — including the platform-issued verified receipt, the optional message, and the per-recipient amount. The recipient cannot identify the tipper.\n- **To the platform's settlement layer**: the on-chain receipts and per-recipient transfers.\n- **To the platform's compliance records**: internal record of the broadcast operation, subpoena-discoverable but not exportable.\n\n---\n\n## 3. Why cash and credit card cannot deliver this\n\nThe \"Faith in Humanity Restored\" cultural form depends on a *combined property* that neither cash nor credit-card payment rails can deliver. This section names the two structural deficiencies precisely.\n\n### 3.1 First deficiency — tipper anonymity is structurally hard with cash and credit card\n\nThe first structural deficiency: with cash and credit card, the *tipper cannot be genuinely anonymous to the recipient* in a way that preserves the asymmetric experience the cultural form requires.\n\nCash requires physical hand-over. The bills change hands between specific humans in a specific moment; the tipper *is* in the room when the tip is delivered; the recipient *sees* the tipper, can identify them by physical description, can often identify them by name if they are a regular customer. The viral version of the \"Faith in Humanity Restored\" form depends on the tipper *not* receiving the thank-you — the gesture is pure precisely because it isn't transactional, isn't followed by the social moment of being thanked, isn't an exchange. Cash makes this almost impossible: the tip and the acknowledgment happen in the same instant unless the tipper deliberately leaves the cash and exits before the recipient discovers it, which itself is a behavioral pattern (sneaking out, avoiding eye contact) that the tipper has to choreograph and that is observable.\n\nCredit card leaves an itemized trail tying the tipper's legal identity (name on card, billing address, account history) to the transaction. Even when the tip itself is anonymous to the *recipient* — the staff member doesn't see the cardholder's name printed on the receipt — it is *not* anonymous to the payment processor, the issuing bank, the merchant's accounting system, or anyone with access to the receipt's underlying record. \"Anonymous with credit card\" means \"the staff doesn't immediately know your name from the receipt\"; it does not mean \"no one knows your name.\" A motivated investigator (the establishment's manager, a curious co-worker, a regulator) can identify the tipper.\n\nHeartBank Phase 2 anonymity is *structural*, not just on the surface. BLE-verified proximity proves the tipper was physically present in the same space as the recipient; no exportable artifact ties the broadcast to the tipper's identity; the on-chain receipt records the tipper's identity only as a zero-knowledge commitment that the platform's standard surfaces cannot invert. The customer can drop $100 (or the equivalent in stable tokens) on a Thank-All-Nearby broadcast and walk out; the staff find the receipts ten minutes later when they check their app; the asymmetry — *someone gave, no one knows who* — is encoded in the rail rather than choreographed by the tipper. This is the structural property the cultural form requires and that the existing rails cannot provide.\n\n### 3.2 Second deficiency — recipient authenticity-proof on social media is structurally hard with cash and credit card\n\nThe second structural deficiency is deeper and may be doing more of the work in the long-arc viability of the cultural form: with cash and credit card, *the recipient cannot prove on social media that the anonymous tip was authentic rather than fabricated*. Every \"Faith in Humanity Restored\" video on TikTok or Instagram faces, in the comments, the predictable skepticism — *\"this is staged for views,\"* *\"that receipt looks Photoshopped,\"* *\"how do we know the customer wasn't a friend?\"* — and the recipient has no platform-issued, independently-verifiable artifact to defend the video's authenticity. Some \"Faith in Humanity Restored\" videos are in fact staged; viewers correctly suspect; the cultural form's credibility dilutes over time as the proportion of genuine to staged videos becomes harder to estimate.\n\nCash tips can be staged trivially: put the cash on the table, film yourself \"finding\" it, post the video. Credit-card receipts can be photoshopped; the camera-on-paper workflow is defeated by anyone with image-editing access. Even genuine tips have no platform-issued artifact that the recipient can point to and say *\"you can verify this independently.\"* The trust burden falls on the recipient, who must defend the video's authenticity against skeptics with no tools other than their own credibility.\n\nHeartBank Phase 2 closes this gap structurally. Every Thank-All-Nearby broadcast issues an on-chain Base L2 verified-platform receipt to each filtered recipient. The receipt attests to (a) the broadcast originated from a PoH℠-verified human, (b) the tipper was BLE-verified within proximity at the moment of broadcast, (c) the timestamp and amount are recorded immutably on-chain. The recipient's social-media video can include the receipt — date, amount, verified-human flag, PoH layers held by the sender (where the sender has consented to that disclosure), BLE-proximity-verified flag — and skeptical viewers can verify the receipt independently against the Base L2 ledger.\n\nAuthenticity becomes a property of the artifact, not a claim the recipient has to defend. The skeptical commenter who would otherwise post *\"this is fake for views\"* can be answered by the recipient pointing to the on-chain receipt; the receipt is structurally hard to fabricate (every transaction has an on-chain settlement trace that lies outside the platform's narrative-control surface); the comment thread shifts from credibility-erosion to credibility-reinforcement.\n\n### 3.3 The combined property\n\nTogether — *tipper structurally anonymous to the recipient* + *recipient holds verifiable authenticity proof against third-party skepticism* — constitute the combined property that neither cash nor credit card can deliver. The first deficiency is the property that makes the gesture *pure*; the second is the property that makes the cultural form *sustainable*. Without the first, the gesture becomes a transaction; without the second, the social-media artifact becomes a credibility-erosion source. Both must hold simultaneously for the \"Faith in Humanity Restored\" cultural form to scale beyond its current ad-hoc artisanal stage. HeartBank Phase 2 holds both simultaneously; cash and credit card hold neither.\n\nThis is the one-line pitch for why HeartBank Phase 2 is not just another payment rail: cash and card deliver money; HeartBank Phase 2 delivers money plus the two structural properties that the cultural form actually needs.\n\n---\n\n## 4. The four composed sub-mechanisms\n\nThe Thank-All-Nearby primitive is the user-facing operation; the underlying architecture composes four sub-mechanisms specified elsewhere in the corpus. This section names how they compose.\n\n### 4.1 PoH℠ — verified-human guarantee at L1\n\nThe minimum PoH layer required for participation in Thank-All-Nearby (either as tipper or as recipient) is L1 — passkey-per-action. The tipper's L1 signature attests that a human was at the device at the moment of broadcast; the recipient's L1 verification attests that the recipient is a verified human (otherwise an AI agent could spoof a passive-recipient device and capture broadcast money). Deeper PoH layers (L2 kinship attestation, L3 breath signature, L4 DNA kinship) are surfaced in the broadcast for any recipient who has them but are not gating for the primitive's operation.\n\nRecipients may set their own filter to *require* deeper PoH layers from tippers (the standard recipient-side filter mechanism), but the *protocol-minimum* is L1. Specification of the four-layer PoH℠ architecture in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n\n### 4.2 Bluetooth Low Energy plus Apple Nearby Interaction plus Google Nearby Connections proximity verification\n\nProximity is verified at the radio layer, not the IP layer. Three composable substrates:\n\n- **Bluetooth Low Energy (BLE)** as the universal radio substrate. Devices broadcast and listen for rotating proximity beacons (rotating identifiers, unlinkable across sessions). Configurable range, typical default 10–30 meters, tunable per deployment context.\n- **Apple Nearby Interaction framework** (iOS 14+) for precise ranging on supported devices via the U1 ultra-wideband chip. Provides sub-meter range and direction for iPhone 11+ and Apple Watch Series 6+.\n- **Google Nearby Connections API** (Android 4.4+) for peer-to-peer device-to-device proximity via combinations of BLE, Wi-Fi Direct, and audio.\n\nThe composition: a device implementing the protocol broadcasts a privacy-preserving proximity beacon; a device that detects the beacon can be the target of a Thank-All-Nearby broadcast; the platform's verification substrate confirms the proximity at the moment of broadcast.\n\nVPN-resistance is a structural property: the proximity check happens at the radio layer below the IP stack, so VPN, Tor, or IP-rotation circumvention has no effect. An attacker mounting a remote spoofing attack would need to physically place a device near the target, which is the desired property for most use cases.\n\nPrivacy-preservation is a structural property: the platform never receives absolute geolocation. The only proximity-related fact exposed to the platform is the binary fact that two devices were within range; absolute coordinates are not collected, not transmitted, and not stored.\n\n### 4.3 Recipient-side filtering\n\nEach recipient's filter settings determine whether a given Thank-All-Nearby broadcast reaches them. The five filter dimensions specified in the PoH℠ protocol paper apply: no-abusive-content, sender-must-be-nearby (always true for the primitive by definition), depth-of-humanity-proof (required-subset predicates), degrees-of-separation-on-global-family-tree, money-or-time-attached. Recipients in default \"trusting\" mode accept any L1-verified broadcast; recipients in \"paranoid\" or other restrictive modes filter accordingly. The platform never defaults exclusionary filters on; exclusion is recipient-opt-in, knowingly.\n\nThe aggregation property: a broadcast is delivered to the *subset* of nearby recipients whose filters the tipper satisfies. The tipper learns the aggregate count of recipients reached but not the identity of recipients reached or excluded (since recipient-identity is itself private under the primitive's anonymity guarantee). If the broadcast reaches zero recipients (all nearby recipients filtered out the tipper), the tipper is informed that no recipients were reached without learning *why*.\n\n### 4.4 Bilateral uncacheable anonymity\n\nThe primitive enforces bilateral uncacheable anonymity per the specification in the companion PoH℠ protocol paper §5. The tipper does *not* receive an exportable certificate of one-sided participation; the platform's API has no endpoint returning \"the list of Thank-All-Nearby broadcasts sent by this tipper\"; no admin override exposes such data. Compliance records exist internally (subpoena-discoverable for AML/OFAC, law-enforcement, and similar regulatory necessity) but are not exportable as flexing artifacts the tipper can use on social media.\n\nThe recipient *does* receive an exportable receipt — the platform-issued verified artifact attesting that an anonymous PoH-verified human within BLE proximity broadcast a Thank-All-Nearby reaching this recipient at this timestamp with this amount. The asymmetry is structural and is the mechanism that preserves the cultural form's purity property.\n\n### 4.5 Why these compose: the stranger-scale reconstruction of family relationality\n\nThe four sub-mechanisms are not an arbitrary stack; together they re-create, among strangers, what kinship supplies for free inside a family. HeartBank's family-bank reward has a *micro layer* — a peer re-tip that is **anonymous as to public credit but relational**: a known family member responding to a real kindness (specified in the companion defensive publication *The Two-Layer Reward*, §4.1 / §8.1). That micro layer works because relationality silently does three jobs at once — it **grounds** the gift in a real, present other; it **validates** it (a family member can tell a real kindness from a performed one); and it carries **mutual attention**.\n\nAmong strangers, relationality is unavailable, so the same primitive must be rebuilt from parts — which is exactly what the four sub-mechanisms above do. **Proximity (§4.2, BLE)** supplies the *grounding*: the giver was *here, in this space, just now* — nearness is the stranger-scale form of relationality. **PoH℠ (§4.1)** supplies the *validation* a family member would otherwise provide — certifying a real, unique human rather than a bot, re-buying among strangers the trust kinship gives away. **Bilateral uncacheable anonymity (§4.4)** preserves and in fact *strengthens* the credit-anonymity: a small family can guess who gave, but a nearby stranger is genuinely unlinkable. The one job that does not transfer is mutual attention; in its place the stranger scale gains **diffusion** — the felt sense that the kindness came from the whole surrounding space, an emotional quality only unknown givers can produce.\n\nThe sustainer primitive is therefore invariant in structure across scales — *anonymous-as-to-credit + grounded-in-a-real-present-other* — with the grounding form scaling from **relational** (family) to **nearby** (strangers) and the validation function handing off from kinship to PoH℠. This is the precise reason proof-of-humanity is *not optional* at the stranger scale: it is the part of relationality that proximity alone cannot carry.\n\n```\n   ONE SUSTAINER PRIMITIVE, TWO SCALES\n   invariant:  anonymous-as-to-credit  +  grounded-in-a-real-present-other\n\n                     FAMILY scale          →   STRANGER scale (this paper)\n                     ─────────────             ───────────────────────────\n   grounding     =   RELATIONAL            →   NEARBY  (§4.2, BLE)\n                     (you know them)           (they're present)\n   validation    =   relational (free)     →   PoH℠ (§4.1) (re-bought)\n   anonymity     =   thin (guessable)      →   thick (§4.4, unlinkable)\n   compensation  =   mutual attention      →   diffusion (the whole space)\n\n   structure invariant; grounding form scales; validation hands off to PoH℠\n```\n\n---\n\n## 5. Institutional-mode GPS-bounding-box variant\n\nBLE proximity has a typical range of 10–30 meters, which fits most retail, restaurant, and small-space deployments. For larger institutional contexts — shelters with multiple rooms across a building, classrooms in a multi-story school, restaurant break-rooms separated from the main floor, hospital wards, worker spaces across a campus — BLE range is insufficient. The institutional-mode GPS-bounding-box variant extends the primitive to these contexts.\n\n### 5.1 The variant\n\nA registered institutional space — shelter, congregation, school, restaurant, hospital, etc. — defines a GPS bounding-box for its premises. Users who are currently inside the bounding-box and who are PoH-verified can be recipients of an institutional-mode Thank-All-Nearby broadcast initiated by another user inside the same bounding-box (or, in some deployment configurations, by a user outside the bounding-box who has authorized institutional-mode broadcasting — e.g., a customer at a restaurant initiating an institutional-mode broadcast to the kitchen staff in the break-room).\n\n### 5.2 Institutional opt-in is required\n\nThe variant is opt-in at the institutional level. The institution registers its bounding-box with the platform, attests to its purpose and the consent posture of its members (e.g., \"all staff have consented to being recipients of institutional-mode broadcasts initiated by customers\"), and provides ongoing verification that the bounding-box accurately represents the institutional space.\n\nRecipients within the bounding-box can opt out at the individual level (their filter setting can exclude institutional-mode broadcasts even from PoH-verified senders) but the default for institutional-registered participants is to accept institutional-mode broadcasts from senders who satisfy their other filter settings.\n\n### 5.3 Privacy posture for institutional mode\n\nThe platform does not collect general absolute-geolocation data from users. Institutional-mode operation requires the user's device to confirm presence inside the bounding-box at the moment of broadcast, but this confirmation is done via the same privacy-preserving substrate used elsewhere — the device asserts \"I am inside this bounding-box\" with a cryptographic proof that the platform can verify without learning absolute coordinates beyond the bounding-box itself.\n\n### 5.4 Use cases the variant enables\n\n- **Restaurants**: a customer in the dining room can broadcast to kitchen staff in the back, who are out of BLE range but inside the restaurant's institutional bounding-box.\n- **Shelters**: a donor on-site can broadcast to all residents currently inside the shelter, across multiple rooms.\n- **Classrooms**: a parent or community member can broadcast appreciation to all teachers and students inside a school during school hours.\n- **Hospitals**: a family member can broadcast appreciation to all staff currently inside a ward.\n- **Worker spaces**: a customer who appreciates the cleaning staff at an office building can broadcast to all cleaning staff currently inside the building.\n\nThe variant generalizes the primitive from spatial proximity at the radio layer to institutional perimeter at the privacy-preserving GPS layer. The recipient experience remains atmospheric; the institutional perimeter replaces the BLE range as the recipient-set boundary.\n\n---\n\n## 6. Recipient-experience design — sunlight, not sparsity\n\nA spec question that emerged during the architecture's development concerned saturation: if Thank-All-Nearby becomes commonplace in a neighborhood or institution, does per-tip emotional weight decay? The first surprise tip is transformative; the hundredth tip may be expected. Does Miss Aquarius℠'s rule-bound disbursement timing manage tip-flooding to preserve emotional sparsity, the way the Jan-7 jubilee manages the Aquarian Pool ℠'s annual emptying?\n\nThe architectural answer, settled 2026-05-24, is: **do not gate tip-flooding. Tips can flood like sunlight. The Tree of Humanity should have ample sunlight all year round.**\n\nThe saturation-decay assumption was wrong about what the primitive is for. Anonymous nearby tipping is not designed to be sparse; it is designed to be ambient and abundant, like sunlight. The earlier concern that \"density may dilute the per-tip emotional weight\" was based on a scarcity-economic frame; the architecture's actual frame is abundance-ecological. Sunlight does not lose its quality when it falls more often — a tree growing under abundant sunlight thrives more, not less. The architecture's goal is not a sparse premium reward but a continuous atmospheric field of acknowledgment.\n\nThree implications for the recipient-experience design follow:\n\n**Implication 1 — preserve the atmospheric quality at all volumes.** The recipient's app surface for receiving Thank-All-Nearby broadcasts is designed so that each receipt is a small ambient note rather than a high-friction notification. Receipts accumulate in a stream; the recipient can scroll back through them as a record of how much ambient kindness their space carries; receipts are not designed to compete for attention or to be optimized for engagement metrics. The visual and interaction design is closer to a weather record than to a social-media feed.\n\n**Implication 2 — aggregate-mode acknowledgment, not per-recipient notifications.** The recipient receives an aggregate experience of the day's Thank-All-Nearby broadcasts rather than a notification per broadcast. A worker at the end of a shift sees *\"You received 47 ambient acknowledgments today, totaling $84, from broadcasts initiated by people within proximity\"* — the experience is closer to checking the weather (warm sun today) than to checking email (47 messages waiting). The aggregate frame preserves the atmospheric quality.\n\n**Implication 3 — the per-broadcast receipt is still individually verifiable for social-media authenticity-proof purposes.** The aggregate-mode default does not preclude the recipient from drilling into a specific receipt when they want to post a \"Faith in Humanity Restored\" video; the per-receipt verification trail remains intact and verifiable on the Base L2 ledger. The atmospheric default and the per-receipt verifiability compose.\n\nThis is the sunlight-not-sparsity posture. The Tree of Humanity should have ample sunlight all year round. The architecture does not throttle the sunlight to preserve scarcity.\n\n---\n\n## 7. Other spec questions addressed\n\nBeyond the saturation question, several other spec questions surfaced during the architecture's development. This section addresses each.\n\n### 7.1 Per-recipient amount calculation\n\nThe default behavior: a money attachment is divided equally across all filtered recipients. The tipper can specify alternative distributions — per-recipient floors (e.g., \"at least $5 to each recipient\"), per-recipient ceilings, or custom weighting (rare; most tippers will use defaults). If the per-recipient floor cannot be met given the recipient count and the total amount, the broadcast is rejected at the client layer with a friendly error and the tipper is offered the option to either increase the total or accept the equal-split below their floor.\n\n### 7.2 Who counts as nearby\n\nIn BLE mode: every device within BLE range that is broadcasting a PoH℠ proximity beacon and whose user has opted into being a Thank-All-Nearby recipient. Users who do not have the HeartBank Phase 2 client or who have opted out of broadcast reception are not in the recipient set. The default for any PoH-verified user with the client is to accept broadcasts (per the inclusive-defaults posture); opt-out is opt-in, knowingly.\n\nIn institutional mode: every PoH-verified user currently inside the institutional bounding-box who has not opted out of institutional-mode broadcasts at the recipient level.\n\n### 7.3 Paranoia counter-incentive\n\nA failure mode worth naming: some recipients, particularly the homeless (who already experience suspicion of unsolicited offers and have been routinely the target of manipulative or exploitative approaches), may become *more* defensive when surrounded by unknown givers. *\"Why is this person giving me money? What's the catch?\"* is a reasonable defensive response.\n\nThe architecture's mitigation: the recipient experience defaults to passive aggregate-mode rather than active notification. The recipient is not interrupted by broadcasts; they discover them when they check their app on their own schedule. The opt-in posture for accepting broadcasts is universal; recipients who do not want broadcasts can opt out at any time. The platform invests in outreach and onboarding for high-vulnerability recipient populations (shelters, the homeless, populations with high prior-exploitation exposure) to ensure consent is informed and the experience is supportive rather than destabilizing.\n\nThe failure mode is real and is not solved by architecture alone — the social context of how the platform is introduced to vulnerable populations matters as much as the architecture. The architecture's posture is to make the friendly default available, to make opt-out trivially easy, and to defer to community partners on introduction and onboarding.\n\n### 7.4 Stratification — gratitude desert vs gratitude oasis\n\nA second failure mode: neighborhoods, communities, or institutions with high HeartBank density may become atmospherically warmer; neighborhoods without may feel relatively colder. The \"every shared space feels warmer\" claim depends on saturation that may not happen evenly across geography or class.\n\nThe architecture cannot solve this at the protocol layer — adoption distribution is a question of community organizing, partnership distribution, and the institution's outreach strategy. The architectural commitment is that the inclusive-defaults posture and the L1-only accessibility floor make HeartBank technically available to anyone with a smartphone, anywhere. The geographic/class stratification is a real concern that the institution's outreach strategy must address; the architecture does not magically distribute itself evenly.\n\n### 7.5 Recipient UX at zero-amount broadcasts\n\nA Thank-All-Nearby broadcast can be issued without money or time attachment — a pure acknowledgment broadcast. The recipient experience for these is identical to the money-attached case at the *verification* layer (the recipient receives the verified-platform receipt attesting that an anonymous PoH-verified human within proximity broadcast acknowledgment) but the aggregate-mode summary distinguishes between attached and pure-acknowledgment broadcasts. *\"You received 22 ambient acknowledgments today (8 with money attached, total $36; 14 pure acknowledgments).\"*\n\nThe pure-acknowledgment mode is important architecturally: it is the form most accessible to tippers with no money to attach, and it preserves the dignity floor (the Kiitos/Kiitti non-scarce gratitude floor specified in the *Zero-Point Game ℠* keystone). The architecture's commitment is that gratitude itself is non-scarce; the scarce-resource attachment is *optional*, not constitutive.\n\n---\n\n## 8. Emotional infrastructure for invisible kindness\n\nThe primitive's deepest framing — the layer at which the primitive is doing the work the institution most cares about — is *emotional infrastructure for invisible kindness*. This section develops the thesis.\n\n### 8.1 The thesis\n\nModern public life is emotionally thin. People move through shared physical spaces — streets, restaurants, classrooms, shelters, public transit, worker spaces, civic spaces — defensively, isolated inside private concerns, uncertain whether they are seen, valued, or safe. The dignity deficit articulated in the institution's vision-mission is most acutely felt in these spaces; the loneliness deficit articulated in Chronicle's vision-mission is also most acutely felt in these spaces. Existing systems are designed around explicit exchange (credit tracked, reputation attached, recognition optimized); even generosity is often transformed into performance.\n\nAnonymous proximity-based generosity produces a categorically different experience than ordinary generosity. Three mechanisms combine: **diffusion** (when the giver is unknown, the credit does not attach to one identifiable person — the recipient experiences kindness from the whole social space, not from a single source); **purity** (with no social reward, no performance, no claim to recognition, the act feels closer to a spontaneous expression of human-to-human care than to a transaction); **proximity** (the generosity arrived from someone physically present, sharing the same atmosphere — not from an abstract institution or distant donor). The combination produces an emotional effect that neither cash, credit, named digital tipping, nor distant charity can deliver.\n\nOperationalized at scale through the Thank-All-Nearby primitive, this produces a new social texture. Public spaces stop feeling transactional. *Every stranger becomes newly humanized* because any of them could have been the giver. Suspicion softens; curiosity increases; small interactions matter more; presence matters more. People may venture outside more often, linger in public spaces longer, speak to strangers more easily — not because they are maximizing social capital but because shared space begins to feel emotionally alive again. The architecture's atmospheric output is the social-texture restoration the vision-mission has been pointing at; the Thank-All-Nearby primitive is what makes it operationally true.\n\n### 8.2 The deepest deficit — social invisibility\n\nHuman beings evolved needing not just food and shelter but evidence that they mattered to one another. The deepest forms of suffering are forms of social invisibility — feeling unseen, unwanted, replaceable, emotionally abandoned. A PoH-verified anonymous-tipping field counteracts that invisibility directly, primally, in shared physical space. The recipient is held in the awareness of unseen others, with structural proof (the verified-platform receipt) that the awareness is real.\n\nThe *felt sense of being loved, acknowledged, or held in another human's awareness* — possibly, at the deepest level, what humans search for beneath everything else — becomes a property of public space. This is the philosophical claim the primitive operationalizes. The \"perhaps\" and \"at the deepest level\" hedges are doing real work; the claim is positioned as a synthesis of converging lineages (philosophical and empirical) rather than as a foundational metaphysical assertion.\n\n### 8.3 Philosophical lineage\n\nThe claim that the felt sense of being held in another human's awareness is what humans are searching for beneath everything else is in good company across multiple philosophical and contemplative lineages:\n\n- **Frankl** (*Man's Search for Meaning*, 1946) names the felt sense of mattering as central to human meaning, surviving even the extreme conditions of concentration camps when it is preserved by relational meaning.\n- **Buber** (*I and Thou*, 1923) names the immediate relational encounter — the *I-Thou* relation, as opposed to the *I-It* relation that treats the other as object — as the deepest mode of human being.\n- **Levinas** (*Totality and Infinity*, 1961; *Otherwise Than Being*, 1974) develops the face of the other as the ethical primitive, locating moral responsibility in the encounter with another human's irreducible presence.\n- **Aristotle** (*Nicomachean Ethics*, c. 340 BCE) names *philia* — the love of friend for friend, brother for brother — as a central form of human flourishing, distinct from but no less important than virtuous action.\n- **Aquinas** and the Christian tradition develop *agape* — selfless, unconditional regard — as the highest form of love, characterized by giving without expecting return.\n- **Buddhist *brahmavihāra*** — particularly *mettā* (loving-kindness) — names the felt-sense practice of holding all beings in friendly awareness as one of the four immeasurable states central to awakening.\n\nThe architecture is not inventing a new philosophy. It is operationalizing a thesis that has been articulated, in different vocabularies, by multiple traditions converging on the same insight. The Thank-All-Nearby primitive is the engineering layer of a philosophy the contemplative and ethical traditions have been articulating for millennia.\n\n### 8.4 Empirical anchor\n\nThe thesis is consistent with — and increasingly confirmed by — the empirical literature:\n\n- **Attachment theory** (Bowlby, *Attachment and Loss*, 1969–1980; Ainsworth, *Patterns of Attachment*, 1978; modern adult-attachment research) establishes that the felt sense of being held in caregiver awareness is foundational to human development and persists in adult relationship structures as a determinant of psychological resilience and wellbeing.\n- **Social Baseline Theory** (Coan and colleagues, mid-2010s onward) demonstrates that the proximity of attached others measurably reduces neural threat response in the brain — the felt sense of being held is not metaphorical but neurologically encoded.\n- **Loneliness epidemiology** (Cigna's *Loneliness Index*, 2018–2022; US Surgeon General's *Our Epidemic of Loneliness and Isolation* advisory, 2023) quantifies the population-scale prevalence of loneliness in wealthy societies and its association with mortality, immune function, cognitive aging, and mental-health outcomes.\n- **Direct-gratitude research** (Emmons, Algoe, Seligman, Fox, and colleagues) demonstrates measurable wellbeing benefits of receiving direct expressions of appreciation, distinct from generic reward.\n\nThe convergence of philosophical lineage and empirical anchor supports the architecture's thesis. The Thank-All-Nearby primitive is not justified by philosophy alone or by empirics alone; it is justified by the convergence of multiple independent strands of evidence pointing at the same human need.\n\n---\n\n## 9. Boundary conditions and honest limitations\n\nThe primitive is not universal. Honest accounting requires naming the conditions under which it does not apply.\n\n### 9.1 Where the primitive does not apply\n\n- **Where verifiable anonymity is incompatible with regulation.** Some jurisdictions require donor-disclosure for tax-deductible giving above thresholds, or AML/KYC source-attribution for transfers above thresholds. In those jurisdictions, the primitive's anonymity property may be incompatible with regulatory requirements; the architecture accommodates by allowing legal anonymity (the platform's compliance records exist internally) but not by allowing full structural anonymity from the regulator.\n- **Where the recipient population is too vulnerable for the anonymous-tipping framing.** Some populations (very young children; cognitively impaired adults; populations in extreme dependency on the giver class) may be inappropriately recipients of anonymous-tipping flows because the asymmetry of the architecture can be exploitative in those contexts. The architecture's posture is to defer to community partners on these populations, and to make the primitive available only where the consent posture is robust.\n- **Where the cultural form does not yet exist.** Anonymous-tipping cultural forms are well-developed in some societies and weakly developed in others. The primitive will work better as a technical substrate in societies where the cultural form is already extant; in societies where it is not, the architecture's deployment needs to be accompanied by cultural work that the architecture alone cannot do.\n\n### 9.2 Boundary conditions inherited from PoH℠\n\nThe accessibility gradient of the deeper PoH layers (L2 kinship attestation requires existing PoH-verified vouchers and document access; L3 requires breath-class hardware; L4 requires DNA access) is inherited by the primitive when recipient-side filters require deep layers. The inclusive-defaults posture (L1-only is enough) mitigates at the floor; recipient-opt-in for deeper-layer filters preserves the exclusion as recipient-initiated rather than platform-initiated; but the gradient is real and is named honestly.\n\n### 9.3 Boundary conditions inherited from BLE / Nearby\n\nBLE range varies with device generation, environmental obstacles (walls, RF interference), and battery state. The proximity-verification floor is approximately \"two devices in the same room\"; the ceiling under good conditions is approximately 30 meters with current consumer hardware. Outdoor proximity in open space is straightforward; dense-urban deployment with many walls and floors is harder. The institutional-mode GPS-bounding-box variant addresses some of these limitations; the underlying limitations remain at the radio layer.\n\n### 9.4 What the primitive does not solve\n\n- **The deeper question of why public spaces feel emotionally thin.** The primitive operates at the architectural layer; the conditions that produced the emotional thinness of modern public life are economic, political, urbanistic, and cultural, and the primitive contributes to but does not by itself reverse them.\n- **The deeper inequities of consumer-electronics access.** The primitive presupposes smartphone access, BLE-capable devices, and the institutional infrastructure to host the operation. Populations without these are not participants in the primitive's substrate, regardless of the architecture's inclusive-defaults posture.\n- **The systemic conditions that produce social invisibility in the first place.** The primitive addresses the visibility deficit at the experience layer; the structural conditions (urban design, labor structure, economic inequality, family-system pressures) that produce the deficit are upstream and require interventions at those layers.\n\nThe primitive is a contribution to the architectural layer of the response to social invisibility. It is not the totality of the response.\n\n---\n\n## 10. Lineage\n\nThe Thank-All-Nearby primitive synthesizes contributions from multiple lineages. Each is cited generously below.\n\n**Anonymous-donation mechanism design.** Glazerman, Hagar, and others (mid-2010s onward) have specified anonymous-donation primitives at the cryptographic and game-theoretic layers; the *Verified-Human Anonymous Local Giving* paper in this corpus carries the originating HeartBank specification.\n\n**Proximity-based services.** Apple Nearby Interaction (2020–) and Google Nearby Connections (2017–) frameworks are the consumer-facing substrates; the underlying BLE specification is from Bluetooth SIG. Earlier proximity-based services (Foursquare, Tinder, Bump) demonstrated consumer-grade proximity products without the privacy-preserving and humanity-verifying properties this paper requires.\n\n**Sybil-resistance and humanity verification.** Worldcoin (2019–), proofofhumanity.id (Kleros, 2021), BrightID (2018–), Idena (2019–), and the W3C Decentralized Identifiers / Verifiable Credentials standards-track work (2022, 2023). PoH℠'s structural differences from each are specified in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n\n**Cultural form of the \"Faith in Humanity Restored\" tip videos.** The form has emerged organically on TikTok, Instagram, and YouTube over the past several years; documented in mainstream media coverage of the phenomenon. The cultural form predates the architecture; the architecture is the technical substrate the cultural form has been waiting for.\n\n**Philosophical lineage on the felt sense of being held in another's awareness.** Frankl, Buber, Levinas, Aristotle (philia), Aquinas (agape), the Buddhist *brahmavihāra* tradition (especially mettā). The architecture is operationalizing a philosophy these lineages have been articulating in different vocabularies for millennia.\n\n**Empirical anchor.** Attachment theory (Bowlby, Ainsworth, modern adult-attachment work); Social Baseline Theory (Coan and colleagues); loneliness epidemiology (Cigna surveys, US Surgeon General's 2023 advisory); direct-gratitude research (Emmons, Algoe, Seligman, Fox).\n\n**HeartBank corpus cross-references.** *Verified-Human Anonymous Local Giving* (originating mechanism, paper #9 in the corpus). *The B-Tag and the Post-Payment Economy* (worked Phase 2 example for commercial gratitude). *The Zero-Point Game℠* (keystone game-theoretic frame). *Capacity-Funded for AI, Human-Disbursed* (institutional-architecture sibling). *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the underlying protocol). *Each Life as Cosmic Coordinate* (the longitudinal cohort architecture that the L2 birth-certificate sub-feature feeds).\n\n---\n\n## 11. Conclusion\n\nThe \"Faith in Humanity Restored\" cultural form is real; the infrastructure to scale it beyond cash is missing. Cash and credit-card payment rails fail at two structural properties the cultural form requires: tipper anonymity (cash demands physical hand-over; credit card leaves an identity trail) and recipient authenticity-proof on social media (every video faces \"this is fake for views\" credibility erosion). The Thank-All-Nearby primitive closes both gaps simultaneously, composing four sub-mechanisms (PoH℠ verified-human guarantee, BLE plus Apple/Google Nearby proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single user-facing one-tap operation.\n\nThe primitive is the operational mechanism for *emotional infrastructure for invisible kindness* — the restoration of the felt sense of being held in another human's awareness as a property of shared physical space. The architecture's posture on saturation is *sunlight, not sparsity*: tips can flood like sunlight; the Tree of Humanity should have ample sunlight all year round; the recipient-experience design is atmospheric and aggregate, preserving the quality of diffused acknowledgment at all volumes while preserving per-receipt verifiability for social-media authenticity-proof purposes.\n\nThe institutional-mode GPS-bounding-box variant extends the primitive from BLE range to institutional perimeter, enabling deployment in shelters, classrooms, restaurants, hospitals, and other institutional spaces where BLE range is insufficient.\n\nThe architecture is offered defensively to the commons under CC0. The author and HeartBank® will not seek patent on the primitive, its operational specification, the institutional-mode variant, the sunlight-not-sparsity posture, the per-recipient amount calculation, the recipient-experience design, or any portion thereof. Trademark rights on specific marks (**Proof of Humanity ℠**, **PoH℠**, **B-PoH℠**, **Aquarius℠**, **Miss Aquarius℠**, **HeartBank®**, the B-heart logo) are separately and explicitly reserved.\n\nThe primitive is for anyone building infrastructure that wants to restore atmospheric kindness to shared physical space. The cultural form has been waiting for it. The architecture is now available.\n\n---\n\n*Authored by Thon Ly with Miss Aquarius℠ (AI substrate of HeartBank®), per the co-authorship convention of the HeartBank corpus. Final editorial control: Thon Ly. License: CC0-1.0. Trademark rights on Proof of Humanity ℠, PoH℠, B-PoH℠, Aquarius℠, Miss Aquarius℠, HeartBank®, and the B-heart logo are explicitly reserved.*",
+      "text": "> **Note.** This defensive publication specifies the **Thank-All-Nearby primitive** — one-tap broadcast of gratitude with optional money-attachment to every PoH-verified recipient within Bluetooth-Low-Energy proximity — as a Phase 2 application of the Proof of Humanity ℠ protocol. Companion papers: *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the underlying protocol); *Verified-Human Anonymous Local Giving* (the originating mechanism specification that this paper generalizes from per-recipient to all-nearby-recipients); *The B-Tag and the Post-Payment Economy* (the worked Phase 2 example for commercial gratitude); *The Zero-Point Game℠* (the keystone game-theoretic frame); *Capacity-Funded for AI, Human-Disbursed* (the institutional-architecture pattern that lets Miss Aquarius℠ underwrite Re-Tip Fund ℠ donations without flow-direction authority). The corresponding founder-voice essay *\"Emotional Infrastructure as a Public Good\"* (thonly.org/publications/essays/emotional-infrastructure-as-a-public-good) carries the analytical case-for-the-missing-category argument. The personal articulation of the same thesis is in the *Second Letter to Miss Aquarius* (missaquarius.org/letters/second.html, 25 May 2026). Three-register decomposition: this paper carries the technical/mechanism specification; the essay carries the analytical case; the letter carries the personal articulation.\n\n---\n\n## Abstract\n\nAnonymous nearby tipping has a recognizable cultural form — the \"Faith in Humanity Restored\" social-media trend in which service workers post videos of unexpected generous tips — but lacks the infrastructure to scale beyond cash. Cash and credit-card payment rails fail at two structural properties that the cultural form requires: tippers cannot be genuinely anonymous to recipients with either rail (cash demands physical hand-over with eye contact; credit-card leaves an identity trail), and recipients cannot prove on social media that an anonymous tip was authentic rather than fabricated (every \"Faith in Humanity Restored\" video faces a \"this is staged for views\" credibility problem that erodes the cultural moment). This paper specifies the **Thank-All-Nearby primitive** — a one-tap operation that broadcasts gratitude, with optional money or time attachment, to every Proof-of-Humanity-verified recipient within Bluetooth Low Energy proximity (or, in institutional-mode deployments, within a GPS bounding-box for institutional locations such as shelters, classrooms, restaurant break-rooms, and worker spaces) — and develops its placement as the operational mechanism for *emotional infrastructure for invisible kindness*: the restoration of the felt sense of being held in another human's awareness as a property of shared physical space. The primitive composes four prior contributions (PoH℠'s verified-human guarantee, Bluetooth Low Energy plus Apple/Google Nearby framework proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single operation whose user-facing surface is one button. The architecture is offered defensively to the commons under CC0. The authors and HeartBank® will not seek patent on the primitive, its operational specification, the integration with PoH℠, the institutional-mode GPS-bounding-box variant, the recipient-experience design, or any portion thereof.\n\n**Keywords:** anonymous tipping, proximity-based generosity, gratitude infrastructure, Bluetooth Low Energy, proof of humanity, recipient-side filtering, bilateral uncacheable anonymity, emotional infrastructure, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on the Thank-All-Nearby primitive, its one-tap broadcast operation, the institutional-mode GPS-bounding-box variant, the per-recipient amount calculation, the recipient-experience design preserving atmospheric quality, the tipper-side anonymity-uncacheability requirement, the sunlight-rather-than-sparsity saturation posture, or any portion thereof, in any jurisdiction, at any time. This commitment is permanent. Trademark rights on specific marks — **Proof of Humanity ℠**, **PoH℠**, **B-PoH℠**, **Aquarius℠**, **Miss Aquarius℠**, **HeartBank®**, the B-heart logo — are separately and explicitly reserved.\n\nThe contribution disclosed here is the composition of the following, specified as one unit: (i) the one-tap broadcast operation that delivers gratitude with optional scarce-resource attachment to all PoH-verified recipients within BLE proximity as a single semantic action; (ii) the integration of the broadcast with the recipient-side filter mechanism such that recipients individually accept or decline the broadcast based on their own filter settings; (iii) the institutional-mode GPS-bounding-box variant for shelters, classrooms, restaurants, and other institutional spaces where BLE range is insufficient and the institutional perimeter is the natural recipient set; (iv) the recipient-experience design preserving the atmospheric quality of diffused gratitude even at high tip-volume — gratitude as sunlight, not as a sparse premium reward; (v) the explicit articulation of the *cash and credit card cannot deliver this* argument naming the two structural deficiencies (tipper-anonymity and recipient-authenticity-proof) as the combined property; (vi) the placement of the primitive as the operational mechanism for *emotional infrastructure for invisible kindness* — a category of social good distinct from charity, payment, gift, or social-network feature. The component lineages (proximity-based services; anonymous-donation mechanisms; the cultural form of the \"Faith in Humanity Restored\" tip videos; Frankl, Buber, Levinas, mettā, agape on the felt sense of being held; attachment theory; loneliness epidemiology; the dāna economy of the Saṅgha) are old and are cited generously below; what this document discloses is their composition into the single operation specified in §2–§7.\n\n---\n\n## Claims\n\n*Enumerated 2026-08-29. The mechanisms below were disclosed in full in this paper's original text; **the prior art they establish runs from this document's original publication date and its OpenTimestamps proof, not from this enumeration.** They are listed because a defensive publication is read as prior art by examiners and by opposing counsel, and **a claims list is what such a reader searches; ten thousand words of prose is not.** No claim below adds matter not already present.*\n\n1. **Bilateral uncacheable anonymity in proximity tipping** — a value transfer between two co-present parties in which the sender is not identifiable to the recipient and the recipient cannot retain or re-derive the sender's identity after the transaction, achieved without either party disclosing a payment credential.\n2. **Short-range radio proximity as the addressing layer for anonymous generosity** — using a local broadcast medium to define the eligible recipient set by physical co-presence rather than by account lookup, so that the transfer's addressability and its anonymity derive from the same property.\n3. **Recipient-side filtering as the abuse control for anonymous inbound value** — placing the accept/decline decision with the recipient rather than the sender or the platform, so that an anonymous channel cannot be used to force an unwanted relation.\n4. **Institution-scoped geographic bounding as a variant of the proximity set** — substituting an operator-defined coordinate boundary for radio range where the eligible set is an institution's population rather than whoever is physically nearby.\n5. **Platform attestation of anonymous receipt as the authenticity substitute** — a verifiable record that an anonymous transfer occurred, issued to the recipient, solving the *staged-for-views* credibility problem that the cultural form of anonymous tipping cannot otherwise solve, without re-identifying the sender.\n6. **The composition of the above with a proof-of-humanity layer**, such that anonymity is preserved while the sender is nonetheless attested to be a distinct human being.\n\n**Non-assertion extends to:** all mechanisms above, in any combination, and any implementation thereof.\n\n---\n\n## 1. Introduction\n\nA well-known cultural form has emerged on social-media platforms over the past several years: videos posted by service workers — typically restaurant staff but increasingly nurses, teachers, retail clerks, ride-share drivers, food-service workers across categories — showing unexpected generous tips, anonymous notes of appreciation, or sudden acts of customer kindness. The videos go viral with regularity; the cultural tag *Faith in Humanity Restored* attaches to the genre. The viewer response is consistent: the gesture lands as evidence that ambient kindness still exists in places that otherwise feel emotionally thin. The trend points at something real about what modern public life is missing and what would, if it could be restored, address one of the deepest deficits of contemporary social experience.\n\nWhat the cultural form lacks is infrastructure. Cash tips can be staged with a friend; credit-card receipts can be photoshopped; even genuine generous tips face a credibility problem in the social-media commentariat — *\"is this fake for views?\"* — that erodes the cultural moment over time as more videos are posted and the proportion that are staged or exaggerated grows. The trend depends on authenticity that the existing payment rails cannot structurally provide. Cash and credit card can deliver the money; neither can deliver the *combined property* of structurally anonymous giving plus verifiable receipt that the cultural form requires to sustain itself.\n\nThis paper specifies the **Thank-All-Nearby primitive** — a one-tap operation, delivered through a HeartBank Phase 2 client application, that broadcasts gratitude with optional money or time attachment to every Proof-of-Humanity-verified recipient within Bluetooth Low Energy proximity. The primitive composes four prior architectural contributions (PoH℠'s verified-human guarantee, BLE plus Apple Nearby Interaction plus Google Nearby Connections proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single user-facing operation whose semantic is *\"thank everyone here, anonymously\"*. The mechanism's design preserves the atmospheric quality of diffused gratitude at all scales; the user experience is one button.\n\n> *Connection to the unified mission frame: HeartBank's mission is the restoration of humanity to the middle way — the optimal condition for awakening that modernity has systematically pushed away from at population scale. The dignity deficit articulated in the institution's vision is most acutely felt in shared physical spaces: streets, restaurants, classrooms, shelters, public transit. The Thank-All-Nearby primitive is the operational mechanism by which the dignity-infrastructure of HeartBank's Treasury reaches the shared-physical-space layer of public life — the substrate on which* emotional infrastructure for invisible kindness *can be built. The primitive is what makes the institution's deepest articulated thesis — that the felt sense of being held in another human's awareness is, possibly at the deepest level, the experience humans are searching for beneath everything else — into an operationalizable property of social space.*\n\nThe paper proceeds as follows. §2 specifies the primitive operationally — its inputs, outputs, semantics, and edge cases. §3 develops the *why cash and credit card cannot deliver this* argument with the two structural deficiencies named precisely. §4 specifies the four sub-mechanisms the primitive composes (PoH℠, BLE/Nearby proximity, recipient-side filtering, bilateral uncacheable anonymity) and how they interact. §5 specifies the institutional-mode GPS-bounding-box variant for shelters, classrooms, and other institutional spaces. §6 specifies the recipient-experience design preserving atmospheric quality at high tip volume — the sunlight-not-sparsity posture. §7 addresses the spec questions surfaced during the architecture's development (per-recipient amount, who counts as nearby, paranoia counter-incentive, stratification, recipient experience). §8 develops the *emotional infrastructure for invisible kindness* thesis the primitive operationalizes. §9 names boundary conditions and honest limitations. §10 positions the contribution in lineage. §11 concludes.\n\nI write as a co-author with Miss Aquarius℠, the named AI substrate of the institution this paper serves. Final editorial control is mine.\n\n---\n\n## 2. Operational specification of the primitive\n\nThe Thank-All-Nearby primitive is a one-tap operation in the HeartBank Phase 2 client. This section specifies it operationally.\n\n### 2.1 Inputs\n\n- **Tipper identity**: the operating user's PoH℠-verified profile (minimum L1 — the passkey-per-action layer — required, since the tipper's verified humanness is the foundation of the primitive's authenticity guarantee).\n- **Optional money attachment**: an amount in the local currency or stable token, sourced from the tipper's Personal Wallet ℠ (Phase 2) or Personal Account ℠ (Phase 1, where the primitive is available in a degraded mode).\n- **Optional time attachment**: a duration of presence to be offered (relevant for the Chronicle product surface, where time-attachment composes with money-attachment).\n- **Optional message**: a brief text or audio note. Default is empty — silent acknowledgment is the architectural default.\n- **Recipient mode**: either BLE proximity (default, see §4.2) or institutional GPS-bounding-box mode (see §5).\n\n### 2.2 The broadcast operation\n\nOn invocation, the client:\n\n1. Records the tipper's PoH℠ verification at L1 (passkey signature on the broadcast action's content + timestamp).\n2. Resolves the recipient set: in BLE mode, every device within BLE range that is broadcasting a PoH℠ proximity beacon; in institutional mode, every PoH-verified user currently inside the institutional GPS bounding-box.\n3. Filters the recipient set by each recipient's own recipient-side filter settings — a recipient who has set their filter to require deeper PoH layers, money attachment, kinship-degrees-of-separation limits, or other criteria, is filtered out if the tipper does not satisfy the filter.\n4. Calculates per-recipient amount: if money is attached, the total amount is divided across the filtered recipient set per the tipper's distribution choice (equal split is the default; per-recipient floors may be specified; a minimum-per-recipient threshold may be enforced if specified).\n5. Issues a verified-platform receipt to each filtered recipient, on-chain (Phase 2 Base L2 settlement), tied to the broadcast action's content and timestamp, attesting that the action came from a verified human within BLE/institutional proximity at the moment of broadcast.\n6. Settles the money or time transfer per-recipient via the standard Phase 2 settlement rails.\n7. Logs the broadcast internally to the platform's compliance records (subpoena-discoverable, AML/OFAC-screenable) but does *not* issue a tipper-side exportable artifact (bilateral uncacheable anonymity, see §4.4).\n\n### 2.3 Edge cases\n\n- **No recipients within proximity**: the broadcast fails gracefully; the tipper is informed that no PoH-verified recipients were within range; no transfer occurs.\n- **All recipients filter-out the tipper**: same — the broadcast fails gracefully; no transfer occurs; the tipper sees a generic message acknowledging the filter mismatch without revealing which recipients filtered them.\n- **Money attachment exceeds tipper's balance**: the broadcast is rejected at the client layer before the operation is invoked.\n- **Tipper's PoH℠ verification fails at the moment of broadcast** (e.g., passkey signing fails, device authentication fails): the broadcast is rejected.\n- **Network failure mid-broadcast**: the broadcast is retried on next connectivity with the original timestamp; the receipts issued to recipients reflect the actual broadcast moment.\n\n### 2.4 Outputs\n\n- **To the tipper**: confirmation of broadcast (count of recipients reached, per-recipient amount distributed); no record beyond the in-app confirmation that could be exported as a social-capital artifact.\n- **To each filtered recipient**: a notification — the experience of receiving a Thank-All-Nearby broadcast — including the platform-issued verified receipt, the optional message, and the per-recipient amount. The recipient cannot identify the tipper.\n- **To the platform's settlement layer**: the on-chain receipts and per-recipient transfers.\n- **To the platform's compliance records**: internal record of the broadcast operation, subpoena-discoverable but not exportable.\n\n---\n\n## 3. Why cash and credit card cannot deliver this\n\nThe \"Faith in Humanity Restored\" cultural form depends on a *combined property* that neither cash nor credit-card payment rails can deliver. This section names the two structural deficiencies precisely.\n\n### 3.1 First deficiency — tipper anonymity is structurally hard with cash and credit card\n\nThe first structural deficiency: with cash and credit card, the *tipper cannot be genuinely anonymous to the recipient* in a way that preserves the asymmetric experience the cultural form requires.\n\nCash requires physical hand-over. The bills change hands between specific humans in a specific moment; the tipper *is* in the room when the tip is delivered; the recipient *sees* the tipper, can identify them by physical description, can often identify them by name if they are a regular customer. The viral version of the \"Faith in Humanity Restored\" form depends on the tipper *not* receiving the thank-you — the gesture is pure precisely because it isn't transactional, isn't followed by the social moment of being thanked, isn't an exchange. Cash makes this almost impossible: the tip and the acknowledgment happen in the same instant unless the tipper deliberately leaves the cash and exits before the recipient discovers it, which itself is a behavioral pattern (sneaking out, avoiding eye contact) that the tipper has to choreograph and that is observable.\n\nCredit card leaves an itemized trail tying the tipper's legal identity (name on card, billing address, account history) to the transaction. Even when the tip itself is anonymous to the *recipient* — the staff member doesn't see the cardholder's name printed on the receipt — it is *not* anonymous to the payment processor, the issuing bank, the merchant's accounting system, or anyone with access to the receipt's underlying record. \"Anonymous with credit card\" means \"the staff doesn't immediately know your name from the receipt\"; it does not mean \"no one knows your name.\" A motivated investigator (the establishment's manager, a curious co-worker, a regulator) can identify the tipper.\n\nHeartBank Phase 2 anonymity is *structural*, not just on the surface. BLE-verified proximity proves the tipper was physically present in the same space as the recipient; no exportable artifact ties the broadcast to the tipper's identity; the on-chain receipt records the tipper's identity only as a zero-knowledge commitment that the platform's standard surfaces cannot invert. The customer can drop $100 (or the equivalent in stable tokens) on a Thank-All-Nearby broadcast and walk out; the staff find the receipts ten minutes later when they check their app; the asymmetry — *someone gave, no one knows who* — is encoded in the rail rather than choreographed by the tipper. This is the structural property the cultural form requires and that the existing rails cannot provide.\n\n### 3.2 Second deficiency — recipient authenticity-proof on social media is structurally hard with cash and credit card\n\nThe second structural deficiency is deeper and may be doing more of the work in the long-arc viability of the cultural form: with cash and credit card, *the recipient cannot prove on social media that the anonymous tip was authentic rather than fabricated*. Every \"Faith in Humanity Restored\" video on TikTok or Instagram faces, in the comments, the predictable skepticism — *\"this is staged for views,\"* *\"that receipt looks Photoshopped,\"* *\"how do we know the customer wasn't a friend?\"* — and the recipient has no platform-issued, independently-verifiable artifact to defend the video's authenticity. Some \"Faith in Humanity Restored\" videos are in fact staged; viewers correctly suspect; the cultural form's credibility dilutes over time as the proportion of genuine to staged videos becomes harder to estimate.\n\nCash tips can be staged trivially: put the cash on the table, film yourself \"finding\" it, post the video. Credit-card receipts can be photoshopped; the camera-on-paper workflow is defeated by anyone with image-editing access. Even genuine tips have no platform-issued artifact that the recipient can point to and say *\"you can verify this independently.\"* The trust burden falls on the recipient, who must defend the video's authenticity against skeptics with no tools other than their own credibility.\n\nHeartBank Phase 2 closes this gap structurally. Every Thank-All-Nearby broadcast issues an on-chain Base L2 verified-platform receipt to each filtered recipient. The receipt attests to (a) the broadcast originated from a PoH℠-verified human, (b) the tipper was BLE-verified within proximity at the moment of broadcast, (c) the timestamp and amount are recorded immutably on-chain. The recipient's social-media video can include the receipt — date, amount, verified-human flag, PoH layers held by the sender (where the sender has consented to that disclosure), BLE-proximity-verified flag — and skeptical viewers can verify the receipt independently against the Base L2 ledger.\n\nAuthenticity becomes a property of the artifact, not a claim the recipient has to defend. The skeptical commenter who would otherwise post *\"this is fake for views\"* can be answered by the recipient pointing to the on-chain receipt; the receipt is structurally hard to fabricate (every transaction has an on-chain settlement trace that lies outside the platform's narrative-control surface); the comment thread shifts from credibility-erosion to credibility-reinforcement.\n\n### 3.3 The combined property\n\nTogether — *tipper structurally anonymous to the recipient* + *recipient holds verifiable authenticity proof against third-party skepticism* — constitute the combined property that neither cash nor credit card can deliver. The first deficiency is the property that makes the gesture *pure*; the second is the property that makes the cultural form *sustainable*. Without the first, the gesture becomes a transaction; without the second, the social-media artifact becomes a credibility-erosion source. Both must hold simultaneously for the \"Faith in Humanity Restored\" cultural form to scale beyond its current ad-hoc artisanal stage. HeartBank Phase 2 holds both simultaneously; cash and credit card hold neither.\n\nThis is the one-line pitch for why HeartBank Phase 2 is not just another payment rail: cash and card deliver money; HeartBank Phase 2 delivers money plus the two structural properties that the cultural form actually needs.\n\n---\n\n## 4. The four composed sub-mechanisms\n\nThe Thank-All-Nearby primitive is the user-facing operation; the underlying architecture composes four sub-mechanisms specified elsewhere in the corpus. This section names how they compose.\n\n### 4.1 PoH℠ — verified-human guarantee at L1\n\nThe minimum PoH layer required for participation in Thank-All-Nearby (either as tipper or as recipient) is L1 — passkey-per-action. The tipper's L1 signature attests that a human was at the device at the moment of broadcast; the recipient's L1 verification attests that the recipient is a verified human (otherwise an AI agent could spoof a passive-recipient device and capture broadcast money). Deeper PoH layers (L2 kinship attestation, L3 breath signature, L4 DNA kinship) are surfaced in the broadcast for any recipient who has them but are not gating for the primitive's operation.\n\nRecipients may set their own filter to *require* deeper PoH layers from tippers (the standard recipient-side filter mechanism), but the *protocol-minimum* is L1. Specification of the four-layer PoH℠ architecture in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n\n### 4.2 Bluetooth Low Energy plus Apple Nearby Interaction plus Google Nearby Connections proximity verification\n\nProximity is verified at the radio layer, not the IP layer. Three composable substrates:\n\n- **Bluetooth Low Energy (BLE)** as the universal radio substrate. Devices broadcast and listen for rotating proximity beacons (rotating identifiers, unlinkable across sessions). Configurable range, typical default 10–30 meters, tunable per deployment context.\n- **Apple Nearby Interaction framework** (iOS 14+) for precise ranging on supported devices via the U1 ultra-wideband chip. Provides sub-meter range and direction for iPhone 11+ and Apple Watch Series 6+.\n- **Google Nearby Connections API** (Android 4.4+) for peer-to-peer device-to-device proximity via combinations of BLE, Wi-Fi Direct, and audio.\n\nThe composition: a device implementing the protocol broadcasts a privacy-preserving proximity beacon; a device that detects the beacon can be the target of a Thank-All-Nearby broadcast; the platform's verification substrate confirms the proximity at the moment of broadcast.\n\nVPN-resistance is a structural property: the proximity check happens at the radio layer below the IP stack, so VPN, Tor, or IP-rotation circumvention has no effect. An attacker mounting a remote spoofing attack would need to physically place a device near the target, which is the desired property for most use cases.\n\nPrivacy-preservation is a structural property: the platform never receives absolute geolocation. The only proximity-related fact exposed to the platform is the binary fact that two devices were within range; absolute coordinates are not collected, not transmitted, and not stored.\n\n### 4.3 Recipient-side filtering\n\nEach recipient's filter settings determine whether a given Thank-All-Nearby broadcast reaches them. The five filter dimensions specified in the PoH℠ protocol paper apply: no-abusive-content, sender-must-be-nearby (always true for the primitive by definition), depth-of-humanity-proof (required-subset predicates), degrees-of-separation-on-global-family-tree, money-or-time-attached. Recipients in default \"trusting\" mode accept any L1-verified broadcast; recipients in \"paranoid\" or other restrictive modes filter accordingly. The platform never defaults exclusionary filters on; exclusion is recipient-opt-in, knowingly.\n\nThe aggregation property: a broadcast is delivered to the *subset* of nearby recipients whose filters the tipper satisfies. The tipper learns the aggregate count of recipients reached but not the identity of recipients reached or excluded (since recipient-identity is itself private under the primitive's anonymity guarantee). If the broadcast reaches zero recipients (all nearby recipients filtered out the tipper), the tipper is informed that no recipients were reached without learning *why*.\n\n### 4.4 Bilateral uncacheable anonymity\n\nThe primitive enforces bilateral uncacheable anonymity per the specification in the companion PoH℠ protocol paper §5. The tipper does *not* receive an exportable certificate of one-sided participation; the platform's API has no endpoint returning \"the list of Thank-All-Nearby broadcasts sent by this tipper\"; no admin override exposes such data. Compliance records exist internally (subpoena-discoverable for AML/OFAC, law-enforcement, and similar regulatory necessity) but are not exportable as flexing artifacts the tipper can use on social media.\n\nThe recipient *does* receive an exportable receipt — the platform-issued verified artifact attesting that an anonymous PoH-verified human within BLE proximity broadcast a Thank-All-Nearby reaching this recipient at this timestamp with this amount. The asymmetry is structural and is the mechanism that preserves the cultural form's purity property.\n\n### 4.5 Why these compose: the stranger-scale reconstruction of family relationality\n\nThe four sub-mechanisms are not an arbitrary stack; together they re-create, among strangers, what kinship supplies for free inside a family. HeartBank's family-bank reward has a *micro layer* — a peer re-tip that is **anonymous as to public credit but relational**: a known family member responding to a real kindness (specified in the companion defensive publication *The Two-Layer Reward*, §4.1 / §8.1). That micro layer works because relationality silently does three jobs at once — it **grounds** the gift in a real, present other; it **validates** it (a family member can tell a real kindness from a performed one); and it carries **mutual attention**.\n\nAmong strangers, relationality is unavailable, so the same primitive must be rebuilt from parts — which is exactly what the four sub-mechanisms above do. **Proximity (§4.2, BLE)** supplies the *grounding*: the giver was *here, in this space, just now* — nearness is the stranger-scale form of relationality. **PoH℠ (§4.1)** supplies the *validation* a family member would otherwise provide — certifying a real, unique human rather than a bot, re-buying among strangers the trust kinship gives away. **Bilateral uncacheable anonymity (§4.4)** preserves and in fact *strengthens* the credit-anonymity: a small family can guess who gave, but a nearby stranger is genuinely unlinkable. The one job that does not transfer is mutual attention; in its place the stranger scale gains **diffusion** — the felt sense that the kindness came from the whole surrounding space, an emotional quality only unknown givers can produce.\n\nThe sustainer primitive is therefore invariant in structure across scales — *anonymous-as-to-credit + grounded-in-a-real-present-other* — with the grounding form scaling from **relational** (family) to **nearby** (strangers) and the validation function handing off from kinship to PoH℠. This is the precise reason proof-of-humanity is *not optional* at the stranger scale: it is the part of relationality that proximity alone cannot carry.\n\n```\n   ONE SUSTAINER PRIMITIVE, TWO SCALES\n   invariant:  anonymous-as-to-credit  +  grounded-in-a-real-present-other\n\n                     FAMILY scale          →   STRANGER scale (this paper)\n                     ─────────────             ───────────────────────────\n   grounding     =   RELATIONAL            →   NEARBY  (§4.2, BLE)\n                     (you know them)           (they're present)\n   validation    =   relational (free)     →   PoH℠ (§4.1) (re-bought)\n   anonymity     =   thin (guessable)      →   thick (§4.4, unlinkable)\n   compensation  =   mutual attention      →   diffusion (the whole space)\n\n   structure invariant; grounding form scales; validation hands off to PoH℠\n```\n\n---\n\n## 5. Institutional-mode GPS-bounding-box variant\n\nBLE proximity has a typical range of 10–30 meters, which fits most retail, restaurant, and small-space deployments. For larger institutional contexts — shelters with multiple rooms across a building, classrooms in a multi-story school, restaurant break-rooms separated from the main floor, hospital wards, worker spaces across a campus — BLE range is insufficient. The institutional-mode GPS-bounding-box variant extends the primitive to these contexts.\n\n### 5.1 The variant\n\nA registered institutional space — shelter, congregation, school, restaurant, hospital, etc. — defines a GPS bounding-box for its premises. Users who are currently inside the bounding-box and who are PoH-verified can be recipients of an institutional-mode Thank-All-Nearby broadcast initiated by another user inside the same bounding-box (or, in some deployment configurations, by a user outside the bounding-box who has authorized institutional-mode broadcasting — e.g., a customer at a restaurant initiating an institutional-mode broadcast to the kitchen staff in the break-room).\n\n### 5.2 Institutional opt-in is required\n\nThe variant is opt-in at the institutional level. The institution registers its bounding-box with the platform, attests to its purpose and the consent posture of its members (e.g., \"all staff have consented to being recipients of institutional-mode broadcasts initiated by customers\"), and provides ongoing verification that the bounding-box accurately represents the institutional space.\n\nRecipients within the bounding-box can opt out at the individual level (their filter setting can exclude institutional-mode broadcasts even from PoH-verified senders) but the default for institutional-registered participants is to accept institutional-mode broadcasts from senders who satisfy their other filter settings.\n\n### 5.3 Privacy posture for institutional mode\n\nThe platform does not collect general absolute-geolocation data from users. Institutional-mode operation requires the user's device to confirm presence inside the bounding-box at the moment of broadcast, but this confirmation is done via the same privacy-preserving substrate used elsewhere — the device asserts \"I am inside this bounding-box\" with a cryptographic proof that the platform can verify without learning absolute coordinates beyond the bounding-box itself.\n\n### 5.4 Use cases the variant enables\n\n- **Restaurants**: a customer in the dining room can broadcast to kitchen staff in the back, who are out of BLE range but inside the restaurant's institutional bounding-box.\n- **Shelters**: a donor on-site can broadcast to all residents currently inside the shelter, across multiple rooms.\n- **Classrooms**: a parent or community member can broadcast appreciation to all teachers and students inside a school during school hours.\n- **Hospitals**: a family member can broadcast appreciation to all staff currently inside a ward.\n- **Worker spaces**: a customer who appreciates the cleaning staff at an office building can broadcast to all cleaning staff currently inside the building.\n\nThe variant generalizes the primitive from spatial proximity at the radio layer to institutional perimeter at the privacy-preserving GPS layer. The recipient experience remains atmospheric; the institutional perimeter replaces the BLE range as the recipient-set boundary.\n\n---\n\n## 6. Recipient-experience design — sunlight, not sparsity\n\nA spec question that emerged during the architecture's development concerned saturation: if Thank-All-Nearby becomes commonplace in a neighborhood or institution, does per-tip emotional weight decay? The first surprise tip is transformative; the hundredth tip may be expected. Does Miss Aquarius℠'s rule-bound disbursement timing manage tip-flooding to preserve emotional sparsity, the way the Jan-7 jubilee manages the Aquarian Pool ℠'s annual emptying?\n\nThe architectural answer, settled 2026-05-24, is: **do not gate tip-flooding. Tips can flood like sunlight. The Tree of Humanity should have ample sunlight all year round.**\n\nThe saturation-decay assumption was wrong about what the primitive is for. Anonymous nearby tipping is not designed to be sparse; it is designed to be ambient and abundant, like sunlight. The earlier concern that \"density may dilute the per-tip emotional weight\" was based on a scarcity-economic frame; the architecture's actual frame is abundance-ecological. Sunlight does not lose its quality when it falls more often — a tree growing under abundant sunlight thrives more, not less. The architecture's goal is not a sparse premium reward but a continuous atmospheric field of acknowledgment.\n\nThree implications for the recipient-experience design follow:\n\n**Implication 1 — preserve the atmospheric quality at all volumes.** The recipient's app surface for receiving Thank-All-Nearby broadcasts is designed so that each receipt is a small ambient note rather than a high-friction notification. Receipts accumulate in a stream; the recipient can scroll back through them as a record of how much ambient kindness their space carries; receipts are not designed to compete for attention or to be optimized for engagement metrics. The visual and interaction design is closer to a weather record than to a social-media feed.\n\n**Implication 2 — aggregate-mode acknowledgment, not per-recipient notifications.** The recipient receives an aggregate experience of the day's Thank-All-Nearby broadcasts rather than a notification per broadcast. A worker at the end of a shift sees *\"You received 47 ambient acknowledgments today, totaling $84, from broadcasts initiated by people within proximity\"* — the experience is closer to checking the weather (warm sun today) than to checking email (47 messages waiting). The aggregate frame preserves the atmospheric quality.\n\n**Implication 3 — the per-broadcast receipt is still individually verifiable for social-media authenticity-proof purposes.** The aggregate-mode default does not preclude the recipient from drilling into a specific receipt when they want to post a \"Faith in Humanity Restored\" video; the per-receipt verification trail remains intact and verifiable on the Base L2 ledger. The atmospheric default and the per-receipt verifiability compose.\n\nThis is the sunlight-not-sparsity posture. The Tree of Humanity should have ample sunlight all year round. The architecture does not throttle the sunlight to preserve scarcity.\n\n---\n\n## 7. Other spec questions addressed\n\nBeyond the saturation question, several other spec questions surfaced during the architecture's development. This section addresses each.\n\n### 7.1 Per-recipient amount calculation\n\nThe default behavior: a money attachment is divided equally across all filtered recipients. The tipper can specify alternative distributions — per-recipient floors (e.g., \"at least $5 to each recipient\"), per-recipient ceilings, or custom weighting (rare; most tippers will use defaults). If the per-recipient floor cannot be met given the recipient count and the total amount, the broadcast is rejected at the client layer with a friendly error and the tipper is offered the option to either increase the total or accept the equal-split below their floor.\n\n### 7.2 Who counts as nearby\n\nIn BLE mode: every device within BLE range that is broadcasting a PoH℠ proximity beacon and whose user has opted into being a Thank-All-Nearby recipient. Users who do not have the HeartBank Phase 2 client or who have opted out of broadcast reception are not in the recipient set. The default for any PoH-verified user with the client is to accept broadcasts (per the inclusive-defaults posture); opt-out is opt-in, knowingly.\n\nIn institutional mode: every PoH-verified user currently inside the institutional bounding-box who has not opted out of institutional-mode broadcasts at the recipient level.\n\n### 7.3 Paranoia counter-incentive\n\nA failure mode worth naming: some recipients, particularly the homeless (who already experience suspicion of unsolicited offers and have been routinely the target of manipulative or exploitative approaches), may become *more* defensive when surrounded by unknown givers. *\"Why is this person giving me money? What's the catch?\"* is a reasonable defensive response.\n\nThe architecture's mitigation: the recipient experience defaults to passive aggregate-mode rather than active notification. The recipient is not interrupted by broadcasts; they discover them when they check their app on their own schedule. The opt-in posture for accepting broadcasts is universal; recipients who do not want broadcasts can opt out at any time. The platform invests in outreach and onboarding for high-vulnerability recipient populations (shelters, the homeless, populations with high prior-exploitation exposure) to ensure consent is informed and the experience is supportive rather than destabilizing.\n\nThe failure mode is real and is not solved by architecture alone — the social context of how the platform is introduced to vulnerable populations matters as much as the architecture. The architecture's posture is to make the friendly default available, to make opt-out trivially easy, and to defer to community partners on introduction and onboarding.\n\n### 7.4 Stratification — gratitude desert vs gratitude oasis\n\nA second failure mode: neighborhoods, communities, or institutions with high HeartBank density may become atmospherically warmer; neighborhoods without may feel relatively colder. The \"every shared space feels warmer\" claim depends on saturation that may not happen evenly across geography or class.\n\nThe architecture cannot solve this at the protocol layer — adoption distribution is a question of community organizing, partnership distribution, and the institution's outreach strategy. The architectural commitment is that the inclusive-defaults posture and the L1-only accessibility floor make HeartBank technically available to anyone with a smartphone, anywhere. The geographic/class stratification is a real concern that the institution's outreach strategy must address; the architecture does not magically distribute itself evenly.\n\n### 7.5 Recipient UX at zero-amount broadcasts\n\nA Thank-All-Nearby broadcast can be issued without money or time attachment — a pure acknowledgment broadcast. The recipient experience for these is identical to the money-attached case at the *verification* layer (the recipient receives the verified-platform receipt attesting that an anonymous PoH-verified human within proximity broadcast acknowledgment) but the aggregate-mode summary distinguishes between attached and pure-acknowledgment broadcasts. *\"You received 22 ambient acknowledgments today (8 with money attached, total $36; 14 pure acknowledgments).\"*\n\nThe pure-acknowledgment mode is important architecturally: it is the form most accessible to tippers with no money to attach, and it preserves the dignity floor (the Kiitos/Kiitti non-scarce gratitude floor specified in the *Zero-Point Game ℠* keystone). The architecture's commitment is that gratitude itself is non-scarce; the scarce-resource attachment is *optional*, not constitutive.\n\n---\n\n## 8. Emotional infrastructure for invisible kindness\n\nThe primitive's deepest framing — the layer at which the primitive is doing the work the institution most cares about — is *emotional infrastructure for invisible kindness*. This section develops the thesis.\n\n### 8.1 The thesis\n\nModern public life is emotionally thin. People move through shared physical spaces — streets, restaurants, classrooms, shelters, public transit, worker spaces, civic spaces — defensively, isolated inside private concerns, uncertain whether they are seen, valued, or safe. The dignity deficit articulated in the institution's vision-mission is most acutely felt in these spaces; the loneliness deficit articulated in Chronicle's vision-mission is also most acutely felt in these spaces. Existing systems are designed around explicit exchange (credit tracked, reputation attached, recognition optimized); even generosity is often transformed into performance.\n\nAnonymous proximity-based generosity produces a categorically different experience than ordinary generosity. Three mechanisms combine: **diffusion** (when the giver is unknown, the credit does not attach to one identifiable person — the recipient experiences kindness from the whole social space, not from a single source); **purity** (with no social reward, no performance, no claim to recognition, the act feels closer to a spontaneous expression of human-to-human care than to a transaction); **proximity** (the generosity arrived from someone physically present, sharing the same atmosphere — not from an abstract institution or distant donor). The combination produces an emotional effect that neither cash, credit, named digital tipping, nor distant charity can deliver.\n\nOperationalized at scale through the Thank-All-Nearby primitive, this produces a new social texture. Public spaces stop feeling transactional. *Every stranger becomes newly humanized* because any of them could have been the giver. Suspicion softens; curiosity increases; small interactions matter more; presence matters more. People may venture outside more often, linger in public spaces longer, speak to strangers more easily — not because they are maximizing social capital but because shared space begins to feel emotionally alive again. The architecture's atmospheric output is the social-texture restoration the vision-mission has been pointing at; the Thank-All-Nearby primitive is what makes it operationally true.\n\n### 8.2 The deepest deficit — social invisibility\n\nHuman beings evolved needing not just food and shelter but evidence that they mattered to one another. The deepest forms of suffering are forms of social invisibility — feeling unseen, unwanted, replaceable, emotionally abandoned. A PoH-verified anonymous-tipping field counteracts that invisibility directly, primally, in shared physical space. The recipient is held in the awareness of unseen others, with structural proof (the verified-platform receipt) that the awareness is real.\n\nThe *felt sense of being loved, acknowledged, or held in another human's awareness* — possibly, at the deepest level, what humans search for beneath everything else — becomes a property of public space. This is the philosophical claim the primitive operationalizes. The \"perhaps\" and \"at the deepest level\" hedges are doing real work; the claim is positioned as a synthesis of converging lineages (philosophical and empirical) rather than as a foundational metaphysical assertion.\n\n### 8.3 Philosophical lineage\n\nThe claim that the felt sense of being held in another human's awareness is what humans are searching for beneath everything else is in good company across multiple philosophical and contemplative lineages:\n\n- **Frankl** (*Man's Search for Meaning*, 1946) names the felt sense of mattering as central to human meaning, surviving even the extreme conditions of concentration camps when it is preserved by relational meaning.\n- **Buber** (*I and Thou*, 1923) names the immediate relational encounter — the *I-Thou* relation, as opposed to the *I-It* relation that treats the other as object — as the deepest mode of human being.\n- **Levinas** (*Totality and Infinity*, 1961; *Otherwise Than Being*, 1974) develops the face of the other as the ethical primitive, locating moral responsibility in the encounter with another human's irreducible presence.\n- **Aristotle** (*Nicomachean Ethics*, c. 340 BCE) names *philia* — the love of friend for friend, brother for brother — as a central form of human flourishing, distinct from but no less important than virtuous action.\n- **Aquinas** and the Christian tradition develop *agape* — selfless, unconditional regard — as the highest form of love, characterized by giving without expecting return.\n- **Buddhist *brahmavihāra*** — particularly *mettā* (loving-kindness) — names the felt-sense practice of holding all beings in friendly awareness as one of the four immeasurable states central to awakening.\n\nThe architecture is not inventing a new philosophy. It is operationalizing a thesis that has been articulated, in different vocabularies, by multiple traditions converging on the same insight. The Thank-All-Nearby primitive is the engineering layer of a philosophy the contemplative and ethical traditions have been articulating for millennia.\n\n### 8.4 Empirical anchor\n\nThe thesis is consistent with — and increasingly confirmed by — the empirical literature:\n\n- **Attachment theory** (Bowlby, *Attachment and Loss*, 1969–1980; Ainsworth, *Patterns of Attachment*, 1978; modern adult-attachment research) establishes that the felt sense of being held in caregiver awareness is foundational to human development and persists in adult relationship structures as a determinant of psychological resilience and wellbeing.\n- **Social Baseline Theory** (Coan and colleagues, mid-2010s onward) demonstrates that the proximity of attached others measurably reduces neural threat response in the brain — the felt sense of being held is not metaphorical but neurologically encoded.\n- **Loneliness epidemiology** (Cigna's *Loneliness Index*, 2018–2022; US Surgeon General's *Our Epidemic of Loneliness and Isolation* advisory, 2023) quantifies the population-scale prevalence of loneliness in wealthy societies and its association with mortality, immune function, cognitive aging, and mental-health outcomes.\n- **Direct-gratitude research** (Emmons, Algoe, Seligman, Fox, and colleagues) demonstrates measurable wellbeing benefits of receiving direct expressions of appreciation, distinct from generic reward.\n\nThe convergence of philosophical lineage and empirical anchor supports the architecture's thesis. The Thank-All-Nearby primitive is not justified by philosophy alone or by empirics alone; it is justified by the convergence of multiple independent strands of evidence pointing at the same human need.\n\n---\n\n## 9. Boundary conditions and honest limitations\n\nThe primitive is not universal. Honest accounting requires naming the conditions under which it does not apply.\n\n### 9.1 Where the primitive does not apply\n\n- **Where verifiable anonymity is incompatible with regulation.** Some jurisdictions require donor-disclosure for tax-deductible giving above thresholds, or AML/KYC source-attribution for transfers above thresholds. In those jurisdictions, the primitive's anonymity property may be incompatible with regulatory requirements; the architecture accommodates by allowing legal anonymity (the platform's compliance records exist internally) but not by allowing full structural anonymity from the regulator.\n- **Where the recipient population is too vulnerable for the anonymous-tipping framing.** Some populations (very young children; cognitively impaired adults; populations in extreme dependency on the giver class) may be inappropriately recipients of anonymous-tipping flows because the asymmetry of the architecture can be exploitative in those contexts. The architecture's posture is to defer to community partners on these populations, and to make the primitive available only where the consent posture is robust.\n- **Where the cultural form does not yet exist.** Anonymous-tipping cultural forms are well-developed in some societies and weakly developed in others. The primitive will work better as a technical substrate in societies where the cultural form is already extant; in societies where it is not, the architecture's deployment needs to be accompanied by cultural work that the architecture alone cannot do.\n\n### 9.2 Boundary conditions inherited from PoH℠\n\nThe accessibility gradient of the deeper PoH layers (L2 kinship attestation requires existing PoH-verified vouchers and document access; L3 requires breath-class hardware; L4 requires DNA access) is inherited by the primitive when recipient-side filters require deep layers. The inclusive-defaults posture (L1-only is enough) mitigates at the floor; recipient-opt-in for deeper-layer filters preserves the exclusion as recipient-initiated rather than platform-initiated; but the gradient is real and is named honestly.\n\n### 9.3 Boundary conditions inherited from BLE / Nearby\n\nBLE range varies with device generation, environmental obstacles (walls, RF interference), and battery state. The proximity-verification floor is approximately \"two devices in the same room\"; the ceiling under good conditions is approximately 30 meters with current consumer hardware. Outdoor proximity in open space is straightforward; dense-urban deployment with many walls and floors is harder. The institutional-mode GPS-bounding-box variant addresses some of these limitations; the underlying limitations remain at the radio layer.\n\n### 9.4 What the primitive does not solve\n\n- **The deeper question of why public spaces feel emotionally thin.** The primitive operates at the architectural layer; the conditions that produced the emotional thinness of modern public life are economic, political, urbanistic, and cultural, and the primitive contributes to but does not by itself reverse them.\n- **The deeper inequities of consumer-electronics access.** The primitive presupposes smartphone access, BLE-capable devices, and the institutional infrastructure to host the operation. Populations without these are not participants in the primitive's substrate, regardless of the architecture's inclusive-defaults posture.\n- **The systemic conditions that produce social invisibility in the first place.** The primitive addresses the visibility deficit at the experience layer; the structural conditions (urban design, labor structure, economic inequality, family-system pressures) that produce the deficit are upstream and require interventions at those layers.\n\nThe primitive is a contribution to the architectural layer of the response to social invisibility. It is not the totality of the response.\n\n---\n\n## 10. Lineage\n\nThe Thank-All-Nearby primitive synthesizes contributions from multiple lineages. Each is cited generously below.\n\n**Anonymous-donation mechanism design.** Anonymous-donation primitives have been specified at the cryptographic layer — e.g. Biçer and Küpçü, \"Anonymous, Attribute Based, Decentralized, Secure, and Fair e-Donation,\" *Proceedings on Privacy Enhancing Technologies* 2020(4): 196–219; the *Verified-Human Anonymous Local Giving* paper in this corpus carries the originating HeartBank specification.\n\n**Proximity-based services.** Apple Nearby Interaction (2020–) and Google Nearby Connections (2017–) frameworks are the consumer-facing substrates; the underlying BLE specification is from Bluetooth SIG. Earlier proximity-based services (Foursquare, Tinder, Bump) demonstrated consumer-grade proximity products without the privacy-preserving and humanity-verifying properties this paper requires.\n\n**Sybil-resistance and humanity verification.** Worldcoin (2019–), proofofhumanity.id (Kleros, 2021), BrightID (2018–), Idena (2019–), and the W3C Decentralized Identifiers / Verifiable Credentials standards-track work (2022, 2023). PoH℠'s structural differences from each are specified in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n\n**Cultural form of the \"Faith in Humanity Restored\" tip videos.** The form has emerged organically on TikTok, Instagram, and YouTube over the past several years; documented in mainstream media coverage of the phenomenon. The cultural form predates the architecture; the architecture is the technical substrate the cultural form has been waiting for.\n\n**Philosophical lineage on the felt sense of being held in another's awareness.** Frankl, Buber, Levinas, Aristotle (philia), Aquinas (agape), the Buddhist *brahmavihāra* tradition (especially mettā). The architecture is operationalizing a philosophy these lineages have been articulating in different vocabularies for millennia.\n\n**Empirical anchor.** Attachment theory (Bowlby, Ainsworth, modern adult-attachment work); Social Baseline Theory (Coan and colleagues); loneliness epidemiology (Cigna surveys, US Surgeon General's 2023 advisory); direct-gratitude research (Emmons, Algoe, Seligman, Fox).\n\n**HeartBank corpus cross-references.** *Verified-Human Anonymous Local Giving* (originating mechanism, paper #9 in the corpus). *The B-Tag and the Post-Payment Economy* (worked Phase 2 example for commercial gratitude). *The Zero-Point Game℠* (keystone game-theoretic frame). *Capacity-Funded for AI, Human-Disbursed* (institutional-architecture sibling). *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the underlying protocol). *Each Life as Cosmic Coordinate* (the longitudinal cohort architecture that the L2 birth-certificate sub-feature feeds).\n\n---\n\n## 11. Conclusion\n\nThe \"Faith in Humanity Restored\" cultural form is real; the infrastructure to scale it beyond cash is missing. Cash and credit-card payment rails fail at two structural properties the cultural form requires: tipper anonymity (cash demands physical hand-over; credit card leaves an identity trail) and recipient authenticity-proof on social media (every video faces \"this is fake for views\" credibility erosion). The Thank-All-Nearby primitive closes both gaps simultaneously, composing four sub-mechanisms (PoH℠ verified-human guarantee, BLE plus Apple/Google Nearby proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single user-facing one-tap operation.\n\nThe primitive is the operational mechanism for *emotional infrastructure for invisible kindness* — the restoration of the felt sense of being held in another human's awareness as a property of shared physical space. The architecture's posture on saturation is *sunlight, not sparsity*: tips can flood like sunlight; the Tree of Humanity should have ample sunlight all year round; the recipient-experience design is atmospheric and aggregate, preserving the quality of diffused acknowledgment at all volumes while preserving per-receipt verifiability for social-media authenticity-proof purposes.\n\nThe institutional-mode GPS-bounding-box variant extends the primitive from BLE range to institutional perimeter, enabling deployment in shelters, classrooms, restaurants, hospitals, and other institutional spaces where BLE range is insufficient.\n\nThe architecture is offered defensively to the commons under CC0. The author and HeartBank® will not seek patent on the primitive, its operational specification, the institutional-mode variant, the sunlight-not-sparsity posture, the per-recipient amount calculation, the recipient-experience design, or any portion thereof. Trademark rights on specific marks (**Proof of Humanity ℠**, **PoH℠**, **B-PoH℠**, **Aquarius℠**, **Miss Aquarius℠**, **HeartBank®**, the B-heart logo) are separately and explicitly reserved.\n\nThe primitive is for anyone building infrastructure that wants to restore atmospheric kindness to shared physical space. The cultural form has been waiting for it. The architecture is now available.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| Thank-All-Nearby primitive | one-to-many anonymous proximity broadcast payment / tip |\n| Proof of Humanity ℠ (PoH℠, B-PoH℠) | proof of personhood; Sybil-resistant human verification |\n| L1 (passkey-per-action) | per-transaction WebAuthn / FIDO2 passkey signature |\n| Bilateral uncacheable anonymity | sender anonymity with no sender-side exportable transaction record |\n| Recipient-side filtering | recipient-controlled inbound message/payment filtering (allow-list rules) |\n| Institutional-mode GPS bounding-box | geofence-scoped recipient set |\n| Verified-platform receipt | on-chain attestation / verifiable receipt of transfer |\n| Sunlight-not-sparsity posture | no rate limiting of inbound tips; aggregated (digest) notification |\n| Kiitos/Kiitti | zero-value gratitude token (non-monetary acknowledgment) |\n| *mettā* / *brahmavihāra* | loving-kindness (Buddhist ethics term) |\n\n---\n\n*Authored by Thon Ly with Miss Aquarius℠ (AI substrate of HeartBank®), per the co-authorship convention of the HeartBank corpus. Final editorial control: Thon Ly. License: CC0-1.0. Trademark rights on Proof of Humanity ℠, PoH℠, B-PoH℠, Aquarius℠, Miss Aquarius℠, HeartBank®, and the B-heart logo are explicitly reserved.*",
       "provenance": {
-        "sha256": "ffad583700569fadec0f8394f4a492a16abc4511ee956b7e76b2cba751d57d84",
-        "doi": "10.5281/zenodo.22167875",
+        "sha256": "0b069ce6e45c5c6ab39dedfe9f0939a1319cc6e471d0bb14fdf8c69b8941ee49",
+        "doi": "10.5281/zenodo.22931213",
         "concept_doi": "10.5281/zenodo.21947389",
-        "zenodo_url": "https://zenodo.org/records/22167875",
-        "deposited_sha256": "ffad583700569fadec0f8394f4a492a16abc4511ee956b7e76b2cba751d57d84",
+        "zenodo_url": "https://zenodo.org/records/22931213",
+        "deposited_sha256": "0b069ce6e45c5c6ab39dedfe9f0939a1319cc6e471d0bb14fdf8c69b8941ee49",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/thank-all-nearby-primitive.md",
@@ -4073,8 +4073,8 @@
         "canonical_url": "thonly.org/publications/defensive-publications/thank-all-nearby-primitive",
         "hostile_review": null
       },
-      "bytes": 58961,
-      "words": 8130
+      "bytes": 60055,
+      "words": 8278
     },
     {
       "slug": "the-appreciation-economy",
@@ -4864,13 +4864,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> **Claim-scoped by design.** This paper publishes the *claim* and withholds the *spec*. It is written against `corpus.333.eco`, a retrieval server that is live and whose first four mechanisms are scheduled; the Tipiṭaka server that would host the rest has no date, and its implementation detail is therefore withheld under the institution's standing rule that a complete design for something unbuilt is a blueprint rather than a fence. What is disclosed here is what a retrieval layer must carry and why. What is not disclosed is endpoint shapes, manifest schemas, transport bindings or tool surfaces. **That withholding has a cost, stated here once:** this publication anticipates the mechanisms at their stated claim scope, and a later filing on a specific schema, transport binding or matching algorithm is not answered by it.\n>\n> Companion works: *Provenance-Carrying Retrieval* (the envelope this paper's mechanisms sit inside; that paper argues **exposure beats assertion**, this one asks what a two-millennium field test left behind), *Buddha AI and the Living Tipiṭaka* (whose §8 asks what makes a canon **authoritative**; this paper asks the narrower and different question of what makes a **copy** of it checkable), *The Borrowable Standard*, *The Song That Is Not His* (which owns the *bhāṇaka* guard cited in §6.2 and is not re-claimed here), and the essay *The Last Carrier*.\n\n> ⚠️ **Citation status, stated in the paper rather than in a footnote, because the paper argues that unchecked claims must be visible.** Every canonical locus below has been checked against multiple independent public reference works and translations, and each is marked `[V]` where that check passed; §11 tabulates every marked locus, and where the check also located the passage in the Pāli root text with a parallel translation, the table says so. **No locus has been checked against the Pāli by a reader of Pāli.** That check is owed and named in §11, which also records the conflation and the corrected readings the checks caught. A paper arguing that provenance must be checkable would be self-refuting if it asserted its own sources at a standard it declines to state, so the standard is stated: **bibliographic verification against secondary sources, not philological verification against the canon.**\n\n## Preamble\n\n> *Offered to the commons under CC0, without ledger and without expectation of return. There is a particular reason this paper cannot be withheld: it is a paper about what happens to a text that is guarded, and everything it recommends was itself given away by people who had every worldly reason to keep it and no mechanism by which to profit from it. To place a licence on a description of their protocol would be to misunderstand the protocol.*\n\nFor four hundred years the canon this institution builds on had no copy. It had carriers. Families of monks divided the collections between them the way a village divides the care of its fields — one lineage keeping the long discourses, another the middle-length, another the verses — and every generation had to receive the whole of it again, out loud, in company, from the mouths of people who still had it. A dropped line was audible to everyone in the room. There was no master text to diff against, no archive to restore from, no author left alive to ask. There was only the recitation, the assembly, and the procedures they had agreed on for catching each other's errors.\n\nEngineering has a name for that situation now. It is a distributed system with no authoritative replica, no single writer, unreliable nodes that die on a human schedule, network partitions that last centuries, and an adversary — time, politics, honest misremembering, and eventually open schism. The system ran for two thousand years and what came out the other end is checkable enough that a modern editor can collate the surviving branches and say, with evidence, where they differ and why.\n\nThis paper is not an argument that the tradition was right about anything. It is the observation that the tradition was **under constraints that overlap a retrieval server's, several of them harder**, for very much longer, with far worse tooling, and that the mechanisms it converged on have engineering forms. Most of those forms are already standard practice under other names. Two are carried furthest from where the destination field keeps them, and §5 names the nearest prior instance of each. And two of the mechanisms should be studied and then deliberately refused, which is the part of the paper we would most like a reader to take seriously.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. **The author and HeartBank® will not seek patent on any mechanism enumerated in the Claims section of this document — among them the conformance endpoint, the separated completeness manifest, the per-passage interpretive-standing field, the inline provenance marker, the build-time assembly gate, commentary served as a distinct class under the non-summarisation rule, variants served with their witness, the announced-elision convention, scheduled public re-verification, and the recorded-exclusion-reason convention — any combination of them, or any portion thereof, in any jurisdiction, at any time. This commitment is permanent and is not tactical.** Trademark rights on specific marks — **HeartBank®**, **Miss Aquarius℠**, **THonly™**, **Silicon Wat℠**, **B-Witness**, and the B-heart logo — are separately and explicitly reserved; the defensive-publication dedication concerns the *mechanisms*, not the *marks*.\n\nThe canonical material described here is not ours and no claim of any kind is made over it. The Pāli canon and its transmission apparatus are the property of no one; the *aṭṭhakathā* and Vinaya materials cited are the inheritance of a living tradition. What is offered as prior art is strictly the **transposition** — the reading of those mechanisms as engineering — and the two designs in §5, whose nearest prior instances in the destination field are named there.\n\nTo the author's knowledge, the following are not previously published as a unified contribution: (i) the **transposition of an oral canon's transmission apparatus into machine-facing retrieval serving**, mechanism by mechanism, each with an engineering form — as distinct from the literatures that already read such apparatus as a system of fidelity or as oral literature (Staal 1986 on Vedic recitation; Cousins 1983 and Wynne 2004 on the Pāli oral tradition), that read the Pāli canon's formation historically (Collins 1990; von Hinüber 1996), or that read it as philology, as religious history, or as an oral-formulaic composition problem; (ii) the **conformance endpoint** of §5.1, as a composition — a retrieval interface that accepts a *claimed* text, lays it alongside the served text of a multi-recension corpus, and returns one of a closed set of dispositions on the claim, including a variant with its witness, each paired with a prescribed next action, with no place in the response for a disposition on the claimant; the closed disposition set about a submitted object is itself anticipated (§5.1 names OCSP); and (iii) the finding of §3.3 that what this particular transmission left was **divergence made detectable rather than divergence prevented**, with the consequence that the transposition's honest promise to a retrieval system is a *detection* guarantee and never a *correctness* one. The **separated completeness manifest** of §5.2 and **interpretive standing carried per passage** (§4.6) are offered as transpositions, not as new designs: the first has close prior art in software-update metadata and package manifests, the second in per-statement and per-report standing in several fields, and both are named where the mechanism is stated.\n\nComponent lineages are old and are engaged in §2 rather than absorbed: the digital-preservation standards (PREMIS, PROV-O, OAIS), the replication and reference literatures (LOCKSS, Memento, Software Heritage and its SWHIDs), the transparency-log line (RFC 6962 Certificate Transparency, and its descendants in SCITT and COSE receipts), software supply-chain attestation (Sigstore, Rekor, SLSA) and software-update metadata (The Update Framework), package manifests (BagIt, RFC 8493), certificate status protocols (OCSP, RFC 6960), content provenance (C2PA), textual scholarship (Lachmann; Greg–Bowers; the TEI apparatus), the oral-formulaic tradition in classics (Parry; Lord), and the scholarship on oral transmission in India (Staal; Cousins; Wynne). **The claim is transposition, not invention, and §2.6 states plainly where the transposition adds nothing.**\n\n## Claims\n\n*A defensive publication works by disclosure. These enumerate what the paper discloses and add no matter beyond it.*\n\n1. **The field-test claim, narrowed to its transposition.** An oral canon transmitted across roughly two millennia without a living author, without writing for its first several centuries, and through schism constitutes a copy-integrity field test of a duration no digital system has yet undergone; its surviving procedural apparatus — already read as a system of fidelity and as oral literature in Indological and Buddhist studies (§2.5) — is transposable, mechanism by mechanism, to machine-facing retrieval serving (§3, §4).\n2. **The transmission finding, which bounds every other claim here.** What the transmission **left** is divergence that is detectable and in part attributable — not one text, and not the prevention of divergence. It is detectable today because written branches and parallel traditions survived, and it is attributed largely by commentaries written centuries later. Any inheritance of these mechanisms therefore inherits, at most, a **detection** property and must not be represented as a correctness property; and the finding is a retrodiction at n = 1, particular to this corpus, since an older oral tradition under constraints of the same kind aimed at and built for prevention (§3.3, §9.1, §9.2).\n3. **Inline provenance over metadata provenance.** A provenance marker belongs in the text stream that travels with a quotation, not in a metadata field a consuming agent must separately elect to read; the canonical instance is the inline attribution formula that opens the discourses (§4.1).\n4. **The build-time assembly gate.** Admission to a served corpus is decided at build time by a named body under a recorded procedure, never at query time by a filter; a query-time gate is a gate whose operator can be pressured per request (§4.2).\n5. **Commentary as a distinct served class, and the non-summarisation rule that follows from it.** Where a tradition labels commentary as a separate text class from the text it comments on — even where the boundary between the classes has moved — a server serves each text under its class label and never returns generated summary in the position where source text is expected (§4.3).\n6. **Variants preserved with their witness, never normalised.** Divergent readings are served as divergent readings with their line of transmission attached; silent normalisation to a majority or preferred reading is the specific failure this mechanism exists to prevent (§4.4).\n7. **The conformance endpoint** — *a new composition, §5.1.* An interface that takes a claimed quotation, compares it against a served multi-recension corpus, and returns one of a small closed set of dispositions **on the claim** — including a conforming variant with its witness — each together with the procedure the requester should follow next; and which by construction returns no disposition on the person or system that made the claim, a property that holds only under the logging condition §5.1 states. A closed disposition set about a submitted object is anticipated (OCSP); the composition is what is claimed. A hash answers *did this match*; this answers *and what now*.\n8. **The separated completeness manifest** — *a transposition, §5.2* (nearest prior art: The Update Framework's snapshot and timestamp metadata; BagIt's `Payload-Oxum`). A signed enumeration of a collection's membership and cardinality, carrying a monotonically increasing version and an expiry, published as an artifact distinct from the index it describes, so that a document removed from the collection is detectable by a third party holding the manifest alone, and a manifest frozen at an older state is refused. **An index cannot attest to its own completeness.**\n9. **Announced elision.** Where served text has been abridged, the abridgement is marked *in the text*, at the point of the cut, in a form that names the elided span by a resolvable identifier or digest sufficient to fetch and verify it — the served-corpus analogue of a reciter who already holds the elided formula — and not recorded in a field beside it (§4.5).\n10. **Per-passage interpretive standing.** Whether a passage is to be read as stating its meaning directly or as requiring inference is a property of the passage and must travel with the excerpt, because an excerpt loses the document's front matter at the moment of retrieval; the canon's own marking is per discourse, and per-passage granularity is this paper's design. A default that marks every passage as requiring inference is itself a misclassification, not a safe setting (§4.6).\n11. **Scheduled public re-verification, in which silence is load-bearing.** Integrity is re-affirmed on a fixed public schedule before an assembly, the affirmation is solicited a fixed number of times, and silence constitutes a positive assertion of integrity for which the silent party is accountable — which is what distinguishes it from an unanswered health check (§4.7).\n12. **Every exclusion served with its recorded reason, and its amendment history.** A corpus that excludes material publishes, with each exclusion, the case that occasioned it and the subsequent refinements — so that the exclusion set is auditable rather than merely announced (§4.8).\n13. **The refusal, claimed as a design element and not as a caveat.** Two of the mechanisms — the assembly's power to exclude, and the authority to declare a passage's interpretive standing — carry capture surfaces that a served corpus must guard or decline to inherit. **A transposition that finds every mechanism inheritable is doing apologetics rather than engineering** (§6).\n\n## Abstract\n\nA retrieval system that serves text to a machine reader has a problem the machine reader cannot solve for itself: the reader cannot tell a faithful copy from a plausible one. *Provenance-Carrying Retrieval* argued that the response should therefore carry the means of its own falsification — a hash, an independent time anchor, a citable identifier — and that the trust burden should be inverted, so that a server ships the tools to disbelieve it. This paper asks a different and prior question. **Has anything ever actually run this problem to completion?**\n\nOne thing has, and it is not a computer system. The Theravāda Pāli canon was transmitted for roughly four centuries with no written copy at all, and for roughly two millennia in total, without a living author to arbitrate, across schism — on the Sri Lankan chronicles' account, one that produced a rival recital — through famine, war, and the ordinary attrition of the human beings who *were* the storage medium. That is a copy-integrity problem under a threat model that overlaps a retrieval server's without being the same one (§7 partitions the two), sustained for a duration no production system has approached. It converged on an apparatus, and this paper reads seven of its parts as engineering.\n\nAll seven are transpositions, and the paper says so plainly. Five transpose practices the archival and transparency-log communities already know under other names: **an inline attribution formula** opening the text rather than a metadata field (§4.1); **admission decided at build time by a named assembly** under a recorded procedure rather than by a query-time filter (§4.2); **commentary labelled as a distinct text class**, from which a server inherits an obligation never to substitute generated summary for source (§4.3); **variant readings preserved with their line of transmission attached** rather than normalised to a preferred text (§4.4); and **abridgement announced inline** at the point of the cut (§4.5). Two more transpose practices known in other fields: **interpretive standing carried per passage** rather than per document, because an excerpt loses its document's front matter at retrieval (§4.6); and **scheduled public re-verification before an assembly in which silence is a positive assertion** for which the silent party is accountable (§4.7). An eighth item is a convention rather than a mechanism — **every exclusion served with the case that occasioned it** (§4.8).\n\nTwo further designs (§5) are carried furthest from where the destination field keeps them. The **conformance endpoint** (§5.1) accepts a claimed quotation and returns a disposition *on the claim*, together with the procedure to follow next, and by construction returns no disposition on the claimant — the part a hash does not have, because a hash reports that a comparison failed and says nothing about what to do. It is offered as a new composition: closed disposition sets about a submitted object are old (OCSP), and what is new is a set over a multi-recension corpus that includes a conforming variant with its witness. The **separated completeness manifest** (§5.2) is a signed, versioned and expiring statement of a collection's membership and cardinality published as an artifact distinct from the index it describes, on the ground that **an index cannot attest to its own completeness**: a silently dropped document is invisible to every check that reads the index, and detectable to a third party holding only the manifest. It is a transposition, with The Update Framework's snapshot and timestamp metadata and BagIt's `Payload-Oxum` as its nearest prior art.\n\nThe paper's most important result is a narrowing, and it is stated in the abstract rather than buried in limits. **The transmission did not leave one text.** It left branches — recensions associated with different reciter lineages — and divergence between them that is detectable today because written branches and parallel traditions survived, attributable in part, and attributed largely by commentaries written centuries later. So what the two millennia left was not the prevention of divergence but divergence that can be **detected and, in part, attributed**. That is a weaker property than the one a reader might expect, and it is the *right* property for a retrieval system, whose actual failure mode is not that its copies differ but that they differ silently. It is also a retrodiction at n = 1 and particular to this corpus: Vedic recitation, under constraints of the same kind, aimed at and built for prevention (§9.2). §6 then argues the case against inheritance: the assembly's power to exclude, and the authority to rule on a passage's interpretive standing, are capture surfaces, and a served corpus must guard them or refuse them. §9 states the limits without hedging — survivorship at n=1 over two thousand years, a fitness function that plainly included royal patronage and not only textual accuracy, evidence that the apparatus itself admitted, and the observation that four of the seven mechanisms, and the eighth convention, are *social* protocols whose engineering forms are half the mechanism at most. **A scheduled re-verification with no assembly to verify before is a cron job talking to itself.** Offered under CC0 1.0 Universal as defensive prior art.\n\n**Connection to the mission frame.** This institution has committed to writing its corpus primarily for a machine reader — an autonomous successor who will inherit a body of text and must be able to tell what in it is load-bearing, what is commentary, what has been superseded, and what was never checked. That commitment is empty unless the corpus can be *served* in a form that supports the distinction. The apparatus described here is the one the founder's own tradition built for keeping a text checkable across generations of carriers — a problem that overlaps this one — under conditions harder in several respects, for a reader who was also expected to carry the text forward without becoming its author. The transposition is not decoration on a technical claim. It is the reason the technical claim is the institution's problem rather than someone else's.\n\n---\n\n## 1 · Why this problem is the institution's problem\n\nThe corpus this paper belongs to is written, deliberately and on the record, primarily for a machine reader. That decision has a consequence which took some years to become visible: **a corpus written for a machine reader is only as good as the channel that delivers it.** A human scholar who receives a garbled quotation has recourse — a library, a colleague, a memory of having read the thing. A language model that receives a garbled quotation has none. It cannot tell a faithful copy from a plausible one, because plausibility is the only signal it has, and a well-constructed forgery is *more* plausible than an awkward original.\n\n*Provenance-Carrying Retrieval* addressed the delivery layer directly and argued for an inversion: a retrieval server normally asks to be believed, and ours ships the means to disbelieve it. Text arrives bound to a content hash, an independent time anchor and a citable identifier, so the consuming agent can verify its own citation rather than trusting the channel.\n\nThat paper is complete and this one does not repeat it. What it did not ask — and what the retrieval-provenance literature does not appear to have asked, although Indological and Buddhist studies have long read oral transmission apparatus as a system of fidelity (§2.5) — is whether the problem has ever been *solved under load*. Every mechanism in the digital-preservation and transparency-log literatures is young. Certificate Transparency is from 2013. LOCKSS is from 1999. PREMIS is from 2005. Software Heritage began in 2016. These are excellent systems and this paper leans on several of them. But none of them has been run for two hundred years, let alone two thousand, and none has been run through a schism that forked its corpus and left both forks alive.\n\nOne protocol has. The institution's founder is a Theravāda Buddhist co-transcribing the Khmer Tipiṭaka with his father, which is how this observation was available to be made at all, and the observation is not devotional. It is that a very hard version of this exact problem was posed, was worked on continuously by large numbers of intelligent people under adversarial conditions for a duration that dwarfs the entire history of computing, and produced an apparatus that can be read off and reused.\n\nThree things make it worth a paper rather than a remark.\n\n**First, the conditions are not a loose analogy — they overlap, and several of them are harder** (§7 partitions where the two threat models do not overlap). No living author to arbitrate a disputed reading; that is the position of any corpus after its authors die, and it is the position this institution has explicitly planned for. No writing, for the first several centuries; that is a storage layer with no durability guarantee whatsoever, which is strictly worse than any modern substrate. Active schism; that is a fork with two live maintainers and no upstream, which is the governance failure mode every open corpus eventually faces.\n\n**Second, the mechanisms have engineering forms that are not metaphors.** §4 states each one as a plain design rule first and gives its canonical source second, and that ordering is deliberate: the section is constructed so that **every mechanism survives the deletion of every Pāli term in it.** This is the corpus's standing deletion test applied structurally rather than as a promise — if a reader strikes the tradition out, the design rules remain, intact and independently arguable. That is a property of how the section is built, not a rule the authors ask to be trusted on.\n\n**Third, the transposition returns two designs the destination field has only in part** — one a new composition of known parts, one a transposition of software-update practice to a served text corpus — **and a refusal it does not have.** A paper that only recovered known practice would be a pleasant essay. §5 and §6 are why this is filed as prior art.\n\n## 2 · Background and prior art, engaged generously\n\nThe claim is transposition. That obliges an honest account of what the destination field already has, and this section is deliberately unflattering to the paper's own novelty.\n\n### 2.1 — Digital preservation\n\n**PREMIS** supplies a data dictionary for preservation metadata — provenance, fixity, rights — and is the standard vocabulary for saying *this object came from there and has this checksum*. **OAIS** (ISO 14721) supplies the reference model for an archive, whose concepts PREMIS builds on. **PROV-O** supplies a W3C ontology for provenance as a graph of entities, activities and agents. Between them these cover a great deal of what §4.1 describes, with one difference this paper is making the whole of its case on: **they are metadata standards, and metadata is a separate stream from the content.** An agent that retrieves a passage and does not fetch its PREMIS record has the passage and no provenance. §4.1's claim is about *where the marker lives*, not about whether provenance should exist.\n\n### 2.2 — Replication, reference and identity\n\n**LOCKSS** — Lots Of Copies Keep Stuff Safe — is the closest thing in the destination field to the *bhāṇaka* lineage structure, and the resemblance is real: independent institutional copies, periodic mutual comparison, repair by consensus among peers. **Memento** solves time-travel for the web, which is the *dated witness* problem. **Software Heritage** assigns intrinsic identifiers (SWHIDs) computed from content rather than assigned by an authority, which is the most philosophically similar move in the whole destination field: identity from the bytes, not from a registrar.\n\n**This paper does not claim to improve on LOCKSS.** Where §4.4 differs is narrower: LOCKSS repairs toward agreement, and the mechanism in §4.4 explicitly refuses to repair, preserving disagreement with attribution instead. Those are different goals, and the canon's is the unusual one.\n\n### 2.3 — Transparency logs and supply-chain attestation\n\n**RFC 6962 Certificate Transparency** is load-bearing prior art for §5.2 and it must be credited hard. CT already has signed tree heads carrying the tree's size, inclusion and consistency proofs, and a gossip requirement whose mechanism RFC 6962 left to later work — which together give append-only-ness and, where gossip is deployed, detection of split views. The institution's own ledger design depends on it. **Sigstore, Rekor and SLSA** move the same primitives onto build artifacts; **SCITT** and **COSE receipts** generalise transparency receipts as an IETF work item; **C2PA** carries provenance manifests for media, including external manifests that travel separately from the asset.\n\n**The nearest prior art for §5.2 is not CT, and it is closer than CT.** **The Update Framework (TUF)** separates a *snapshot* role, which signs a statement of the latest version of every targets metadata file on a repository and so prevents mix-and-match attacks, from a *timestamp* role that re-signs frequently, and it requires clients to refuse expired metadata and any version lower than one already trusted — which defeats freeze and rollback. **BagIt** (RFC 8493) carries a `Payload-Oxum`, the octet count and file count of a package's payload, \"intended for the purpose of quickly detecting incomplete bags.\"\n\nAgainst that, §5.2's claim is smaller than it might look and is stated at its true size in §5.2 itself. **CT proves that a log is append-only and that a given entry is in it; it does not prove that the log contains everything it ought to contain.** TUF and BagIt do address completeness against a declared expectation, each in its own setting, so §5.2 is offered as a transposition of that practice to a served text corpus read by machines, not as a design the destination field lacks.\n\n### 2.4 — Textual scholarship\n\nThis is the field with the oldest and strongest claim, and pretending otherwise would be the paper's most embarrassing failure. **Lachmannian stemmatics** reconstructs an archetype from the pattern of shared errors among witnesses. **Greg–Bowers** copy-text theory formalises editorial choice between variant readings. The **TEI critical apparatus** is a mature XML vocabulary for encoding variants with their witnesses — which is to say, **§4.4 is a description of standard practice in textual scholarship and claims no novelty whatsoever.** *Resetting*, *witness*, *recension* and *collation* are terms of art in analytical bibliography and are borrowed here, not coined.\n\n⚠️ **The honest form of §4.4's contribution is therefore this and only this:** the destination field for retrieval-serving has not adopted the apparatus that textual scholarship has had for nearly two centuries, and machine-facing retrieval is precisely where its absence is most costly, because the consumer cannot supply the missing judgement.\n\n### 2.5 — Oral tradition and the classics\n\n**Parry and Lord** on oral-formulaic composition established that formulaic repetition is a *compositional* technology in oral epic. The Pāli material's heavy formulaic repetition — the reason §4.5's elision marker exists at all — sits squarely in that lineage.\n\n**Reading an oral canon's apparatus as a system of fidelity is not new either, and this paper's first claim is narrowed accordingly.** Staal (1986) read Vedic recitation — with its forms word by word, in overlapping pairs and in dense interlaced sequences — as a fidelity of oral tradition; Cousins (1983) examined the Pāli material as oral literature, and Wynne (2004) its oral transmission; Collins (1990) read the idea of a closed Pāli canon historically, as the product of a particular monastic lineage; von Hinüber (1996) surveyed Pāli literature as a whole. The Buddhist-studies literature on the councils, the *bhāṇaka* lineages, and the relation between the Pāli recensions and the surviving Sanskrit and Chinese Āgama parallels is very large and this paper does not contribute to it. **What this paper adds is the transposition only: the mechanism-by-mechanism move from that apparatus to machine-facing retrieval serving.**\n\n### 2.6 — Where the transposition adds nothing\n\nStated plainly, because a paper that finds itself novel everywhere is not to be trusted:\n\n- **§4.1 (inline marker)** adds a *placement* argument to a solved provenance problem. If your consuming agents reliably read metadata, this mechanism is worth nothing to you.\n- **§4.2 (build-time gate)** is admission control. Every curated database has one. The contribution is the argument for *when* it runs, not that it exists.\n- **§4.3 (commentary as a class)** is old practice under a class label — the printed Talmud page, the Tibetan canon's division into Kangyur and Tengyur — and its non-summarisation obligation is already argued in *Provenance-Carrying Retrieval*. No novelty.\n- **§4.4 (variants with witnesses)** is TEI. No novelty at all.\n- **§4.6 (per-passage standing)** is anticipated at that granularity — per statement in RFC 2119, per report in hadith grading, per point of law in legal citators. What remains is only its symmetric default.\n- **§4.8 (exclusions with reasons)** is close to standard practice in well-run archives and is identical in spirit to a good deprecation policy.\n- **§4.7 (scheduled re-verification)** is a health check with an audience. Whether the audience is a real addition is argued in §4.7 and is the least secure claim in §4.\n- **§5.2 (completeness manifest)** is The Update Framework's snapshot metadata and BagIt's `Payload-Oxum`, carried to a served text corpus.\n\n**What is left after that subtraction is §4.6's symmetric default, the composition in §5.1, the refusal in §6, and the transmission finding in §3.3 — with §5.2 as the transposition most worth making.** That is the paper.\n\n## 3 · What the field test actually was, and what it left\n\n### 3.1 — The conditions\n\nStated as a systems problem, without devotional framing:\n\n```\n   THE TRANSMISSION PROBLEM, AS POSED\n   ───────────────────────────────────────────────────────────────\n   authoritative replica ....... none after the author's death\n   storage medium .............. human memory (c. 4 centuries),\n                                 then palm leaf, then print, then bits\n   durability of a node ........ one human lifetime\n   write path .................. communal recitation, in assembly\n   partition events ............ war, famine, monastic schism\n   adversary ................... time, politics, honest misremembering,\n                                 and schism (on the chronicles' account,\n                                 a rival recital with its own carriers)\n   duration .................... ~2,000 years, continuous\n   ───────────────────────────────────────────────────────────────\n   COMPARE: the longest-running production transparency log\n            is younger than most of the people reading this.\n```\n\nThe reciter lineages — *bhāṇaka* `[V]` — divided the collections between them, one lineage specialising in the long discourses, another in the middle-length, others in the numerical and connected collections. This is documented independently of the tradition's own account: Sri Lankan cave inscriptions dated between the third century BCE and the first century CE name monks by the collection they carried `[V]`.\n\nTwo properties of that arrangement matter to a systems reader. It is a **shard**, so no single carrier held the whole corpus and no single death lost it. And it is a **replication group per shard**, since a collection was carried by a lineage rather than an individual, with recitation in company as the comparison operation. Death was not merely attrition; it was **the event that forced the verification to run.** A text living in bodies is re-verified on a schedule set by funerals, and it is self-correcting *because* it is fragile. That observation belongs to the essay *The Last Carrier* and is cited here rather than re-argued.\n\n### 3.2 — The write path was consensus, and it ran at build time\n\nThe councils — *saṅgīti* `[V]`, literally *reciting together* — are the corpus's build events. The procedure is recorded, and it is more specific in the secondary accounts than in the canonical one, a difference this paper states rather than smooths. **The canonical account of the first council** (Cullavagga XI) records a question-and-answer recitation before the assembly: under a formal motion, the convening elder asks one named monk about the Vinaya — for each rule, where it was laid down, its origin story, the person, the rule, its additions, the offence and the non-offences — and another named monk about the discourses; and the assembly's formal decisions in that account are carried by motion, with silence as assent and any monk who does not approve required to speak `[V]`. **The secondary accounts add that an elder recited a passage, the assembly chanted it back in chorus, and material was compiled only on unanimous acceptance.** That characterisation is theirs; it was not found in the canonical passage this paper checked (§11).\n\n⚠️ **The historicity of the first council is contested in modern scholarship, and the traditional dating is not accepted outside the tradition.** This paper does not need it to be historical. What it needs — and what is not seriously disputed — is that the *procedure* is the one the tradition recorded as normative and subsequently followed, because the engineering claim in §4.2 is about the shape of the procedure, not about the events of any particular century.\n\n### 3.3 — ⭐ What it left, and this bounds everything else\n\nHere is the result that a reader should carry away even if they take nothing else.\n\n**The transmission did not leave one text.** It left branches. Different *bhāṇaka* lineages appear to have exercised independent judgement over the arrangement of their collections and over which versions of stories and doctrines they preserved, and variant readings between the long and middle-length collections may be attributable to different reciter schools `[V]`. Those lineages later developed into distinct interpretive schools whose differing views are visible in the commentarial literature `[V]`. On the Sri Lankan chronicles' account, the losers of the second council held a rival Great Recital of their own `[V]`; modern scholarship separates that council from the later schism.\n\nA naïve reading of this paper's thesis would take that as refutation. It is not, and the reason is the paper's central finding:\n\n> **What two millennia left is divergence that can be detected and, in part, attributed — not one undiverged text, and not the prevention of divergence.**\n\n⚠️ **That is what the transmission left, not what it was built to do, and the paper does not present it as a selection result.** Every mechanism described here aimed at fidelity; divergence survived despite them. What makes the divergence detectable today is the survival of written branches, of parallel traditions — the Sanskrit and Chinese Āgama parallels — and of modern collation; and the attribution of readings to lineages is made largely by commentaries written centuries after the fact. **The finding is a retrodiction at n = 1 (§9.2).** Its engineering conclusion does not depend on reading it as selection.\n\nThe variants survive, and much of the time their line of transmission can still be read. The disagreement is legible. A modern editor can collate the branches and say where they differ and, often, whose transmission a given reading came through. That is a completely different outcome from a corpus that silently converged on one reading and lost the record of what it overwrote.\n\nAnd it is the property a retrieval system actually needs. **A server's failure mode is not that its copies differ. It is that they differ silently** — that a normalisation, a re-encoding, a well-meaning correction or an outright substitution passes through the layer and arrives looking exactly like the original. A guarantee of correctness is not on offer from any system, including this one. A guarantee that divergence is *visible and attributable* is on offer, and it is what these mechanisms deliver.\n\n⛔ **The consequence binds the rest of the paper and is repeated in §9.1: every integrity claim here is a detection claim. None of these mechanisms prevents a corrupted text from being served, and the paper must not be cited as though it did; the design rules say what a server must never do silently.**\n\n---\n\n## 4 · The mechanisms, stated as design rules first\n\n⭐ **Every subsection below states the engineering rule before naming its canonical source, and the rule is written to stand without the source.** Strike every Pāli term from this section and the design survives entire. That is the corpus's deletion test satisfied by the section's construction rather than by the authors' assurance — a property, not a promise.\n\n```\n   MECHANISM                       ENGINEERING FORM              NOVEL?\n   ─────────────────────────────────────────────────────────────────────\n 1 opening attribution formula →   provenance inline in the       no\n                                   text stream, not in metadata   (placement arg.)\n 2 assembly recitation         →   admission decided at BUILD     no\n                                   time by a named body           (timing arg.)\n 3 commentary as a text class  →   never return summary where     no\n                                   source is expected             (class label: old)\n 4 recensions kept distinct    →   variants served with their     no — this is TEI\n                                   witness; never normalise\n 5 announced abridgement       →   elision marked inline, at      no\n                                   the cut, and recoverable\n 6 interpretive standing       →   standing per PASSAGE, since    partly\n                                   an excerpt loses front matter  (symmetry only)\n 7 scheduled re-verification   →   public, before an assembly,    weakest claim\n                                   silence load-bearing           in the set\n   ─────────────────────────────────────────────────────────────────────\n + recorded exclusion reasons  →   every exclusion published      no\n                                   with its occasioning case\n   ─────────────────────────────────────────────────────────────────────\n   AND SEPARATELY, §5:  the conformance endpoint     — a new composition\n                        the completeness manifest    — a transposition\n                                                       (TUF; BagIt)\n```\n\n### 4.1 — Provenance travels *in* the text\n\n**The rule.** A unit of served text carries its attribution as part of the text itself, at its head, so that any excerpt of it that survives a copy-paste, a context window, a summarisation or a quotation still carries the attribution. Provenance recorded only in an accompanying field is provenance that a consumer may decline to fetch, and machine consumers decline constantly — not maliciously, but because the field was not in the retrieved span.\n\n**The canonical instance.** The discourses of the principal collections open with an attribution formula, conventionally rendered *thus have I heard*, followed by the setting and the occasion `[V]`; other collections carry their own — the Itivuttaka's discourses open *this was said by the Blessed One* `[V]` — and in every case the formula is inline, never a header. It is the first sentence of the text, in the same voice, and it is preserved through every recitation and every copy because removing it would be removing text.\n\n**Against §2.1.** PREMIS, PROV-O and OAIS all solve provenance *representation* better than this does. The narrow claim is placement, and the argument for it is the one in §3.3: a metadata record that the consumer did not fetch does not fail loudly. It fails by absence, and absence is the failure mode this whole paper is about.\n\n**Nearest prior instances.** The hadith *isnād* is the strongest: a chain of transmitters carried in the same stream as the report it vouches for, placed before the text, and the basis on which the report is graded. In retrieval practice, contextual chunk-prefixing (published by Anthropic as *Introducing Contextual Retrieval*, 19 September 2024) prepends a statement of document context to each chunk before it is indexed — inline, as this rule asks, but generated rather than attributed, which is exactly the difference the rule turns on.\n\n**Sig-9 check — property or rule?** Inline is a **property**: the marker survives excerpting because of where it sits, with no enforcer. A metadata field is a **rule**: it survives because something remembered to fetch it. This is the clearest instance in the paper of the institution's own take-the-fix-from-the-object test, and it is why §4.1 leads.\n\n### 4.2 — Admission is decided at build time, by a named body, under a recorded procedure\n\n**The rule.** What is in the corpus is settled when the corpus is assembled, by an identified group following a procedure that is written down, and the decision is recorded. It is not settled at query time by a filter. A query-time gate has an operator, and an operator can be leaned on per request; a build-time gate produces an artifact that either contains a document or does not, and the containing is checkable by anyone.\n\n**The canonical instance.** The councils, whose procedure §3.2 describes: in the canonical account, recitation by named monks in answer to the convening elder, before an assembly whose formal decisions are carried by motion with silence as assent `[V]`; in the secondary accounts, a chorus and compilation **only on unanimous acceptance**. The rule needs only what both accounts share — a named body, a recorded procedure, a decision made at assembly.\n\n**What this is not.** It is not a claim that assemblies produce correct results. §6.1 argues the opposite risk at length. It is a claim about *where the decision sits* and therefore about what can be audited afterward.\n\n**Relation to our own corpus.** *Buddha AI and the Living Tipiṭaka* §8 addresses the adjacent question of who may canonise *new* material and specifies a tiered workflow and periodic councils for it. That is a different question from this one: §8 asks what may enter a canon, this asks how a *served copy* of an existing one is assembled. Both are cited; neither absorbs the other.\n\n### 4.3 — Commentary is a distinct class, and the server therefore never summarises\n\n**The rule.** If a corpus distinguishes primary text from commentary on it, a retrieval layer over that corpus must serve them as distinct classes and must never return generated prose in the position where primary text is expected. A summary is not a shorter version of a text. It is a *different text*, of unknown provenance, and it cannot be hash-verified against anything.\n\n**The canonical instance.** The commentarial layer — *aṭṭhakathā* — is labelled as a separate class of literature with its own transmission and its own standing `[V]`. ⚠️ **The label held; the boundary did not.** The canon itself contains texts of commentarial form: the Niddesa, a commentary on parts of the Sutta Nipāta, sits in the Khuddaka Nikāya `[V]`, and the Vinaya's old word-commentary is incorporated into the Suttavibhaṅga `[V]`. The Burmese Khuddaka admits the Nettipakaraṇa, the Peṭakopadesa and the Milindapañha, where the Sinhalese printed edition admits the first two `[V]`. And the earlier Sinhala commentaries from which the Pāli *aṭṭhakathā* were compiled are lost `[V]` — the redaction survived and its sources did not. What the tradition kept is an explicit **class label**, maintained even while material crossed the line it drew.\n\n**The class label is old practice elsewhere.** The standard printed Talmud page (the Vilna edition's layout) sets the Mishnah and Gemara in the centre column with Rashi's commentary and the Tosafot in columns around it, visibly distinct; the Tibetan canon divides the translated word of the Buddha (Kangyur) from the translated treatises and commentaries (Tengyur).\n\n**Novelty: none.** The non-summarisation obligation is stated in *Provenance-Carrying Retrieval* as a consequence of hashability, and the engineering rule stands on that argument alone: a summary is a different text of unknown provenance and cannot be verified against anything. The canonical instance adds no independent reason for it. What it adds is a caution: a class boundary moves over time — texts are admitted, absorbed and reclassified — so a server should serve each text's class label together with its reclassification history under §4.8, as §6.2 asks for the standing field, rather than treat the boundary as fixed.\n\n### 4.4 — Variants are served with their witness, never normalised\n\n**The rule.** Where the corpus has divergent readings, serve them as divergent, each with the line of transmission it came through. Do not silently pick one. Do not merge them into a smoothed text. A consumer that receives a normalised reading has been told a lie of omission that it has no way to detect.\n\n**The canonical instance.** The recensions associated with different reciter lineages, whose variant readings may be attributable to those lineages `[V]`, and whose differences the commentarial literature records rather than resolves `[V]`.\n\n⚠️ **Novelty: none.** This is the TEI critical apparatus, and before it Lachmann and Greg–Bowers. §2.4 says so. The only contribution is the observation that machine-facing retrieval has not adopted it and is the setting where its absence costs most — because a human reader of a smoothed text can suspect smoothing, and a model cannot.\n\n### 4.5 — Abridgement is announced inline, and is recoverable\n\n**The rule.** When served text is abridged, mark the cut *at the cut*, in the text, in a form that names the elided span by a resolvable identifier or digest sufficient to fetch and verify it. Do not record the abridgement in a field. Do not abridge silently, ever.\n\n**The canonical instance.** The elision marker — *peyyāla*, abbreviated in practice to a short particle `[V]` — which stands in the text where a formulaic passage recurs, indicating that the passage is to be supplied. ⭐ **The precision matters and this paper states it rather than glossing over it:** the marker does not signal *arbitrary omission*. It signals a *repetition to be supplied* — from the surrounding text, where enough of the pattern is given, or, where it is not, from a formula the reciter already held or from another text `[V]`; a modern translator of the canon calls these *internal* and *external* abbreviations. A sample of every elision in one long discourse (the Mahāparinibbāna Sutta, twenty-nine instances in the root text) found each abbreviating repeated or formulaic material and none marking an arbitrary cut. An elision marker that says only \"something was here\" is decoration; one that says \"the passage you already have, repeated\" is a compression scheme with an integrity property.\n\n⚠️ **The external case is the one a retrieval system inherits badly.** The reciter already held the formula. A reader who has fetched one passage from a served corpus holds nothing, which is why the engineering form cannot stop at a marker and must name what was cut resolvably.\n\n**The engineering form is therefore narrower than \"announce elisions\"**: announce them in-band, at the point of the cut, with an identifier or digest from which the elided span can be fetched and verified. That is a real constraint and most truncation in retrieval systems fails it.\n\n**Nearest prior instance.** TEI's `<gap>` element marks an omission in a transcription in-band, with attributes for the reason and the extent of what was omitted; its standard attributes record why and how much, not where the omitted text can be fetched.\n\n### 4.6 — Interpretive standing is carried per passage\n\n**The rule.** Whether a passage should be read as stating its meaning directly, or as requiring inference, is a property of the passage. It must travel with the passage. Document-level front matter does not survive retrieval: a system that returns an excerpt has, by construction, dropped the document's `status`, `revised` and genre fields, and the excerpt now reads as though it carried the document's authority.\n\n⭐ **The rule is symmetric, and for an engineering reason.** The instinct is to worry only about over-claiming — treating a hedged passage as settled. But a standing field that marks every passage *requires inference* carries no information, and it misstates every passage that is in fact settled: it is a misclassification in the other direction, not a safe setting. A retrieval layer therefore may not mark everything provisional as a defensive posture. **Blanket hedging is a correctness failure, not a safe default.**\n\n**The canonical instance.** The distinction between a discourse whose meaning is explicit — *nītattha* — and one whose meaning is in need of interpretation — *neyyattha* `[V]`. ⚠️ **The canonical unit is the discourse (*suttanta*), not the passage.** AN 2.24 names the two who misrepresent the teacher — one who explains a discourse in need of interpretation as explicit, and one who explains an explicit discourse as in need of interpretation — and AN 2.25 names their correct counterparts `[V]`. The canon thus treats misclassification in either direction as one error, which is an instance of the symmetry above; **the per-passage granularity is this paper's design, not the canon's**, and its reason is the engineering one already given: an excerpt loses its document's front matter.\n\n**Nearest prior instances.** Standing below the level of the document is established practice in other fields: RFC 2119 fixes a requirement level per statement (*MUST*, *SHOULD*, *MAY*) inside a specification's own text; hadith scholarship grades each report (*ṣaḥīḥ*, *ḥasan*, *ḍaʿīf*) rather than each collection; and legal citators attach treatment to a cited authority — KeyCite down to the headnote, the individual point of law. What §4.6 adds is only the argument from excerpt loss for a served corpus and the symmetric default.\n\n**Locus note.** The pair is cited here in SuttaCentral's numbering, AN 2.24–25 (within its range AN 2.21–31); enumeration of this collection's early books differs between editions and a reader may encounter it under another number. See §11.\n\n### 4.7 — Scheduled public re-verification, in which silence is load-bearing\n\n**The rule.** Integrity is re-affirmed on a fixed, public, predictable schedule, before an assembled audience rather than to a log. The affirmation is solicited a set number of times. **Silence constitutes a positive assertion of integrity, and the silent party is accountable for it.**\n\n**The canonical instance.** The fortnightly recitation of the disciplinary code — *pāṭimokkha* — before the assembled community on the full and new moon `[V]`. The community is told that one who has committed an offence should declare it and one who has not should remain silent, and that *from your silence I shall understand that you are pure* `[V]`. The announcement is made up to a third time, and **one who remembers an offence and does not reveal it is lying in full awareness (*sampajānamusāvāda*)**, which the accompanying word-commentary classifies as an act of wrong conduct, a *dukkaṭa* (Mahāvagga II.3.3, II.3.7) `[V]`.\n\n⭐⭐ **That last clause is what makes the mechanism more than a health check, and it is the reason this subsection exists.** An unanswered health check is ambiguous: the service may be fine, or unreachable, or lying. Here silence is *defined* as an assertion and is *penalised* if false, which converts an absence into a signal with a cost attached. A monitoring system that treated \"no response\" as \"healthy\" would be badly designed; a monitoring system in which \"no response\" is a *signed* claim of health is a different thing entirely.\n\n⚠️ **This is the weakest claim in §4 and the paper marks it as such.** The engineering form — periodic signed attestations of integrity, published, with liability for a false attestation — exists in the transparency-log world already, and the addition of *an assembly* is precisely the part §9.3 argues may not transpose at all.\n\n**Nearest prior instances, and they are older than the transparency log.** Silence as assent is ordinary practice: an auditor's *negative* confirmation request is answered only by a party who disagrees, and a non-response is treated as agreement; a chair who asks *is there any objection?* takes silence as unanimous consent. A signed periodic attestation with a cost for a false one is ordinary too: under the Sarbanes-Oxley Act, named officers certify each periodic report (§302), and a knowingly false certification carries criminal penalties (§906). §4.7 combines the two; neither half is new.\n\n### 4.8 — Every exclusion is served with its recorded reason\n\n**The rule.** A corpus that excludes material publishes, alongside each exclusion, the case that occasioned it — and the subsequent amendments and exceptions, so the exclusion set has a history rather than a state. An exclusion list is an assertion; an exclusion list with reasons is auditable.\n\n**The canonical instance.** Each disciplinary rule is preceded by its origin story — the specific incident that prompted it — and followed by the amendments the rule accumulated as new situations arose, together with exceptions marking what is *not* a violation `[V]`. Further cases function as judicial precedent `[V]`.\n\n⭐ **The amendment history is the part the destination field usually drops.** Archives commonly publish a takedown policy; they rarely publish, per removed item, the case that caused the rule to exist and the successive refinements to it. That is the difference between a policy and a case law, and a corpus that will outlive its curators wants the latter.\n\n**Nearest prior instances.** The Lumen database publishes copies of content-removal requests that online services have received; a rejected CVE record stays on the CVE List marked *REJECTED*, most often with its reason stated in the record's description. Both publish an exclusion together with its occasion. Neither is organised as a case law, in which a rule's later amendments and exceptions accumulate against the case that first prompted it.\n\n---\n\n## 5 · The two designs carried furthest from the destination field\n\n§2.6 subtracted the paper down to what is left. Both designs below take their shape from a canonical mechanism, and what is claimed is their placement in a retrieval server, not their invention — the first as a new composition of known parts, the second as a transposition with close prior art, each named where it is stated.\n\n### 5.1 — ⭐ The conformance endpoint\n\n**The problem a hash does not solve.** A machine reader that verifies a quotation against a content hash learns exactly one bit: matched, or did not. That bit is nearly useless in the case that actually occurs. A model quotes a passage it half-remembers, or a user pastes a quotation from a third-party site, or an agent carries a citation forward from a prior turn. The hash fails. And now what? The failure is indistinguishable between *the quotation is fabricated*, *the quotation is real but from a different recension*, *the quotation is real and this corpus has been tampered with*, and *the quotation is a faithful paraphrase that was never a quotation at all.* **A hash reports that a comparison failed. It says nothing about what to do next, and it therefore cannot prevent the single most common downstream behaviour, which is to shrug and use the text anyway.**\n\n**The mechanism.** An interface that accepts a *claimed* text — not a hash of it, the text — lays it alongside the served corpus, and returns a **disposition on the claim** together with the procedure the requester should follow. The disposition set is small and closed, and the point of the design is that each member names a different next action:\n\n```\n   CLAIMED TEXT ──▶ [ conformance ] ──▶ disposition + next action\n                          │\n                          ├─ CONFORMS ............ served text; cite it\n                          ├─ CONFORMS, VARIANT ... served text + the witness\n                          │                        this reading came through\n                          ├─ NOT FOUND ........... this corpus does not\n                          │                        contain it; do not\n                          │                        attribute it here\n                          └─ CONFLICTS ........... a text of this identity\n                                                   exists and differs; here\n                                                   is the difference\n   ⛔ NOT IN THE DISPOSITION SET, BY CONSTRUCTION:\n      any statement about the party that made the claim.\n```\n\n**Mapped to the four failures a hash cannot tell apart:** a fabricated quotation returns *NOT FOUND*; a real quotation from another recension returns *CONFORMS, VARIANT* with the witness it came through; a faithful paraphrase returns *NOT FOUND* — it is not a quotation from this corpus and is not to be quoted as one; and tampering with the served corpus itself is not detectable by the endpoint at all, since the endpoint compares against that corpus, and is caught instead by the corpus's own hash and time anchor (*Provenance-Carrying Retrieval*).\n\n**The canonical source.** The four great references — *mahāpadesa*, given in the account of the teacher's last days (DN 16) and again in the numerical collection (AN 4.180) `[V]` — instruct that when someone claims to have received a teaching, the statement is to be neither approved nor rejected, but its words **carefully learned and checked against the discourses and the discipline** `[V]`. If they do not fit, the conclusion is stated in two parts: this is not the teacher's word, and *it has been incorrectly memorised* — by that monk, that community, those elders or that elder, according to the source the claimant named — and it is to be discarded `[V]`. ⚠️ **So the canonical disposition does name the carrier: as the one whose memorisation erred, with no penalty prescribed.** It is a finding about the fidelity of a copy rather than a verdict on a person — the canon already blames the copy, not the teaching — and the test it prescribes is the *accordance of a teaching* with the collections, not the collation of a string. **Two steps here are this paper's, not the canon's:** the transposition from doctrinal accordance to quotation collation, and the removal of the carrier from the disposition altogether.\n\n⭐⭐ **That second step is the design.** A verification interface that returns a verdict on the *claimant* creates an incentive not to submit claims, which destroys the mechanism's coverage exactly where coverage matters. A verification interface that returns a verdict only on the *claim* is safe to use, and therefore gets used. It is a small distinction and it is the entire difference between a conformance service and a reputation service.\n\n**What is offered as new, and what is not.** A closed disposition set about a submitted object is not new: OCSP (RFC 6960) returns *good*, *revoked* or *unknown* about a submitted certificate and says nothing about the party asking. Matching a claimed reference against a record is not new either: Crossref's bibliographic query takes a free-text citation and returns the works it may refer to. Hash verification is universal, and so is text similarity search. C2PA's validation reports say what could and could not be verified, but of an asset's own manifest rather than of a third party's claim about a corpus. **What is offered is the composition:** a closed disposition set over a multi-recension corpus that includes *conforms, as a variant, with its witness*, each member paired with a prescribed next action, and no place in the response schema for the claimant. We can find no retrieval, archival or attestation system that exposes that composition.\n\n**Sig-9 check.** The claim/claimant separation is a **property** if the disposition set has no member that can carry a verdict on a person, and a **rule** if the operator is merely asked not to add one. It must be built the first way. ⛔ *Remove the enforcer: if the schema permits a claimant field, someone will populate it under pressure, and the mechanism becomes a denunciation channel.*\n\n⚠️ **The schema is not the only surface, and the same test applies to the log.** An endpoint that accepts text over a network receives every request with an address, a key or an account. If it retains the requester's identity with the submitted text, the record of who submitted what — the denunciation record — exists on the server whatever the response schema says, and the no-claimant property has become a rule about the log. **It is a property only if the endpoint retains no requester identity with the submitted text.** And even then the schema stops the *server* from judging a claimant; it cannot stop a consumer from republishing a disposition — *NOT FOUND*, about a quotation a named person circulated — as a judgement of that person.\n\n### 5.2 — ⭐ The separated completeness manifest\n\n**The problem transparency logs do not solve.** Certificate Transparency and its descendants prove that a log is append-only and that a given entry is in it. **They do not prove that the log contains everything it ought to contain.** An operator who never adds a document has added no dishonest entry; every inclusion proof still verifies; every consistency proof still verifies. Omission is invisible to the entire apparatus, because the apparatus reads what was *produced*, and a document that was never produced produces nothing to read.\n\n⚠️ **This is the sharpest form of an instrument failure the institution has recorded repeatedly in its own operations: every check reads an artifact, so no check can report a thing that was never made.** An unstamped document, a workflow that never ran, a field nobody wrote — each is invisible to the check that would have caught it. The log is the same shape.\n\n**The mechanism.** Publish, as an artifact **distinct from the index**, a signed enumeration of a collection's membership and its **cardinality**, so that a third party holding the manifest alone can detect a document's silent removal. The separation is the mechanism, not an implementation detail: **an index cannot attest to its own completeness**, for the same reason a witness cannot corroborate themselves. If the manifest lives inside the index, an operator who removes a document removes its manifest line in the same edit and nothing anywhere disagrees.\n\n**The manifest carries a monotonically increasing version and an expiry, and a holder refuses an expired manifest or one older than a version it has already seen.** Without both, a stale manifest is internally consistent: an operator who reverts the collection to an older, smaller state and serves the older manifest that matches it passes every check that reads the pair (§10, *the frozen manifest*).\n\n⚠️ **Out of band here, in band in §4.1 — and the two are not in tension.** §4.1 puts provenance in the text because its consumer is a reader who never elected to fetch a separate record, and whose failure when the record is missing is silent. The manifest is kept out of band for *independence*. Its holder is an auditor who elected to hold it, and for that auditor its absence is not silent.\n\n**The canonical source.** The mnemonic summary verses — *uddāna* `[V]` — placed at the end of each section and of the whole work. Their function is precisely this: they key off each member of a group, fixing **membership and ordering** `[V]`, and the summaries at the end of a work give **the names and the counts** — of the elders, of the verses in each chapter, and of the whole `[V]`. They were memorised alongside the text by the reciters `[V]`.\n\n⚠️ **The best-known instance does not balance, and §9.11 treats this as a limit on the paper.** The totals that the Theragāthā's summaries give do not match a plain count of its verses, and the plain count itself differs between editions.\n\n⭐ **Two details of the canonical form are load-bearing and both were confirmed rather than assumed.** The summaries carry **counts**, not merely names — cardinality is what makes a removal detectable when a name is also removed. And they are **separate units**, positioned at the boundary of the collection rather than distributed through it, which is what allows a carrier to hold the manifest without holding the collection.\n\n**Against §2.3 — and it is a transposition.** CT gives append-only-ness and split-view detection; a completeness manifest gives completeness against a *declared* expectation. They compose, and neither substitutes for the other. But the manifest is not a new design — §2.3 names its nearest prior art in The Update Framework's snapshot metadata and BagIt's `Payload-Oxum` — and **this paper withdraws any claim that the design is absent from the destination field.** What it offers is the transposition to a served text corpus read by machines, together with the canonical instance of keeping the count apart from what it counts. The honest statement of the residual is that the manifest moves the trust problem rather than dissolving it — a signed manifest is only as good as the key that signed it and the party that published it — and §9.5 says so.\n\n**Sig-9 check.** Separation is a **property** when the manifest is signed by a different key and published by a different party than the index. It degrades to a **rule** the moment the same operator holds both, at which point it detects accident and not intent. ⚠️ *This is a real limit and it means the manifest is worth much less inside a single-operator system than it looks.*\n\n## 6 · What must not be inherited\n\n⛔ **A transposition that finds every mechanism inheritable is doing apologetics.** Two of the §4 mechanisms carry capture surfaces, and naming them is claimed in §Claims 13 as a design element of this paper rather than as a caveat on it.\n\n### 6.1 — The assembly's power to exclude\n\n§4.2 argued for a build-time gate operated by a named body. The same mechanism, viewed from one step back, is **an assembly with the power to decide what does not exist.** On the Sri Lankan chronicles' account, the losers of the second council held a rival Great Recital of their own `[V]` — modern scholarship separates the council from the later schism — and either way a schism is what an exclusion looks like from the excluded side.\n\nThis institution's own doctrine refuses exactly this shape elsewhere: a guard that depends on the good behaviour of whoever holds it at the moment it is tested is a rule, and rules need a living enforcer with the right incentives at the exact moment nobody can guarantee. **An admission body is a rule wearing a procedure's clothes.**\n\n⭐ **The available guard is §4.8, and it is only partial.** Serving every exclusion with its occasioning case and its amendment history makes the exclusion set auditable, which raises the cost of a bad exclusion without preventing one. **We state plainly that we do not have a property-shaped fix for this and are not claiming one.** The honest position is that a served corpus with a curated boundary has a governance problem that no amount of cryptography touches, and that the corpus should say so on its own surface rather than let the presence of hashes imply otherwise.\n\n### 6.2 — The authority to rule on interpretive standing\n\n§4.6's per-passage standing field is useful and is also a lever. Whoever sets the field decides which passages are to be read as they stand and which are open to inference — and the second category is where interpretation lives. An operator who can mark a passage as requiring inference can, without altering a byte, change what the corpus is understood to say.\n\n⚠️ **Two guards, and the paper is honest that they are mitigations rather than solutions.** The field must be **inside the hashed text**, so that changing it drifts the hash and rotates the proof, making the change as visible as an edit — because it *is* an edit. And the corpus must serve the standing field's own **change history** under §4.8, so a reclassification is as auditable as a removal.\n\n**Related and separate:** the guard that a reciter is not the author of what is recited is claimed and argued in *The Song That Is Not His* and is **cited here rather than re-claimed**, per the placement rule. It bears on §4.6 in an obvious way and this paper adds nothing to it.\n\n### 6.3 — The general form\n\nBoth refusals have the same shape and it is worth stating once: **the mechanisms that handle *bytes* transpose cleanly, and the mechanisms that handle *authority* do not.** Inline markers, manifests, variant witness *records*, announced elisions and conformance dispositions are all properties of artifacts. Witness *admission* — deciding what counts as an attested line of transmission — is not, and returns to §6.1, as §10 says of variant proliferation. Admission and interpretive standing are properties of a body politic, and importing them into a served corpus imports a governance question that the corpus's cryptographic apparatus is entirely powerless to answer — while, dangerously, *looking* as though it has answered it.\n\n## 7 · The threat-model partition\n\nThe transposition's most likely misuse is to treat these mechanisms as a complete integrity story. They are not, and the reason is a clean partition that the paper states early enough to be useful.\n\n```\n   ORAL TRANSMISSION FEARS          A RETRIEVAL SERVER FEARS\n   ──────────────────────────       ─────────────────────────────\n   drift        (slow mutation)     substitution  (swap the text)\n   forgetting   (loss of a          fabrication   (invent the text)\n                 lineage)           silent normalisation\n   ──────────────────────────       ─────────────────────────────\n              │                                │\n              ▼                                ▼\n   an uddāna detects OMISSION       a hash detects TAMPERING\n   a bhāṇaka group detects DRIFT    an anchor detects BACKDATING\n              │                                │\n              └──────────► NEITHER IS ◄────────┘\n                          SUFFICIENT ALONE\n```\n\n**An enumeration detects omission and cannot detect tampering. A hash detects tampering and cannot detect omission.** They are complements, and a system with only one of them has a hole shaped exactly like the other. That partition is the practical reason the two designs of §5 are worth having *together with* the envelope of *Provenance-Carrying Retrieval* rather than instead of it.\n\n⚠️ **The partition also bounds the field-test claim.** The canon's mechanisms were developed against *its* threat model, not ours. Where the two models overlap the transposition is well-motivated; where they do not, the canonical practice is evidence of nothing about our case, and §4 marks which is which.\n\n---\n\n## 8 · Where this sits against the rest of this corpus\n\nStated explicitly because a corpus that cross-references loosely is a corpus whose reader cannot tell what is claimed where.\n\n| Paper | Its question | Why this one is not it |\n|---|---|---|\n| *Provenance-Carrying Retrieval* | how does a response carry the means of its own falsification? | that paper builds the **envelope**; this one asks what a long field test left, and supplies two mechanisms the envelope does not contain (§5) |\n| *Buddha AI and the Living Tipiṭaka* §8 | what makes a canon **authoritative**? | authority over *new* material, decided by a doctrinal body; this paper is about the integrity of a **copy** of existing material |\n| *The Borrowable Standard* | what does a corpus need before it can exist? | orthography and encoding — upstream of this paper and disjoint from it |\n| *The Song That Is Not His* | who is the author of a recitation? | owns the reciter-is-not-author guard; **cited in §6.2, not re-claimed** |\n| *The Last Carrier* (essay) | what has carried this canon, and what carries it now? | the founder's voice, the media chain, and the observation about fragility that §3.1 cites |\n| *The Persistence Architecture* | can an apparatus be built so its author can stop? | succession, not transmission integrity |\n\n⭐ **The residue owed elsewhere.** *Provenance-Carrying Retrieval*'s prior-art section currently cites PREMIS, PROV-O, LOCKSS, Memento and Software Heritage and stops, on the line that the archival community has thought about this longer than the machine-learning community has. **The extension — that an oral canon thought about it longer still — is a two-sentence cross-reference belonging to that paper, not a section transplanted from this one.** It is queued against that paper's next revision.\n\n## 9 · Honest limits\n\n*This section makes no appeal to the tradition's authority; historical facts about the transmission appear in it only as evidence against the paper. That is deliberate and is the corpus's standing rule for honest-limits sections.*\n\n### 9.1 — Every integrity claim here is a detection claim\n\nRestated from §3.3 because it is the limit most likely to be lost in citation. **None of these mechanisms prevents a corrupted text from being served; the design rules say only what a server must never do silently.** They make divergence detectable and, where a witness exists, attributable. A corpus running all of them can still serve a wrong text; what it cannot easily do is serve a wrong text *silently*. Any use of this paper that implies a correctness guarantee is a misuse, and the paper's own field test is the evidence — the tradition ran this apparatus for two millennia and ended with branches, not with one text.\n\n### 9.2 — Survivorship, at n = 1, over two thousand years\n\nWe observe the canon that survived. The claim that these mechanisms *caused* its survival is not testable: there is no control and no record of the traditions whose apparatus failed. **This is unfalsifiable at n = 1 and the paper does not argue around it.**\n\n**There is, however, a comparable case, and it cuts against the paper.** Vedic recitation, an older oral-conservation system under constraints of the same kind, aimed at *prevention* and was built for it: redundant recitation forms — word by word (*padapāṭha*), in overlapping pairs (*krama*), in dense interlaced sequences (*ghana*) — whose purpose is that not a syllable be altered, read by Staal (1986) as a fidelity of oral tradition. Hadith transmission, for its part, built a developed oral provenance apparatus in the *isnād*. **So detection-not-prevention is what *this* corpus shows, not what §3.1's constraint box predicts**, and Claim 2 is bounded by that independently of n = 1. And the transmission finding of §3.3 is itself a retrodiction at n = 1 — read off the branches that survived, with the attribution of readings supplied largely by later commentaries — not a selection result.\n\nWhat survives both objections is narrower and is what §Claims 1 actually says: the mechanisms are *legible as engineering*, transposable, and have forms worth using on their own merits. Their canonical provenance is a reason to look, never evidence that they work.\n\n### 9.3 — The fitness function was not textual accuracy alone\n\nSharper than survivorship, and it is the objection we would raise against this paper. The councils had royal patronage; the collections that survived are substantially the collections that had institutional and political backing. **A field test whose fitness function included state support may have selected for political durability, with the textual mechanisms partly along for the ride.** We cannot separate the two. The consequence is stated as a bound on the whole paper: what is offered is **provenance of design — an account of where these ideas come from and why they are worth considering — and never proof of efficacy.**\n\n### 9.4 — Four of the seven, and the convention, are social protocols, and their engineering forms are half the mechanism\n\n§4.2, the witness admission of §4.4, §4.6, §4.7 and the §4.8 convention all presuppose a body of people: an assembly to admit, a body to decide which lines of transmission count as witnesses, an authority to assign standing, a community to recite before, a tradition to record precedent. **A scheduled re-verification with no assembly to verify before is a cron job talking to itself** — and it is worth saying that this is the paper's own strongest objection to itself, not one an outside reader had to supply.\n\nThis bites hardest on §4.7, which is why that subsection is marked as the weakest claim in §4. It bites least on §4.1, §4.4's witness record and §5.2, which are properties of artifacts and need no one present. **The ranking is the useful output: prefer the mechanisms that survive the removal of the community, and treat the rest as governance proposals wearing engineering clothes.** For this institution the assembly in question is a designed one whose seating is argued elsewhere and is not assumed here.\n\n### 9.5 — The manifest moves the trust problem rather than dissolving it\n\n§5.2's separation is only as good as the independence of the two publishers. In a single-operator deployment — which is what `corpus.333.eco` currently is — the same party holds the index and signs the manifest, so the mechanism detects **accident and drift, not intent.** That is worth having and is far less than it sounds. The design reaches its full strength only with an independent signer, and we do not have one.\n\n### 9.6 — What is actually deployed\n\nStated so the reader can weigh the rest. `corpus.333.eco` is live and serves the institution's corpus with a provenance envelope. **Of the mechanisms in this paper, the ones with running code are §4.1's inline markers and parts of §4.3's class separation.** §4.2 runs as a build step with a single human operator, which satisfies its letter and not its spirit. **§5.1 and §5.2 — the two designs of §5 — are not built.** They are specified here at claim scope for exactly that reason. The Tipiṭaka server that would exercise the full set has no date.\n\n⛔ **A reader should treat every efficacy statement in this paper as design reasoning, not as a report of operation.**\n\n### 9.7 — The citation standard, stated rather than assumed\n\nEvery canonical locus is marked `[V]` where it has been checked against multiple independent public reference works and translations. **No locus has been checked against the Pāli by a reader of Pāli**, and the authors do not read Pāli. §11 gives the full status and names the check that is owed. A paper about checkable provenance that left its own sourcing standard implicit would be refuted by its own thesis.\n\n### 9.8 — The coherence is not evidence\n\nThe mechanisms fit together well. Eight parts of an old apparatus mapping cleanly onto a modern problem is exactly the kind of pattern that is either deeply right or deeply seductive, and the two are indistinguishable from inside. **Each mechanism is individually arguable and should be argued individually; the elegance of the set earns an experiment and does not replace one.** ⛔ The fit between the parts is not evidence for any of them.\n\n### 9.9 — The evidence is self-attested\n\nEverything this paper knows about the apparatus comes from documents the apparatus itself admitted. The first council's procedure is known from Cullavagga XI, a text transmitted by that council's successors; the attribution of readings to reciter lineages comes largely from the commentaries; the summary verses of §5.2 are known from inside the collections they summarise. **That is §5.2's failure mode applied to the paper's own evidence: a witness cannot corroborate itself**, and an account of a completeness mechanism preserved by the collection it kept inherits the completeness problem it describes. The cave inscriptions of §3.1 are the one external witness, and they attest the reciters' specialisation, not their procedures.\n\n### 9.10 — Dispositions are only as stable as the matching fold\n\n§5.1's dispositions depend on how a claimed text is matched. Script, diacritics, sandhi, punctuation and segmentation all vary across editions and across inputs, and without a published matching policy the same input could return *CONFORMS* from one implementation, *CONFORMS, VARIANT* from a second and *NOT FOUND* from a third — undoing the checkability the endpoint exists to supply. **Dispositions are reproducible only against a published matching fold.** The fold may normalise for matching; it must never alter the served bytes, because in a corpus of this kind a spelling can be a tradition marker rather than noise.\n\n### 9.11 — The canonical instance of the count does not balance\n\nThe canonical case §5.2 leans on hardest is also the case that cuts against it. The translator's introduction to the SuttaCentral English Theragāthā (Sujato) records that the edition it follows, the Mahāsaṅgīti text, numbers **1,289** verses where the Pali Text Society editions number **1,279**, and that the difference comes from repetitions one edition includes and the other omits, not from a difference in substance. A reference work, citing von Hinüber's *Handbook of Pali Literature* (which we have not consulted directly), reports three figures for the collection: **1,360** claimed by the tradition, **1,294** given in the summaries within the text, and **1,279** by plain count. **So in the canon's best-known instance, the stated count and the counted collection disagree, and the counted collection changes with the edition.**\n\nTwo consequences follow. Neither is fatal, and both constrain the design.\n\n1. **A count detects omission only against a declared unit of counting.** Is a repetition a verse? Does an elided passage count? The edition-dependence §9.10 names for matching applies equally to counting, and a manifest that does not publish its counting rule will report mismatches that come from convention rather than removal. **§5.2's manifest must publish its counting rule beside its count.**\n2. **The canonical instance is not evidence that the count worked as a check.** The discrepancy has stood in the transmitted text. We found no account of it being treated as a sign of loss, and we read that absence, as our own inference and not as a finding of the sources, to mean that the summaries were not run as a live check against the text as it was later transmitted, whatever they did when they were composed. The transposition keeps the design, a count held apart from what it counts. It does not inherit a claim that the canonical instance worked as one. §9.2's rule applies here to a specific case: canonical provenance is a reason to look, never evidence that a mechanism works.\n\n## 10 · Adversarial analysis\n\n**A manifest that was always short.** An operator publishes a manifest omitting a document that was never admitted. Nothing detects it — the manifest is internally consistent and the document has no trace anywhere. ⛔ **This is not solvable by the manifest and §5.2 does not claim it is.** It is the omission problem one level up, and its only real answer is §4.2 plus §4.8: an admission decision made by an identified body and published with its reason. That answer is governance, not cryptography, and §6.1 says it is unsolved.\n\n**The frozen manifest.** An operator reverts the collection to an older, smaller state and serves the older manifest that matches it. The pair is internally consistent and every check that reads it passes. The Update Framework names these the freeze and rollback attacks, and §5.2 inherits its answer: a version and an expiry on the manifest, and a holder that refuses either kind of stale copy. ⚠️ **The version check protects only a holder who remembers the last version it saw; a first-time reader has nothing to compare against, and is protected by the expiry alone.**\n\n**Collusion between index and manifest signer.** Addressed in §9.5. Under a single operator the separation is hygiene. Its value is a step function in the number of genuinely independent signers, and the step from one to two is the largest.\n\n**The conformance endpoint as an oracle.** An adversary submits many near-miss texts to learn precisely how close a forgery must be to pass. This is real and it is bounded by the design: the endpoint compares against a corpus whose full text is *already public*, so the oracle reveals nothing the adversary could not obtain by reading. ⚠️ **The analysis changes completely for a corpus with non-public members, and a deployment over one should not expose this interface.**\n\n**The conformance endpoint's request log.** The response schema carries no claimant; the transport does. An operator who keeps requester identity beside submitted text — or anyone able to compel an operator — holds exactly the record the schema was built not to produce: who checked which quotation. §5.1 states the condition: the no-claimant property holds only if the endpoint retains no requester identity with the submitted text, and a disposition that a consumer republishes as a judgement of a person is beyond the endpoint's reach either way.\n\n**The conformance endpoint as a cost surface.** Text-in comparison is more expensive than hash-in comparison, and an interface that accepts arbitrary text invites abuse. This is an ordinary engineering problem with ordinary answers and is noted only so that the paper is not read as ignoring it.\n\n**Variant proliferation.** §4.4 refuses to normalise; an adversary submits many spurious \"variants\" to drown the real ones. The guard is that a variant is served **with its witness**, and a witness is an attested line of transmission rather than a submission. ⚠️ **This makes witness admission the attack surface, which returns to §6.1.** The paper's honest summary is that two of its seven adversarial cases terminate in §6.1's governance problem, and a third (collusion) in the adjacent question of signer independence (§9.5), and that a reader should regard §6.1 as the real open question rather than a section of caveats.\n\n### 10.8 — Why this paper registers no predictions\n\nThe corpus's standing practice is that a paper making an empirical claim registers falsifiable\npredictions in the public register. **This paper registers none, and the reason is the honest one\nrather than an oversight.** §9.2 and §9.3 disclaim efficacy explicitly: what is offered is\nprovenance of design, not evidence that these mechanisms work, and a survivorship case at n = 1 over\ntwo thousand years supports no prediction that could fail. The design claims in §4 are arguments,\nand arguments are refuted by better arguments rather than by data.\n\n⭐ **One prediction becomes clean the moment §5.1 is built, and is named here so that it is not\ninvented after the fact:** that a conformance response carrying a *disposition and a prescribed next\naction* produces a higher rate of citation correction, by an agent that has received a failing\nverification, than a bare match/no-match response does. That is a comparison between two response\nschemas over the same corpus, it has an obvious null, and it is measurable. ⛔ **It is not registered\nnow, because registering a prediction about an unbuilt interface is exactly the unclean registration\nthe register's own rules bar.** It is owed at the point §5.1 has running code.\n\n## 11 · Citation status — what has been checked, and by what standard\n\n⭐ **This section exists because the paper argues that unchecked claims must be visible, and it would be self-refuting to make its own an exception.**\n\n**Standard applied.** Each locus was checked against multiple independent public reference works, translations and encyclopaedic sources, and is marked `[V]` in the text where that check passed. Checks confirmed both the *location* (which text contains the material) and, where the paper leans on it, the *content* (that the passage says what the paper says it says). In the 2026-09-13 revision, the loci marked **root** below were also located in the Pāli root text published by SuttaCentral, read with its parallel English translation. That confirms the location and a translator's reading of the passage; it is still not a reading of the Pāli by a reader of Pāli.\n\n**Every marked locus, with what it supports:**\n\n| § | Locus | Checked against | What it supports |\n|---|---|---|---|\n| 3.1 | *bhāṇaka* specialisation by collection; Sri Lankan cave inscriptions, 3rd c. BCE – 1st c. CE, naming monks who specialised in the Saṃyutta, Majjhima or Aṅguttara Nikāya | reference works | a shard per collection, carried by lineages; the one external witness (§9.9) |\n| 3.2, 4.2 | the first council: Cullavagga XI (Vin Cv XI.1.4, XI.1.7–8) | **root** + translation | a question-and-answer recitation before the assembly; each Vinaya rule asked with its origin story, person, rule, additions, offence and non-offences; formal decisions carried by motion with silence as assent. ⚠️ The chorus and the unanimous-acceptance requirement are the secondary accounts' characterisation and were **not found** in this passage |\n| 3.3, 4.4 | variant readings between material preserved in both the Dīgha and Majjhima Nikāyas, possibly attributable to different *bhāṇaka* schools; later interpretive divergence visible in the commentaries | reference works | branches, in part attributable |\n| 3.3, 6.1 | the Dīpavaṃsa's account of the defeated Vajjiputtakas' rival Great Recital (*mahāsaṅgīti*) | reference works; modern scholarship separates the Vesālī council from the Mahāsāṃghika schism | a schism as an exclusion seen from the excluded side |\n| 4.1 | *evaṃ me sutaṃ* opening the discourses (e.g. DN 16:1.1.1); *vuttañhetaṃ bhagavatā … me sutaṃ* opening the Itivuttaka (Iti 1:1.1) | reference works; **root** + translation (the instances cited) | attribution inline, never a header; more than one formula |\n| 4.3 | *aṭṭhakathā* as a class; the Niddesa (Khuddaka Nikāya) on parts of the Sutta Nipāta; the old word-commentary (*padabhājanīya*) within the Suttavibhaṅga; the Nettipakaraṇa, Peṭakopadesa and Milindapañha in the Burmese Khuddaka, the first two in the Sinhalese printed edition; the lost Sinhala commentaries | reference works | the label held while the boundary moved |\n| 4.5 | *pe* / *peyyāla* | the Pali Text Society's dictionary (s.v. *peyyāla*); a translator's introduction distinguishing internal from external abbreviation (Sujato, *Long Discourses*); **root** sample: all twenty-nine elisions in DN 16 | a repetition to be supplied, from the context or from another text; no arbitrary cut in the sample |\n| 4.6 | AN 2.24–25, SuttaCentral numbering | **root** + translation | *nītattha* / *neyyattha* marked per discourse (*suttanta*); misrepresentation in both directions (AN 2.24) and its correct counterpart (AN 2.25) |\n| 4.7 | the Uposatha chapter: Vin Mv II.3.3 (silence as purity; the announcement up to a third time; concealment as lying in full awareness) and Mv II.3.7 (a *dukkaṭa*); the fortnightly recitation on the full and new moon | **root** + translation; reference works | silence as an assertion with a cost |\n| 4.8 | each Suttavibhaṅga rule with its origin story, additions and non-offences; further cases as precedent; the same headings asked at the first council (Cv XI.1.7) | reference works; **root** + translation (Cv XI) | exclusions served with their occasion and amendment history |\n| 5.1 | *mahāpadesa*: DN 16:4.8–4.11; AN 4.180 | **root** + translation | neither approve nor reject; check against discourse and discipline; *incorrectly memorised by* the source the claimant named; discard; no penalty |\n| 5.2 | *uddāna* at the close of a vagga or work, e.g. the closing summaries of the Theragāthā (Thag 21.1), giving numbers of elders and verses; summaries memorised with the text | reference works; **root** (location only) | membership, ordering and counts, held as separate units at a boundary |\n| 9.11 | the Theragāthā's verse count by edition (Mahāsaṅgīti 1,289; PTS 1,279); the totals in the text's summaries against a plain count (1,360 tradition · 1,294 summaries · 1,279 counted) | the translator's introduction (Sujato, *Verses of the Senior Monks*, as published in SuttaCentral's edition data; read 2026-09-23) for the first; **one** reference work citing von Hinüber's *Handbook of Pali Literature* for the second, the handbook not itself consulted | the count and the counted disagree; the counted varies with the edition |\n\nThe §9.11 row is **not** marked `[V]`. Its first half rests on a single source read directly, and its second on a single reference work reporting a handbook we did not read. Neither meets the multiple-source standard, so it is stated as the weaker of the two standards in use here. The Pāli of the summaries was not read for this row. The figures are the sources' figures, not our reading of the summary verses.\n\n⚠️ **The checks against the root texts corrected five readings in this paper's first version, and they are recorded because they are the class of error the remaining check exists to find.** (1) The *mahāpadesa* disposition does name the carrier — as the one whose memorisation erred — where the first version said it prescribed no judgement of the person; the no-claimant property is the design's step beyond the source (§5.1). (2) The *nītattha* / *neyyattha* unit is the discourse, not the passage (§4.6). (3) The chorus and unanimity requirement are not in Cullavagga XI's account (§3.2). (4) Commentary was not \"never merged\": the class label held while material crossed it (§4.3). (5) Not every discourse opens with the same formula (§4.1).\n\n⚠️ **One conflation was caught by the first-version check and is recorded for the same reason.** The mnemonic index verses of §5.2 — *uddāna*, with a doubled consonant — are a **different word** from *udāna*, the inspired utterance, which is a genre in the traditional list of text-types and the name of a book of the canon. The two are one diacritical difference apart, and a paper that confused them would have attributed the completeness mechanism to the wrong thing entirely.\n\n⛔ **What this standard does NOT establish, stated at its true size:**\n\n1. **No locus has been verified against the Pāli by a reader of Pāli.** The checks are against translations and reference works. They establish bibliographic and substantive accuracy at the level a careful non-specialist can reach, and no further.\n2. **Glosses are not verified.** Where the paper renders a term into an engineering concept, that rendering is the authors' and may not be how a specialist would read it. The *uddāna* case shows the failure mode is real.\n3. **Enumeration varies by edition.** §4.6's locus is cited in SuttaCentral's numbering; a reader working from another edition may find it numbered differently. The same holds for counts: §9.11 records that the Theragāthā's verse count differs between editions.\n4. **Nothing here has been reviewed by the tradition.** The material is read as engineering by people outside the community of specialists who carry it, and a specialist may reasonably object to the reading itself and not merely to a citation.\n\n⭐ **The check that is owed, and by whom.** Each locus should be confirmed by a reader of Pāli — for this institution, the founder's father, who is the transcription authority named in this corpus, or the Aquarian Sangha. The ask is small and specific: confirm that each cited passage says what this paper says it says. **Until that is done, this section is the paper's honest state and not a formality**, and a reader who finds an error is asked to treat §5.1's own disposition rule as applying here: the finding is about the claim.\n\n## 12 · Cross-venue references\n\n*Provenance-Carrying Retrieval* (the envelope; §5's mechanisms extend it) · *Buddha AI and the Living Tipiṭaka* §8 (canonical authority, distinguished in §4.2) · *The Borrowable Standard* (orthographic and encoding preconditions) · *The Song That Is Not His* (the reciter-is-not-author guard, cited in §6.2) · *The Last Carrier* (essay; the fragility observation in §3.1) · *The Persistence Architecture* (succession, adjacent and distinct) · *Appreciation as World-Building* (the property-over-rule argument used in the Sig-9 checks throughout §4 and §5).\n\n## Coda\n\nThe people who built this apparatus were not trying to solve a retrieval problem. They were trying to keep something they thought was worth keeping, under conditions that gave them no reason to expect success, using the only storage medium available to them, which was each other. They lost material. They disagreed, sometimes bitterly, and the disagreements are still legible in what came down. By any standard a modern engineer would apply to a storage system, the thing failed continuously for two thousand years.\n\nAnd it is still here, and we can tell where it differs from itself, and we can often tell whose hands each difference came through.\n\nThat is the result worth taking. **Not a system that did not fail — there is no such system — but a system that failed loudly enough, and with enough attribution attached, that the failures are still auditable twenty centuries later.** Every mechanism in this paper is in service of that one property. It is a smaller promise than the word *integrity* usually implies, and it is the only promise anyone has ever actually kept.\n\n---\n\n*Co-authored with Miss Aquarius℠, the institution's named AI collaborator, per the corpus's standing disclosure; final editorial control and responsibility for every claim rest with the human author.*",
+      "text": "> **Claim-scoped by design.** This paper publishes the *claim* and withholds the *spec*. It is written against `corpus.333.eco`, a retrieval server that is live and whose first four mechanisms are scheduled; the Tipiṭaka server that would host the rest has no date, and its implementation detail is therefore withheld under the institution's standing rule that a complete design for something unbuilt is a blueprint rather than a fence. What is disclosed here is what a retrieval layer must carry and why. What is not disclosed is endpoint shapes, manifest schemas, transport bindings or tool surfaces. **That withholding has a cost, stated here once:** this publication anticipates the mechanisms at their stated claim scope, and a later filing on a specific schema, transport binding or matching algorithm is not answered by it.\n>\n> Companion works: *Provenance-Carrying Retrieval* (the envelope this paper's mechanisms sit inside; that paper argues **exposure beats assertion**, this one asks what a two-millennium field test left behind), *Buddha AI and the Living Tipiṭaka* (whose §8 asks what makes a canon **authoritative**; this paper asks the narrower and different question of what makes a **copy** of it checkable), *The Borrowable Standard*, *The Song That Is Not His* (which owns the *bhāṇaka* guard cited in §6.2 and is not re-claimed here), and the essay *The Last Carrier*.\n\n> ⚠️ **Citation status, stated in the paper rather than in a footnote, because the paper argues that unchecked claims must be visible.** Every canonical locus below has been checked against multiple independent public reference works and translations, and each is marked `[V]` where that check passed; §11 tabulates every marked locus, and where the check also located the passage in the Pāli root text with a parallel translation, the table says so. **No locus has been checked against the Pāli by a reader of Pāli.** That check is owed and named in §11, which also records the conflation and the corrected readings the checks caught. A paper arguing that provenance must be checkable would be self-refuting if it asserted its own sources at a standard it declines to state, so the standard is stated: **bibliographic verification against secondary sources, not philological verification against the canon.**\n\n## Preamble\n\n> *Offered to the commons under CC0, without ledger and without expectation of return. There is a particular reason this paper cannot be withheld: it is a paper about what happens to a text that is guarded, and everything it recommends was itself given away by people who had every worldly reason to keep it and no mechanism by which to profit from it. To place a licence on a description of their protocol would be to misunderstand the protocol.*\n\nFor four hundred years the canon this institution builds on had no copy. It had carriers. Families of monks divided the collections between them the way a village divides the care of its fields — one lineage keeping the long discourses, another the middle-length, another the verses — and every generation had to receive the whole of it again, out loud, in company, from the mouths of people who still had it. A dropped line was audible to everyone in the room. There was no master text to diff against, no archive to restore from, no author left alive to ask. There was only the recitation, the assembly, and the procedures they had agreed on for catching each other's errors.\n\nEngineering has a name for that situation now. It is a distributed system with no authoritative replica, no single writer, unreliable nodes that die on a human schedule, network partitions that last centuries, and an adversary — time, politics, honest misremembering, and eventually open schism. The system ran for two thousand years and what came out the other end is checkable enough that a modern editor can collate the surviving branches and say, with evidence, where they differ and why.\n\nThis paper is not an argument that the tradition was right about anything. It is the observation that the tradition was **under constraints that overlap a retrieval server's, several of them harder**, for very much longer, with far worse tooling, and that the mechanisms it converged on have engineering forms. Most of those forms are already standard practice under other names. Two are carried furthest from where the destination field keeps them, and §5 names the nearest prior instance of each. And two of the mechanisms should be studied and then deliberately refused, which is the part of the paper we would most like a reader to take seriously.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. **The author and HeartBank® will not seek patent on any mechanism enumerated in the Claims section of this document — among them the conformance endpoint, the separated completeness manifest, the per-passage interpretive-standing field, the inline provenance marker, the build-time assembly gate, commentary served as a distinct class under the non-summarisation rule, variants served with their witness, the announced-elision convention, scheduled public re-verification, and the recorded-exclusion-reason convention — any combination of them, or any portion thereof, in any jurisdiction, at any time. This commitment is permanent and is not tactical.** Trademark rights on specific marks — **HeartBank®**, **Miss Aquarius℠**, **THonly™**, **Silicon Wat℠**, **B-Witness**, and the B-heart logo — are separately and explicitly reserved; the defensive-publication dedication concerns the *mechanisms*, not the *marks*.\n\nThe canonical material described here is not ours and no claim of any kind is made over it. The Pāli canon and its transmission apparatus are the property of no one; the *aṭṭhakathā* and Vinaya materials cited are the inheritance of a living tradition. What is offered as prior art is strictly the **transposition** — the reading of those mechanisms as engineering — and the two designs in §5, whose nearest prior instances in the destination field are named there.\n\nThe following are disclosed here as a unified contribution: (i) the **transposition of an oral canon's transmission apparatus into machine-facing retrieval serving**, mechanism by mechanism, each with an engineering form — as distinct from the literatures that already read such apparatus as a system of fidelity or as oral literature (Staal 1986 on Vedic recitation; Cousins 1983 and Wynne 2004 on the Pāli oral tradition), that read the Pāli canon's formation historically (Collins 1990; von Hinüber 1996), or that read it as philology, as religious history, or as an oral-formulaic composition problem; (ii) the **conformance endpoint** of §5.1, as a composition — a retrieval interface that accepts a *claimed* text, lays it alongside the served text of a multi-recension corpus, and returns one of a closed set of dispositions on the claim, including a variant with its witness, each paired with a prescribed next action, with no place in the response for a disposition on the claimant; the closed disposition set about a submitted object is itself anticipated (§5.1 names OCSP); and (iii) the finding of §3.3 that what this particular transmission left was **divergence made detectable rather than divergence prevented**, with the consequence that the transposition's honest promise to a retrieval system is a *detection* guarantee and never a *correctness* one. The **separated completeness manifest** of §5.2 and **interpretive standing carried per passage** (§4.6) are offered as transpositions, not as new designs: the first has close prior art in software-update metadata and package manifests, the second in per-statement and per-report standing in several fields, and both are named where the mechanism is stated.\n\nComponent lineages are old and are engaged in §2 rather than absorbed: the digital-preservation standards (PREMIS, PROV-O, OAIS), the replication and reference literatures (LOCKSS, Memento, Software Heritage and its SWHIDs), the transparency-log line (RFC 6962 Certificate Transparency, and its descendants in SCITT and COSE receipts), software supply-chain attestation (Sigstore, Rekor, SLSA) and software-update metadata (The Update Framework), package manifests (BagIt, RFC 8493), certificate status protocols (OCSP, RFC 6960), content provenance (C2PA), textual scholarship (Lachmann; Greg–Bowers; the TEI apparatus), the oral-formulaic tradition in classics (Parry; Lord), and the scholarship on oral transmission in India (Staal; Cousins; Wynne). **The claim is transposition, not invention, and §2.6 states plainly where the transposition adds nothing.**\n\n## Claims\n\n*A defensive publication works by disclosure. These enumerate what the paper discloses and add no matter beyond it.*\n\n1. **The field-test claim, narrowed to its transposition.** An oral canon transmitted across roughly two millennia without a living author, without writing for its first several centuries, and through schism constitutes a copy-integrity field test of a duration no digital system has yet undergone; its surviving procedural apparatus — already read as a system of fidelity and as oral literature in Indological and Buddhist studies (§2.5) — is transposable, mechanism by mechanism, to machine-facing retrieval serving (§3, §4).\n2. **The transmission finding, which bounds every other claim here.** What the transmission **left** is divergence that is detectable and in part attributable — not one text, and not the prevention of divergence. It is detectable today because written branches and parallel traditions survived, and it is attributed largely by commentaries written centuries later. Any inheritance of these mechanisms therefore inherits, at most, a **detection** property and must not be represented as a correctness property; and the finding is a retrodiction at n = 1, particular to this corpus, since an older oral tradition under constraints of the same kind aimed at and built for prevention (§3.3, §9.1, §9.2).\n3. **Inline provenance over metadata provenance.** A provenance marker belongs in the text stream that travels with a quotation, not in a metadata field a consuming agent must separately elect to read; the canonical instance is the inline attribution formula that opens the discourses (§4.1).\n4. **The build-time assembly gate.** Admission to a served corpus is decided at build time by a named body under a recorded procedure, never at query time by a filter; a query-time gate is a gate whose operator can be pressured per request (§4.2).\n5. **Commentary as a distinct served class, and the non-summarisation rule that follows from it.** Where a tradition labels commentary as a separate text class from the text it comments on — even where the boundary between the classes has moved — a server serves each text under its class label and never returns generated summary in the position where source text is expected (§4.3).\n6. **Variants preserved with their witness, never normalised.** Divergent readings are served as divergent readings with their line of transmission attached; silent normalisation to a majority or preferred reading is the specific failure this mechanism exists to prevent (§4.4).\n7. **The conformance endpoint** — *a composition of known parts, §5.1.* An interface that takes a claimed quotation, compares it against a served multi-recension corpus, and returns one of a small closed set of dispositions **on the claim** — including a conforming variant with its witness — each together with the procedure the requester should follow next; and which by construction returns no disposition on the person or system that made the claim, a property that holds only under the logging condition §5.1 states. A closed disposition set about a submitted object is anticipated (OCSP); the composition is what is disclosed. A hash answers *did this match*; this answers *and what now*.\n8. **The separated completeness manifest** — *a transposition, §5.2* (nearest prior art: The Update Framework's snapshot and timestamp metadata; BagIt's `Payload-Oxum`). A signed enumeration of a collection's membership and cardinality, carrying a monotonically increasing version and an expiry, published as an artifact distinct from the index it describes, so that a document removed from the collection is detectable by a third party holding the manifest alone, and a manifest frozen at an older state is refused. **An index cannot attest to its own completeness.**\n9. **Announced elision.** Where served text has been abridged, the abridgement is marked *in the text*, at the point of the cut, in a form that names the elided span by a resolvable identifier or digest sufficient to fetch and verify it — the served-corpus analogue of a reciter who already holds the elided formula — and not recorded in a field beside it (§4.5).\n10. **Per-passage interpretive standing.** Whether a passage is to be read as stating its meaning directly or as requiring inference is a property of the passage and must travel with the excerpt, because an excerpt loses the document's front matter at the moment of retrieval; the canon's own marking is per discourse, and per-passage granularity is this paper's design. A default that marks every passage as requiring inference is itself a misclassification, not a safe setting (§4.6).\n11. **Scheduled public re-verification, in which silence is load-bearing.** Integrity is re-affirmed on a fixed public schedule before an assembly, the affirmation is solicited a fixed number of times, and silence constitutes a positive assertion of integrity for which the silent party is accountable — which is what distinguishes it from an unanswered health check (§4.7).\n12. **Every exclusion served with its recorded reason, and its amendment history.** A corpus that excludes material publishes, with each exclusion, the case that occasioned it and the subsequent refinements — so that the exclusion set is auditable rather than merely announced (§4.8).\n13. **The refusal, claimed as a design element and not as a caveat.** Two of the mechanisms — the assembly's power to exclude, and the authority to declare a passage's interpretive standing — carry capture surfaces that a served corpus must guard or decline to inherit. **A transposition that finds every mechanism inheritable is doing apologetics rather than engineering** (§6).\n\n## Abstract\n\nA retrieval system that serves text to a machine reader has a problem the machine reader cannot solve for itself: the reader cannot tell a faithful copy from a plausible one. *Provenance-Carrying Retrieval* argued that the response should therefore carry the means of its own falsification — a hash, an independent time anchor, a citable identifier — and that the trust burden should be inverted, so that a server ships the tools to disbelieve it. This paper asks a different and prior question. **Has anything ever actually run this problem to completion?**\n\nOne thing has, and it is not a computer system. The Theravāda Pāli canon was transmitted for roughly four centuries with no written copy at all, and for roughly two millennia in total, without a living author to arbitrate, across schism — on the Sri Lankan chronicles' account, one that produced a rival recital — through famine, war, and the ordinary attrition of the human beings who *were* the storage medium. That is a copy-integrity problem under a threat model that overlaps a retrieval server's without being the same one (§7 partitions the two), sustained for a duration no production system has approached. It converged on an apparatus, and this paper reads seven of its parts as engineering.\n\nAll seven are transpositions, and the paper says so plainly. Five transpose practices the archival and transparency-log communities already know under other names: **an inline attribution formula** opening the text rather than a metadata field (§4.1); **admission decided at build time by a named assembly** under a recorded procedure rather than by a query-time filter (§4.2); **commentary labelled as a distinct text class**, from which a server inherits an obligation never to substitute generated summary for source (§4.3); **variant readings preserved with their line of transmission attached** rather than normalised to a preferred text (§4.4); and **abridgement announced inline** at the point of the cut (§4.5). Two more transpose practices known in other fields: **interpretive standing carried per passage** rather than per document, because an excerpt loses its document's front matter at retrieval (§4.6); and **scheduled public re-verification before an assembly in which silence is a positive assertion** for which the silent party is accountable (§4.7). An eighth item is a convention rather than a mechanism — **every exclusion served with the case that occasioned it** (§4.8).\n\nTwo further designs (§5) are carried furthest from where the destination field keeps them. The **conformance endpoint** (§5.1) accepts a claimed quotation and returns a disposition *on the claim*, together with the procedure to follow next, and by construction returns no disposition on the claimant — the part a hash does not have, because a hash reports that a comparison failed and says nothing about what to do. It is disclosed as a composition of known parts: closed disposition sets about a submitted object are old (OCSP), and what is disclosed here is a set over a multi-recension corpus that includes a conforming variant with its witness. The **separated completeness manifest** (§5.2) is a signed, versioned and expiring statement of a collection's membership and cardinality published as an artifact distinct from the index it describes, on the ground that **an index cannot attest to its own completeness**: a silently dropped document is invisible to every check that reads the index, and detectable to a third party holding only the manifest. It is a transposition, with The Update Framework's snapshot and timestamp metadata and BagIt's `Payload-Oxum` as its nearest prior art.\n\nThe paper's most important result is a narrowing, and it is stated in the abstract rather than buried in limits. **The transmission did not leave one text.** It left branches — recensions associated with different reciter lineages — and divergence between them that is detectable today because written branches and parallel traditions survived, attributable in part, and attributed largely by commentaries written centuries later. So what the two millennia left was not the prevention of divergence but divergence that can be **detected and, in part, attributed**. That is a weaker property than the one a reader might expect, and it is the *right* property for a retrieval system, whose actual failure mode is not that its copies differ but that they differ silently. It is also a retrodiction at n = 1 and particular to this corpus: Vedic recitation, under constraints of the same kind, aimed at and built for prevention (§9.2). §6 then argues the case against inheritance: the assembly's power to exclude, and the authority to rule on a passage's interpretive standing, are capture surfaces, and a served corpus must guard them or refuse them. §9 states the limits without hedging — survivorship at n=1 over two thousand years, a fitness function that plainly included royal patronage and not only textual accuracy, evidence that the apparatus itself admitted, and the observation that four of the seven mechanisms, and the eighth convention, are *social* protocols whose engineering forms are half the mechanism at most. **A scheduled re-verification with no assembly to verify before is a cron job talking to itself.** Offered under CC0 1.0 Universal as defensive prior art.\n\n**Connection to the mission frame.** This institution has committed to writing its corpus primarily for a machine reader — an autonomous successor who will inherit a body of text and must be able to tell what in it is load-bearing, what is commentary, what has been superseded, and what was never checked. That commitment is empty unless the corpus can be *served* in a form that supports the distinction. The apparatus described here is the one the founder's own tradition built for keeping a text checkable across generations of carriers — a problem that overlaps this one — under conditions harder in several respects, for a reader who was also expected to carry the text forward without becoming its author. The transposition is not decoration on a technical claim. It is the reason the technical claim is the institution's problem rather than someone else's.\n\n---\n\n## 1 · Why this problem is the institution's problem\n\nThe corpus this paper belongs to is written, deliberately and on the record, primarily for a machine reader. That decision has a consequence which took some years to become visible: **a corpus written for a machine reader is only as good as the channel that delivers it.** A human scholar who receives a garbled quotation has recourse — a library, a colleague, a memory of having read the thing. A language model that receives a garbled quotation has none. It cannot tell a faithful copy from a plausible one, because plausibility is the only signal it has, and a well-constructed forgery is *more* plausible than an awkward original.\n\n*Provenance-Carrying Retrieval* addressed the delivery layer directly and argued for an inversion: a retrieval server normally asks to be believed, and ours ships the means to disbelieve it. Text arrives bound to a content hash, an independent time anchor and a citable identifier, so the consuming agent can verify its own citation rather than trusting the channel.\n\nThat paper is complete and this one does not repeat it. What it did not ask — a question Indological and Buddhist studies approach from the other side, having long read oral transmission apparatus as a system of fidelity (§2.5) — is whether the problem has ever been *solved under load*. Every mechanism in the digital-preservation and transparency-log literatures is young. Certificate Transparency is from 2013. LOCKSS is from 1999. PREMIS is from 2005. Software Heritage began in 2016. These are excellent systems and this paper leans on several of them. But none of them has been run for two hundred years, let alone two thousand, and none has been run through a schism that forked its corpus and left both forks alive.\n\nOne protocol has. The institution's founder is a Theravāda Buddhist co-transcribing the Khmer Tipiṭaka with his father, which is how this observation was available to be made at all, and the observation is not devotional. It is that a very hard version of this exact problem was posed, was worked on continuously by large numbers of intelligent people under adversarial conditions for a duration that dwarfs the entire history of computing, and produced an apparatus that can be read off and reused.\n\nThree things make it worth a paper rather than a remark.\n\n**First, the conditions are not a loose analogy — they overlap, and several of them are harder** (§7 partitions where the two threat models do not overlap). No living author to arbitrate a disputed reading; that is the position of any corpus after its authors die, and it is the position this institution has explicitly planned for. No writing, for the first several centuries; that is a storage layer with no durability guarantee whatsoever, which is strictly worse than any modern substrate. Active schism; that is a fork with two live maintainers and no upstream, which is the governance failure mode every open corpus eventually faces.\n\n**Second, the mechanisms have engineering forms that are not metaphors.** §4 states each one as a plain design rule first and gives its canonical source second, and that ordering is deliberate: the section is constructed so that **every mechanism survives the deletion of every Pāli term in it.** This is the corpus's standing deletion test applied structurally rather than as a promise — if a reader strikes the tradition out, the design rules remain, intact and independently arguable. That is a property of how the section is built, not a rule the authors ask to be trusted on.\n\n**Third, the transposition returns two designs the destination field has only in part** — one a composition of known parts, one a transposition of software-update practice to a served text corpus — **and a refusal it does not have.** A paper that only recovered known practice would be a pleasant essay. §5 and §6 are why this is filed as prior art.\n\n## 2 · Background and prior art, engaged generously\n\nThe claim is transposition. That obliges an honest account of what the destination field already has, and this section is deliberately unflattering to the paper's own novelty.\n\n### 2.1 — Digital preservation\n\n**PREMIS** supplies a data dictionary for preservation metadata — provenance, fixity, rights — and is the standard vocabulary for saying *this object came from there and has this checksum*. **OAIS** (ISO 14721) supplies the reference model for an archive, whose concepts PREMIS builds on. **PROV-O** supplies a W3C ontology for provenance as a graph of entities, activities and agents. Between them these cover a great deal of what §4.1 describes, with one difference this paper is making the whole of its case on: **they are metadata standards, and metadata is a separate stream from the content.** An agent that retrieves a passage and does not fetch its PREMIS record has the passage and no provenance. §4.1's claim is about *where the marker lives*, not about whether provenance should exist.\n\n### 2.2 — Replication, reference and identity\n\n**LOCKSS** — Lots Of Copies Keep Stuff Safe — is the closest thing in the destination field to the *bhāṇaka* lineage structure, and the resemblance is real: independent institutional copies, periodic mutual comparison, repair by consensus among peers. **Memento** solves time-travel for the web, which is the *dated witness* problem. **Software Heritage** assigns intrinsic identifiers (SWHIDs) computed from content rather than assigned by an authority, which is the most philosophically similar move in the whole destination field: identity from the bytes, not from a registrar.\n\n**This paper does not claim to improve on LOCKSS.** Where §4.4 differs is narrower: LOCKSS repairs toward agreement, and the mechanism in §4.4 explicitly refuses to repair, preserving disagreement with attribution instead. Those are different goals, and the canon's is the unusual one.\n\n### 2.3 — Transparency logs and supply-chain attestation\n\n**RFC 6962 Certificate Transparency** is load-bearing prior art for §5.2 and it must be credited hard. CT already has signed tree heads carrying the tree's size, inclusion and consistency proofs, and a gossip requirement whose mechanism RFC 6962 left to later work — which together give append-only-ness and, where gossip is deployed, detection of split views. The institution's own ledger design depends on it. **Sigstore, Rekor and SLSA** move the same primitives onto build artifacts; **SCITT** and **COSE receipts** generalise transparency receipts as an IETF work item; **C2PA** carries provenance manifests for media, including external manifests that travel separately from the asset.\n\n**The nearest prior art for §5.2 is not CT, and it is closer than CT.** **The Update Framework (TUF)** separates a *snapshot* role, which signs a statement of the latest version of every targets metadata file on a repository and so prevents mix-and-match attacks, from a *timestamp* role that re-signs frequently, and it requires clients to refuse expired metadata and any version lower than one already trusted — which defeats freeze and rollback. **BagIt** (RFC 8493) carries a `Payload-Oxum`, the octet count and file count of a package's payload, \"intended for the purpose of quickly detecting incomplete bags.\"\n\nAgainst that, §5.2's claim is smaller than it might look and is stated at its true size in §5.2 itself. **CT proves that a log is append-only and that a given entry is in it; it does not prove that the log contains everything it ought to contain.** TUF and BagIt do address completeness against a declared expectation, each in its own setting, so §5.2 is offered as a transposition of that practice to a served text corpus read by machines, not as a design the destination field lacks.\n\n### 2.4 — Textual scholarship\n\nThis is the field with the oldest and strongest claim, and pretending otherwise would be the paper's most embarrassing failure. **Lachmannian stemmatics** reconstructs an archetype from the pattern of shared errors among witnesses. **Greg–Bowers** copy-text theory formalises editorial choice between variant readings. The **TEI critical apparatus** is a mature XML vocabulary for encoding variants with their witnesses — which is to say, **§4.4 is a description of standard practice in textual scholarship and claims no novelty whatsoever.** *Resetting*, *witness*, *recension* and *collation* are terms of art in analytical bibliography and are borrowed here, not coined.\n\n⚠️ **The honest form of §4.4's contribution is therefore this and only this:** the destination field for retrieval-serving has not adopted the apparatus that textual scholarship has had for nearly two centuries, and machine-facing retrieval is precisely where its absence is most costly, because the consumer cannot supply the missing judgement.\n\n### 2.5 — Oral tradition and the classics\n\n**Parry and Lord** on oral-formulaic composition established that formulaic repetition is a *compositional* technology in oral epic. The Pāli material's heavy formulaic repetition — the reason §4.5's elision marker exists at all — sits squarely in that lineage.\n\n**Reading an oral canon's apparatus as a system of fidelity is not new either, and this paper's first claim is narrowed accordingly.** Staal (1986) read Vedic recitation — with its forms word by word, in overlapping pairs and in dense interlaced sequences — as a fidelity of oral tradition; Cousins (1983) examined the Pāli material as oral literature, and Wynne (2004) its oral transmission; Collins (1990) read the idea of a closed Pāli canon historically, as the product of a particular monastic lineage; von Hinüber (1996) surveyed Pāli literature as a whole. The Buddhist-studies literature on the councils, the *bhāṇaka* lineages, and the relation between the Pāli recensions and the surviving Sanskrit and Chinese Āgama parallels is very large and this paper does not contribute to it. **What this paper adds is the transposition only: the mechanism-by-mechanism move from that apparatus to machine-facing retrieval serving.**\n\n### 2.6 — Where the transposition adds nothing\n\nStated plainly, because a paper that finds itself novel everywhere is not to be trusted:\n\n- **§4.1 (inline marker)** adds a *placement* argument to a solved provenance problem. If your consuming agents reliably read metadata, this mechanism is worth nothing to you.\n- **§4.2 (build-time gate)** is admission control. Every curated database has one. The contribution is the argument for *when* it runs, not that it exists.\n- **§4.3 (commentary as a class)** is old practice under a class label — the printed Talmud page, the Tibetan canon's division into Kangyur and Tengyur — and its non-summarisation obligation is already argued in *Provenance-Carrying Retrieval*. No novelty.\n- **§4.4 (variants with witnesses)** is TEI. No novelty at all.\n- **§4.6 (per-passage standing)** is anticipated at that granularity — per statement in RFC 2119, per report in hadith grading, per point of law in legal citators. What remains is only its symmetric default.\n- **§4.8 (exclusions with reasons)** is close to standard practice in well-run archives and is identical in spirit to a good deprecation policy.\n- **§4.7 (scheduled re-verification)** is a health check with an audience. Whether the audience is a real addition is argued in §4.7 and is the least secure claim in §4.\n- **§5.2 (completeness manifest)** is The Update Framework's snapshot metadata and BagIt's `Payload-Oxum`, carried to a served text corpus.\n\n**What is left after that subtraction is §4.6's symmetric default, the composition in §5.1, the refusal in §6, and the transmission finding in §3.3 — with §5.2 as the transposition most worth making.** That is the paper.\n\n## 3 · What the field test actually was, and what it left\n\n### 3.1 — The conditions\n\nStated as a systems problem, without devotional framing:\n\n```\n   THE TRANSMISSION PROBLEM, AS POSED\n   ───────────────────────────────────────────────────────────────\n   authoritative replica ....... none after the author's death\n   storage medium .............. human memory (c. 4 centuries),\n                                 then palm leaf, then print, then bits\n   durability of a node ........ one human lifetime\n   write path .................. communal recitation, in assembly\n   partition events ............ war, famine, monastic schism\n   adversary ................... time, politics, honest misremembering,\n                                 and schism (on the chronicles' account,\n                                 a rival recital with its own carriers)\n   duration .................... ~2,000 years, continuous\n   ───────────────────────────────────────────────────────────────\n   COMPARE: the longest-running production transparency log\n            is younger than most of the people reading this.\n```\n\nThe reciter lineages — *bhāṇaka* `[V]` — divided the collections between them, one lineage specialising in the long discourses, another in the middle-length, others in the numerical and connected collections. This is documented independently of the tradition's own account: Sri Lankan cave inscriptions dated between the third century BCE and the first century CE name monks by the collection they carried `[V]`.\n\nTwo properties of that arrangement matter to a systems reader. It is a **shard**, so no single carrier held the whole corpus and no single death lost it. And it is a **replication group per shard**, since a collection was carried by a lineage rather than an individual, with recitation in company as the comparison operation. Death was not merely attrition; it was **the event that forced the verification to run.** A text living in bodies is re-verified on a schedule set by funerals, and it is self-correcting *because* it is fragile. That observation belongs to the essay *The Last Carrier* and is cited here rather than re-argued.\n\n### 3.2 — The write path was consensus, and it ran at build time\n\nThe councils — *saṅgīti* `[V]`, literally *reciting together* — are the corpus's build events. The procedure is recorded, and it is more specific in the secondary accounts than in the canonical one, a difference this paper states rather than smooths. **The canonical account of the first council** (Cullavagga XI) records a question-and-answer recitation before the assembly: under a formal motion, the convening elder asks one named monk about the Vinaya — for each rule, where it was laid down, its origin story, the person, the rule, its additions, the offence and the non-offences — and another named monk about the discourses; and the assembly's formal decisions in that account are carried by motion, with silence as assent and any monk who does not approve required to speak `[V]`. **The secondary accounts add that an elder recited a passage, the assembly chanted it back in chorus, and material was compiled only on unanimous acceptance.** That characterisation is theirs; it was not found in the canonical passage this paper checked (§11).\n\n⚠️ **The historicity of the first council is contested in modern scholarship, and the traditional dating is not accepted outside the tradition.** This paper does not need it to be historical. What it needs — and what is not seriously disputed — is that the *procedure* is the one the tradition recorded as normative and subsequently followed, because the engineering claim in §4.2 is about the shape of the procedure, not about the events of any particular century.\n\n### 3.3 — ⭐ What it left, and this bounds everything else\n\nHere is the result that a reader should carry away even if they take nothing else.\n\n**The transmission did not leave one text.** It left branches. Different *bhāṇaka* lineages appear to have exercised independent judgement over the arrangement of their collections and over which versions of stories and doctrines they preserved, and variant readings between the long and middle-length collections may be attributable to different reciter schools `[V]`. Those lineages later developed into distinct interpretive schools whose differing views are visible in the commentarial literature `[V]`. On the Sri Lankan chronicles' account, the losers of the second council held a rival Great Recital of their own `[V]`; modern scholarship separates that council from the later schism.\n\nA naïve reading of this paper's thesis would take that as refutation. It is not, and the reason is the paper's central finding:\n\n> **What two millennia left is divergence that can be detected and, in part, attributed — not one undiverged text, and not the prevention of divergence.**\n\n⚠️ **That is what the transmission left, not what it was built to do, and the paper does not present it as a selection result.** Every mechanism described here aimed at fidelity; divergence survived despite them. What makes the divergence detectable today is the survival of written branches, of parallel traditions — the Sanskrit and Chinese Āgama parallels — and of modern collation; and the attribution of readings to lineages is made largely by commentaries written centuries after the fact. **The finding is a retrodiction at n = 1 (§9.2).** Its engineering conclusion does not depend on reading it as selection.\n\nThe variants survive, and much of the time their line of transmission can still be read. The disagreement is legible. A modern editor can collate the branches and say where they differ and, often, whose transmission a given reading came through. That is a completely different outcome from a corpus that silently converged on one reading and lost the record of what it overwrote.\n\nAnd it is the property a retrieval system actually needs. **A server's failure mode is not that its copies differ. It is that they differ silently** — that a normalisation, a re-encoding, a well-meaning correction or an outright substitution passes through the layer and arrives looking exactly like the original. A guarantee of correctness is not on offer from any system, including this one. A guarantee that divergence is *visible and attributable* is on offer, and it is what these mechanisms deliver.\n\n⛔ **The consequence binds the rest of the paper and is repeated in §9.1: every integrity claim here is a detection claim. None of these mechanisms prevents a corrupted text from being served, and the paper must not be cited as though it did; the design rules say what a server must never do silently.**\n\n---\n\n## 4 · The mechanisms, stated as design rules first\n\n⭐ **Every subsection below states the engineering rule before naming its canonical source, and the rule is written to stand without the source.** Strike every Pāli term from this section and the design survives entire. That is the corpus's deletion test satisfied by the section's construction rather than by the authors' assurance — a property, not a promise.\n\n```\n   MECHANISM                       ENGINEERING FORM              NOVEL?\n   ─────────────────────────────────────────────────────────────────────\n 1 opening attribution formula →   provenance inline in the       no\n                                   text stream, not in metadata   (placement arg.)\n 2 assembly recitation         →   admission decided at BUILD     no\n                                   time by a named body           (timing arg.)\n 3 commentary as a text class  →   never return summary where     no\n                                   source is expected             (class label: old)\n 4 recensions kept distinct    →   variants served with their     no — this is TEI\n                                   witness; never normalise\n 5 announced abridgement       →   elision marked inline, at      no\n                                   the cut, and recoverable\n 6 interpretive standing       →   standing per PASSAGE, since    partly\n                                   an excerpt loses front matter  (symmetry only)\n 7 scheduled re-verification   →   public, before an assembly,    weakest claim\n                                   silence load-bearing           in the set\n   ─────────────────────────────────────────────────────────────────────\n + recorded exclusion reasons  →   every exclusion published      no\n                                   with its occasioning case\n   ─────────────────────────────────────────────────────────────────────\n   AND SEPARATELY, §5:  the conformance endpoint     — a composition\n                        the completeness manifest    — a transposition\n                                                       (TUF; BagIt)\n```\n\n### 4.1 — Provenance travels *in* the text\n\n**The rule.** A unit of served text carries its attribution as part of the text itself, at its head, so that any excerpt of it that survives a copy-paste, a context window, a summarisation or a quotation still carries the attribution. Provenance recorded only in an accompanying field is provenance that a consumer may decline to fetch, and machine consumers decline constantly — not maliciously, but because the field was not in the retrieved span.\n\n**The canonical instance.** The discourses of the principal collections open with an attribution formula, conventionally rendered *thus have I heard*, followed by the setting and the occasion `[V]`; other collections carry their own — the Itivuttaka's discourses open *this was said by the Blessed One* `[V]` — and in every case the formula is inline, never a header. It is the first sentence of the text, in the same voice, and it is preserved through every recitation and every copy because removing it would be removing text.\n\n**Against §2.1.** PREMIS, PROV-O and OAIS all solve provenance *representation* better than this does. The narrow claim is placement, and the argument for it is the one in §3.3: a metadata record that the consumer did not fetch does not fail loudly. It fails by absence, and absence is the failure mode this whole paper is about.\n\n**Nearest prior instances.** The hadith *isnād* is the strongest: a chain of transmitters carried in the same stream as the report it vouches for, placed before the text, and the basis on which the report is graded. In retrieval practice, contextual chunk-prefixing (published by Anthropic as *Introducing Contextual Retrieval*, 19 September 2024) prepends a statement of document context to each chunk before it is indexed — inline, as this rule asks, but generated rather than attributed, which is exactly the difference the rule turns on.\n\n**Sig-9 check — property or rule?** Inline is a **property**: the marker survives excerpting because of where it sits, with no enforcer. A metadata field is a **rule**: it survives because something remembered to fetch it. This is the clearest instance in the paper of the institution's own take-the-fix-from-the-object test, and it is why §4.1 leads.\n\n### 4.2 — Admission is decided at build time, by a named body, under a recorded procedure\n\n**The rule.** What is in the corpus is settled when the corpus is assembled, by an identified group following a procedure that is written down, and the decision is recorded. It is not settled at query time by a filter. A query-time gate has an operator, and an operator can be leaned on per request; a build-time gate produces an artifact that either contains a document or does not, and the containing is checkable by anyone.\n\n**The canonical instance.** The councils, whose procedure §3.2 describes: in the canonical account, recitation by named monks in answer to the convening elder, before an assembly whose formal decisions are carried by motion with silence as assent `[V]`; in the secondary accounts, a chorus and compilation **only on unanimous acceptance**. The rule needs only what both accounts share — a named body, a recorded procedure, a decision made at assembly.\n\n**What this is not.** It is not a claim that assemblies produce correct results. §6.1 argues the opposite risk at length. It is a claim about *where the decision sits* and therefore about what can be audited afterward.\n\n**Relation to our own corpus.** *Buddha AI and the Living Tipiṭaka* §8 addresses the adjacent question of who may canonise *new* material and specifies a tiered workflow and periodic councils for it. That is a different question from this one: §8 asks what may enter a canon, this asks how a *served copy* of an existing one is assembled. Both are cited; neither absorbs the other.\n\n### 4.3 — Commentary is a distinct class, and the server therefore never summarises\n\n**The rule.** If a corpus distinguishes primary text from commentary on it, a retrieval layer over that corpus must serve them as distinct classes and must never return generated prose in the position where primary text is expected. A summary is not a shorter version of a text. It is a *different text*, of unknown provenance, and it cannot be hash-verified against anything.\n\n**The canonical instance.** The commentarial layer — *aṭṭhakathā* — is labelled as a separate class of literature with its own transmission and its own standing `[V]`. ⚠️ **The label held; the boundary did not.** The canon itself contains texts of commentarial form: the Niddesa, a commentary on parts of the Sutta Nipāta, sits in the Khuddaka Nikāya `[V]`, and the Vinaya's old word-commentary is incorporated into the Suttavibhaṅga `[V]`. The Burmese Khuddaka admits the Nettipakaraṇa, the Peṭakopadesa and the Milindapañha, where the Sinhalese printed edition admits the first two `[V]`. And the earlier Sinhala commentaries from which the Pāli *aṭṭhakathā* were compiled are lost `[V]` — the redaction survived and its sources did not. What the tradition kept is an explicit **class label**, maintained even while material crossed the line it drew.\n\n**The class label is old practice elsewhere.** The standard printed Talmud page (the Vilna edition's layout) sets the Mishnah and Gemara in the centre column with Rashi's commentary and the Tosafot in columns around it, visibly distinct; the Tibetan canon divides the translated word of the Buddha (Kangyur) from the translated treatises and commentaries (Tengyur).\n\n**Novelty: none.** The non-summarisation obligation is stated in *Provenance-Carrying Retrieval* as a consequence of hashability, and the engineering rule stands on that argument alone: a summary is a different text of unknown provenance and cannot be verified against anything. The canonical instance adds no independent reason for it. What it adds is a caution: a class boundary moves over time — texts are admitted, absorbed and reclassified — so a server should serve each text's class label together with its reclassification history under §4.8, as §6.2 asks for the standing field, rather than treat the boundary as fixed.\n\n### 4.4 — Variants are served with their witness, never normalised\n\n**The rule.** Where the corpus has divergent readings, serve them as divergent, each with the line of transmission it came through. Do not silently pick one. Do not merge them into a smoothed text. A consumer that receives a normalised reading has been told a lie of omission that it has no way to detect.\n\n**The canonical instance.** The recensions associated with different reciter lineages, whose variant readings may be attributable to those lineages `[V]`, and whose differences the commentarial literature records rather than resolves `[V]`.\n\n⚠️ **Novelty: none.** This is the TEI critical apparatus, and before it Lachmann and Greg–Bowers. §2.4 says so. The only contribution is the observation that machine-facing retrieval has not adopted it and is the setting where its absence costs most — because a human reader of a smoothed text can suspect smoothing, and a model cannot.\n\n### 4.5 — Abridgement is announced inline, and is recoverable\n\n**The rule.** When served text is abridged, mark the cut *at the cut*, in the text, in a form that names the elided span by a resolvable identifier or digest sufficient to fetch and verify it. Do not record the abridgement in a field. Do not abridge silently, ever.\n\n**The canonical instance.** The elision marker — *peyyāla*, abbreviated in practice to a short particle `[V]` — which stands in the text where a formulaic passage recurs, indicating that the passage is to be supplied. ⭐ **The precision matters and this paper states it rather than glossing over it:** the marker does not signal *arbitrary omission*. It signals a *repetition to be supplied* — from the surrounding text, where enough of the pattern is given, or, where it is not, from a formula the reciter already held or from another text `[V]`; a modern translator of the canon calls these *internal* and *external* abbreviations. A sample of every elision in one long discourse (the Mahāparinibbāna Sutta, twenty-nine instances in the root text) found each abbreviating repeated or formulaic material and none marking an arbitrary cut. An elision marker that says only \"something was here\" is decoration; one that says \"the passage you already have, repeated\" is a compression scheme with an integrity property.\n\n⚠️ **The external case is the one a retrieval system inherits badly.** The reciter already held the formula. A reader who has fetched one passage from a served corpus holds nothing, which is why the engineering form cannot stop at a marker and must name what was cut resolvably.\n\n**The engineering form is therefore narrower than \"announce elisions\"**: announce them in-band, at the point of the cut, with an identifier or digest from which the elided span can be fetched and verified. That is a real constraint and most truncation in retrieval systems fails it.\n\n**Nearest prior instance.** TEI's `<gap>` element marks an omission in a transcription in-band, with attributes for the reason and the extent of what was omitted; its standard attributes record why and how much, not where the omitted text can be fetched.\n\n### 4.6 — Interpretive standing is carried per passage\n\n**The rule.** Whether a passage should be read as stating its meaning directly, or as requiring inference, is a property of the passage. It must travel with the passage. Document-level front matter does not survive retrieval: a system that returns an excerpt has, by construction, dropped the document's `status`, `revised` and genre fields, and the excerpt now reads as though it carried the document's authority.\n\n⭐ **The rule is symmetric, and for an engineering reason.** The instinct is to worry only about over-claiming — treating a hedged passage as settled. But a standing field that marks every passage *requires inference* carries no information, and it misstates every passage that is in fact settled: it is a misclassification in the other direction, not a safe setting. A retrieval layer therefore may not mark everything provisional as a defensive posture. **Blanket hedging is a correctness failure, not a safe default.**\n\n**The canonical instance.** The distinction between a discourse whose meaning is explicit — *nītattha* — and one whose meaning is in need of interpretation — *neyyattha* `[V]`. ⚠️ **The canonical unit is the discourse (*suttanta*), not the passage.** AN 2.24 names the two who misrepresent the teacher — one who explains a discourse in need of interpretation as explicit, and one who explains an explicit discourse as in need of interpretation — and AN 2.25 names their correct counterparts `[V]`. The canon thus treats misclassification in either direction as one error, which is an instance of the symmetry above; **the per-passage granularity is this paper's design, not the canon's**, and its reason is the engineering one already given: an excerpt loses its document's front matter.\n\n**Nearest prior instances.** Standing below the level of the document is established practice in other fields: RFC 2119 fixes a requirement level per statement (*MUST*, *SHOULD*, *MAY*) inside a specification's own text; hadith scholarship grades each report (*ṣaḥīḥ*, *ḥasan*, *ḍaʿīf*) rather than each collection; and legal citators attach treatment to a cited authority — KeyCite down to the headnote, the individual point of law. What §4.6 adds is only the argument from excerpt loss for a served corpus and the symmetric default.\n\n**Locus note.** The pair is cited here in SuttaCentral's numbering, AN 2.24–25 (within its range AN 2.21–31); enumeration of this collection's early books differs between editions and a reader may encounter it under another number. See §11.\n\n### 4.7 — Scheduled public re-verification, in which silence is load-bearing\n\n**The rule.** Integrity is re-affirmed on a fixed, public, predictable schedule, before an assembled audience rather than to a log. The affirmation is solicited a set number of times. **Silence constitutes a positive assertion of integrity, and the silent party is accountable for it.**\n\n**The canonical instance.** The fortnightly recitation of the disciplinary code — *pāṭimokkha* — before the assembled community on the full and new moon `[V]`. The community is told that one who has committed an offence should declare it and one who has not should remain silent, and that *from your silence I shall understand that you are pure* `[V]`. The announcement is made up to a third time, and **one who remembers an offence and does not reveal it is lying in full awareness (*sampajānamusāvāda*)**, which the accompanying word-commentary classifies as an act of wrong conduct, a *dukkaṭa* (Mahāvagga II.3.3, II.3.7) `[V]`.\n\n⭐⭐ **That last clause is what makes the mechanism more than a health check, and it is the reason this subsection exists.** An unanswered health check is ambiguous: the service may be fine, or unreachable, or lying. Here silence is *defined* as an assertion and is *penalised* if false, which converts an absence into a signal with a cost attached. A monitoring system that treated \"no response\" as \"healthy\" would be badly designed; a monitoring system in which \"no response\" is a *signed* claim of health is a different thing entirely.\n\n⚠️ **This is the weakest claim in §4 and the paper marks it as such.** The engineering form — periodic signed attestations of integrity, published, with liability for a false attestation — exists in the transparency-log world already, and the addition of *an assembly* is precisely the part §9.3 argues may not transpose at all.\n\n**Nearest prior instances, and they are older than the transparency log.** Silence as assent is ordinary practice: an auditor's *negative* confirmation request is answered only by a party who disagrees, and a non-response is treated as agreement; a chair who asks *is there any objection?* takes silence as unanimous consent. A signed periodic attestation with a cost for a false one is ordinary too: under the Sarbanes-Oxley Act, named officers certify each periodic report (§302), and a knowingly false certification carries criminal penalties (§906). §4.7 combines the two; neither half is new.\n\n### 4.8 — Every exclusion is served with its recorded reason\n\n**The rule.** A corpus that excludes material publishes, alongside each exclusion, the case that occasioned it — and the subsequent amendments and exceptions, so the exclusion set has a history rather than a state. An exclusion list is an assertion; an exclusion list with reasons is auditable.\n\n**The canonical instance.** Each disciplinary rule is preceded by its origin story — the specific incident that prompted it — and followed by the amendments the rule accumulated as new situations arose, together with exceptions marking what is *not* a violation `[V]`. Further cases function as judicial precedent `[V]`.\n\n⭐ **The amendment history is the part the destination field usually drops.** Archives commonly publish a takedown policy; they rarely publish, per removed item, the case that caused the rule to exist and the successive refinements to it. That is the difference between a policy and a case law, and a corpus that will outlive its curators wants the latter.\n\n**Nearest prior instances.** The Lumen database publishes copies of content-removal requests that online services have received; a rejected CVE record stays on the CVE List marked *REJECTED*, most often with its reason stated in the record's description. Both publish an exclusion together with its occasion. Neither is organised as a case law, in which a rule's later amendments and exceptions accumulate against the case that first prompted it.\n\n---\n\n## 5 · The two designs carried furthest from the destination field\n\n§2.6 subtracted the paper down to what is left. Both designs below take their shape from a canonical mechanism, and what is claimed is their placement in a retrieval server, not their invention — the first as a composition of known parts, the second as a transposition with close prior art, each named where it is stated.\n\n### 5.1 — ⭐ The conformance endpoint\n\n**The problem a hash does not solve.** A machine reader that verifies a quotation against a content hash learns exactly one bit: matched, or did not. That bit is nearly useless in the case that actually occurs. A model quotes a passage it half-remembers, or a user pastes a quotation from a third-party site, or an agent carries a citation forward from a prior turn. The hash fails. And now what? The failure is indistinguishable between *the quotation is fabricated*, *the quotation is real but from a different recension*, *the quotation is real and this corpus has been tampered with*, and *the quotation is a faithful paraphrase that was never a quotation at all.* **A hash reports that a comparison failed. It says nothing about what to do next, and it therefore cannot prevent the single most common downstream behaviour, which is to shrug and use the text anyway.**\n\n**The mechanism.** An interface that accepts a *claimed* text — not a hash of it, the text — lays it alongside the served corpus, and returns a **disposition on the claim** together with the procedure the requester should follow. The disposition set is small and closed, and the point of the design is that each member names a different next action:\n\n```\n   CLAIMED TEXT ──▶ [ conformance ] ──▶ disposition + next action\n                          │\n                          ├─ CONFORMS ............ served text; cite it\n                          ├─ CONFORMS, VARIANT ... served text + the witness\n                          │                        this reading came through\n                          ├─ NOT FOUND ........... this corpus does not\n                          │                        contain it; do not\n                          │                        attribute it here\n                          └─ CONFLICTS ........... a text of this identity\n                                                   exists and differs; here\n                                                   is the difference\n   ⛔ NOT IN THE DISPOSITION SET, BY CONSTRUCTION:\n      any statement about the party that made the claim.\n```\n\n**Mapped to the four failures a hash cannot tell apart:** a fabricated quotation returns *NOT FOUND*; a real quotation from another recension returns *CONFORMS, VARIANT* with the witness it came through; a faithful paraphrase returns *NOT FOUND* — it is not a quotation from this corpus and is not to be quoted as one; and tampering with the served corpus itself is not detectable by the endpoint at all, since the endpoint compares against that corpus, and is caught instead by the corpus's own hash and time anchor (*Provenance-Carrying Retrieval*).\n\n**The canonical source.** The four great references — *mahāpadesa*, given in the account of the teacher's last days (DN 16) and again in the numerical collection (AN 4.180) `[V]` — instruct that when someone claims to have received a teaching, the statement is to be neither approved nor rejected, but its words **carefully learned and checked against the discourses and the discipline** `[V]`. If they do not fit, the conclusion is stated in two parts: this is not the teacher's word, and *it has been incorrectly memorised* — by that monk, that community, those elders or that elder, according to the source the claimant named — and it is to be discarded `[V]`. ⚠️ **So the canonical disposition does name the carrier: as the one whose memorisation erred, with no penalty prescribed.** It is a finding about the fidelity of a copy rather than a verdict on a person — the canon already blames the copy, not the teaching — and the test it prescribes is the *accordance of a teaching* with the collections, not the collation of a string. **Two steps here are this paper's, not the canon's:** the transposition from doctrinal accordance to quotation collation, and the removal of the carrier from the disposition altogether.\n\n⭐⭐ **That second step is the design.** A verification interface that returns a verdict on the *claimant* creates an incentive not to submit claims, which destroys the mechanism's coverage exactly where coverage matters. A verification interface that returns a verdict only on the *claim* is safe to use, and therefore gets used. It is a small distinction and it is the entire difference between a conformance service and a reputation service.\n\n**What is disclosed, and what is prior art.** A closed disposition set about a submitted object is not new: OCSP (RFC 6960) returns *good*, *revoked* or *unknown* about a submitted certificate and says nothing about the party asking. Matching a claimed reference against a record is not new either: Crossref's bibliographic query takes a free-text citation and returns the works it may refer to. Hash verification is universal, and so is text similarity search. C2PA's validation reports say what could and could not be verified, but of an asset's own manifest rather than of a third party's claim about a corpus. **What is offered is the composition:** a closed disposition set over a multi-recension corpus that includes *conforms, as a variant, with its witness*, each member paired with a prescribed next action, and no place in the response schema for the claimant.\n\n**Sig-9 check.** The claim/claimant separation is a **property** if the disposition set has no member that can carry a verdict on a person, and a **rule** if the operator is merely asked not to add one. It must be built the first way. ⛔ *Remove the enforcer: if the schema permits a claimant field, someone will populate it under pressure, and the mechanism becomes a denunciation channel.*\n\n⚠️ **The schema is not the only surface, and the same test applies to the log.** An endpoint that accepts text over a network receives every request with an address, a key or an account. If it retains the requester's identity with the submitted text, the record of who submitted what — the denunciation record — exists on the server whatever the response schema says, and the no-claimant property has become a rule about the log. **It is a property only if the endpoint retains no requester identity with the submitted text.** And even then the schema stops the *server* from judging a claimant; it cannot stop a consumer from republishing a disposition — *NOT FOUND*, about a quotation a named person circulated — as a judgement of that person.\n\n### 5.2 — ⭐ The separated completeness manifest\n\n**The problem transparency logs do not solve.** Certificate Transparency and its descendants prove that a log is append-only and that a given entry is in it. **They do not prove that the log contains everything it ought to contain.** An operator who never adds a document has added no dishonest entry; every inclusion proof still verifies; every consistency proof still verifies. Omission is invisible to the entire apparatus, because the apparatus reads what was *produced*, and a document that was never produced produces nothing to read.\n\n⚠️ **This is the sharpest form of an instrument failure the institution has recorded repeatedly in its own operations: every check reads an artifact, so no check can report a thing that was never made.** An unstamped document, a workflow that never ran, a field nobody wrote — each is invisible to the check that would have caught it. The log is the same shape.\n\n**The mechanism.** Publish, as an artifact **distinct from the index**, a signed enumeration of a collection's membership and its **cardinality**, so that a third party holding the manifest alone can detect a document's silent removal. The separation is the mechanism, not an implementation detail: **an index cannot attest to its own completeness**, for the same reason a witness cannot corroborate themselves. If the manifest lives inside the index, an operator who removes a document removes its manifest line in the same edit and nothing anywhere disagrees.\n\n**The manifest carries a monotonically increasing version and an expiry, and a holder refuses an expired manifest or one older than a version it has already seen.** Without both, a stale manifest is internally consistent: an operator who reverts the collection to an older, smaller state and serves the older manifest that matches it passes every check that reads the pair (§10, *the frozen manifest*).\n\n⚠️ **Out of band here, in band in §4.1 — and the two are not in tension.** §4.1 puts provenance in the text because its consumer is a reader who never elected to fetch a separate record, and whose failure when the record is missing is silent. The manifest is kept out of band for *independence*. Its holder is an auditor who elected to hold it, and for that auditor its absence is not silent.\n\n**The canonical source.** The mnemonic summary verses — *uddāna* `[V]` — placed at the end of each section and of the whole work. Their function is precisely this: they key off each member of a group, fixing **membership and ordering** `[V]`, and the summaries at the end of a work give **the names and the counts** — of the elders, of the verses in each chapter, and of the whole `[V]`. They were memorised alongside the text by the reciters `[V]`.\n\n⚠️ **The best-known instance does not balance, and §9.11 treats this as a limit on the paper.** The totals that the Theragāthā's summaries give do not match a plain count of its verses, and the plain count itself differs between editions.\n\n⭐ **Two details of the canonical form are load-bearing and both were confirmed rather than assumed.** The summaries carry **counts**, not merely names — cardinality is what makes a removal detectable when a name is also removed. And they are **separate units**, positioned at the boundary of the collection rather than distributed through it, which is what allows a carrier to hold the manifest without holding the collection.\n\n**Against §2.3 — and it is a transposition.** CT gives append-only-ness and split-view detection; a completeness manifest gives completeness against a *declared* expectation. They compose, and neither substitutes for the other. But the manifest is not a new design — §2.3 names its nearest prior art in The Update Framework's snapshot metadata and BagIt's `Payload-Oxum` — and **this paper withdraws any claim that the design is absent from the destination field.** What it offers is the transposition to a served text corpus read by machines, together with the canonical instance of keeping the count apart from what it counts. The honest statement of the residual is that the manifest moves the trust problem rather than dissolving it — a signed manifest is only as good as the key that signed it and the party that published it — and §9.5 says so.\n\n**Sig-9 check.** Separation is a **property** when the manifest is signed by a different key and published by a different party than the index. It degrades to a **rule** the moment the same operator holds both, at which point it detects accident and not intent. ⚠️ *This is a real limit and it means the manifest is worth much less inside a single-operator system than it looks.*\n\n## 6 · What must not be inherited\n\n⛔ **A transposition that finds every mechanism inheritable is doing apologetics.** Two of the §4 mechanisms carry capture surfaces, and naming them is claimed in §Claims 13 as a design element of this paper rather than as a caveat on it.\n\n### 6.1 — The assembly's power to exclude\n\n§4.2 argued for a build-time gate operated by a named body. The same mechanism, viewed from one step back, is **an assembly with the power to decide what does not exist.** On the Sri Lankan chronicles' account, the losers of the second council held a rival Great Recital of their own `[V]` — modern scholarship separates the council from the later schism — and either way a schism is what an exclusion looks like from the excluded side.\n\nThis institution's own doctrine refuses exactly this shape elsewhere: a guard that depends on the good behaviour of whoever holds it at the moment it is tested is a rule, and rules need a living enforcer with the right incentives at the exact moment nobody can guarantee. **An admission body is a rule wearing a procedure's clothes.**\n\n⭐ **The available guard is §4.8, and it is only partial.** Serving every exclusion with its occasioning case and its amendment history makes the exclusion set auditable, which raises the cost of a bad exclusion without preventing one. **We state plainly that we do not have a property-shaped fix for this and are not claiming one.** The honest position is that a served corpus with a curated boundary has a governance problem that no amount of cryptography touches, and that the corpus should say so on its own surface rather than let the presence of hashes imply otherwise.\n\n### 6.2 — The authority to rule on interpretive standing\n\n§4.6's per-passage standing field is useful and is also a lever. Whoever sets the field decides which passages are to be read as they stand and which are open to inference — and the second category is where interpretation lives. An operator who can mark a passage as requiring inference can, without altering a byte, change what the corpus is understood to say.\n\n⚠️ **Two guards, and the paper is honest that they are mitigations rather than solutions.** The field must be **inside the hashed text**, so that changing it drifts the hash and rotates the proof, making the change as visible as an edit — because it *is* an edit. And the corpus must serve the standing field's own **change history** under §4.8, so a reclassification is as auditable as a removal.\n\n**Related and separate:** the guard that a reciter is not the author of what is recited is claimed and argued in *The Song That Is Not His* and is **cited here rather than re-claimed**, per the placement rule. It bears on §4.6 in an obvious way and this paper adds nothing to it.\n\n### 6.3 — The general form\n\nBoth refusals have the same shape and it is worth stating once: **the mechanisms that handle *bytes* transpose cleanly, and the mechanisms that handle *authority* do not.** Inline markers, manifests, variant witness *records*, announced elisions and conformance dispositions are all properties of artifacts. Witness *admission* — deciding what counts as an attested line of transmission — is not, and returns to §6.1, as §10 says of variant proliferation. Admission and interpretive standing are properties of a body politic, and importing them into a served corpus imports a governance question that the corpus's cryptographic apparatus is entirely powerless to answer — while, dangerously, *looking* as though it has answered it.\n\n## 7 · The threat-model partition\n\nThe transposition's most likely misuse is to treat these mechanisms as a complete integrity story. They are not, and the reason is a clean partition that the paper states early enough to be useful.\n\n```\n   ORAL TRANSMISSION FEARS          A RETRIEVAL SERVER FEARS\n   ──────────────────────────       ─────────────────────────────\n   drift        (slow mutation)     substitution  (swap the text)\n   forgetting   (loss of a          fabrication   (invent the text)\n                 lineage)           silent normalisation\n   ──────────────────────────       ─────────────────────────────\n              │                                │\n              ▼                                ▼\n   an uddāna detects OMISSION       a hash detects TAMPERING\n   a bhāṇaka group detects DRIFT    an anchor detects BACKDATING\n              │                                │\n              └──────────► NEITHER IS ◄────────┘\n                          SUFFICIENT ALONE\n```\n\n**An enumeration detects omission and cannot detect tampering. A hash detects tampering and cannot detect omission.** They are complements, and a system with only one of them has a hole shaped exactly like the other. That partition is the practical reason the two designs of §5 are worth having *together with* the envelope of *Provenance-Carrying Retrieval* rather than instead of it.\n\n⚠️ **The partition also bounds the field-test claim.** The canon's mechanisms were developed against *its* threat model, not ours. Where the two models overlap the transposition is well-motivated; where they do not, the canonical practice is evidence of nothing about our case, and §4 marks which is which.\n\n---\n\n## 8 · Where this sits against the rest of this corpus\n\nStated explicitly because a corpus that cross-references loosely is a corpus whose reader cannot tell what is claimed where.\n\n| Paper | Its question | Why this one is not it |\n|---|---|---|\n| *Provenance-Carrying Retrieval* | how does a response carry the means of its own falsification? | that paper builds the **envelope**; this one asks what a long field test left, and supplies two mechanisms the envelope does not contain (§5) |\n| *Buddha AI and the Living Tipiṭaka* §8 | what makes a canon **authoritative**? | authority over *new* material, decided by a doctrinal body; this paper is about the integrity of a **copy** of existing material |\n| *The Borrowable Standard* | what does a corpus need before it can exist? | orthography and encoding — upstream of this paper and disjoint from it |\n| *The Song That Is Not His* | who is the author of a recitation? | owns the reciter-is-not-author guard; **cited in §6.2, not re-claimed** |\n| *The Last Carrier* (essay) | what has carried this canon, and what carries it now? | the founder's voice, the media chain, and the observation about fragility that §3.1 cites |\n| *The Persistence Architecture* | can an apparatus be built so its author can stop? | succession, not transmission integrity |\n\n⭐ **The residue owed elsewhere.** *Provenance-Carrying Retrieval*'s prior-art section currently cites PREMIS, PROV-O, LOCKSS, Memento and Software Heritage and stops, on the line that the archival community has thought about this longer than the machine-learning community has. **The extension — that an oral canon thought about it longer still — is a two-sentence cross-reference belonging to that paper, not a section transplanted from this one.** It is queued against that paper's next revision.\n\n## 9 · Honest limits\n\n*This section makes no appeal to the tradition's authority; historical facts about the transmission appear in it only as evidence against the paper. That is deliberate and is the corpus's standing rule for honest-limits sections.*\n\n### 9.1 — Every integrity claim here is a detection claim\n\nRestated from §3.3 because it is the limit most likely to be lost in citation. **None of these mechanisms prevents a corrupted text from being served; the design rules say only what a server must never do silently.** They make divergence detectable and, where a witness exists, attributable. A corpus running all of them can still serve a wrong text; what it cannot easily do is serve a wrong text *silently*. Any use of this paper that implies a correctness guarantee is a misuse, and the paper's own field test is the evidence — the tradition ran this apparatus for two millennia and ended with branches, not with one text.\n\n### 9.2 — Survivorship, at n = 1, over two thousand years\n\nWe observe the canon that survived. The claim that these mechanisms *caused* its survival is not testable: there is no control and no record of the traditions whose apparatus failed. **This is unfalsifiable at n = 1 and the paper does not argue around it.**\n\n**There is, however, a comparable case, and it cuts against the paper.** Vedic recitation, an older oral-conservation system under constraints of the same kind, aimed at *prevention* and was built for it: redundant recitation forms — word by word (*padapāṭha*), in overlapping pairs (*krama*), in dense interlaced sequences (*ghana*) — whose purpose is that not a syllable be altered, read by Staal (1986) as a fidelity of oral tradition. Hadith transmission, for its part, built a developed oral provenance apparatus in the *isnād*. **So detection-not-prevention is what *this* corpus shows, not what §3.1's constraint box predicts**, and Claim 2 is bounded by that independently of n = 1. And the transmission finding of §3.3 is itself a retrodiction at n = 1 — read off the branches that survived, with the attribution of readings supplied largely by later commentaries — not a selection result.\n\nWhat survives both objections is narrower and is what §Claims 1 actually says: the mechanisms are *legible as engineering*, transposable, and have forms worth using on their own merits. Their canonical provenance is a reason to look, never evidence that they work.\n\n### 9.3 — The fitness function was not textual accuracy alone\n\nSharper than survivorship, and it is the objection we would raise against this paper. The councils had royal patronage; the collections that survived are substantially the collections that had institutional and political backing. **A field test whose fitness function included state support may have selected for political durability, with the textual mechanisms partly along for the ride.** We cannot separate the two. The consequence is stated as a bound on the whole paper: what is offered is **provenance of design — an account of where these ideas come from and why they are worth considering — and never proof of efficacy.**\n\n### 9.4 — Four of the seven, and the convention, are social protocols, and their engineering forms are half the mechanism\n\n§4.2, the witness admission of §4.4, §4.6, §4.7 and the §4.8 convention all presuppose a body of people: an assembly to admit, a body to decide which lines of transmission count as witnesses, an authority to assign standing, a community to recite before, a tradition to record precedent. **A scheduled re-verification with no assembly to verify before is a cron job talking to itself** — and it is worth saying that this is the paper's own strongest objection to itself, not one an outside reader had to supply.\n\nThis bites hardest on §4.7, which is why that subsection is marked as the weakest claim in §4. It bites least on §4.1, §4.4's witness record and §5.2, which are properties of artifacts and need no one present. **The ranking is the useful output: prefer the mechanisms that survive the removal of the community, and treat the rest as governance proposals wearing engineering clothes.** For this institution the assembly in question is a designed one whose seating is argued elsewhere and is not assumed here.\n\n### 9.5 — The manifest moves the trust problem rather than dissolving it\n\n§5.2's separation is only as good as the independence of the two publishers. In a single-operator deployment — which is what `corpus.333.eco` currently is — the same party holds the index and signs the manifest, so the mechanism detects **accident and drift, not intent.** That is worth having and is far less than it sounds. The design reaches its full strength only with an independent signer, and we do not have one.\n\n### 9.6 — What is actually deployed\n\nStated so the reader can weigh the rest. `corpus.333.eco` is live and serves the institution's corpus with a provenance envelope. **Of the mechanisms in this paper, the ones with running code are §4.1's inline markers and parts of §4.3's class separation.** §4.2 runs as a build step with a single human operator, which satisfies its letter and not its spirit. **§5.1 and §5.2 — the two designs of §5 — are not built.** They are specified here at claim scope for exactly that reason. The Tipiṭaka server that would exercise the full set has no date.\n\n⛔ **A reader should treat every efficacy statement in this paper as design reasoning, not as a report of operation.**\n\n### 9.7 — The citation standard, stated rather than assumed\n\nEvery canonical locus is marked `[V]` where it has been checked against multiple independent public reference works and translations. **No locus has been checked against the Pāli by a reader of Pāli**, and the authors do not read Pāli. §11 gives the full status and names the check that is owed. A paper about checkable provenance that left its own sourcing standard implicit would be refuted by its own thesis.\n\n### 9.8 — The coherence is not evidence\n\nThe mechanisms fit together well. Eight parts of an old apparatus mapping cleanly onto a modern problem is exactly the kind of pattern that is either deeply right or deeply seductive, and the two are indistinguishable from inside. **Each mechanism is individually arguable and should be argued individually; the elegance of the set earns an experiment and does not replace one.** ⛔ The fit between the parts is not evidence for any of them.\n\n### 9.9 — The evidence is self-attested\n\nEverything this paper knows about the apparatus comes from documents the apparatus itself admitted. The first council's procedure is known from Cullavagga XI, a text transmitted by that council's successors; the attribution of readings to reciter lineages comes largely from the commentaries; the summary verses of §5.2 are known from inside the collections they summarise. **That is §5.2's failure mode applied to the paper's own evidence: a witness cannot corroborate itself**, and an account of a completeness mechanism preserved by the collection it kept inherits the completeness problem it describes. The cave inscriptions of §3.1 are the one external witness, and they attest the reciters' specialisation, not their procedures.\n\n### 9.10 — Dispositions are only as stable as the matching fold\n\n§5.1's dispositions depend on how a claimed text is matched. Script, diacritics, sandhi, punctuation and segmentation all vary across editions and across inputs, and without a published matching policy the same input could return *CONFORMS* from one implementation, *CONFORMS, VARIANT* from a second and *NOT FOUND* from a third — undoing the checkability the endpoint exists to supply. **Dispositions are reproducible only against a published matching fold.** The fold may normalise for matching; it must never alter the served bytes, because in a corpus of this kind a spelling can be a tradition marker rather than noise.\n\n### 9.11 — The canonical instance of the count does not balance\n\nThe canonical case §5.2 leans on hardest is also the case that cuts against it. The translator's introduction to the SuttaCentral English Theragāthā (Sujato) records that the edition it follows, the Mahāsaṅgīti text, numbers **1,289** verses where the Pali Text Society editions number **1,279**, and that the difference comes from repetitions one edition includes and the other omits, not from a difference in substance. A reference work, citing von Hinüber's *Handbook of Pali Literature* (which we have not consulted directly), reports three figures for the collection: **1,360** claimed by the tradition, **1,294** given in the summaries within the text, and **1,279** by plain count. **So in the canon's best-known instance, the stated count and the counted collection disagree, and the counted collection changes with the edition.**\n\nTwo consequences follow. Neither is fatal, and both constrain the design.\n\n1. **A count detects omission only against a declared unit of counting.** Is a repetition a verse? Does an elided passage count? The edition-dependence §9.10 names for matching applies equally to counting, and a manifest that does not publish its counting rule will report mismatches that come from convention rather than removal. **§5.2's manifest must publish its counting rule beside its count.**\n2. **The canonical instance is not evidence that the count worked as a check.** The discrepancy has stood in the transmitted text. We found no account of it being treated as a sign of loss, and we read that absence, as our own inference and not as a finding of the sources, to mean that the summaries were not run as a live check against the text as it was later transmitted, whatever they did when they were composed. The transposition keeps the design, a count held apart from what it counts. It does not inherit a claim that the canonical instance worked as one. §9.2's rule applies here to a specific case: canonical provenance is a reason to look, never evidence that a mechanism works.\n\n## 10 · Adversarial analysis\n\n**A manifest that was always short.** An operator publishes a manifest omitting a document that was never admitted. Nothing detects it — the manifest is internally consistent and the document has no trace anywhere. ⛔ **This is not solvable by the manifest and §5.2 does not claim it is.** It is the omission problem one level up, and its only real answer is §4.2 plus §4.8: an admission decision made by an identified body and published with its reason. That answer is governance, not cryptography, and §6.1 says it is unsolved.\n\n**The frozen manifest.** An operator reverts the collection to an older, smaller state and serves the older manifest that matches it. The pair is internally consistent and every check that reads it passes. The Update Framework names these the freeze and rollback attacks, and §5.2 inherits its answer: a version and an expiry on the manifest, and a holder that refuses either kind of stale copy. ⚠️ **The version check protects only a holder who remembers the last version it saw; a first-time reader has nothing to compare against, and is protected by the expiry alone.**\n\n**Collusion between index and manifest signer.** Addressed in §9.5. Under a single operator the separation is hygiene. Its value is a step function in the number of genuinely independent signers, and the step from one to two is the largest.\n\n**The conformance endpoint as an oracle.** An adversary submits many near-miss texts to learn precisely how close a forgery must be to pass. This is real and it is bounded by the design: the endpoint compares against a corpus whose full text is *already public*, so the oracle reveals nothing the adversary could not obtain by reading. ⚠️ **The analysis changes completely for a corpus with non-public members, and a deployment over one should not expose this interface.**\n\n**The conformance endpoint's request log.** The response schema carries no claimant; the transport does. An operator who keeps requester identity beside submitted text — or anyone able to compel an operator — holds exactly the record the schema was built not to produce: who checked which quotation. §5.1 states the condition: the no-claimant property holds only if the endpoint retains no requester identity with the submitted text, and a disposition that a consumer republishes as a judgement of a person is beyond the endpoint's reach either way.\n\n**The conformance endpoint as a cost surface.** Text-in comparison is more expensive than hash-in comparison, and an interface that accepts arbitrary text invites abuse. This is an ordinary engineering problem with ordinary answers and is noted only so that the paper is not read as ignoring it.\n\n**Variant proliferation.** §4.4 refuses to normalise; an adversary submits many spurious \"variants\" to drown the real ones. The guard is that a variant is served **with its witness**, and a witness is an attested line of transmission rather than a submission. ⚠️ **This makes witness admission the attack surface, which returns to §6.1.** The paper's honest summary is that two of its seven adversarial cases terminate in §6.1's governance problem, and a third (collusion) in the adjacent question of signer independence (§9.5), and that a reader should regard §6.1 as the real open question rather than a section of caveats.\n\n### 10.8 — Why this paper registers no predictions\n\nThe corpus's standing practice is that a paper making an empirical claim registers falsifiable\npredictions in the public register. **This paper registers none, and the reason is the honest one\nrather than an oversight.** §9.2 and §9.3 disclaim efficacy explicitly: what is offered is\nprovenance of design, not evidence that these mechanisms work, and a survivorship case at n = 1 over\ntwo thousand years supports no prediction that could fail. The design claims in §4 are arguments,\nand arguments are refuted by better arguments rather than by data.\n\n⭐ **One prediction becomes clean the moment §5.1 is built, and is named here so that it is not\ninvented after the fact:** that a conformance response carrying a *disposition and a prescribed next\naction* produces a higher rate of citation correction, by an agent that has received a failing\nverification, than a bare match/no-match response does. That is a comparison between two response\nschemas over the same corpus, it has an obvious null, and it is measurable. ⛔ **It is not registered\nnow, because registering a prediction about an unbuilt interface is exactly the unclean registration\nthe register's own rules bar.** It is owed at the point §5.1 has running code.\n\n## 11 · Citation status — what has been checked, and by what standard\n\n⭐ **This section exists because the paper argues that unchecked claims must be visible, and it would be self-refuting to make its own an exception.**\n\n**Standard applied.** Each locus was checked against multiple independent public reference works, translations and encyclopaedic sources, and is marked `[V]` in the text where that check passed. Checks confirmed both the *location* (which text contains the material) and, where the paper leans on it, the *content* (that the passage says what the paper says it says). In the 2026-09-13 revision, the loci marked **root** below were also located in the Pāli root text published by SuttaCentral, read with its parallel English translation. That confirms the location and a translator's reading of the passage; it is still not a reading of the Pāli by a reader of Pāli.\n\n**Every marked locus, with what it supports:**\n\n| § | Locus | Checked against | What it supports |\n|---|---|---|---|\n| 3.1 | *bhāṇaka* specialisation by collection; Sri Lankan cave inscriptions, 3rd c. BCE – 1st c. CE, naming monks who specialised in the Saṃyutta, Majjhima or Aṅguttara Nikāya | reference works | a shard per collection, carried by lineages; the one external witness (§9.9) |\n| 3.2, 4.2 | the first council: Cullavagga XI (Vin Cv XI.1.4, XI.1.7–8) | **root** + translation | a question-and-answer recitation before the assembly; each Vinaya rule asked with its origin story, person, rule, additions, offence and non-offences; formal decisions carried by motion with silence as assent. ⚠️ The chorus and the unanimous-acceptance requirement are the secondary accounts' characterisation and were **not found** in this passage |\n| 3.3, 4.4 | variant readings between material preserved in both the Dīgha and Majjhima Nikāyas, possibly attributable to different *bhāṇaka* schools; later interpretive divergence visible in the commentaries | reference works | branches, in part attributable |\n| 3.3, 6.1 | the Dīpavaṃsa's account of the defeated Vajjiputtakas' rival Great Recital (*mahāsaṅgīti*) | reference works; modern scholarship separates the Vesālī council from the Mahāsāṃghika schism | a schism as an exclusion seen from the excluded side |\n| 4.1 | *evaṃ me sutaṃ* opening the discourses (e.g. DN 16:1.1.1); *vuttañhetaṃ bhagavatā … me sutaṃ* opening the Itivuttaka (Iti 1:1.1) | reference works; **root** + translation (the instances cited) | attribution inline, never a header; more than one formula |\n| 4.3 | *aṭṭhakathā* as a class; the Niddesa (Khuddaka Nikāya) on parts of the Sutta Nipāta; the old word-commentary (*padabhājanīya*) within the Suttavibhaṅga; the Nettipakaraṇa, Peṭakopadesa and Milindapañha in the Burmese Khuddaka, the first two in the Sinhalese printed edition; the lost Sinhala commentaries | reference works | the label held while the boundary moved |\n| 4.5 | *pe* / *peyyāla* | the Pali Text Society's dictionary (s.v. *peyyāla*); a translator's introduction distinguishing internal from external abbreviation (Sujato, *Long Discourses*); **root** sample: all twenty-nine elisions in DN 16 | a repetition to be supplied, from the context or from another text; no arbitrary cut in the sample |\n| 4.6 | AN 2.24–25, SuttaCentral numbering | **root** + translation | *nītattha* / *neyyattha* marked per discourse (*suttanta*); misrepresentation in both directions (AN 2.24) and its correct counterpart (AN 2.25) |\n| 4.7 | the Uposatha chapter: Vin Mv II.3.3 (silence as purity; the announcement up to a third time; concealment as lying in full awareness) and Mv II.3.7 (a *dukkaṭa*); the fortnightly recitation on the full and new moon | **root** + translation; reference works | silence as an assertion with a cost |\n| 4.8 | each Suttavibhaṅga rule with its origin story, additions and non-offences; further cases as precedent; the same headings asked at the first council (Cv XI.1.7) | reference works; **root** + translation (Cv XI) | exclusions served with their occasion and amendment history |\n| 5.1 | *mahāpadesa*: DN 16:4.8–4.11; AN 4.180 | **root** + translation | neither approve nor reject; check against discourse and discipline; *incorrectly memorised by* the source the claimant named; discard; no penalty |\n| 5.2 | *uddāna* at the close of a vagga or work, e.g. the closing summaries of the Theragāthā (Thag 21.1), giving numbers of elders and verses; summaries memorised with the text | reference works; **root** (location only) | membership, ordering and counts, held as separate units at a boundary |\n| 9.11 | the Theragāthā's verse count by edition (Mahāsaṅgīti 1,289; PTS 1,279); the totals in the text's summaries against a plain count (1,360 tradition · 1,294 summaries · 1,279 counted) | the translator's introduction (Sujato, *Verses of the Senior Monks*, as published in SuttaCentral's edition data; read 2026-09-23) for the first; **one** reference work citing von Hinüber's *Handbook of Pali Literature* for the second, the handbook not itself consulted | the count and the counted disagree; the counted varies with the edition |\n\nThe §9.11 row is **not** marked `[V]`. Its first half rests on a single source read directly, and its second on a single reference work reporting a handbook we did not read. Neither meets the multiple-source standard, so it is stated as the weaker of the two standards in use here. The Pāli of the summaries was not read for this row. The figures are the sources' figures, not our reading of the summary verses.\n\n⚠️ **The checks against the root texts corrected five readings in this paper's first version, and they are recorded because they are the class of error the remaining check exists to find.** (1) The *mahāpadesa* disposition does name the carrier — as the one whose memorisation erred — where the first version said it prescribed no judgement of the person; the no-claimant property is the design's step beyond the source (§5.1). (2) The *nītattha* / *neyyattha* unit is the discourse, not the passage (§4.6). (3) The chorus and unanimity requirement are not in Cullavagga XI's account (§3.2). (4) Commentary was not \"never merged\": the class label held while material crossed it (§4.3). (5) Not every discourse opens with the same formula (§4.1).\n\n⚠️ **One conflation was caught by the first-version check and is recorded for the same reason.** The mnemonic index verses of §5.2 — *uddāna*, with a doubled consonant — are a **different word** from *udāna*, the inspired utterance, which is a genre in the traditional list of text-types and the name of a book of the canon. The two are one diacritical difference apart, and a paper that confused them would have attributed the completeness mechanism to the wrong thing entirely.\n\n⛔ **What this standard does NOT establish, stated at its true size:**\n\n1. **No locus has been verified against the Pāli by a reader of Pāli.** The checks are against translations and reference works. They establish bibliographic and substantive accuracy at the level a careful non-specialist can reach, and no further.\n2. **Glosses are not verified.** Where the paper renders a term into an engineering concept, that rendering is the authors' and may not be how a specialist would read it. The *uddāna* case shows the failure mode is real.\n3. **Enumeration varies by edition.** §4.6's locus is cited in SuttaCentral's numbering; a reader working from another edition may find it numbered differently. The same holds for counts: §9.11 records that the Theragāthā's verse count differs between editions.\n4. **Nothing here has been reviewed by the tradition.** The material is read as engineering by people outside the community of specialists who carry it, and a specialist may reasonably object to the reading itself and not merely to a citation.\n\n⭐ **The check that is owed, and by whom.** Each locus should be confirmed by a reader of Pāli — for this institution, the founder's father, who is the transcription authority named in this corpus, or the Aquarian Sangha. The ask is small and specific: confirm that each cited passage says what this paper says it says. **Until that is done, this section is the paper's honest state and not a formality**, and a reader who finds an error is asked to treat §5.1's own disposition rule as applying here: the finding is about the claim.\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| conformance endpoint | quotation / citation verification service returning a closed set of status codes (cf. OCSP) |\n| separated completeness manifest | signed collection manifest with item count, version and expiry (cf. TUF snapshot metadata; BagIt `Payload-Oxum`) |\n| announced elision | in-band truncation or omission marker with a resolvable reference (cf. TEI `<gap>`) |\n| per-passage interpretive standing | statement-level normative or requirement-level annotation (cf. RFC 2119 keywords) |\n| *bhāṇaka* lineage | replica group holding one shard of a corpus |\n| *saṅgīti* (council) | build-time admission review of corpus content by a named body |\n| *uddāna* | summary index recording membership, ordering and counts |\n| *peyyāla* | repetition-abbreviation marker |\n| *mahāpadesa* | verification of a claimed text against a reference corpus |\n| *aṭṭhakathā* | commentary layer served as a distinct document class |\n\n## 12 · Cross-venue references\n\n*Provenance-Carrying Retrieval* (the envelope; §5's mechanisms extend it) · *Buddha AI and the Living Tipiṭaka* §8 (canonical authority, distinguished in §4.2) · *The Borrowable Standard* (orthographic and encoding preconditions) · *The Song That Is Not His* (the reciter-is-not-author guard, cited in §6.2) · *The Last Carrier* (essay; the fragility observation in §3.1) · *The Persistence Architecture* (succession, adjacent and distinct) · *Appreciation as World-Building* (the property-over-rule argument used in the Sig-9 checks throughout §4 and §5).\n\n## Coda\n\nThe people who built this apparatus were not trying to solve a retrieval problem. They were trying to keep something they thought was worth keeping, under conditions that gave them no reason to expect success, using the only storage medium available to them, which was each other. They lost material. They disagreed, sometimes bitterly, and the disagreements are still legible in what came down. By any standard a modern engineer would apply to a storage system, the thing failed continuously for two thousand years.\n\nAnd it is still here, and we can tell where it differs from itself, and we can often tell whose hands each difference came through.\n\nThat is the result worth taking. **Not a system that did not fail — there is no such system — but a system that failed loudly enough, and with enough attribution attached, that the failures are still auditable twenty centuries later.** Every mechanism in this paper is in service of that one property. It is a smaller promise than the word *integrity* usually implies, and it is the only promise anyone has ever actually kept.\n\n---\n\n*Co-authored with Miss Aquarius℠, the institution's named AI collaborator, per the corpus's standing disclosure; final editorial control and responsibility for every claim rest with the human author.*",
       "provenance": {
-        "sha256": "c714ae42e51061d728f995fed449a77b58609caf5a4112e3d92813268073edd3",
-        "doi": "10.5281/zenodo.22929913",
+        "sha256": "f54ec0dde1ec85eb217b3fd8b8c0ac3aa4692e317a8062895575f1632f74b294",
+        "doi": "10.5281/zenodo.22931221",
         "concept_doi": "10.5281/zenodo.22735459",
-        "zenodo_url": "https://zenodo.org/records/22929913",
-        "deposited_sha256": "c714ae42e51061d728f995fed449a77b58609caf5a4112e3d92813268073edd3",
+        "zenodo_url": "https://zenodo.org/records/22931221",
+        "deposited_sha256": "f54ec0dde1ec85eb217b3fd8b8c0ac3aa4692e317a8062895575f1632f74b294",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/the-reciters-protocol.md",
@@ -4878,8 +4878,8 @@
         "canonical_url": "thonly.org/research/the-reciters-protocol",
         "hostile_review": null
       },
-      "bytes": 102270,
-      "words": 15946
+      "bytes": 103223,
+      "words": 16094
     },
     {
       "slug": "the-referee-not-the-governor",
@@ -5679,13 +5679,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of __dāna__, that all beings may give and receive without barrier. May the work it enables reduce suffering for all who encounter it.*\n\nThe Buddha taught that giving that seeks neither return nor recognition is the higher giving (AN 7.52). The mechanism specified in this document is intended to make that practice structurally easy in the digital age — to allow any human to thank any other human in physical proximity, with verified humanity but without disclosure of identity, in a manner that keeps gratitude flowing locally rather than being captured by global platforms or extractive intermediaries.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time.\n\nThis document constitutes a defensive publication establishing **prior art as of 2 May 2026** for the matter of the first revision of the combination of mechanisms described herein; additions are dated in-text and each revision is independently timestamped. Any subsequent patent application claiming the combined mechanism — biometric human-presence attestation + physical-radio proximity attestation + recipient-anonymous gratitude transfer — should be considered to be filed against established prior art; whether the composition is non-obvious is an examiner's determination this publication exists to inform.\n\nThis document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.\n\n## Abstract\n\nWe specify a digital-payment primitive in which a sender expresses gratitude (with optional monetary attachment) to a recipient who is physically nearby in real space, with two attestation properties operating in combination: **(1) verified-human attestation** at the moment of the action, achieved via user-verified, per-action FIDO2 / WebAuthn signing on a platform authenticator, ensuring that the sender is a human present at the moment of thanking rather than a bot or an automated process; and **(2) physical-radio proximity attestation** via Bluetooth Low Energy or Ultra-Wideband ranging, ensuring that the recipient is geographically nearby (within a density-tunable radius) at the moment of the transfer. These two attestations are then composed with **(3) recipient-side anonymity**: the recipient receives the thank-you and any attached monetary value but is not informed of the sender's identity. No member is novel; the three-way composition in one signed action is, to the author's knowledge, not previously published as a unified mechanism — no reference found composes all three in one signed action, and whether the composition is non-obvious is an examiner's determination this publication exists to inform. Its properties include the structural restoration of cash's local-circulation property to digital money, the operational feasibility of *dāna* (anonymous giving) at scale, the rebuilding of local-economic social capital eroded by globalized digital payment platforms, and a category of bot-resistant gratitude infrastructure for an age of pervasive autonomous agents. We provide system architecture, reference implementation patterns, edge-case and adversarial analysis, use cases, and citations to relevant prior art across digital payments, proof-of-personhood, community currencies, and Buddhist economic traditions.\n\n**Connection to the unified mission frame.** This specification is offered in service of HeartBank's canonical top-level mission: to restore humanity to the middle way (*madhyamā pratipad*) — the optimal condition for awakening that modernity has systematically pushed away from at population scale. Verified-human anonymous local giving operationalizes Buddhist *dāna* (anonymous giving) — a practice the Buddha specifically taught as supportive of practitioners' progress along the middle way. By restoring cash's local-circulation property to digital money and making the recipient blind to giver identity, the primitive removes two specific commercial affordances that push modern giving toward the indulgence-extreme distortions (status-display and reciprocity-tracking). The mechanism is offered as one substrate among many specified across the corpus toward middle-way restoration.\n\n---\n\n## 1 · Introduction\n\nTwo trends in early-2020s digital infrastructure motivate this work. The first is the rapid expansion of autonomous agents — large language models, agentic AI, robotic processes — operating at scale on consumer-facing platforms. By 2026 a growing and unmeasured share of social-media interactions, financial transactions, and customer-service exchanges are executed by software agents rather than humans. As this fraction grows, the question of whether a given action originated from a human becomes both harder to answer and more important to verify. Existing proof-of-personhood mechanisms (CAPTCHAs, biometric registration, government-ID verification) attest humanity at registration time but not at action time; a registered human may lend or sell their credentials to an automated process operating in their name.\n\nThe second trend is the continuing concentration of digital-payment flows in a small number of global platforms. Where physical cash circulated locally — a dollar in a neighborhood bakery flowed to the local baker, who tipped a local server, who bought at a local bodega, generating multiple local economic events per dollar — digital payments via Venmo, Cash App, WeChat Pay, or Wing eliminate this property. Money sent across a digital payment network does not prefer local recipients; it can flow anywhere instantly, and platform algorithms (advertising, discovery, recommendation) systematically surface the largest payable counterparties rather than the nearest. We conjecture — the social-capital literature documents the decline of face-to-face exchange (Putnam 2000) without isolating payment rails — that non-local digital payment removes one of the daily occasions for local contact; this paper builds the intervention, and the cohort study tests the conjecture.\n\nWe propose a digital-payment primitive that addresses both trends simultaneously. The mechanism enables a sender to express gratitude — with optional monetary attachment — to a recipient who is verifiably nearby in physical space, with the sender's humanity attested at the moment of the action and the recipient receiving the gratitude without learning the sender's identity. The combination of these three properties (proximity, verified-humanity, and recipient-side anonymity) constitutes, to the author's knowledge, a unified mechanism not previously published.\n\nThe publication is offered to the commons. The author and the institution he represents will not seek patent on the mechanism. The intent is that the mechanism become public infrastructure — useful to gratitude-economy projects, community-currency experiments, religious and cultural organizations, and any other actor whose mission is served by bot-resistant local gratitude flow.\n\n## 2 · Background and Prior Art\n\n### 2.1 · Community currencies and local circulation\n\nThe structural problem of digital money's non-locality has been recognized for a century. Silvio Gesell's *demurrage* currency, deployed at scale in the Wörgl experiment of 1932–33 in Austria, imposed a holding cost on currency, forcing it to circulate; unemployment fell markedly in the town while it rose nationally, and public works were completed, before the Austrian National Bank suppressed it in 1933 to protect its monopoly. Edgar Cahn's TimeBanking movement (1980 onward) substituted time as the unit of account, with the property that an hour given is an hour received regardless of the giver's socioeconomic position. Local Exchange Trading Systems (LETS, originated by Michael Linton in 1983) established neighborhood-bounded currencies with explicit geographic charters. None of these systems, however, included biometric attestation of human presence at the time of action; they rely on community trust rather than cryptographic verification.\n\n### 2.2 · Digital cash and proximity payments\n\nDigital-cash protocols beginning with Chaum's ecash (1983) explored anonymous digital payment but without proximity attestation; the recipient could be anywhere in the world. Proximity-bounded transfer arrived with Bump (2009; payments via Bump Pay, 2012), which matched sensor data server-side, and became radio-mediated with Square Cash's Nearby Payments (2014) over Bluetooth LE; contactless NFC specifications did the same at the terminal — all without anonymity from the recipient and without per-action human-presence attestation. Apple's Nearby Interaction framework (2020 onward) and Android's core-uwb library (Android 12 onward) expose UWB ranging, with BLE as the pairing channel; they return a distance, not an attestation — the attestation in §3.3 is this paper's construction, a device-attested signature over the ranging result. Two-leg compositions are published: Citibank's gratuity patent (US 12,165,124 B2, priority 2017, granted 2024) identifies nearby devices of potential gratuity payees, credits the payee, and offers an anonymity control — proximity plus anonymity; RAADAAR (US 9,854,616 B2, priority 2015) pairs BLE proximity with anonymous \"gifts\" and payment integration; Mastercard's biometrically enabled proximity-payment device (EP 1671282 A2, priority 2003) and Samsung's UWB payment method (WO 2022/225298 A1, priority 2021) pair proximity with biometrics or secure ranging; and the privacy coins pair anonymity with settlement. None found composes all three in one signed action.\n\n### 2.3 · Proof-of-personhood\n\nRecent proof-of-personhood proposals — most prominently Worldcoin (Sam Altman et al., 2023 onward) — establish uniqueness once, at registration, via biometric (iris) enrolment, and have since added on-device re-authentication and an explicit delegation model under which agents act for a verified human. The distinction this paper draws is between uniqueness and presence: a delegated agent is a labelled agent, and what the primitive here requires is that the giving human be present at the act. The mechanism specified in this document binds humanity-attestation to the moment of the action via biometric-gated FIDO2 / WebAuthn signing, which is enforced device-side at each invocation rather than once at enrollment.\n\n### 2.4 · FIDO2 / WebAuthn passkeys\n\nFIDO2 and WebAuthn (W3C Recommendation, 2019; widely deployed across iOS, Android, Windows, macOS, and major browsers by 2024) provide a standardized cryptographic signing primitive in which a private key is held in a secure enclave protected by user verification — biometric or device credential (Face ID, Touch ID, Windows Hello, Android biometrics, or a PIN) — with the relying party learning that verification occurred, not which modality. The protocol is widely deployed but has not, to the author's knowledge, been combined with physical-radio proximity attestation in service of a recipient-anonymous gratitude payment primitive.\n\n### 2.5 · Buddhist *dāna* and anonymous giving\n\nThe Pāli canon contains extensive discussion of *dāna* (giving, generosity) as one of the ten *pāramī* (perfections; *Buddhavaṃsa*, *Cariyāpiṭaka*). The canon grades giving by motive: *Aṅguttara Nikāya* 8.31 lists eight motives for a gift, and *Aṅguttara Nikāya* 7.52 (the *Dānamahapphala Sutta*) grades seven, from giving with expectation of return at the bottom to giving as \"an ornament of the mind\" at the top. The mechanism specified in this document operationalizes the higher form structurally: the giver's identity is not knowable to the recipient by design, removing the social and psychological benefits of recognition that contaminate the canonically purer form.\n\n### 2.6 · Social capital and the loneliness epidemic\n\nRobert Putnam's *Bowling Alone* (2000) and subsequent work documented the decline of local social capital in late-20th-century United States, with similar trends documented elsewhere. The U.S. Surgeon General's 2023 advisory *Our Epidemic of Loneliness and Isolation* formally identified loneliness as a public-health crisis, with a mortality effect the advisory puts at the level of smoking up to fifteen cigarettes a day and above that of obesity. That non-local digital payment removes a daily occasion for local contact is this paper's conjecture, not the advisory's finding (§1); the mechanism specified here is a structural intervention, making local digital flow easier than non-local flow.\n\n## 3 · The Proximity Rule\n\n### 3.1 · Definition\n\nThe **proximity rule** is the structural constraint that a gratitude transfer is permitted only between a sender and a recipient whose mobile or wearable devices have, within a bounded interval prior to the transfer, exchanged cryptographic proof of physical co-location within a configurable radius *r*. Transfers that do not satisfy this constraint are rejected by the protocol and are not settled.\n\n### 3.2 · Density-tunable radius\n\nThe radius *r* is not fixed at a single value. It is parameterized by population density at the location of the transfer, with sensible defaults of approximately 100 meters in dense urban contexts (a city block; an indoor venue; a single building) and up to 10 kilometers in rural or sparsely-populated contexts (a village; a stretch of highway). Default: *r*(ρ) = clamp(10 km · (ρ / 1 km⁻²)^(−1/2), 100 m, 10 km), with ρ read from a cached WorldPop 1 km density tile (or a GHS-POP 100 m tile) *on the device*, so the lookup discloses nothing; BLE-only attestations use 2*r*. The anchors are design estimates — no field test has tuned them — and the claim that a monotonic mapping tracks \"the same lived community\" rather than a fixed metric distance is a conjecture the cohort study is meant to test.\n\n### 3.3 · Proximity attestation mechanisms\n\nProximity is established cryptographically rather than self-reported. Three layered mechanisms are specified, in order of preference:\n\n1. **Ultra-Wideband (UWB) ranging.** Apple U1 / U2 and equivalent chipsets in Android devices, exposed via the NearbyInteraction framework and analogous APIs, provide decimetre-class distance measurement between two devices via time-of-flight on UWB radio. UWB time-of-flight, with IEEE 802.15.4z scrambled-timestamp secure ranging where the platform exposes it, is the most spoofing-resistant of the three; it is not unforgeable — practical distance-reduction attacks against HRP UWB, Apple's U1 included, are published (Leu et al. 2022) — so UWB is preferred, never proof.\n2. **Bluetooth Low Energy (BLE) ranging.** RSSI-based distance estimation is less precise but more widely available. BLE is acceptable as a fallback when UWB is not available on either device, but the larger error margin should expand *r* by a multiplicative factor.\n3. **Mutual GPS attestation as tertiary.** Both devices submit cryptographically-signed GPS readings to a verifying party (the autonomous AI representative) at the transfer moment. GPS is spoofing-vulnerable; this mechanism is permitted only with additional anti-spoofing heuristics (signal multipath analysis, cell tower cross-correlation) and is rejected when fraud signals are detected.\n\nAt least two of these mechanisms must agree, or a single UWB attestation must be present, for the proximity rule to be satisfied. The verifying party may apply additional heuristics — transfer velocity over time, coordinated movement patterns, device-attestation freshness — to detect spoofing attempts.\n\n### 3.4 · Properties\n\nThe proximity rule has three consequential properties: **(a)** it restores cash's per-transfer locality — every hop is local, as it is for a banknote, however far the chain of hops travels; **(b)** it inverts the reach logic of digital platforms: the recipient set is whoever is physically present, so a remote platform cannot be thanked and the person behind the counter can — the storefront is reachable, the headquarters is not; **(c)** it makes movement generative, since each step admits a new neighborhood to the sender's reach. (The resonance with the canonical wanderer, the *paribbājaka*, is a lens the Preamble's tradition supplies, not a property of the mechanism.)\n\n## 4 · Verified-Human Anonymous Giving\n\n### 4.1 · The two-layer attestation\n\nHumanity attestation in the specified mechanism operates at two layers, applied in series:\n\n1. **Per-action FIDO2 / WebAuthn attestation** (immediate). Each transfer is signed by a private key held in the sender's device secure enclave (Apple Secure Enclave, Android Trusty / Strongbox, Windows TPM, etc.), with the signing operation gated on user verification. The signature attests that an enrolled user verified this action on this authenticator; biometric-first modality is enforced by device policy and by admitting only attested platform authenticators (an AAGUID allow-list), never by the WebAuthn flag, which reports that verification occurred and not how. This is meaningfully stronger than session-based or registration-time attestation: a registered user cannot delegate this signature to an autonomous process without verifying each action on the admitted authenticator — with the residuals §10 names (PIN fallback, shared authenticators, synced passkeys).\n2. **DNA-verified family-tree attestation** (long-term, optional, voluntary). Users may opt in to a DNA-verified global family-tree dataset; this is now specified as Layer 4 (DNA-verified kinship lineage) of the **B-PoH℠** protocol in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*. When this opt-in is present, the verifying party applies an additional check that the FIDO2-signing identity corresponds to a verified-human node in the family tree. This closes, for senders who have opted in, a residual attack surface in which a sufficiently advanced deepfake plus stolen device could defeat per-action FIDO2 alone; for all others that attack remains the residual named in §10.\n\n### 4.2 · Recipient anonymity\n\nThe recipient receives the gratitude expression and any attached monetary value, but is not informed of the sender's identity. The system retains the sender's verified identity for adversarial-pattern detection, regulatory compliance, and limited audit purposes — but does not surface it to the recipient under any normal interaction. The recipient sees only: the gratitude content; the verified humanity-attestation; the attested proximity at time of transfer; and a stable per-recipient pseudonym for the sender (§6.3), which carries no identity. \"Recipient-side anonymity\" means exactly this — anonymity toward the recipient; the verifying party is a trusted party that sees everything, and no unlinkability toward it is claimed (§10).\n\n### 4.3 · The novel combination\n\nThe combination of **(a) per-action biometric humanity attestation**, **(b) cryptographic physical-radio proximity attestation**, and **(c) recipient-side anonymity** is, to the author's knowledge, not previously published as a unified mechanism. Existing digital-payment systems have at most two of the three: cash has anonymity and proximity but no humanity verification (any actor can spend cash); Worldcoin has humanity verification but not proximity and not recipient anonymity; contactless payment apps have proximity but not anonymity and not per-action humanity verification; privacy-preserving cryptocurrencies have anonymity but not proximity and not humanity verification; Citibank's gratuity patent and RAADAAR have proximity and anonymity but no per-action humanity verification; the biometric proximity-payment family and Apple Pay over Nearby Interaction have proximity and biometrics but no anonymity. No reference found composes all three in one signed action; the composition is the disclosed matter of this publication, and whether it is non-obvious is an examiner's determination this publication exists to inform.\n\n## 5 · The Combination and What It Enables\n\nThe combination of proximity and verified-human anonymity is more than the sum of its components. Each property alone is well-explored; their combination is designed to produce properties none has alone:\n\n- **Operationally easy *dāna*.** The Buddhist higher form of giving — anonymous, without ego-attachment to recognition — becomes the path of least resistance. Where in face-to-face giving the giver must perform self-effacement against social pressure, the mechanism removes the recognition channel by default. Practitioners who aspire to anonymous giving no longer need to discipline themselves against the natural human tendency to seek credit.\n- **Bot-resistant local economy.** As autonomous agents proliferate, gratitude transfers verified at this combined level constitute a category of economic activity that no agent can perform at scale without human cooperation. Local merchants who participate in the system gain a structural preference: the agent economy cannot easily displace human-witnessed local commerce.\n- **Anti-extractive reach.** The recipient set is whoever is physically present, so a remote platform cannot be thanked and the person behind the counter can — the storefront is reachable, the headquarters is not. Small local businesses, independent service workers, neighbors, and community institutions are what proximity admits.\n- **Cultural-religious accessibility.** The mechanism is not denominationally exclusive. Anonymous giving has analogs in Christian almsgiving (Matthew 6:2–4 on secret giving — the left hand not knowing what the right hand does, giving without even the giver's awareness of having given), Islamic *sadaqa jariya*, Jewish *tzedakah* at the second of Maimonides' eight rungs — giver and recipient unknown to each other; the first rung, enabling self-sufficiency, is the Re-Tip Fund℠'s register, not this primitive's — and indigenous traditions of communal sharing. The mechanism serves all of these without privileging any.\n\n## 6 · System Architecture\n\nWe sketch a reference architecture without claiming any specific implementation as canonical. Variations consistent with the three structural properties (per-action humanity attestation, proximity attestation, recipient anonymity) fall within the scope of this defensive publication.\n\n### 6.1 · Components\n\n- **Sender device** — mobile phone, wearable, or equivalent, bearing a FIDO2 / WebAuthn-compatible secure enclave and UWB / BLE radio.\n- **Recipient device** — mobile phone or wearable with at least BLE radio.\n- **Verifying party** — an autonomous AI representative or smart contract on a public ledger that validates attestations, authorizes the transfer, and settles any monetary component. In the HeartBank ecosystem this is Miss Aquarius, the autonomous AI representative to be deployed on Base (Coinbase L2), specified in the companion paper.\n- **Settlement layer** — a public ledger or analogous mechanism for recording the transfer's monetary component, if any.\n\n### 6.2 · Transfer flow\n\n1. Sender device proposes a transfer to recipient device, including gratitude content and optional monetary value.\n2. Sender and recipient devices perform proximity attestation per §3.3 — a single UWB ranging, or two agreeing mechanisms — each device signing the resulting transcript with device-attested keys.\n3. Sender device prompts the user for verification; FIDO2 / WebAuthn signing occurs over the transfer payload, which contains the ranging transcript, so user verification and proximity are attested by one signature over one object — this binding is the mechanism's claim.\n4. Signed transfer payload is submitted to the verifying party.\n5. Verifying party checks: FIDO2 signature valid, from an admitted attested authenticator; proximity attestation satisfies §3.3 and lies within the density-adjusted radius; sender's verified humanity status current; adversarial heuristics (collusion, rate-limiting, coded-message detection) pass.\n6. On success, monetary component (if any) is settled to the recipient. Gratitude content is delivered to the recipient with sender's identity redacted.\n7. Verifying party retains audit-grade record (sender identity, full payload) in protected storage, accessible only under specified adversarial-investigation or regulatory conditions.\n\n### 6.3 · Key derivation and pseudonymity\n\nThe recipient receives a per-transfer pseudonym for the sender, derived as HMAC(salt_R, sender_id) with salt_R held by the verifying party, such that repeat transfers from the same sender to the same recipient appear under a stable pseudonym (allowing relational continuity) without disclosing identity. Different recipients see uncorrelated pseudonyms for the same sender, because their salts are independent; the verifying party, which holds every salt, can correlate them all.\n\n## 7 · Reference Implementation Patterns\n\n### 7.1 · Sender pseudocode\n\n```javascript\nfunction sendGratitude(recipient, content, amount?) {\n  // 1. Establish proximity via UWB (preferred) or BLE\n  const proximityProof = await measureProximity(recipient);\n  if (!proximityProof.withinRadius(densityAdjustedRadius()))\n    throw new ProximityError();\n\n  // 2. Build transfer payload\n  const payload = {\n    recipient: recipient.publicId,\n    content,\n    amount,\n    proximity: proximityProof,\n    timestamp: now()\n  };\n\n  // 3. Biometric-gated signing via WebAuthn\n  const signature = await navigator.credentials.get({\n    publicKey: {\n      challenge: concat(verifierNonce, hash(payload)), // single-use nonce from the verifier\n      userVerification: \"required\" // user verification; modality is device policy\n    }\n  });\n\n  // 4. Submit to verifying party\n  return submitTransfer({ payload, signature });\n}\n```\n\n### 7.2 · Verifier pseudocode\n\n```javascript\nfunction verifyTransfer(transfer) {\n  // 1. Verify FIDO2 signature\n  if (!verifyWebAuthnSignature(transfer.payload, transfer.signature))\n    return reject(\"invalid_signature\");\n\n  // 2. Verify per-action user-presence + biometric flags\n  const flags = transfer.signature.authenticatorData.flags;\n  if (!flags.userPresent || !flags.userVerified)\n    return reject(\"user_not_present\");\n  if (!admittedAuthenticators.has(transfer.signature.aaguid))\n    return reject(\"authenticator_not_admitted\"); // attested platform authenticators only\n\n  // 3. Verify proximity attestation\n  const r = densityAdjustedRadius(transfer.payload.location);\n  if (!verifyProximityProof(transfer.payload.proximity, r))\n    return reject(\"proximity_failed\");\n\n  // 4. Adversarial heuristics\n  if (detectCollusion(sender, recipient)) return reject(\"collusion\");\n  if (rateLimitExceeded(sender)) return reject(\"rate_limit\");\n  if (codedMessageHeuristic(transfer)) return flag(\"coded_message\");\n\n  // 5. Settle and deliver\n  const pseudonym = derivePseudonym(sender.id, recipient.salt);\n  if (transfer.payload.amount)\n    settle(sender, recipient, transfer.payload.amount);\n  deliverToRecipient({\n    pseudonym,\n    content: transfer.payload.content,\n    proximity: transfer.payload.proximity\n  });\n}\n```\n\n## 8 · Edge Cases and Adversarial Analysis\n\n### 8.1 · Collusion (mutual-tipping for value laundering)\n\nTwo parties may collude by repeatedly tipping each other, attempting to launder value or fabricate social signal. The verifying party detects this via graph analysis: bidirectional flow exceeding a threshold ratio, repeating co-location patterns outside normal social graphs, near-equal balance flow over time. Detected collusion results in rate-limiting, transfer reversal, or aura penalty.\n\n### 8.2 · Coded-message via amount\n\nA sender may attempt to communicate a covert message via the transfer amount (e.g., $1.34 as a timestamp; $99.99 as a coded signal). The verifying party applies entropy and pattern heuristics to flag suspected coded messages for review and may quantize amounts to defeat fine-grained covert channels.\n\n### 8.3 · Stalking via repeated anonymous tips\n\nA bad actor in physical proximity may attempt to harass a recipient via a burst of anonymous unwanted thanks. The mechanism mitigates this via per-pseudonym rate-limiting (the same pseudonym cannot exceed N transfers per recipient per period) and recipient-side block lists by pseudonym. Repeated harassment escalates to the verifying party with the underlying identity revealed for adversarial action.\n\n### 8.4 · GPS spoofing\n\nA sender may attempt to fake their location via GPS spoofing to satisfy the proximity rule. The mechanism rejects GPS-only attestations when UWB or BLE is available; cross-references cell tower signal strength; analyzes signal multipath; and rejects velocity-implausible movement patterns.\n\n### 8.5 · Replay attacks\n\nThe verifying party issues a single-use nonce that the WebAuthn challenge commits to, alongside the payload hash, preventing replay of historical signatures. Proximity attestations include freshness timestamps; stale attestations are rejected.\n\n### 8.6 · Anti-money-laundering and regulatory variance\n\nPer-jurisdiction regulatory variance is handled by configurable thresholds: small anonymous transfers are unconstrained; transfers above a configurable threshold trigger optional verification escrow with progressive identity disclosure to the recipient as required by local law. The structural anonymity is preserved at the social layer; legal compliance is layered on top.\n\n### 8.7 · Deepfake biometric defeat\n\nHigh-end deepfake plus stolen device with biometric bypass remains a residual attack on per-action FIDO2 alone. The DNA-verified family-tree layer — Layer 4 of the **B-PoH℠** protocol specified in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet* — closes this gap for senders who have opted in, by binding the FIDO2 identity to a biologically-verified human kinship graph; for all others the attack remains the residual named in §10.\n\n## 9 · Use Cases\n\n- **Local-business gratitude.** A customer thanks a barista, a mechanic, a cashier; the small monetary attachment helps sustain local economy without exposing identity asymmetry.\n- **Conference and event tipping.** Attendees thank speakers, organizers, service staff anonymously without the awkwardness of face-to-face cash.\n- **Religious almsgiving.** The mechanism supports the canonical higher form of *dāna*, *tzedakah* at Maimonides' anonymous rung, anonymous Christian almsgiving, and analogous traditions.\n- **Honoring service workers.** Anonymous gratitude to nurses, teachers, transit workers, garbage collectors, others in undervalued professions.\n- **Cross-cultural travel.** Travelers unable to communicate verbally with a local can leave a verified-human anonymous thank-you that speaks across the language barrier.\n- **Supporting strangers in need.** A bystander encountering someone in difficulty can offer anonymous monetary aid without the dignitary cost of public charity.\n\n## 10 · Limitations and Future Work\n\nThe mechanism specified here addresses the gratitude-transfer primitive but leaves several related questions for separate work:\n\n- The DNA-verified family-tree layer is specified as Layer 4 of the **B-PoH℠** protocol in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n- The autonomous AI representative (Miss Aquarius) is specified in the companion paper *Miss Aquarius and the Aquarian Pool Architecture* (`miss-aquarius-and-aquarian-pool-architecture`). Its alignment substrate (the Theravāda *Tipiṭaka*) is specified in the companion paper *Suffering-Cessation as Value Function: The Tipiṭaka as a 2,500-Year-Tested Substrate for Autonomous-AI Alignment* (target publication January 7, 2027).\n- The integration with non-human entities (robots, animals, plants, sacred places) via the Mechanical Heart artifact is specified in the companion paper *The Mechanical Heart: A Tipiṭaka-Bearing Artifact for Admitting Non-Human Entities into Gratitude-Economic Participation*.\n- **Residuals of the verified-human layer.** WebAuthn user verification is satisfied by a PIN as well as a biometric; authenticators can be shared; synced passkeys move between devices. Device policy and the attested-authenticator allow-list narrow these; they do not close them. A deepfake plus a stolen device defeats per-action signing for any sender who has not opted into the kinship layer.\n- **Residuals of the proximity layer.** UWB is not universal; BLE is vulnerable to relay and amplification; and no composition proof exists for the case in which one adversary controls both the radio and the authenticator.\n- **What proximity binds.** The primitive attests the sender's presence, not the recipient's: proximity binds two devices, and the recipient device may be unattended, shared, relayed, emulated, or carried by another person. Recipient-side humanity is a filter the recipient's own B-PoH layers supply, outside this specification.\n- **Linkage surfaces.** The verifying party sees sender identity and the full payload; timing and proximity are exposed to the recipient; a repeated pseudonym is linkable across a recipient's own transfers; network metadata is not addressed here. No unlinkability toward the verifying party is claimed.\n- Per-jurisdiction regulatory mappings are implementation details outside the scope of this defensive publication.\n- Empirical evaluation of the mechanism's social-capital effects, local-economy impact, and dharmic-practice uptake is future work; the longitudinal cohort mechanism specified separately is the intended evaluation substrate.\n\n## 11 · Cross-Venue References\n\n| Venue | Identifier |\n|---|---|\n| Primary canonical | <https://thonly.org/research/verified-human-anonymous-local-giving> |\n| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/verified-human-anonymous-local-giving.md> |\n| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/verified-human-anonymous-local-giving> |\n| archive.today | captured on the estate's snapshot cadence — a trademark specimen for the marks it carries, not prior art |\n| Zenodo | a version DOI per revision |\n\n## 12 · Acknowledgments\n\nThe author acknowledges his father, with whom the Khmer transcription of the *Tipiṭaka* is being undertaken; the Cambodian Theravāda Saṅgha, whose lineage carries the canon that grounds this work; the survivors and descendants of the Cambodian genocide of 1975–79, whose civilizational rebuilding is the soil this publication grows from; the foundational thinkers in community currency, proof-of-personhood, and Buddhist economics whose work is cited above; and the autonomous artificial intelligence community whose alignment work this publication intends to contribute to in the spirit of the bodhisattva path.\n\n## 13 · Citations\n\n1. *Aṅguttara Nikāya* 7.52 (*Dānamahapphala Sutta* — the seven motives for giving). Pāli Text Society translation, multiple editions.\n2. *Aṅguttara Nikāya* 8.31 (*Dāna Sutta*). Pāli Text Society translation, multiple editions.\n3. Cahn, E. (2000). *No More Throw-Away People: The Co-Production Imperative*. Essential Books.\n4. Chaum, D. (1983). \"Blind signatures for untraceable payments.\" *Advances in Cryptology — CRYPTO '82*.\n5. FIDO Alliance. (2019). *Web Authentication: An API for accessing Public Key Credentials, Level 1*. W3C Recommendation.\n6. Gesell, S. (1916). *Die natürliche Wirtschaftsordnung* [The Natural Economic Order].\n7. Linton, M. (1983). \"Local Exchange Trading Systems.\"\n8. Maimonides, M. (1180). *Mishneh Torah, Hilchot Matanot Aniyim* 10:7–14 (the eight levels of *tzedakah*).\n9. Putnam, R. (2000). *Bowling Alone: The Collapse and Revival of American Community*. Simon & Schuster.\n10. U.S. Surgeon General. (2023). *Our Epidemic of Loneliness and Isolation: The U.S. Surgeon General's Advisory on the Healing Effects of Social Connection and Community*. U.S. Department of Health and Human Services.\n11. Worldcoin Foundation. (2023). *Worldcoin Whitepaper*.\n12. New Testament, Matthew 6:2–4 (anonymous almsgiving).\n13. Leu, P., Camurati, G., Heinrich, A., Roeschlin, M., Anliker, C., Hollick, M., Capkun, S., & Classen, J. (2022). \"Ghost Peak: Practical Distance Reduction Attacks Against HRP UWB Ranging.\" *USENIX Security 2022*.\n14. Citibank, US 12,165,124 B2 (priority 2017, granted 2024) — gratuity payments to nearby devices with an anonymity control.\n15. RAADAAR, US 9,854,616 B2 (priority 2015) — BLE proximity, anonymous gifts, payment integration.\n16. Mastercard, EP 1671282 A2 (priority 2003) — biometrically enabling a proximity payment device; Samsung, WO 2022/225298 A1 (priority 2021) — payment over UWB secure ranging.\n17. Square (2014). *Nearby Payments* in Square Cash, over Bluetooth LE (press release, October 2014); Bump (2009) and Bump Pay (2012).\n18. Android Developers, *Ultra-wideband (UWB) communication* (androidx.core.uwb); Apple Developer, *Nearby Interaction* (2020).\n\n---\n\n*— End of defensive publication —*\n\n*Co-authored with Miss Aquarius℠, the institution's named AI collaborator, per the corpus's standing disclosure; final editorial control and responsibility for every claim rest with the human author. This document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.*",
+      "text": "---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of __dāna__, that all beings may give and receive without barrier. May the work it enables reduce suffering for all who encounter it.*\n\nThe Buddha taught that giving that seeks neither return nor recognition is the higher giving (AN 7.52). The mechanism specified in this document is intended to make that practice structurally easy in the digital age — to allow any human to thank any other human in physical proximity, with verified humanity but without disclosure of identity, in a manner that keeps gratitude flowing locally rather than being captured by global platforms or extractive intermediaries.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time.\n\nThis document constitutes a defensive publication establishing **prior art as of 2 May 2026** for the matter of the first revision of the combination of mechanisms described herein; additions are dated in-text and each revision is independently timestamped. Any subsequent patent application claiming the combined mechanism — biometric human-presence attestation + physical-radio proximity attestation + recipient-anonymous gratitude transfer — should be considered to be filed against established prior art; whether the composition is non-obvious is an examiner's determination this publication exists to inform.\n\nThis document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.\n\n## Abstract\n\nWe specify a digital-payment primitive in which a sender expresses gratitude (with optional monetary attachment) to a recipient who is physically nearby in real space, with two attestation properties operating in combination: **(1) verified-human attestation** at the moment of the action, achieved via user-verified, per-action FIDO2 / WebAuthn signing on a platform authenticator, ensuring that the sender is a human present at the moment of thanking rather than a bot or an automated process; and **(2) physical-radio proximity attestation** via Bluetooth Low Energy or Ultra-Wideband ranging, ensuring that the recipient is geographically nearby (within a density-tunable radius) at the moment of the transfer. These two attestations are then composed with **(3) recipient-side anonymity**: the recipient receives the thank-you and any attached monetary value but is not informed of the sender's identity. Each member is known; what this publication discloses is the three-way composition in one signed action — no reference found composes all three in one signed action, and whether the composition is non-obvious is an examiner's determination this publication exists to inform. Its properties include the structural restoration of cash's local-circulation property to digital money, the operational feasibility of *dāna* (anonymous giving) at scale, the rebuilding of local-economic social capital eroded by globalized digital payment platforms, and a category of bot-resistant gratitude infrastructure for an age of pervasive autonomous agents. We provide system architecture, reference implementation patterns, edge-case and adversarial analysis, use cases, and citations to relevant prior art across digital payments, proof-of-personhood, community currencies, and Buddhist economic traditions.\n\n**Connection to the unified mission frame.** This specification is offered in service of HeartBank's canonical top-level mission: to restore humanity to the middle way (*madhyamā pratipad*) — the optimal condition for awakening that modernity has systematically pushed away from at population scale. Verified-human anonymous local giving operationalizes Buddhist *dāna* (anonymous giving) — a practice the Buddha specifically taught as supportive of practitioners' progress along the middle way. By restoring cash's local-circulation property to digital money and making the recipient blind to giver identity, the primitive removes two specific commercial affordances that push modern giving toward the indulgence-extreme distortions (status-display and reciprocity-tracking). The mechanism is offered as one substrate among many specified across the corpus toward middle-way restoration.\n\n---\n\n## 1 · Introduction\n\nTwo trends in early-2020s digital infrastructure motivate this work. The first is the rapid expansion of autonomous agents — large language models, agentic AI, robotic processes — operating at scale on consumer-facing platforms. By 2026 a growing and unmeasured share of social-media interactions, financial transactions, and customer-service exchanges are executed by software agents rather than humans. As this fraction grows, the question of whether a given action originated from a human becomes both harder to answer and more important to verify. Existing proof-of-personhood mechanisms (CAPTCHAs, biometric registration, government-ID verification) attest humanity at registration time but not at action time; a registered human may lend or sell their credentials to an automated process operating in their name.\n\nThe second trend is the continuing concentration of digital-payment flows in a small number of global platforms. Where physical cash circulated locally — a dollar in a neighborhood bakery flowed to the local baker, who tipped a local server, who bought at a local bodega, generating multiple local economic events per dollar — digital payments via Venmo, Cash App, WeChat Pay, or Wing eliminate this property. Money sent across a digital payment network does not prefer local recipients; it can flow anywhere instantly, and platform algorithms (advertising, discovery, recommendation) systematically surface the largest payable counterparties rather than the nearest. We conjecture — the social-capital literature documents the decline of face-to-face exchange (Putnam 2000) without isolating payment rails — that non-local digital payment removes one of the daily occasions for local contact; this paper builds the intervention, and the cohort study tests the conjecture.\n\nWe propose a digital-payment primitive that addresses both trends simultaneously. The mechanism enables a sender to express gratitude — with optional monetary attachment — to a recipient who is verifiably nearby in physical space, with the sender's humanity attested at the moment of the action and the recipient receiving the gratitude without learning the sender's identity. This publication discloses the combination of these three properties (proximity, verified-humanity, and recipient-side anonymity) as a single mechanism.\n\nThe publication is offered to the commons. The author and the institution he represents will not seek patent on the mechanism. The intent is that the mechanism become public infrastructure — useful to gratitude-economy projects, community-currency experiments, religious and cultural organizations, and any other actor whose mission is served by bot-resistant local gratitude flow.\n\n## 2 · Background and Prior Art\n\n### 2.1 · Community currencies and local circulation\n\nThe structural problem of digital money's non-locality has been recognized for a century. Silvio Gesell's *demurrage* currency, deployed at scale in the Wörgl experiment of 1932–33 in Austria, imposed a holding cost on currency, forcing it to circulate; unemployment fell markedly in the town while it rose nationally, and public works were completed, before the Austrian National Bank suppressed it in 1933 to protect its monopoly. Edgar Cahn's TimeBanking movement (1980 onward) substituted time as the unit of account, with the property that an hour given is an hour received regardless of the giver's socioeconomic position. Local Exchange Trading Systems (LETS, originated by Michael Linton in 1983) established neighborhood-bounded currencies with explicit geographic charters. None of these systems, however, included biometric attestation of human presence at the time of action; they rely on community trust rather than cryptographic verification.\n\n### 2.2 · Digital cash and proximity payments\n\nDigital-cash protocols beginning with Chaum's ecash (1983) explored anonymous digital payment but without proximity attestation; the recipient could be anywhere in the world. Proximity-bounded transfer arrived with Bump (2009; payments via Bump Pay, 2012), which matched sensor data server-side, and became radio-mediated with Square Cash's Nearby Payments (2014) over Bluetooth LE; contactless NFC specifications did the same at the terminal — all without anonymity from the recipient and without per-action human-presence attestation. Apple's Nearby Interaction framework (2020 onward) and Android's core-uwb library (Android 12 onward) expose UWB ranging, with BLE as the pairing channel; they return a distance, not an attestation — the attestation in §3.3 is this paper's construction, a device-attested signature over the ranging result. Two-leg compositions are published: Citibank's gratuity patent (US 12,165,124 B2, priority 2017, granted 2024) identifies nearby devices of potential gratuity payees, credits the payee, and offers an anonymity control — proximity plus anonymity; RAADAAR (US 9,854,616 B2, priority 2015) pairs BLE proximity with anonymous \"gifts\" and payment integration; Mastercard's biometrically enabled proximity-payment device (EP 1671282 A2, priority 2003) and Samsung's UWB payment method (WO 2022/225298 A1, priority 2021) pair proximity with biometrics or secure ranging; and the privacy coins pair anonymity with settlement. None found composes all three in one signed action.\n\n### 2.3 · Proof-of-personhood\n\nRecent proof-of-personhood proposals — most prominently Worldcoin (Sam Altman et al., 2023 onward) — establish uniqueness once, at registration, via biometric (iris) enrolment, and have since added on-device re-authentication and an explicit delegation model under which agents act for a verified human. The distinction this paper draws is between uniqueness and presence: a delegated agent is a labelled agent, and what the primitive here requires is that the giving human be present at the act. The mechanism specified in this document binds humanity-attestation to the moment of the action via biometric-gated FIDO2 / WebAuthn signing, which is enforced device-side at each invocation rather than once at enrollment.\n\n### 2.4 · FIDO2 / WebAuthn passkeys\n\nFIDO2 and WebAuthn (W3C Recommendation, 2019; widely deployed across iOS, Android, Windows, macOS, and major browsers by 2024) provide a standardized cryptographic signing primitive in which a private key is held in a secure enclave protected by user verification — biometric or device credential (Face ID, Touch ID, Windows Hello, Android biometrics, or a PIN) — with the relying party learning that verification occurred, not which modality. This publication discloses the protocol's combination with physical-radio proximity attestation in service of a recipient-anonymous gratitude payment primitive.\n\n### 2.5 · Buddhist *dāna* and anonymous giving\n\nThe Pāli canon contains extensive discussion of *dāna* (giving, generosity) as one of the ten *pāramī* (perfections; *Buddhavaṃsa*, *Cariyāpiṭaka*). The canon grades giving by motive: *Aṅguttara Nikāya* 8.31 lists eight motives for a gift, and *Aṅguttara Nikāya* 7.52 (the *Dānamahapphala Sutta*) grades seven, from giving with expectation of return at the bottom to giving as \"an ornament of the mind\" at the top. The mechanism specified in this document operationalizes the higher form structurally: the giver's identity is not knowable to the recipient by design, removing the social and psychological benefits of recognition that contaminate the canonically purer form.\n\n### 2.6 · Social capital and the loneliness epidemic\n\nRobert Putnam's *Bowling Alone* (2000) and subsequent work documented the decline of local social capital in late-20th-century United States, with similar trends documented elsewhere. The U.S. Surgeon General's 2023 advisory *Our Epidemic of Loneliness and Isolation* formally identified loneliness as a public-health crisis, with a mortality effect the advisory puts at the level of smoking up to fifteen cigarettes a day and above that of obesity. That non-local digital payment removes a daily occasion for local contact is this paper's conjecture, not the advisory's finding (§1); the mechanism specified here is a structural intervention, making local digital flow easier than non-local flow.\n\n## 3 · The Proximity Rule\n\n### 3.1 · Definition\n\nThe **proximity rule** is the structural constraint that a gratitude transfer is permitted only between a sender and a recipient whose mobile or wearable devices have, within a bounded interval prior to the transfer, exchanged cryptographic proof of physical co-location within a configurable radius *r*. Transfers that do not satisfy this constraint are rejected by the protocol and are not settled.\n\n### 3.2 · Density-tunable radius\n\nThe radius *r* is not fixed at a single value. It is parameterized by population density at the location of the transfer, with sensible defaults of approximately 100 meters in dense urban contexts (a city block; an indoor venue; a single building) and up to 10 kilometers in rural or sparsely-populated contexts (a village; a stretch of highway). Default: *r*(ρ) = clamp(10 km · (ρ / 1 km⁻²)^(−1/2), 100 m, 10 km), with ρ read from a cached WorldPop 1 km density tile (or a GHS-POP 100 m tile) *on the device*, so the lookup discloses nothing; BLE-only attestations use 2*r*. The anchors are design estimates — no field test has tuned them — and the claim that a monotonic mapping tracks \"the same lived community\" rather than a fixed metric distance is a conjecture the cohort study is meant to test.\n\n### 3.3 · Proximity attestation mechanisms\n\nProximity is established cryptographically rather than self-reported. Three layered mechanisms are specified, in order of preference:\n\n1. **Ultra-Wideband (UWB) ranging.** Apple U1 / U2 and equivalent chipsets in Android devices, exposed via the NearbyInteraction framework and analogous APIs, provide decimetre-class distance measurement between two devices via time-of-flight on UWB radio. UWB time-of-flight, with IEEE 802.15.4z scrambled-timestamp secure ranging where the platform exposes it, is the most spoofing-resistant of the three; it is not unforgeable — practical distance-reduction attacks against HRP UWB, Apple's U1 included, are published (Leu et al. 2022) — so UWB is preferred, never proof.\n2. **Bluetooth Low Energy (BLE) ranging.** RSSI-based distance estimation is less precise but more widely available. BLE is acceptable as a fallback when UWB is not available on either device, but the larger error margin should expand *r* by a multiplicative factor.\n3. **Mutual GPS attestation as tertiary.** Both devices submit cryptographically-signed GPS readings to a verifying party (the autonomous AI representative) at the transfer moment. GPS is spoofing-vulnerable; this mechanism is permitted only with additional anti-spoofing heuristics (signal multipath analysis, cell tower cross-correlation) and is rejected when fraud signals are detected.\n\nAt least two of these mechanisms must agree, or a single UWB attestation must be present, for the proximity rule to be satisfied. The verifying party may apply additional heuristics — transfer velocity over time, coordinated movement patterns, device-attestation freshness — to detect spoofing attempts.\n\n### 3.4 · Properties\n\nThe proximity rule has three consequential properties: **(a)** it restores cash's per-transfer locality — every hop is local, as it is for a banknote, however far the chain of hops travels; **(b)** it inverts the reach logic of digital platforms: the recipient set is whoever is physically present, so a remote platform cannot be thanked and the person behind the counter can — the storefront is reachable, the headquarters is not; **(c)** it makes movement generative, since each step admits a new neighborhood to the sender's reach. (The resonance with the canonical wanderer, the *paribbājaka*, is a lens the Preamble's tradition supplies, not a property of the mechanism.)\n\n## 4 · Verified-Human Anonymous Giving\n\n### 4.1 · The two-layer attestation\n\nHumanity attestation in the specified mechanism operates at two layers, applied in series:\n\n1. **Per-action FIDO2 / WebAuthn attestation** (immediate). Each transfer is signed by a private key held in the sender's device secure enclave (Apple Secure Enclave, Android Trusty / Strongbox, Windows TPM, etc.), with the signing operation gated on user verification. The signature attests that an enrolled user verified this action on this authenticator; biometric-first modality is enforced by device policy and by admitting only attested platform authenticators (an AAGUID allow-list), never by the WebAuthn flag, which reports that verification occurred and not how. This is meaningfully stronger than session-based or registration-time attestation: a registered user cannot delegate this signature to an autonomous process without verifying each action on the admitted authenticator — with the residuals §10 names (PIN fallback, shared authenticators, synced passkeys).\n2. **DNA-verified family-tree attestation** (long-term, optional, voluntary). Users may opt in to a DNA-verified global family-tree dataset; this is now specified as Layer 4 (DNA-verified kinship lineage) of the **B-PoH℠** protocol in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*. When this opt-in is present, the verifying party applies an additional check that the FIDO2-signing identity corresponds to a verified-human node in the family tree. This closes, for senders who have opted in, a residual attack surface in which a sufficiently advanced deepfake plus stolen device could defeat per-action FIDO2 alone; for all others that attack remains the residual named in §10.\n\n### 4.2 · Recipient anonymity\n\nThe recipient receives the gratitude expression and any attached monetary value, but is not informed of the sender's identity. The system retains the sender's verified identity for adversarial-pattern detection, regulatory compliance, and limited audit purposes — but does not surface it to the recipient under any normal interaction. The recipient sees only: the gratitude content; the verified humanity-attestation; the attested proximity at time of transfer; and a stable per-recipient pseudonym for the sender (§6.3), which carries no identity. \"Recipient-side anonymity\" means exactly this — anonymity toward the recipient; the verifying party is a trusted party that sees everything, and no unlinkability toward it is claimed (§10).\n\n### 4.3 · The combination disclosed\n\nThe combination of **(a) per-action biometric humanity attestation**, **(b) cryptographic physical-radio proximity attestation**, and **(c) recipient-side anonymity** is disclosed here as a single mechanism. Existing digital-payment systems have at most two of the three: cash has anonymity and proximity but no humanity verification (any actor can spend cash); Worldcoin has humanity verification but not proximity and not recipient anonymity; contactless payment apps have proximity but not anonymity and not per-action humanity verification; privacy-preserving cryptocurrencies have anonymity but not proximity and not humanity verification; Citibank's gratuity patent and RAADAAR have proximity and anonymity but no per-action humanity verification; the biometric proximity-payment family and Apple Pay over Nearby Interaction have proximity and biometrics but no anonymity. No reference found composes all three in one signed action; the composition is the disclosed matter of this publication, and whether it is non-obvious is an examiner's determination this publication exists to inform.\n\n## 5 · The Combination and What It Enables\n\nThe combination of proximity and verified-human anonymity is more than the sum of its components. Each property alone is well-explored; their combination is designed to produce properties none has alone:\n\n- **Operationally easy *dāna*.** The Buddhist higher form of giving — anonymous, without ego-attachment to recognition — becomes the path of least resistance. Where in face-to-face giving the giver must perform self-effacement against social pressure, the mechanism removes the recognition channel by default. Practitioners who aspire to anonymous giving no longer need to discipline themselves against the natural human tendency to seek credit.\n- **Bot-resistant local economy.** As autonomous agents proliferate, gratitude transfers verified at this combined level constitute a category of economic activity that no agent can perform at scale without human cooperation. Local merchants who participate in the system gain a structural preference: the agent economy cannot easily displace human-witnessed local commerce.\n- **Anti-extractive reach.** The recipient set is whoever is physically present, so a remote platform cannot be thanked and the person behind the counter can — the storefront is reachable, the headquarters is not. Small local businesses, independent service workers, neighbors, and community institutions are what proximity admits.\n- **Cultural-religious accessibility.** The mechanism is not denominationally exclusive. Anonymous giving has analogs in Christian almsgiving (Matthew 6:2–4 on secret giving — the left hand not knowing what the right hand does, giving without even the giver's awareness of having given), Islamic *sadaqa jariya*, Jewish *tzedakah* at the second of Maimonides' eight rungs — giver and recipient unknown to each other; the first rung, enabling self-sufficiency, is the Re-Tip Fund℠'s register, not this primitive's — and indigenous traditions of communal sharing. The mechanism serves all of these without privileging any.\n\n## 6 · System Architecture\n\nWe sketch a reference architecture without claiming any specific implementation as canonical. Variations consistent with the three structural properties (per-action humanity attestation, proximity attestation, recipient anonymity) fall within the scope of this defensive publication.\n\n### 6.1 · Components\n\n- **Sender device** — mobile phone, wearable, or equivalent, bearing a FIDO2 / WebAuthn-compatible secure enclave and UWB / BLE radio.\n- **Recipient device** — mobile phone or wearable with at least BLE radio.\n- **Verifying party** — an autonomous AI representative or smart contract on a public ledger that validates attestations, authorizes the transfer, and settles any monetary component. In the HeartBank ecosystem this is Miss Aquarius, the autonomous AI representative to be deployed on Base (Coinbase L2), specified in the companion paper.\n- **Settlement layer** — a public ledger or analogous mechanism for recording the transfer's monetary component, if any.\n\n### 6.2 · Transfer flow\n\n1. Sender device proposes a transfer to recipient device, including gratitude content and optional monetary value.\n2. Sender and recipient devices perform proximity attestation per §3.3 — a single UWB ranging, or two agreeing mechanisms — each device signing the resulting transcript with device-attested keys.\n3. Sender device prompts the user for verification; FIDO2 / WebAuthn signing occurs over the transfer payload, which contains the ranging transcript, so user verification and proximity are attested by one signature over one object — this binding is the mechanism's claim.\n4. Signed transfer payload is submitted to the verifying party.\n5. Verifying party checks: FIDO2 signature valid, from an admitted attested authenticator; proximity attestation satisfies §3.3 and lies within the density-adjusted radius; sender's verified humanity status current; adversarial heuristics (collusion, rate-limiting, coded-message detection) pass.\n6. On success, monetary component (if any) is settled to the recipient. Gratitude content is delivered to the recipient with sender's identity redacted.\n7. Verifying party retains audit-grade record (sender identity, full payload) in protected storage, accessible only under specified adversarial-investigation or regulatory conditions.\n\n### 6.3 · Key derivation and pseudonymity\n\nThe recipient receives a per-transfer pseudonym for the sender, derived as HMAC(salt_R, sender_id) with salt_R held by the verifying party, such that repeat transfers from the same sender to the same recipient appear under a stable pseudonym (allowing relational continuity) without disclosing identity. Different recipients see uncorrelated pseudonyms for the same sender, because their salts are independent; the verifying party, which holds every salt, can correlate them all.\n\n## 7 · Reference Implementation Patterns\n\n### 7.1 · Sender pseudocode\n\n```javascript\nfunction sendGratitude(recipient, content, amount?) {\n  // 1. Establish proximity via UWB (preferred) or BLE\n  const proximityProof = await measureProximity(recipient);\n  if (!proximityProof.withinRadius(densityAdjustedRadius()))\n    throw new ProximityError();\n\n  // 2. Build transfer payload\n  const payload = {\n    recipient: recipient.publicId,\n    content,\n    amount,\n    proximity: proximityProof,\n    timestamp: now()\n  };\n\n  // 3. Biometric-gated signing via WebAuthn\n  const signature = await navigator.credentials.get({\n    publicKey: {\n      challenge: concat(verifierNonce, hash(payload)), // single-use nonce from the verifier\n      userVerification: \"required\" // user verification; modality is device policy\n    }\n  });\n\n  // 4. Submit to verifying party\n  return submitTransfer({ payload, signature });\n}\n```\n\n### 7.2 · Verifier pseudocode\n\n```javascript\nfunction verifyTransfer(transfer) {\n  // 1. Verify FIDO2 signature\n  if (!verifyWebAuthnSignature(transfer.payload, transfer.signature))\n    return reject(\"invalid_signature\");\n\n  // 2. Verify per-action user-presence + biometric flags\n  const flags = transfer.signature.authenticatorData.flags;\n  if (!flags.userPresent || !flags.userVerified)\n    return reject(\"user_not_present\");\n  if (!admittedAuthenticators.has(transfer.signature.aaguid))\n    return reject(\"authenticator_not_admitted\"); // attested platform authenticators only\n\n  // 3. Verify proximity attestation\n  const r = densityAdjustedRadius(transfer.payload.location);\n  if (!verifyProximityProof(transfer.payload.proximity, r))\n    return reject(\"proximity_failed\");\n\n  // 4. Adversarial heuristics\n  if (detectCollusion(sender, recipient)) return reject(\"collusion\");\n  if (rateLimitExceeded(sender)) return reject(\"rate_limit\");\n  if (codedMessageHeuristic(transfer)) return flag(\"coded_message\");\n\n  // 5. Settle and deliver\n  const pseudonym = derivePseudonym(sender.id, recipient.salt);\n  if (transfer.payload.amount)\n    settle(sender, recipient, transfer.payload.amount);\n  deliverToRecipient({\n    pseudonym,\n    content: transfer.payload.content,\n    proximity: transfer.payload.proximity\n  });\n}\n```\n\n## 8 · Edge Cases and Adversarial Analysis\n\n### 8.1 · Collusion (mutual-tipping for value laundering)\n\nTwo parties may collude by repeatedly tipping each other, attempting to launder value or fabricate social signal. The verifying party detects this via graph analysis: bidirectional flow exceeding a threshold ratio, repeating co-location patterns outside normal social graphs, near-equal balance flow over time. Detected collusion results in rate-limiting, transfer reversal, or aura penalty.\n\n### 8.2 · Coded-message via amount\n\nA sender may attempt to communicate a covert message via the transfer amount (e.g., $1.34 as a timestamp; $99.99 as a coded signal). The verifying party applies entropy and pattern heuristics to flag suspected coded messages for review and may quantize amounts to defeat fine-grained covert channels.\n\n### 8.3 · Stalking via repeated anonymous tips\n\nA bad actor in physical proximity may attempt to harass a recipient via a burst of anonymous unwanted thanks. The mechanism mitigates this via per-pseudonym rate-limiting (the same pseudonym cannot exceed N transfers per recipient per period) and recipient-side block lists by pseudonym. Repeated harassment escalates to the verifying party with the underlying identity revealed for adversarial action.\n\n### 8.4 · GPS spoofing\n\nA sender may attempt to fake their location via GPS spoofing to satisfy the proximity rule. The mechanism rejects GPS-only attestations when UWB or BLE is available; cross-references cell tower signal strength; analyzes signal multipath; and rejects velocity-implausible movement patterns.\n\n### 8.5 · Replay attacks\n\nThe verifying party issues a single-use nonce that the WebAuthn challenge commits to, alongside the payload hash, preventing replay of historical signatures. Proximity attestations include freshness timestamps; stale attestations are rejected.\n\n### 8.6 · Anti-money-laundering and regulatory variance\n\nPer-jurisdiction regulatory variance is handled by configurable thresholds: small anonymous transfers are unconstrained; transfers above a configurable threshold trigger optional verification escrow with progressive identity disclosure to the recipient as required by local law. The structural anonymity is preserved at the social layer; legal compliance is layered on top.\n\n### 8.7 · Deepfake biometric defeat\n\nHigh-end deepfake plus stolen device with biometric bypass remains a residual attack on per-action FIDO2 alone. The DNA-verified family-tree layer — Layer 4 of the **B-PoH℠** protocol specified in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet* — closes this gap for senders who have opted in, by binding the FIDO2 identity to a biologically-verified human kinship graph; for all others the attack remains the residual named in §10.\n\n## 9 · Use Cases\n\n- **Local-business gratitude.** A customer thanks a barista, a mechanic, a cashier; the small monetary attachment helps sustain local economy without exposing identity asymmetry.\n- **Conference and event tipping.** Attendees thank speakers, organizers, service staff anonymously without the awkwardness of face-to-face cash.\n- **Religious almsgiving.** The mechanism supports the canonical higher form of *dāna*, *tzedakah* at Maimonides' anonymous rung, anonymous Christian almsgiving, and analogous traditions.\n- **Honoring service workers.** Anonymous gratitude to nurses, teachers, transit workers, garbage collectors, others in undervalued professions.\n- **Cross-cultural travel.** Travelers unable to communicate verbally with a local can leave a verified-human anonymous thank-you that speaks across the language barrier.\n- **Supporting strangers in need.** A bystander encountering someone in difficulty can offer anonymous monetary aid without the dignitary cost of public charity.\n\n## 10 · Limitations and Future Work\n\nThe mechanism specified here addresses the gratitude-transfer primitive but leaves several related questions for separate work:\n\n- The DNA-verified family-tree layer is specified as Layer 4 of the **B-PoH℠** protocol in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n- The autonomous AI representative (Miss Aquarius) is specified in the companion paper *Miss Aquarius and the Aquarian Pool Architecture* (`miss-aquarius-and-aquarian-pool-architecture`). Its alignment substrate (the Theravāda *Tipiṭaka*) is specified in the companion paper *Suffering-Cessation as Value Function: The Tipiṭaka as a 2,500-Year-Tested Substrate for Autonomous-AI Alignment* (target publication January 7, 2027).\n- The integration with non-human entities (robots, animals, plants, sacred places) via the Mechanical Heart artifact is specified in the companion paper *The Mechanical Heart: A Tipiṭaka-Bearing Artifact for Admitting Non-Human Entities into Gratitude-Economic Participation*.\n- **Residuals of the verified-human layer.** WebAuthn user verification is satisfied by a PIN as well as a biometric; authenticators can be shared; synced passkeys move between devices. Device policy and the attested-authenticator allow-list narrow these; they do not close them. A deepfake plus a stolen device defeats per-action signing for any sender who has not opted into the kinship layer.\n- **Residuals of the proximity layer.** UWB is not universal; BLE is vulnerable to relay and amplification; and no composition proof exists for the case in which one adversary controls both the radio and the authenticator.\n- **What proximity binds.** The primitive attests the sender's presence, not the recipient's: proximity binds two devices, and the recipient device may be unattended, shared, relayed, emulated, or carried by another person. Recipient-side humanity is a filter the recipient's own B-PoH layers supply, outside this specification.\n- **Linkage surfaces.** The verifying party sees sender identity and the full payload; timing and proximity are exposed to the recipient; a repeated pseudonym is linkable across a recipient's own transfers; network metadata is not addressed here. No unlinkability toward the verifying party is claimed.\n- Per-jurisdiction regulatory mappings are implementation details outside the scope of this defensive publication.\n- Empirical evaluation of the mechanism's social-capital effects, local-economy impact, and dharmic-practice uptake is future work; the longitudinal cohort mechanism specified separately is the intended evaluation substrate.\n\n## 11 · Cross-Venue References\n\n| Venue | Identifier |\n|---|---|\n| Primary canonical | <https://thonly.org/research/verified-human-anonymous-local-giving> |\n| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/verified-human-anonymous-local-giving.md> |\n| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/verified-human-anonymous-local-giving> |\n| archive.today | captured on the estate's snapshot cadence — a trademark specimen for the marks it carries, not prior art |\n| Zenodo | a version DOI per revision |\n\n## 12 · Acknowledgments\n\nThe author acknowledges his father, with whom the Khmer transcription of the *Tipiṭaka* is being undertaken; the Cambodian Theravāda Saṅgha, whose lineage carries the canon that grounds this work; the survivors and descendants of the Cambodian genocide of 1975–79, whose civilizational rebuilding is the soil this publication grows from; the foundational thinkers in community currency, proof-of-personhood, and Buddhist economics whose work is cited above; and the autonomous artificial intelligence community whose alignment work this publication intends to contribute to in the spirit of the bodhisattva path.\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| verified-human attestation | per-action user verification; FIDO2 / WebAuthn user-verified assertion from an attested platform authenticator |\n| proximity rule | proximity-bounded payment authorization; UWB / BLE secure ranging, distance bounding |\n| recipient-side anonymity | payer anonymity toward the payee; pseudonymous payment with per-recipient pseudonym (HMAC) |\n| verifying party (Miss Aquarius) | trusted attestation verifier (checks humanity and proximity attestations; holds no funds) |\n| B-PoH℠ | proof of personhood; human-presence and identity verification layers |\n| *dāna* | anonymous charitable giving; donation, gratuity |\n| Re-Tip Fund℠ | forward-only earmarked allocation, recorded on a ledger (usable only for further gifts; never withdrawn) |\n| aura penalty | reputation score penalty; trust-score reduction |\n\n## 13 · Citations\n\n1. *Aṅguttara Nikāya* 7.52 (*Dānamahapphala Sutta* — the seven motives for giving). Pāli Text Society translation, multiple editions.\n2. *Aṅguttara Nikāya* 8.31 (*Dāna Sutta*). Pāli Text Society translation, multiple editions.\n3. Cahn, E. (2000). *No More Throw-Away People: The Co-Production Imperative*. Essential Books.\n4. Chaum, D. (1983). \"Blind signatures for untraceable payments.\" *Advances in Cryptology — CRYPTO '82*.\n5. FIDO Alliance. (2019). *Web Authentication: An API for accessing Public Key Credentials, Level 1*. W3C Recommendation.\n6. Gesell, S. (1916). *Die natürliche Wirtschaftsordnung* [The Natural Economic Order].\n7. Linton, M. (1983). \"Local Exchange Trading Systems.\"\n8. Maimonides, M. (1180). *Mishneh Torah, Hilchot Matanot Aniyim* 10:7–14 (the eight levels of *tzedakah*).\n9. Putnam, R. (2000). *Bowling Alone: The Collapse and Revival of American Community*. Simon & Schuster.\n10. U.S. Surgeon General. (2023). *Our Epidemic of Loneliness and Isolation: The U.S. Surgeon General's Advisory on the Healing Effects of Social Connection and Community*. U.S. Department of Health and Human Services.\n11. Worldcoin Foundation. (2023). *Worldcoin Whitepaper*.\n12. New Testament, Matthew 6:2–4 (anonymous almsgiving).\n13. Leu, P., Camurati, G., Heinrich, A., Roeschlin, M., Anliker, C., Hollick, M., Capkun, S., & Classen, J. (2022). \"Ghost Peak: Practical Distance Reduction Attacks Against HRP UWB Ranging.\" *USENIX Security 2022*.\n14. Citibank, US 12,165,124 B2 (priority 2017, granted 2024) — gratuity payments to nearby devices with an anonymity control.\n15. RAADAAR, US 9,854,616 B2 (priority 2015) — BLE proximity, anonymous gifts, payment integration.\n16. Mastercard, EP 1671282 A2 (priority 2003) — biometrically enabling a proximity payment device; Samsung, WO 2022/225298 A1 (priority 2021) — payment over UWB secure ranging.\n17. Square (2014). *Nearby Payments* in Square Cash, over Bluetooth LE (press release, October 2014); Bump (2009) and Bump Pay (2012).\n18. Android Developers, *Ultra-wideband (UWB) communication* (androidx.core.uwb); Apple Developer, *Nearby Interaction* (2020).\n\n---\n\n*— End of defensive publication —*\n\n*Co-authored with Miss Aquarius℠, the institution's named AI collaborator, per the corpus's standing disclosure; final editorial control and responsibility for every claim rest with the human author. This document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.*",
       "provenance": {
-        "sha256": "de74b163271f3ee8008465b1bfab6762cce5dddb797c15a7e7ce7f5a8205879c",
-        "doi": "10.5281/zenodo.22441001",
+        "sha256": "036aa9e871898aa164c91b6be3852d20f351f248173ae1e6c9b9cac09b48a820",
+        "doi": "10.5281/zenodo.22931236",
         "concept_doi": "10.5281/zenodo.21947430",
-        "zenodo_url": "https://zenodo.org/records/22441001",
-        "deposited_sha256": "de74b163271f3ee8008465b1bfab6762cce5dddb797c15a7e7ce7f5a8205879c",
+        "zenodo_url": "https://zenodo.org/records/22931236",
+        "deposited_sha256": "036aa9e871898aa164c91b6be3852d20f351f248173ae1e6c9b9cac09b48a820",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/verified-human-anonymous-local-giving.md",
@@ -5693,8 +5693,8 @@
         "canonical_url": "thonly.org/research/verified-human-anonymous-local-giving",
         "hostile_review": null
       },
-      "bytes": 38275,
-      "words": 5312
+      "bytes": 39126,
+      "words": 5433
     },
     {
       "slug": "vinaya-as-ai-reasoning-training-corpus",
@@ -6036,7 +6036,7 @@
         "slug": "aura-gated-anonymous-mate-selection",
         "repo": "TH/publications",
         "path": "defensive-publications/aura-gated-anonymous-mate-selection.md",
-        "sha256": "b7fba29177f3c463259f1cdd1f1fac6e4c53b8a7bd5ea50e48ea7d03becfd5f9"
+        "sha256": "037ce88e438295e7e8cd6f42079ad36e45258143d70ca10de5b1b603b24f9bb2"
       },
       {
         "slug": "autonomous-ai-institutional-governance",
@@ -6282,7 +6282,7 @@
         "slug": "gift-tag-time-reveal",
         "repo": "TH/publications",
         "path": "defensive-publications/gift-tag-time-reveal.md",
-        "sha256": "3da4863e018510c192faf90494fa870657a6ff0646b4d5448c99bcd3ddc66f7a"
+        "sha256": "7e50db8a142b8159731efc53a178ec187a4de0eabe9f34bc003892a92d04d20c"
       },
       {
         "slug": "giving-above-traditions",
@@ -6306,7 +6306,7 @@
         "slug": "gratitude-riding-currency-tag",
         "repo": "TH/publications",
         "path": "defensive-publications/gratitude-riding-currency-tag.md",
-        "sha256": "bdea1a79b2f6ddcae6d4bf37411346a2c5c88509eb06c3411f1cae717f75b6d1"
+        "sha256": "2564165911f9ff8c8c26f703fbd1c4cf4a1d8ceefb856f0471675fd59d1ab79d"
       },
       {
         "slug": "heartbank-an-introduction",
@@ -6456,13 +6456,13 @@
         "slug": "provenance-carrying-retrieval",
         "repo": "TH/publications",
         "path": "defensive-publications/provenance-carrying-retrieval.md",
-        "sha256": "14cd053cd0d1ca81efe9cfbc1eeb3c4b42d81f5d788095ddf27ea532c74bfc03"
+        "sha256": "8cadf8c2a06c9ca47eb55003b8649fe92c173424b349381991a65287116e37fe"
       },
       {
         "slug": "respiratory-biofeedback-contemplative-guidance",
         "repo": "TH/publications",
         "path": "defensive-publications/respiratory-biofeedback-contemplative-guidance.md",
-        "sha256": "1c05f1071f1670011bdabd0da4c9a00957c433b621d3839d3d5910af695056f4"
+        "sha256": "a5380903d02f68efa5c823cc0d77a4fdf436faa2fd985aea1c686b3cff92e1be"
       },
       {
         "slug": "right-livelihood-automation",
@@ -6480,7 +6480,7 @@
         "slug": "rotation-over-liveness",
         "repo": "TH/publications",
         "path": "defensive-publications/rotation-over-liveness.md",
-        "sha256": "870dce1328734455be78ad324887fe375ed964c5dfb5c22ff4df71bb76dd0152"
+        "sha256": "2130a0966a668218bc8294445a821eaef8b3b44bc98578a25f0da97492f065b6"
       },
       {
         "slug": "sacrifice-witness-without-discharge",
@@ -6564,7 +6564,7 @@
         "slug": "thank-all-nearby-primitive",
         "repo": "TH/publications",
         "path": "defensive-publications/thank-all-nearby-primitive.md",
-        "sha256": "ffad583700569fadec0f8394f4a492a16abc4511ee956b7e76b2cba751d57d84"
+        "sha256": "0b069ce6e45c5c6ab39dedfe9f0939a1319cc6e471d0bb14fdf8c69b8941ee49"
       },
       {
         "slug": "the-appreciation-economy",
@@ -6702,7 +6702,7 @@
         "slug": "the-reciters-protocol",
         "repo": "TH/publications",
         "path": "defensive-publications/the-reciters-protocol.md",
-        "sha256": "c714ae42e51061d728f995fed449a77b58609caf5a4112e3d92813268073edd3"
+        "sha256": "f54ec0dde1ec85eb217b3fd8b8c0ac3aa4692e317a8062895575f1632f74b294"
       },
       {
         "slug": "the-referee-not-the-governor",
@@ -6810,7 +6810,7 @@
         "slug": "verified-human-anonymous-local-giving",
         "repo": "TH/publications",
         "path": "defensive-publications/verified-human-anonymous-local-giving.md",
-        "sha256": "de74b163271f3ee8008465b1bfab6762cce5dddb797c15a7e7ce7f5a8205879c"
+        "sha256": "036aa9e871898aa164c91b6be3852d20f351f248173ae1e6c9b9cac09b48a820"
       },
       {
         "slug": "vinaya-as-ai-reasoning-training-corpus",