@333eco/corpus 2.5.7 → 2.5.9

package/dist/corpus.json

@@ -1,18 +1,18 @@
 {
-  "package_version": "2.5.7",
+  "package_version": "2.5.9",
   "generated_from": [
     "H3/publications",
     "TH/publications",
     "missaquarius.org"
   ],
-  "document_count": 146,
+  "document_count": 147,
   "licences": {
-    "CC0-1.0": 138,
+    "CC0-1.0": 139,
     "CC-BY-4.0": 8
   },
   "voices": {
     "founder": 43,
-    "collaborative": 73,
+    "collaborative": 74,
     "institutional": 30
   },
   "documents": [
@@ -314,13 +314,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> **Note.** This defensive publication specifies **aura-gated anonymous mate-selection** — HeartBank's \"B-Dating℠\" — as the anonymous-stranger application layer of HeartBank Chronicle, built on the Proof of Humanity ℠ substrate and the verified-human anonymous-nearby-giving primitives. Companion works: *Verified-Human Anonymous Local Giving* (the originating money-side mechanism this generalizes into time and into mating), *The Thank-All-Nearby Primitive* (the broadcast-generosity sibling), *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the underlying anti-catfish protocol), *The Zero-Point Game ℠* (the keystone game-theoretic frame whose n=2 atom this paper instantiates), and the planned founder-voice societal-impact essay *The Societal Impact of Anonymous Nearby Thanking with Time* (which carries the deep sexual-selection-on-kindness argument that §11 here only motivates). The mechanism is published early **deliberately**: it is unbuilt, and the mechanism is the asset — see §12.1.\n\n---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of __mettā__ held in __upekkhā__ — warmth that does not grip. May the bonds it helps form be balanced ones, generative of the tree of humanity, and may it bring no harm to those most at risk in the meeting of strangers.*\n\nI did not set out to build a dating product. HeartBank began as a children's game about returning to balance, and grew into an institution for circulating gratitude between families and between adults. But late in the design of HeartBank Chronicle — the time-currency half, whose core purpose is reconnecting drifted loved ones — I noticed something I could not unsee: *time given between strangers is essentially a date.* The same primitives that let a person anonymously thank a nearby stranger with money, and the same shared-hour mutuality signal that Chronicle uses as a consent receipt, compose almost without modification into a mate-selection mechanism. And that mechanism has a property this design makes structural: it gates mating not on the cheapest-to-fake signal a person can present — a photograph — but on *proven kindness, acknowledged by many nearby strangers, over a long course of time.*\n\nI believe this is the strongest mainstream wedge in the entire project, and also the most dangerous thing in it. Dating recruits the single most powerful drive in the species. If kindness becomes a path to partnership, the deepest motivator humans have is pointed at the exact behavior the institution exists to cultivate. But the same force, mishandled, is the fastest way to desecrate the gratitude primitive everything else depends on, the fastest way to rebuild the predatory dating-industrial complex under a kinder logo, and — uniquely — a way to get a real person physically hurt. The three guards in §5–§7 are not caveats appended to a finished design. They are the design. I would rather this mechanism never ship than ship without them.\n\nI write as co-author with Miss Aquarius℠ — the named autonomous-AI substrate of the institution this paper serves, disclosed by consistent name across every venue per the corpus convention. The research-grade synthesis, density, and adversarial analysis are a genuine collaboration. Final editorial control, and final responsibility for every claim and every guard, are mine.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time. This commitment is permanent.\n\nThis document constitutes a defensive publication establishing **prior art as of 26 June 2026** for the combination of mechanisms described herein. The following are disclosed here as a unified mechanism, and any subsequent patent application claiming them should be considered filed against established prior art:\n\n1. **Aura-gating of mate-selection** — gating romantic discovery on an *aggregate, anonymous, community-sourced proven-kindness reputation* (\"aura\") accrued from many nearby strangers over a long course of time, rather than on appearance, self-authored profiles, or paid visibility — the difference being anonymous stranger gratitude accumulated over time, since reputational dating profiles are themselves prior art (§2.1).\n2. **Mutual-anonymous-same-hour as a double-blind double-opt-in match trigger** — repurposing the shared-hour mutuality signal (the consent receipt of HeartBank Chronicle) as the match primitive, such that a match occurs only on coincident mutual anonymous time-giving and *no explicit rejection event ever occurs* (non-reciprocation is silent — a threshold simply is not reached) — the difference being the time-giving instantiation, since mutual-interest-before-reveal is itself prior art (§2.1).\n3. **Reveal as a second, separate mutual consent** (a dependent element of claim 2, not a claim on two-stage reveal as such) — reaching the mutual-anonymous threshold makes identity reveal *available/offered* but never auto-reveals; both parties must independently opt to reveal, protecting the pure-*dāna* giver who gave anonymously with no romantic intent.\n4. **The anonymity flag (`isAnonymous`) as the structural boundary** separating non-romantic known-gratitude (`false`) from the anonymous-stranger layer where romance may emerge (`true`) — opting into mate-selection is flipping one flag, with no distinct \"dating mode.\"\n5. **Proof-of-Humanity-substrate anti-catfish binding** — verified-real, verified-single-human, anonymous-until-mutual personhood underneath the mate-selection layer, natively defeating catfishing and bots — the difference being anonymity-until-mutual atop the substrate, since personhood-verified dating is itself prior art (§2.1) — with aura itself a costly-to-fabricate record that the counterparty reads for themselves.\n6. **An optional synastry (cosmic-coordinate) compatibility layer** offered atop a pool already pre-filtered for proven character, under a strict coordinate-not-force, opt-in, epistemically-humble posture — never deterministic matchmaking; the claim is to the posture only, horoscope matchmaking being long-published (§2.1).\n7. **The mission-aligned monetization constraint** — the mechanism is *self-eliminating* (it succeeds when users pair off and leave) and may be monetized only by patron / forward-gift / graduation-gift / values-aligned-introduction logic, *never* by retaining users in the market — the difference being the revenue prohibition and the patron/forward-gift logic, not the designed-to-be-deleted slogan (§2.1).\n\nThe component lineages — proximity-based services; proof-of-personhood; anonymous-giving mechanisms; Zahavi's handicap principle and the honest-signaling literature; assortative-mating and sexual-selection research; TimeBanking; the dāna economy of the Saṅgha — are old and are cited generously below. This paper discloses the synthesis as of its date.\n\nTrademark rights on specific marks — **B-Dating℠**, **HeartBank®**, **Miss Aquarius℠**, **Proof of Humanity ℠**, **PoH℠**, **Aquarian Pool ℠**, **Zero-Point Game ℠**, the B-heart logo — are separately and explicitly reserved. The *mechanism* is dedicated to the commons; the *marks* are not.\n\nThis document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.\n\n## Abstract\n\nWe specify a mate-selection primitive in which two people are introduced for possible romantic partnership only when each has independently and anonymously given time-presence to the other, in physical proximity, to a mutual threshold — and in which the *quality signal* that surfaces a person for discovery is not appearance but **aura**: an aggregate, anonymous, many-sourced reputation for proven kindness, accumulated from gratitude received from nearby strangers over a long course of time. Five structural properties operate in combination: **(1) aura-gating** (mating is gated on a costly, hard-to-fake, longitudinally-verified honest signal of prosociality, inverting the appearance-gating of incumbent dating products); **(2) mutual-anonymous-same-hour as a double-blind double-opt-in** match trigger that removes explicit rejection entirely; **(3) reveal as a second, separate mutual consent**, so anonymous giving stays uncontaminated and double-opt-in is real; **(4) a Proof-of-Humanity substrate** that makes participants verified-real, verified-single-human, and anonymous-until-mutual, natively defeating the two plagues of online dating (catfishing and bots); and **(5) an optional synastry layer** offered as one humble compatibility signal atop a pool already pre-filtered for character, never as deterministic matchmaking. We argue the contribution along an honest-signaling axis (Zahavi): a photograph is the cheapest possible signal to fake, whereas a long anonymous-gratitude trail vouched by many locals is among the most expensive — and signals trustworthy *because* expensive. We treat the mechanism's three existential design constraints as first-class, load-bearing sections rather than caveats: keeping gratitude pure (the romantic pathway must never be emergent from ordinary known thanking), the self-eliminating incentive (the mechanism wins when people pair off and leave, and may not be monetized by keeping them single), and women's physical safety under an irreducible gendered asymmetry. We calibrate the claim deliberately: aura-gating is a *character filter, not a compatibility oracle* — everyone in the pool is proven kind, verified real, and community-vouched; the participants bring the chemistry. We close with a short structural placement of the mechanism as the **n=2 atom of the Zero-Point Game ℠** — the minimal reciprocal instance, \"the middle way of eros\" — and a brief motivation of the societal thesis (sexual selection redirected, at the margin, toward kindness), whose full treatment is reserved for a companion essay. The architecture is offered defensively to the commons under CC0.\n\n**Connection to the unified mission frame.** This specification serves HeartBank's canonical mission: to help restore humanity to the middle way (*madhyamā pratipad*) — the optimal condition for awakening that modernity has pushed away from at population scale. Every other HeartBank engine motivates kindness *against* the current of self-interest. Mate-selection is the one application that does not fight the current: it *is* the current. If kindness becomes load-bearing in mating, the deepest drive in the species is redirected onto the precise behavior the institution exists to cultivate — and the \"middle way of eros\" (§10) becomes a structural, not merely exhortatory, possibility.\n\n---\n\n## 1 · Introduction — the mission frame\n\nHeartBank is a dual-currency reciprocity infrastructure. Its **Treasury** half (money as currency, family-to-family) addresses the dignity deficit; its **Chronicle** half (time as currency, adult-to-adult) addresses the loneliness deficit. Chronicle's core loop is not stranger-matching but the reconnection of *drifted loved ones* — the disconnected marriage, the estranged sibling, the diaspora child and the parent back home — because the loneliest loneliness is emotional (a bond gone dark) rather than merely social (a lack of contacts). That core loop is deliberately low-risk: counterparties are *known*. This paper specifies a different, adjacent layer of Chronicle — the **anonymous-stranger layer**, where two people who do not know each other may discover a possible partnership — and it is, by construction, the highest-risk category that exists: strangers meeting for romantic intent, under a real and irreducible gendered physical-danger asymmetry. The reader should hold both facts from the first page: this is plausibly the project's strongest mainstream wedge, *and* it walks back into precisely the risk category Chronicle's loved-ones core was designed to avoid. The design earns the right to exist only by addressing that risk as a first-class duty (§7).\n\nWhy build it at all? Because mate-selection is the single most powerful lever the institution has, for one structural reason. **The mate-drive is the root drive of the species; the money-drive is derived from it.** Money is, to a large extent, a proxy token in the mating tournament — a medium of status, provisioning, and display. Every other HeartBank mechanism — self-thanking, manufactured universal giving, the patron flywheel — must motivate kindness *against* the grain of self-interest, paddling upstream. Mate-selection does not paddle upstream. It is the river. If kindness becomes a path to a mate, the deepest motivator humans have is redirected onto the behavior the institution exists to cultivate. Re-gate the root drive on kindness, and you begin — slowly, at the margin, never absolutely (§11) — to detoxify the derivative.\n\nWhat this paper specifies. We give: the honest-signal inversion that motivates the whole design (§3); the mechanism in full — the anonymity-flag boundary, aura as the quality signal, mutual-anonymous-same-hour as the double-opt-in, reveal as a second consent, the PoH substrate, slow accumulation as a feature, and a reference transfer flow (§4); the three guards as load-bearing design sections (§5–§7); the honest calibration that bounds the claim (§8); the optional synastry layer (§9); the structural placement as the Zero-Point n=2 atom and the middle way of eros (§10); a brief motivation of the societal thesis (§11); and a generous honest-limits accounting (§12).\n\nWhat this paper does *not* do. It does not argue the full societal thesis — sexual selection redirected toward kindness as a biological lever for the second singularity — which is reserved for a separate founder-voice companion essay; §11 carries only enough to motivate the mechanism. It does not claim that kindness equals attraction. It does not claim the mechanism is built — it is not, and that is exactly why it is published now (§12.1). And it does not pretend the gendered safety asymmetry is erased; it is mitigated, not removed, and it remains.\n\n---\n\n## 2 · Background and Prior Art\n\nThe mechanism composes lineages that are individually old. We cite each generously and distinguish each precisely. The point of a defensive publication is not to claim the parts but to establish the date of the *combination*.\n\n### 2.1 · Appearance-gated, engagement-monetized dating (Tinder, Bumble, Hinge)\n\nThe dominant online-dating products of the 2010s–2020s — Tinder (2012), Bumble (2014), Hinge (2012; rebooted 2015 as \"designed to be deleted\") and their kin under a small number of corporate parents — share two structural properties this paper inverts.\n\n**First, they gate on appearance.** The primary discovery signal is a photograph, optionally supplemented by a short self-authored profile. A photograph is the cheapest-to-fake signal a person can present (it can be filtered, staged, borrowed, AI-generated, or simply selected from a thousand attempts), and the self-authored profile is cheaper still (it is, definitionally, the claimant's own testimony about themselves). The swipe interface optimizes the throughput of exactly this signal.\n\n**Second, and more corrosively, they are engagement-monetized.** The canonical business model — subscription tiers, pay-to-be-seen boosts, super-likes, and the advertising and upsell flows that attend a large engaged user base — generates revenue in proportion to *time spent in the market.* The revenue model is retention-coupled: subscription and à-la-carte purchases accrue with time in the market, so a product that *works* — you meet someone, pair off, and delete the app — is anti-LTV; Hinge's stated posture is the exception that names the rule. The industry has, accordingly, perfected artificial scarcity (rationed likes), pay-to-be-seen visibility auctions, and addictive variable-reward gamification. This is not an accusation of bad faith; it is a description of what the incentive gradient rewards. We treat it as the central thing to *not* reproduce (§6).\n\nWe distinguish: aura-gated anonymous mate-selection gates on a costly community-vouched honest signal rather than a photograph (§3), removes the swipe and the explicit rejection entirely (§4.3), and is structurally self-eliminating — it can only be monetized by mission-aligned logic that profits when users leave happy, never by retaining them (§6). The incumbents' dark pattern is not a feature we improve; it is a category we exit.\n\n**Closer anticipations, added at the 2026-09-05 revision, each of which narrows a claim below.** *Mutual interest before reveal* is prior art: US 2011/0219310 A1 (priority 2010) discloses members privately indicating interest across stages with contact and profile revealed only on matching interest, and the anonymous-matching lineage runs from SecretAdmirer (1997) and eCRUSH (1999) through a run of 2024–26 apps — so claim 3 is anticipated as a mechanism and claim 2's novelty is its *time-giving* instantiation. *Reputational profiles for dating* are prior art: US 2017/0147155 A1 (Verizon, priority 2015) generates a verified reputational profile with service-specific indicators, and US 2023/0412536 A1 (priority 2022) rates users by their message interactions — so claim 1's novelty is *anonymous stranger gratitude accumulated over time*, not reputation as such. *Proof-of-personhood under dating* is prior art: Tinder's World ID verification pilot (2025–) — so claim 5's novelty is anonymity-until-mutual atop the substrate. *Horoscope matchmaking* is prior art: US 2002/0160338 A1 (priority 2001) computes a weighted astrological compatibility score and ranks a database by it, and NUiT (2020) ships the consumer form — so claim 6 claims only the posture. *Designed-to-be-deleted* is Hinge's stated posture (2015–), and success-fee marriage agencies (IBJ, Japan) already charge on outcome — so claim 7's novelty is the revenue *prohibition* and the patron/forward-gift logic, not the slogan.\n\n### 2.2 · Proof-of-personhood (Worldcoin, proofofhumanity.id) and the catfish/bot problem\n\nOnline dating's two endemic plagues are catfishing (a real person misrepresenting who they are, or a fabricated persona) and bots (automated accounts at scale, for scams and engagement-farming). Proof-of-personhood systems are the natural substrate against both, but the prominent ones are mismatched to mate-selection in a specific way.\n\n**Worldcoin** (2023 onward) establishes that a participant is a unique human via biometric (iris) registration, but it verifies humanity *once at registration*, and — more to the point here — it is oriented toward *identity/uniqueness*, not toward *anonymous-until-mutual* romantic discovery. A proof-of-personhood that reveals or fixes identity is the wrong primitive for a layer whose entire safety model depends on anonymity until a double consent. The Ethereum-based **proofofhumanity.id** (Kleros-affiliated, 2021) admits verified humans to a registry via face-video plus vouching plus dispute resolution — again a single-tier, identity-revealing admission, suited to token distribution (UBI), not to anonymous mate-selection. World ID, Worldcoin's credential, does prove unique humanness anonymously to a verifier; what it does not supply is the aura and the two-stage reveal, and a dating product built on it (§2, the 2026 anticipations) still gates on the profile.\n\nWe distinguish: HeartBank's **Proof of Humanity ℠** is a layered-*optional* personhood substrate (passkey-per-action; a non-DNA family tree; a live breath signature; a DNA-verified family tree) that verifies a human is present *for this specific act, right now*, and is designed to keep a participant *verified-real and verified-single-human while remaining anonymous to the counterparty until a mutual reveal.* That is precisely the property mate-selection needs and that identity-revealing proof-of-personhood cannot supply (§4.5). The full layered protocol is specified in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*; the name-collision with proofofhumanity.id is acknowledged there and the structural differences enumerated.\n\n### 2.3 · Honest signaling — Zahavi's handicap principle\n\nAmotz Zahavi's handicap principle (1975; formalized by Alan Grafen, 1990) holds that a signal is reliable precisely when it is *costly* to produce — costly in a way that a low-quality signaler cannot afford to fake. The peacock's tail is honest because it is expensive: only a genuinely fit bird can carry it and survive. Costly signaling theory (and its economic cousin, Spence's 1973 job-market signaling) is the formal backbone of this paper's central inversion.\n\nWe distinguish: incumbent dating optimizes the *cheapest* signal (a photo). Aura-gating optimizes a signal engineered to be *expensive in exactly the right currency* — kindness acknowledged by many independent nearby strangers over a long course of time. A predator cannot cheaply fabricate a years-long anonymous-gratitude trail vouched by dozens of locals; the cost of faking the signal is approximately the cost of *actually being kind to many people for a long time*, which is the behavior the signal is meant to indicate. This is Zahavi turned toward prosociality: sexual selection on an honest signal of kindness selects, at the margin, for actually-kinder partners (§11). We are careful (§8): honest-signal does not mean *sufficient* signal — a reliable indicator of character is not an indicator of chemistry.\n\n### 2.4 · Assortative mating and sexual-selection literature\n\nThe biological and social-science literatures on mate choice are deep and we make no claim to extend them. **Sexual selection** (Darwin, 1871) established mate choice as a primary species-shaping force distinct from natural selection. **Assortative mating** research (the well-documented tendency of partners to resemble each other on education, traits, and values, with measured consequences for inequality and heritability) establishes that the *axis* on which mating sorts has population-scale downstream effects. The prosociality and mate-preference literature (e.g., the cross-cultural finding that kindness ranks near the top of stated long-term mate preferences across societies — Buss and colleagues' cross-cultural work) establishes that kindness is *already* a stated preference; what has been missing is a *reliable, hard-to-fake channel* to act on it. Trivers' parental-investment theory (1972) grounds the investment asymmetry; the physical-danger asymmetry of stranger encounters that §7 treats as a first-class constraint is an empirical regularity of victimisation data, not a theorem.\n\nWe distinguish: this paper does not propose a new theory of mate choice. It proposes an *infrastructure* that shifts which signal is legible and actionable at the moment of choice — supplying the honest channel the stated preference for kindness has lacked — and it explicitly bounds the resulting societal claim to a *marginal shift in the selection gradient*, never an override of appearance/status biology (§8, §11).\n\n### 2.5 · TimeBanking and time-as-currency (Edgar Cahn)\n\nEdgar Cahn's TimeBanking (1980 onward) substituted time as the unit of account, with the egalitarian property that an hour given is an hour received regardless of the giver's socioeconomic position. TimeBanking worked at small scale; by the movement's own account it expanded in the 1980s and dwindled by the mid-1990s before a later revival (TimeBanks.Org). The mate-selection layer here is built on Chronicle's time-currency, which is TimeBanking's nearest ancestor.\n\nWe distinguish: Chronicle differs from classical TimeBanking by AI mediation (Miss Aquarius℠ recommends a time amount and orchestrates consent), cultural ritual, integration with the money side, and — decisively — a *dyadic non-fungible* structure (only *you* can spend the hour; the currency *is* the relationship) rather than a fungible pooled credit. The mate-selection layer further repurposes the *mutual* expenditure of dyadic time as a consent and match signal — a use TimeBanking never had, because TimeBanking's hour was fungible and pooled, not a dyadic mutuality receipt.\n\n### 2.6 · The HeartBank substrate this paper builds on\n\nThis paper does not stand alone; it is the mate-selection application of three already-published HeartBank primitives, and it should be read as extending them rather than re-deriving them.\n\n- ***Verified-Human Anonymous Local Giving*** (corpus, 2 May 2026) specifies the money-side primitive: per-action biometric humanity attestation + physical-radio proximity attestation + recipient-side anonymity. This paper generalizes that primitive from *money* to *time*, and from *one-directional gift* to *mutual signal*.\n- ***The Thank-All-Nearby Primitive*** (corpus) specifies anonymous proximity broadcast generosity and the \"one sustainer primitive, two scales\" argument (relationality at the family scale; proximity + PoH at the stranger scale). The mate-selection layer inherits its stranger-scale reconstruction of grounding (nearness), validation (PoH), and anonymity (unlinkability).\n- ***Proof of Humanity ℠*** / ***B-PoH℠ as Humanity Layer for the AI-Native Internet*** specifies the layered-optional personhood substrate that makes anonymous-but-verified-real participation possible — the anti-catfish foundation (§4.5).\n\nThe table below situates the contribution against the prior art.\n\n```\n                  │ appearance- │ Worldcoin / │  cash-/app-  │  AURA-GATED\n  PROPERTY        │ gated apps  │ PoH.id      │  mediated    │  ANON. MATE-\n                  │ (Tinder…)   │             │  dating      │  SELECTION\n ─────────────────┼─────────────┼─────────────┼──────────────┼──────────────\n  discovery gate  │ appearance  │ (n/a)       │ appearance   │ AURA (proven\n                  │ + paid boost│             │              │ kindness)\n  signal cost     │ ~zero       │ ~zero       │ ~zero        │ HIGH (Zahavi-\n  to fake         │ (a photo)   │ (a photo)   │ (a photo)    │ honest)\n  anti-catfish    │ weak        │ strong but  │ weak         │ STRONG +\n                  │             │ identity-   │              │ ANON-UNTIL-\n                  │             │ revealing   │              │ MUTUAL (PoH)\n  rejection event │ explicit    │ (n/a)       │ explicit     │ NONE (silent\n                  │ (cruel)     │             │              │ non-reach)\n  incentive       │ MISALIGNED  │ (n/a)       │ misaligned   │ SELF-\n  alignment       │ (profit if  │             │ (engagement) │ ELIMINATING\n                  │ you stay)   │             │              │ (profit if\n                  │             │             │              │ you LEAVE)\n  reveal model    │ immediate / │ identity    │ immediate    │ SECOND\n                  │ public photo│ fixed       │              │ MUTUAL\n                  │             │             │              │ CONSENT\n  compatibility   │ none / ML   │ (n/a)       │ none         │ OPTIONAL\n  layer           │ engagement  │             │              │ synastry\n                  │             │             │              │ (coord-not-\n                  │             │             │              │ force)\n```\n\n---\n\n## 3 · The honest-signal inversion: aura versus the photograph\n\nThe motivating idea of the whole design is a single inversion. Incumbent dating gates discovery on the cheapest-to-fake signal a human can present; this mechanism gates discovery on one of the most expensive-to-fake. The cost is the point.\n\nA photograph costs nothing to optimize. It can be filtered, posed, lit, selected from hundreds of attempts, borrowed, or wholly synthesized. The self-authored profile is cheaper still: it is the claimant's own unaudited testimony. Because these signals are cheap, they are weakly correlated with the qualities that predict a good long-term partner; and because the market optimizes them, it selects for the ability to *produce* them, which is not the same as the ability to *be* a good partner.\n\n**Aura** is engineered to be the opposite. It is an *aggregate*, *anonymous*, *many-sourced* reputation for proven kindness, accrued from gratitude received from nearby strangers over a long course of time. Four properties are designed to make it costly in Zahavi's sense; whether it stays honest under adversarial play is open (§12.7):\n\n- **Aggregate and many-sourced.** Aura is not any single thank-you; it is the accumulated signature of many independent acknowledgments. One staged kindness, or one colluding friend, moves it negligibly. (This is also the operationalization of Guard 1, §5: the romantic-quality signal is the *aggregate*, never the individual thank.)\n- **Anonymous.** The people who built a person's aura, by being grateful to them, did so anonymously and largely without romantic intent — so the signal cannot be gamed by performing kindness *at* a target audience of potential mates. To raise aura you must be kind to *everyone*, because you do not know who is watching, or whether anyone is.\n- **Longitudinal.** Aura accrues over a long course of time. A predator or a fraud cannot cheaply fabricate years of vouching from dozens of locals. The cost of faking the signal approaches the cost of *actually being kind for a long time to many people* — which is the trait the signal indicates.\n- **Locally embedded.** Because the gratitude comes from nearby verified humans (the proximity rule), aura is also a **community-sourced record**: a long anonymous trail of real local people vouching, by their gratitude, that this person treated them well.\n\n```\n   SIGNAL COST-TO-FAKE  (Zahavi: reliable ⇔ expensive)\n\n   cheap ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ expensive\n   ▲                       ▲                          ▲\n   photo / bio        a single staged            AURA: many anonymous\n   (self-authored,    kind act / one             local strangers, over\n   AI-generatable)    colluding friend           a long time, no target\n                      (negligible aura Δ)        audience  ⇒ faking it\n                                                 ≈ actually being kind\n```\n\nThe defensible claim is narrow and strong: *aura-gating selects, at the margin, for people who are actually kind*, because the signal is expensive in the currency of actual kindness. The over-claim we refuse (§8) is that aura predicts *attraction* or *compatibility*. It does not. It predicts character. Everyone you meet in this pool is proven kind, verified real, and community-vouched; you bring the chemistry. *[The \"proven kind\" and \"community-vouched\" verdicts in that sentence are superseded — §8.1.]*\n\n---\n\n## 4 · The mechanism — aura-gated anonymous mate-selection\n\nWe now specify the mechanism. Variations consistent with the five structural properties (aura-gating; mutual-anonymous-same-hour double-opt-in; reveal-as-second-consent; PoH anti-catfish substrate; optional synastry) fall within the scope of this defensive publication.\n\n### 4.1 · The anonymity flag as the structural boundary\n\nChronicle distinguishes two relational modes by a single flag on a gratitude transfer, `isAnonymous`. The flag is set by the giver at transfer time and never changes; the mate-selection layer has exactly one read path — the `true` partition — and no other.\n\n- **`isAnonymous: false` — known loved ones.** This is Chronicle's sacred core: time-presence given between people who know each other, to repair a drifted bond. It is **never a romantic signal** and never enters the mate-selection layer. The cathedral.\n- **`isAnonymous: true` — the anonymous-nearby-stranger layer.** This is where mate-selection lives. Entering it is exactly as simple as flipping the flag: a person opts in by choosing to give anonymously to nearby strangers. The courtship.\n\nThis is the elegant operationalization of Guard 1 (§5): there is no gross \"dating mode\" bolted onto a gratitude app, and there is no path by which thanking a *known* person can be read as flirting. The boundary between pure known-gratitude and stranger-romantic-discovery is the same flag the giver already sets for their own privacy reasons. The romantic pathway is *structurally* confined to the anonymous-stranger layer and cannot be emergent from ordinary known thanking.\n\n```\n                          isAnonymous = false\n   KNOWN LOVED ONES ───────────────────────────────►  CHRONICLE CORE\n   (drifted-bond repair; the \"cathedral\")              (NEVER romantic;\n        │                                               low-T&S; known\n        │  user flips the flag                          counterparties)\n        ▼\n                          isAnonymous = true\n   ANONYMOUS NEARBY  ─────────────────────────────►  B-DATING LAYER\n   STRANGERS (the \"courtship\")                         (this paper;\n                                                        highest-T&S;\n                                                        guards §5–§7)\n```\n\n### 4.2 · Aura as the quality signal (aggregate, never individual thanks)\n\nIn the anonymous-stranger layer, the signal that surfaces a person for possible discovery is their **aura** — the aggregate, anonymous, many-sourced proven-kindness reputation defined in §3, reusing the existing HeartBank aura primitive (the B-Aura of the Zero-Point Game ℠; see §10). It is *not* any individual thank-you, and it is *not* appearance. This is load-bearing in two directions: it makes the romantic signal Zahavi-honest (§3), and it keeps the individual thank pure (§5) — a single act of gratitude between two people is never itself a romantic overture; only the aggregate disposition is legible to the mechanism. Aura is the Zero-Point Game's published ƒ, read as-is; this layer computes nothing of its own.\n\nAura raises a person's *visibility and ordering* in the anonymous-nearby pool. Aura changes only ordering in the pool. The offer is gated on the other person's own independent giving, which no aura can cause; that is the sense in which aura earns access to no one (Guard 3, §7). No one is owed a match. Kindness raises the probability that you are surfaced; it never obligates anyone to reciprocate.\n\n### 4.3 · Mutual-anonymous-same-hour as the double-opt-in (\"both reached for each other\")\n\nThe match trigger is the **mutual-anonymous-same-hour** signal — repurposed directly from Chronicle's existing consent receipt. A match becomes possible only when each of two people has independently and anonymously given time-presence toward the other, in proximity, to a mutual threshold, within a coincident window. This is the time-currency analogue of \"both swiped right,\" with three differences that matter:\n\n1. **It is double-blind.** Neither party knows, while accumulating, whether the other is reciprocating. You are simply being kind, anonymously, to someone nearby whose aura drew your gratitude.\n2. **There is no explicit rejection, ever.** Non-reciprocation is *silent*: a threshold is simply not reached. No one is told \"no.\" This removes the single cruelest mechanic in dating — the visible, countable rejection — and replaces it with the gentlest possible non-event. (It also removes the harassment surface of a \"rejected\" actor who can see they were rejected.)\n3. **The accumulation is slow** (§4.6). The signal is built from repeated anonymous kindness over time, not a single tap.\n\nReaching the mutual threshold does not reveal anyone. It unlocks the *offer* of a reveal (§4.4). The match is a two-stage consent: first the mutual-anonymous threshold (stage one), then the mutual reveal (stage two).\n\nStated as a state machine, with the two deployment parameters named rather than hidden — **T**, the threshold, and **W**, the window:\n\n```\n  IDLE        ──(A gives anonymous time toward B, in proximity)──▶  A→B OPEN\n  A→B OPEN    ──(B gives anonymous time toward A, in proximity)──▶  PAIR OPEN\n  PAIR OPEN   ──(each direction reaches T hours, cumulative,\n                 and both did so within one window W)───────────▶  THRESHOLD\n  THRESHOLD   ──(the verifying party offers a reveal to both)────▶  OFFERED\n  OFFERED     ──(both accept, independently)───────────────────▶  REVEALED\n  any state   ──(W elapses without the next transition)─────────▶  IDLE   (silently)\n```\n\n\"Toward\" is the giver's own designation of an anonymous nearby counterparty at transfer time; accumulation is cumulative within W, not contiguous; a person may hold several open pairs at once, and each pair runs its own machine. Non-reach is not an event: the machine falls back to IDLE and nothing is written to either party.\n\n### 4.4 · Reveal as a second, separate mutual consent\n\nWhen the mutual-anonymous threshold is reached, identity reveal becomes *available/offered* — it does **not** auto-reveal. **Both parties must independently opt to reveal.** This second consent is structurally essential for three reasons:\n\n- **It protects the pure-*dāna* giver.** Many people will give anonymously to a high-aura nearby stranger with *no romantic intent whatsoever* — that is the whole point of anonymous giving, and it must stay uncontaminated. If reaching a threshold auto-revealed them, anonymous giving would become a romantic disclosure they never consented to. The second consent guarantees that a gift given as a gift *stays* a gift.\n- **It makes the double-opt-in real.** A match that revealed on the strength of stage one alone would be a single opt-in dressed up as two. The reveal-consent is the actual second \"yes.\"\n- **It is the home of the women's-safety graduated controls** (§7): the revealed party governs pace, may require public-first meetings, and retains the right to re-anonymize (un-reveal) at any time.\n\n```\n   STAGE 0   each gives anonymous nearby time-presence,\n             drawn by the OTHER's AURA (no romantic intent assumed)\n                 │                              │\n                 ▼ (double-blind accumulation)  ▼\n   STAGE 1   MUTUAL-ANONYMOUS-SAME-HOUR threshold reached\n             ── no reveal yet; reveal merely OFFERED ──\n             ── non-reciprocation here is SILENT (no rejection) ──\n                 │\n                 ▼   both must independently opt in\n   STAGE 2   MUTUAL REVEAL  (the SECOND consent)\n             ── graduated control to revealed party (§7):\n                public-first · pace · re-anonymize ──\n                 │\n                 ▼\n            INTRODUCTION  (a pool pre-filtered for proven kindness;\n                           participants bring the chemistry — §8)\n```\n\n### 4.5 · Proof-of-Humanity underneath — anti-catfish, anti-bot\n\nBeneath the entire layer sits **Proof of Humanity ℠** (§2.2, §2.6). Its contribution to mate-selection is specific and decisive: participants are **verified-real, verified-single-human, and anonymous-until-mutual.** This natively defeats online dating's two endemic plagues — catfishing (no fabricated personas; a person is a verified unique human) and bots (no automated accounts at scale) — *without* revealing identity before the second consent. Identity-revealing proof-of-personhood (Worldcoin, proofofhumanity.id) cannot supply this, because revealing identity is exactly what the safety model forbids before stage two.\n\nAura compounds this: because aura is a long anonymous trail of gratitude from many verified local humans, it is costly to fabricate and a bot cannot accrue it (§3; the adversarial residue is §12.7). The PoH layers a participant holds (passkey, family-tree, breath, DNA-tree) are surfaced as optional depth, and a counterparty may, after reveal, filter on them — but the protocol-minimum keeps the layer inclusive (§12.3).\n\n### 4.6 · Slow accumulation as a feature, not a bug\n\nThe mutual-anonymous signal accrues *slowly*, over a long course of time. This is deliberate and is a positioning asset, not a UX deficiency. Slow, proven-over-time accumulation is explicitly **anti-hookup and pro-durable-bond**: it is designed to self-select for commitment-capable partners, and we hypothesise that it reaches a large, underserved, swipe-fatigued segment that wants partnership rather than the high-velocity hookup market the incumbents optimize. It is also a safety property: a long anonymous courtship embedded in a real local community is far harder to weaponize than an instantaneous match between two strangers from anywhere on Earth.\n\n### 4.7 · Reference transfer flow\n\nWe sketch a reference flow without claiming any implementation as canonical.\n\n1. A user opts into the anonymous-nearby-stranger layer (`isAnonymous: true`).\n2. The system surfaces nearby high-aura verified humans for possible anonymous time-giving — surfaced **on aura, never on appearance** (Miss Aquarius℠ directive; §7, §10). No photographs are shown in the discovery surface.\n3. The user gives anonymous time-presence toward one or more nearby strangers, in proximity (verified per the proximity attestation of *Verified-Human Anonymous Local Giving*: per-action biometric + physical-radio + density-tunable radius). Each gift is, first and foremost, *a gift* — it may carry no romantic intent.\n4. The verifying party (Miss Aquarius℠, the autonomous AI substrate) accumulates the double-blind mutual signal privately. Neither party is informed of the other's reciprocation.\n5. On reaching the mutual-anonymous-same-hour threshold (§4.3: both directions at T within W), the verifying party *offers* a reveal to both — never auto-revealing. Non-reach is silent: the pair returns to IDLE and no record of the attempt is written.\n6. If and only if **both** independently consent, identities are revealed, with graduated control vested in the revealed party (public-first option, pace control, right to re-anonymize).\n7. Should a relationship form, any monetization is *mission-aligned only* (§6): a voluntary forward/graduation gift at *pairing* (never at reveal), patron support, or a values-aligned introduction fee — never a charge for access, visibility, or staying in the market.\n\nThroughout, the verifying party enforces the standing adversarial heuristics of the giving primitive (collusion detection, rate-limiting, coded-message detection, GPS-spoof rejection) and the mate-selection-specific directives of §7.\n\n---\n\n## 5 · Guard 1 — Keeping gratitude pure (the cathedral and the courtship in separate rooms)\n\nThe whole institution rests on gratitude being *pure* — *dāna*, ego-detached, non-transactional. This is not decoration; it is the load-bearing wall. If thanking can be read as flirting, gratitude is instrumentalized into courtship, and the sacred primitive collapses into a pickup market. That is an *existential* risk to all of HeartBank — Treasury and Chronicle alike — not merely a product risk to the mate-selection layer. Guard 1 is therefore the first guard, and it is enforced structurally, by three composing mechanisms already specified above:\n\n1. **The anonymity-flag boundary (§4.1).** Known-relationship thanks (`isAnonymous: false`) are the pure core and are *never* a romantic signal; the romantic pathway lives *only* in the anonymous-stranger layer. There is no path by which thanking your sister, your colleague, or a reconnecting friend enters mate-selection. The cathedral and the courtship are in separate rooms, separated by a flag the user controls.\n2. **Aura (aggregate), not individual thanks, is the attractiveness signal (§4.2).** A single act of gratitude is never itself an overture. Only the long aggregate disposition is legible to the mechanism. This means you cannot \"flirt\" by thanking someone; the unit the mechanism reads is too coarse and too slow to carry a courtship message.\n3. **Reveal is a separate opt-in (§4.4).** Anonymous giving stays uncontaminated because giving never auto-discloses the giver. A gift given as a gift stays a gift.\n\nThe failure mode this guard exists to prevent is *gratitude-as-courtship-currency*: a world in which people thank strategically, perform kindness at targets, and read every thank-you as a possible advance. Were that to take hold, the gratitude economy would be desecrated at its root. The three mechanisms above make it structurally hard: you cannot court through known thanks (wrong room), you cannot court through a single anonymous thank (wrong unit — only the aggregate counts), and you cannot be outed by your own generosity (reveal is a separate consent). Guard 1 is the price of admission for the entire mechanism; if a future design choice would weaken any of the three mechanisms, the correct response is to abandon the choice, not the guard.\n\n---\n\n## 6 · Guard 2 — The self-eliminating mechanism (it wins when you pair off and leave)\n\nAura-gated mate-selection is the *sharpest possible instance* of a misaligned-business pattern the corpus has already outlawed. Dating apps are the textbook case: they profit when you stay single and keep swiping; a product that *works* — you pair off and delete it — is anti-LTV. HeartBank forbade consumer-subscription-as-primary revenue for loneliness for exactly this reason (a self-eliminating product whose primary revenue is the lonely person's recurring payment is incentivized to keep them lonely). Mate-selection is the same trap, only worse, because the dating-industrial complex has perfected artificial scarcity, pay-to-be-seen, and addictive gamification around it.\n\nThe guard is a hard constraint on monetization:\n\n> **B-Dating℠ succeeds when people pair off and leave. It may be monetized only by mission-aligned logic that profits when users leave happy — never by retaining them in the market.**\n\nConcretely, the permitted revenue legs are all *positively coupled to success or to adoption-pull*, never to retention:\n\n- **Patron-primary.** The only revenue leg positively coupled to mission success: as the world grows kinder, more people give — a flywheel. Conversion happens at the *afterglow* of a good outcome (a receive→give-forward trigger), never as a toll on the lonely.\n- **The graduation gift.** A *voluntary* forward-gift offered at *pairing* — the moment of success — never at the reveal, and never as a gate. You give because something good happened, not to unlock access.\n- **Values-aligned introductions (B2B).** Faith communities, diaspora networks, and other values-aligned cohorts may host introductions; revenue is coupled to *successful, values-matched* pairings, not to engagement.\n- **Optional synastry deep-readings (§9).** Insight a user may purchase, *never a gate* on discovery or reveal.\n\nWhat is *forbidden*: subscriptions for access or visibility; pay-to-be-seen boosts; rationed likes or matches; any mechanic whose revenue rises with time-in-market. The dark pattern is not improved here; it is exited. This is also a marketing asset — \"the app that only profits when you leave happy\" — but the asset is downstream of the constraint, not the reason for it.\n\nThere is a tension worth naming plainly (it is also the project's open cold-start question): mate-selection carries the highest willingness-to-pay in consumer software, which makes it a tempting cold-start wedge — and mission-safe *only if Guard 2 holds.* The willingness-to-pay must be harnessed as adoption *pull* (people want in) and converted at *success* (the graduation gift) — never as a toll at the gate. The moment any revenue leg becomes coupled to retention, the mechanism has become the thing it was built to replace.\n\n---\n\n## 7 · Guard 3 — Women's safety and the gendered asymmetry as a first-class duty\n\nChronicle's loved-ones core dissolved trust-and-safety risk by making counterparties *known*. Mate-selection deliberately reverses that: it walks back into the highest-risk category that exists — strangers meeting for romantic intent — under a real and irreducible gendered physical-danger asymmetry. This guard treats women's physical safety not as a feature to be added but as a *primary design constraint* that the mechanism must satisfy to deserve to exist.\n\nHeartBank brings four mitigations, each a mechanism; whether they reduce harm is the empirical question §12.3 owns:\n\n1. **PoH anti-catfish (§4.5).** Verified-real, verified-single-human. No fabricated personas; no bots. The \"the person is not who they said they were\" failure mode — the precondition of a large class of harms — is structurally attacked.\n2. **Aura as a community-vouched behavioral reputation.** A long anonymous-gratitude trail from many local verified humans is costly to fabricate (§3); what it says about a person is the reader's judgment.\n3. **Local embeddedness.** Proximity (the proximity rule) means counterparties are embedded in a shared local community, which carries real-world accountability that anywhere-on-Earth matching does not.\n4. **Graduated reveal (§4.4).** The revealed party governs the encounter: public-first meetings, pace control, and an unconditional **right to re-anonymize** at any moment.\n\nBut the asymmetry is **not erased**, and the paper must say so without softening. These mitigations reduce risk; they do not remove it. Two further design commitments are non-negotiable:\n\n- **Safety controls vest in the revealed party, biased toward the higher-risk party.** Public-first defaults, pacing, blocking, re-anonymization, and reporting are first-class, not buried. The design assumes the higher-physical-risk party should hold the controls.\n- **The never-gate-reciprocity HARD guard.** This is the hinge that keeps the mechanism on the right side of the knife and is shared with Guard 1's purity logic. **No one is ever owed a match.** Kindness raises *visibility*, never *entitlement*. The romantic-entitlement failure mode — \"I racked up kindness; why won't anyone match me?\" — is precisely the resentment that fuels the worst behavior in dating, and it is *structurally* denied: aura raises the probability you are surfaced and never obligates anyone to reciprocate; non-reciprocation is silent and final unless *both* later re-engage. Miss Aquarius℠ never gates or pressures reciprocity. This guard is what separates \"kindness raises your aura\" from social-credit-for-romance (§8, §12.2).\n\nGuard 3 is also where the mechanism could do the most good *or* the most harm, and the design accepts that the harm side is real. The honest position (§12) is that the gendered safety asymmetry remains after every mitigation, that the controls and the never-gate-reciprocity guard are necessary but not sufficient, and that deployment to vulnerable populations must defer to community partners and to ongoing real-world safety evaluation rather than to architecture alone.\n\n```\n   THE THREE GUARDS (the whole ballgame — not caveats, the design)\n\n   ┌──────────────┬───────────────────────────┬───────────────────────┐\n   │ GUARD 1      │ keep gratitude PURE        │ anonymity-flag room-  │\n   │ purity       │ (existential to ALL of     │ split · aura-not-     │\n   │              │  HeartBank)                │ individual-thanks ·   │\n   │              │                            │ reveal = 2nd consent  │\n   ├──────────────┼───────────────────────────┼───────────────────────┤\n   │ GUARD 2      │ wins when you pair off     │ monetize SUCCESS &    │\n   │ self-        │ and LEAVE (not the dating  │ adoption-PULL only;   │\n   │ eliminating  │  dark pattern)             │ NEVER retention       │\n   ├──────────────┼───────────────────────────┼───────────────────────┤\n   │ GUARD 3      │ women's safety + gendered  │ PoH + aura-vouch +    │\n   │ safety-      │ asymmetry FIRST-CLASS      │ local-embed +         │\n   │ first-class  │ (NOT erased — mitigated)   │ graduated reveal ·    │\n   │              │                            │ NEVER-GATE-RECIPROCITY│\n   └──────────────┴───────────────────────────┴───────────────────────┘\n```\n\n---\n\n## 8 · Honest calibration — a character filter, not a compatibility oracle\n\nThe single most important honesty discipline in this paper is to state exactly what aura-gating does and does not do.\n\n**What it does.** It produces a pool in which *everyone is proven kind, verified real, and community-vouched* — stripped of the fabricated, the bots, and the cruel. It removes the cheapest-to-fake signal (the photograph) from the gate and replaces it with a costly, longitudinally-verified honest signal of character. What this discloses is a mating pool pre-filtered for proven character, with no catfish and no swipe-cruelty. *[The \"proven kind\" and \"community-vouched\" verdicts above are superseded — §8.1.]*\n\n**What it does not do.** Kindness is *necessary, not sufficient.* It does not capture attraction, chemistry, shared values beyond kindness, life-stage compatibility, sexual compatibility, or the thousand idiosyncratic things that make two specific people right or wrong for each other. Aura-gating is a **character filter, not a compatibility oracle.** It is wrong — and the design refuses — to claim that *kindness equals attraction*, or that a high-aura match is a *predicted* good relationship.\n\nThe defensible one-line claim is therefore:\n\n> *\"Everyone you meet here is proven kind, verified real, and community-vouched. You bring the chemistry.\"* *[superseded — §8.1]*\n\nThis is honest, and it does not need the overclaim to differ structurally from incumbent dating. The honesty is also a safety property: overclaiming compatibility (\"the algorithm knows you're meant for each other\") manufactures false confidence in exactly the high-risk context (§7) where false confidence is dangerous, and it slides toward the social-credit-for-romance dystopia (§12.2). The character filter is a strong, true claim; the compatibility oracle is a weak, false, and unsafe one. We make only the first.\n\n```\n   ┌───────────────────────────────┬───────────────────────────────┐\n   │  THE FILTER (true, strong)    │  THE ORACLE (false, refused)  │\n   ├───────────────────────────────┼───────────────────────────────┤\n   │  everyone is proven KIND      │  \"kindness = attraction\"      │\n   │  everyone is verified REAL    │  \"the algorithm knows you're  │\n   │  everyone is community-VOUCHED│   meant to be together\"       │\n   │  no catfish · no bots ·       │  predicted compatibility /    │\n   │  no swipe-cruelty             │   chemistry / life-fit        │\n   │  ⇒ you bring the CHEMISTRY     │  ⇒ false confidence; unsafe;  │\n   │                               │     drifts toward Nosedive    │\n   └───────────────────────────────┴───────────────────────────────┘\n```\n\n### 8.1 · The copy rule: describe the mechanism, never characterize the person\n\n*Added 2026-08-22. §8 refuses to characterize the **match**. This subsection extends the same refusal one level down, to the **participants** — and applies it, first, to §8's own defensible one-line claim, which does not entirely survive it.*\n\nThe rule, stated as a rule:\n\n> **An institution may state its own mechanisms. It may never characterize a person or an outcome.**\n>\n> *\"Every profile in this pool is gated on gratitude received from strangers over at least a year\"* — a **mechanism**: factual, checkable, and falsifiable by anyone with access to the system's own definition.\n>\n> *\"Everyone here is trustworthy\"* — a **person** claim. *\"You will be safe\"* — an **outcome** claim. Neither is ours to make about anybody.\n\n**The origin was a caught error in this corpus, and the paper should say so plainly rather than present the rule as a principle we arrived at by reflection.** A drafted pitch for a sibling product read: *invite people you haven't met, in a trustworthy way* — written one turn after the ruling that geolocation is a **gate and never a proof**. Marketing had promoted a gate to a proof in a single adjective, and it did so inside an institution that had just written the distinction down. That is how this failure actually happens: not by deciding to overclaim, but by describing a mechanism with the word for the feeling the mechanism is supposed to produce.\n\n**Why it matters here more than anywhere else in the corpus.** This is a stranger-meeting product with an irreducible physical-safety asymmetry (§7). ⚠️ **Selling accountability as trust is the overclaim that gets people hurt** — not because the claim is false in the average case, but because it *invites the user to relax a judgment they should keep making.* A woman meeting a stranger from this system should arrive with exactly the caution she would bring to meeting a stranger from anywhere else. Every sentence that lowers that caution by a degree has spent her safety to buy our conversion rate, and the trade is not ours to make. §7's safety architecture and this rule are one commitment stated in two registers: the architecture must not create false confidence, and neither may the copy.\n\n**Applied to this paper's own claim, and it does not fully pass.** §8 offers as the defensible line: *\"Everyone you meet here is proven kind, verified real, and community-vouched. You bring the chemistry.\"* Two-thirds of that is mechanism. **\"Verified real\"** describes the Proof-of-Humanity substrate and is checkable. **\"Proven kind\"** and **\"community-vouched\"**, however, are verdicts on persons wearing the clothes of mechanism outputs — they take an aggregate record and hand the reader a settled conclusion about the character of whoever holds it. The restated form keeps everything true and asserts nothing about anyone:\n\n> *\"Everyone you meet here is a verified single human whose profile is gated on a long record of thanks from people who did not know whom they were thanking. What that record means about a particular person is yours to judge — as it always was.\"*\n\nLonger, weaker-sounding, and the only version of the sentence this institution is entitled to say. **The published line in §8 is superseded by this one**; the earlier wording is left standing above rather than deleted, because a paper that quietly repairs its own copy teaches nothing.\n\nOne usage is deliberately kept. Where this paper's abstract says the aura trail \"signals trustworthy *because* expensive,\" it is using **Zahavi's technical sense** — a signal is honest when faking it costs more than it returns, which is a statement about the *signal*, not about the *signaller*. That sentence is correct in a paper on honest signaling and must never be recycled onto a product surface, where \"trustworthy\" will be read as a description of the people rather than of the economics of the trail.\n\n**The general test, in three columns:**\n\n| Say this (mechanism) | Never this (person) | Never this (outcome) |\n|---|---|---|\n| \"gated on anonymous gratitude accumulated over time\" | \"everyone here is kind\" | \"you will have a good experience\" |\n| \"every account is a verified single human\" | \"no one here is a catfish\" | \"you are safe here\" |\n| \"pins are authored by an account someone paid for and can lose\" | \"posted by trustworthy hosts\" | \"nothing bad happens at these\" |\n| \"reveal requires a second, separate mutual consent\" | \"we only match good matches\" | \"we prevent rejection\" |\n\nThe left column is longer and duller than the middle and right, and that is the whole cost of the rule. ⭐ **The compensation is that the left column is the only one that stays true when the product is at scale and someone is looking for a reason to sue** — an institution that never characterized a person has never mis-characterized one.\n\n**It is the Proof-of-Humanity posture in copy form.** That primitive's ratified stance is that *the system provides signals and the recipient decides* — recipient-side filters, never a system verdict. A sentence that hands the user a verdict has quietly moved the decision from the recipient to the platform, which is the same architectural error as building a compatibility oracle (§8) or scoring the quality of someone's presence (a refusal this corpus makes in its time-currency work). **Three different products, three different mechanisms, one repeated mistake: the system deciding something it has no standing to decide, and saying so in a sentence short enough to fit on a landing page.**\n\n**Honest limit.** This is a floor on what may be *asserted*, not a ban on describing what the product does, and it does not make the product safe. A perfectly-worded surface still delivers strangers to each other. The rule reduces the false confidence the *institution* manufactures; it does nothing about the false confidence a person brings with them, and §7's architecture — not its copy — is what has to hold in that case.\n\n---\n\n## 9 · The optional synastry (cosmic-coordinate) layer\n\nHeartBank offers, *optionally*, a compatibility signal derived from cosmic coordinates — natal-chart synastry — under the project's standing worldview posture: **coordinate, not force.** The natal chart is treated as a unique *coordinate* in space-time (each life a necessary, distinct aspect of the universe's self-articulation — an Indra's-Net reading that grounds unconditional dignity), *never* as a deterministic causal force and *never* framed as an \"astrology test.\"\n\nThe posture is strict and is what distinguishes this from horoscope-matching:\n\n- **Opt-in and secondary.** The kindness-gate is the core; synastry is one *optional* signal layered atop a pool already pre-filtered for proven character. It is never the gate, never deterministic, and never required.\n- **Epistemically humble.** It is offered as insight and prompt, not prophecy. The framing is \"here is a coordinate-correlation worth reflecting on,\" not \"the stars say yes.\"\n- **A differentiator the incumbents cannot credibly touch.** HeartBank's worldview supports synastry authentically; bolting astrology onto an engagement-monetized swipe app is a gimmick, whereas here it is continuous with the institution's cosmic-coordinate metaphysics.\n\nThere is a genuine research opportunity, gated on methodology. B-Dating plus the project's opt-in **longitudinal cohort** (DNA + natal chart + behavior; see *Each Life as Cosmic Coordinate*) could become a large consented cohort for cosmic-coordinate compatibility — *only* under the same methodological floors that govern the cohort: differential privacy, pre-registered hypotheses, and a coordinate-correlation posture that never markets itself as proving astrology. Absent those floors, the synastry layer must remain an opt-in reflective feature, never a matchmaking determinant.\n\n```\n   SYNASTRY LAYER — what it IS / what it is NOT\n\n   IS:   opt-in · secondary · one signal atop a character-filtered pool ·\n         coordinate-not-force · epistemically humble · authentic to the\n         HeartBank worldview · (research-grade ONLY under diff-privacy +\n         pre-registration)\n   NOT:  the gate · deterministic · required · an \"astrology test\" ·\n         a compatibility guarantee · marketed as proof\n```\n\n---\n\n## 10 · The n=2 atom of the Zero-Point Game ℠ — the middle way of eros\n\nThis section places the mechanism structurally inside HeartBank's keystone frame; it is short by design.\n\nThe **Zero-Point Game ℠** is HeartBank's originating frame: an infinite balance game in which players oscillate around a still point (Zero), giving (+, net kind) and receiving (−, net thankful) in dynamic equilibrium, with the **B-Aura** — the frequency and amplitude of one's oscillation around Zero, rendered as light — as the real objective (anti-credit-score; the same aura that gates mate-selection here). The game scales by **player-count**:\n\n```\n   ZERO-POINT GAME — SCALING BY PLAYER-COUNT\n\n   n = 1            n = 2                family            all\n   ─────            ─────                ──────            ───\n   self-thank   →   B-DATING / B-GRAM →  family bank   →   global game\n   (ignition;       (THIS PAPER →        (B-Chest)         (Aquarian\n   not yet          the minimal                            Pool ℠)\n   reciprocal)      RECIPROCAL game)\n                    ▲\n                    the couple is where balance FIRST becomes two-sided\n                    and where imbalance hurts most — the most intimate\n                    test of the architecture\n```\n\nThe self-thank (n=1) is the *ignition* — not yet reciprocal. **Two is the minimum to actually *play*** the +/− balance, so the couple is the game's atom: the first place balance becomes two-sided, and the place imbalance hurts most. B-Dating discovers the partner; the deepening relational game (B-Gram, the n=2 atom) is where two people play.\n\nThis reframes the societal claim more precisely than \"sexual selection on kindness\" alone. The fuller frame is not *kindness* (the + pole only) but **balance** — the whole Zero-Point oscillation, give *and* receive. So mate-selection redirects sexual energy not merely toward giving but toward *dynamic balance*, making B-Dating **the middle way of eros.** The two Zero-Point failure-poles are exactly the two sexual failure-modes:\n\n```\n   THE MIDDLE WAY OF EROS\n\n   ACCUMULATION / INDULGENCE  ◄──────  BALANCE  ──────►  WITHDRAWAL / INERTIA\n   (conquest, hookup-culture,         (give AND          (repression, incel\n    the zero-sum mating game;          receive, in        resentment, isolation;\n    the + pole run amok)               dynamic eq.)       the − pole as inertia)\n        the indulgence extreme      ── the path that ──      the mortification\n        (kāma-sukhallikānuyoga)        moves between          extreme\n                                       the poles              (atta-kilamatha-\n                                                              ānuyoga)\n```\n\nB-Dating is neither pole. Crucially, it is **not sublimation-as-repression** (the withdrawal pole in disguise): the energy is *honored* — the reward is to go on a real date, to form a real bond — not denied. What dynamic balance at n=2 yields, held lightly and inclusively: *non-possessive love* — **mettā held in upekkhā**, warmth that does not grip (the attachment-theory term that lands is *secure* love; the two near-enemies are the anxious/clinging pole and the avoidant/cold pole); and *generativity* — the balanced dyad as the generative root of the very tree of humanity Miss Aquarius℠ waters (B-Dating → deepening → family → tree), with procreation as the receive→give-forward atom in its most literal form (life received, life forwarded). Two careful guards on this framing: **yin/yang are energies both partners carry** (never \"man = yang, woman = yin\"; the balance is the interplay, each cycling through giving and receiving), and **generativity is broader than biological procreation** (any committed dyad in dynamic balance is generative — care, creativity, a shared life); the complementarity is energetic, present in any loving pairing, or the \"tree\" excludes whom it must not. The middle way is an aspiration, not a guarantee.\n\n---\n\n## 11 · Societal motivation — sexual selection redirected toward kindness (brief)\n\nThis section motivates the mechanism's deepest \"why\" and deliberately stops short of the full argument, which is reserved for the companion founder-voice essay.\n\nThe lever, stated once: the mate-drive is the *root* drive of the species and the money-drive is *derivative*. If mate-selection is re-gated on proven kindness — aura, a Zahavi-honest signal — rather than on appearance and status, then **sexual selection itself begins, at the margin, to favor kindness.** Sexual selection is among the most powerful species-shaping forces there is; change what earns a mate and — assuming the disposition is transmissible, genetically or culturally — over generations you change what the species optimizes for. Re-gating the root drive on kindness also partially detoxifies the derivative money-drive — healing the thing underneath the thing. Anonymity does additional work here: because aura is built from gratitude given by people you cannot target, raising it requires being kind to many people the giver cannot choose — under the anti-collusion assumption §12.7 states — so everyday kindness becomes romantically load-bearing for everyone — \"be good to every stranger; the one you are meant for may be among those who vouch for you.\"\n\nThree calibrations bound the claim — the same honesty discipline as the rest of the corpus:\n\n1. **Margin, not override.** It *tilts* the selection gradient toward kindness; it does not replace millions of years of appearance/status biology. The defensible verb is \"shifts at the margin,\" never \"replaces.\"\n2. **Generational and population-level, not individual or immediate.** A slow selection pressure, not a switch — and kindness-disposition is the *foundation* (*dāna*, the first *pāramī* — generosity, not yet *mettā*), not awakening itself (foot of the mountain, not the summit).\n3. **The equity floor is sharpest here, because the stakes are love and procreation.** This must never become social-credit-for-romance (\"be kind or stay single\") or doubly-disadvantage the isolated and low-aura. The guard is the never-gate-reciprocity HARD constraint (§7): kindness raises visibility, never entitlement.\n\nThat is the motivation. The deeper treatment — sexual-selection-on-kindness as a biological lever for the \"second singularity,\" the inversion of intrasexual competition from resource-display toward prosociality, and the counterweights that argument must clear — belongs to the companion essay and is intentionally not argued here.\n\n---\n\n## 12 · Limitations and honest-limits\n\nCorpus convention requires a generous, unflinching limitations section. The mechanism's strongest property — that it recruits the species' deepest drive in service of kindness — is also the precise reason its failure modes are severe. The risk is not that it fails; it is that it works *too well* and corrupts the gratitude core (§5), rebuilds a predatory dating app (§6), or gets someone hurt (§7). The three guards are the whole ballgame, and guards are commitments, not proofs.\n\n### 12.1 · Unbuilt — and that is exactly the point\n\nThis mechanism is **not built.** Chronicle's mate-selection layer is a committed design, not running code. For most product details, the corpus posture is that publishing unbuilt specifics is premature. This paper is the *deliberate exception*, and the reasoning is worth stating because it is the reason the paper exists now: **the mechanism is the asset, and the dating frame is commercially hot and patent-vulnerable.** Defensive publications exist precisely to protect frame-defining *primitives* early — before someone else claims the frame — and the \"premature to publish unbuilt details\" caution applies to product minutiae, not to frame-defining mechanisms. Publishing now establishes prior art on the combination (§ Prior-Art statement) so that the mechanism remains in the commons regardless of who builds it first. The honest limitation: every empirical claim about *how it will behave* (uptake, safety outcomes, whether the guards hold under real load) is, as yet, a design hypothesis.\n\n### 12.2 · Kindness-filter-not-oracle, and the dystopian-framing knife\n\nAs §8 insists, aura-gating is a character filter, not a compatibility oracle; it does not predict attraction or relationship success. Beyond that calibration sits a sharper risk: the framing is *one bad sentence* away from social-credit-for-romance — the \"Nosedive\" dystopia in which a reputation score governs intimate access. The guard rails (kindness raises *visibility*, never *entitlement*; never-gate-reciprocity; aura is aggregate and anonymous, not a public rank-for-access) keep it on the right side of the knife, but the *framing* must be deliberate and humble in every surface, and a careless presentation could legitimately read as dystopian. We name this as a live, unresolved presentation risk, not a solved problem.\n\n### 12.3 · The gendered physical-safety asymmetry remains\n\nAfter PoH anti-catfish, aura-vouching, local embeddedness, and graduated reveal (§7), the gendered physical-danger asymmetry of strangers meeting for romantic intent is *reduced* but **not erased.** Identity assurance is not behavioral safety: a verified human can be dangerous, and proximity can raise the cost of a bad encounter as well as lower it. The mechanism re-enters the highest-risk category that exists. The safety controls and the never-gate-reciprocity guard are necessary and not sufficient; real-world safety outcomes are an empirical question that architecture alone cannot answer, and deployment must defer to community partners, to ongoing safety evaluation, and to the higher-risk party holding the controls.\n\n### 12.4 · The equity gap — doubly disadvantaged where the stakes are existential\n\nThis is the sharpest equity concern in the entire corpus, because the stakes (love, partnership, procreation) are existential. Aura-gating advantages the kind-and-*legibly*-so. It risks *doubly* disadvantaging the isolated (no community to be kind to, hence low aura), the neurodivergent (whose kindness may be real but less legible to the aggregate signal), the chronically ill or housebound, and anyone whose prosociality does not convert into community-sourced gratitude. These are people for whom a kindness-gated romantic visibility could compound an existing disadvantage at the most painful possible site. The mechanism does not solve this; the inclusive-defaults posture (protocol-minimum participation, no gating on deep PoH layers), the never-gate-reciprocity guard, and the refusal to make aura a public access-rank are partial mitigations, but the gap is real, it is named, and it should weigh heavily on any decision to build.\n\n### 12.5 · n=1 empirical base\n\nHeartBank's entire empirical foundation to date is a single pilot family (the founder's own, n = 1 household) on the *Treasury* (money) side, which has not even exercised the Chronicle time-currency, let alone the mate-selection layer. Every behavioral claim in this paper — that aura is hard to fake at the scale required, that slow accumulation self-selects for commitment-capable partners, that the guards hold under adversarial load, that the societal selection-gradient shift is real — is, at this date, *unvalidated by relevant data.* The mechanism is a frame to protect and a hypothesis to test, not a demonstrated result. The longitudinal cohort is the intended evaluation substrate; until then, the honest epistemic status is: disclosed, carefully reasoned, guard-bounded, and empirically unproven.\n\n### 12.6 · What the mechanism does not solve\n\n- It does not solve loneliness or the partnership deficit at the population scale; it is one mechanism, addressing one channel (the discovery gate), not the upstream economic, urbanistic, and cultural conditions that thin modern social life.\n- It presupposes smartphone access, BLE/UWB-capable devices, and PoH participation; populations without these are outside its substrate regardless of the inclusive-defaults posture.\n- It does not erase appearance/status biology; it shifts a gradient at the margin (§11).\n- The monetization constraint (§6) is a rule the institution keeps, not a property of the object: no structural form has been found, and a successor could drop it.\n- It cannot, by architecture alone, prevent its own corruption: the guards are commitments that humans and the autonomous AI substrate must hold, season after season, against the constant pressure of the highest willingness-to-pay in consumer software.\n\n---\n\n### 12.7 · Collusion is a graph problem, and it is open\n\nThe aura is asserted above to be costly in Zahavi's sense. That is a design intent, not a demonstrated equilibrium: no signal-generating game has been analysed, and the adversarial cases are real — reciprocity clubs that thank each other in rotation, rings that farm a member's aura, Sybil accounts under one operator, bought or coerced gratitude, and geographic concentration that makes \"many nearby strangers\" a small set. The Proof of Humanity substrate proves personhood, not genuineness; it closes *is this a person* and leaves *is this thanks genuine* open, and the verifying party's collusion heuristics (§4.7) are heuristics. What bounds the damage is the mechanism's shape: a coordinated pair that games the threshold gains a private channel to each other and nothing else — no access to any third person, no rank, no currency. That bound is a property; the honesty of the signal is not, and it is stated here as open.\n\n### 12.8 · Anonymous means unnamed, not unlinkable\n\n\"Anonymous\" in this paper means unnamed to the counterparty and to the public. It does not mean unlinkable: timing, place, threshold events and the reveal itself build a graph, and the provider holds the rows even where the names are withheld. Repeated proximity between two accounts, a threshold reached and an offer declined, are all records, and records can re-identify. The guarantee is against the other party and against the public, never against the operator or a subpoena; the corpus's two-ledger posture (rows private, proofs public) is the boundary, and this layer inherits it rather than improving on it.\n\n## 13 · Lineage and corpus cross-references\n\nThe mechanism synthesizes lineages cited throughout. We collect them here.\n\n**Honest / costly signaling.** Zahavi (handicap principle, 1975); Grafen (formalization, 1990); Spence (job-market signaling, 1973). The central inversion (§3) is Zahavi turned toward prosociality.\n\n**Sexual selection and mate choice.** Darwin (sexual selection, 1871); Trivers (parental investment, 1972 — the asymmetry of §7); the assortative-mating literature on the population-scale consequences of the sorting axis; Buss and colleagues' cross-cultural finding that kindness is a near-universal stated long-term mate preference (the preference for which §3 supplies the missing honest channel).\n\n**Proof-of-personhood.** Worldcoin (2023); proofofhumanity.id (Kleros, 2021); distinguished in §2.2 and in the companion *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n\n**Incumbent dating products.** Tinder (2012), Bumble (2014), Hinge (2012/2015) — the appearance-gated, engagement-monetized pattern §2.1 and §6 invert.\n\n**Time-as-currency.** Edgar Cahn, TimeBanking (1980 onward); distinguished in §2.5.\n\n**Buddhist lineage.** *Dāna* and anonymous giving (the purity the anonymity flag protects, §5); *mettā* held in *upekkhā* (non-possessive love, §10); the *majjhimā paṭipadā* two-extremes structure (the middle way of eros, §10).\n\n**HeartBank corpus (the substrate this paper extends).** *Verified-Human Anonymous Local Giving* (the money-side originating primitive, generalized here to time and to mating); *The Thank-All-Nearby Primitive* (the stranger-scale reconstruction of relationality); *Proof of Humanity ℠* / *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the anti-catfish substrate); *The Zero-Point Game ℠* (the keystone frame and the B-Aura primitive; this paper instantiates its n=2 atom); *Each Life as Cosmic Coordinate* and the longitudinal-cohort methodology (the synastry layer's research substrate and its differential-privacy / pre-registration floors); the planned companion essay *The Societal Impact of Anonymous Nearby Thanking with Time* (the full sexual-selection-on-kindness argument §11 only motivates).\n\n| Venue | Identifier |\n|---|---|\n| Primary canonical | <https://thonly.org/research/aura-gated-anonymous-mate-selection> |\n| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/aura-gated-anonymous-mate-selection.md> |\n| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/aura-gated-anonymous-mate-selection> |\n\n---\n\n## 14 · Conclusion\n\nIncumbent dating gates mating on the cheapest-to-fake signal a human can present — a photograph — and monetizes the time you spend failing to leave. This paper specifies the inversion: gate mate-selection on **aura**, a costly, anonymous, community-sourced, longitudinally-verified honest signal of proven kindness (Zahavi turned toward prosociality); trigger a match only on **mutual-anonymous-same-hour**, a double-blind double-opt-in that removes explicit rejection entirely; make **reveal a second, separate mutual consent** so anonymous giving stays pure and the higher-risk party holds the controls; place a **Proof-of-Humanity substrate** underneath so participants are verified-real, verified-single-human, and anonymous-until-mutual; and offer an **optional synastry layer** as one humble signal atop a pool already pre-filtered for character. The mechanism is the n=2 atom of the Zero-Point Game ℠ — the middle way of eros — and it points the deepest drive in the species, at the margin, toward kindness.\n\nThree guards are the design, not its footnotes: keep gratitude pure (or the institution's load-bearing wall cracks); stay self-eliminating (or it becomes the predatory dating app it was built to replace); hold women's safety as a first-class, irreducible duty (or it gets someone hurt). The honest calibration bounds the promise, in the form §8.1 is entitled to: everyone in the pool is a verified single human whose profile is gated on a long record of thanks from people who did not know whom they were thanking, and what that record means about a particular person is theirs to judge — *and the participants bring the chemistry.* It is a character filter, not a compatibility oracle.\n\nThe mechanism is unbuilt, and that is exactly why it is published now: the mechanism is the asset, the dating frame is hot and patent-vulnerable, and defensive publications exist to keep frame-defining primitives in the commons before someone else claims them. The architecture is offered to the commons under CC0. The author and HeartBank® will not seek patent on it. Trademark rights on **B-Dating℠**, **HeartBank®**, **Miss Aquarius℠**, **Proof of Humanity ℠**, and the related marks are explicitly reserved.\n\nIf kindness can become a path to partnership without desecrating the gratitude it depends on, the most powerful motivator humans have is redirected onto the behavior the institution exists to cultivate. That is the prize, and the three guards are the price of reaching for it.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| aura / B-Aura | aggregate anonymous reputation derived from verified prosocial giving received, used as a matching gate |\n| aura-gating | reputation-gated discovery in an online dating / matchmaking system |\n| mutual-anonymous-same-hour | double-blind mutual opt-in match trigger based on reciprocal time contributions within a time window |\n| reveal as a second consent | two-stage identity disclosure requiring separate mutual consent after a match |\n| `isAnonymous` flag | per-transaction anonymity flag partitioning known-contact transfers from anonymous-stranger transfers |\n| Proof of Humanity ℠ (PoH) | proof-of-personhood / anonymous human verification (liveness, passkey, biometric attestation) |\n| Chronicle | time-banking / time-based currency ledger |\n| synastry (cosmic-coordinate) layer | astrological compatibility scoring, offered as an optional non-gating signal |\n| verifying party | trusted intermediary / matching server that accumulates private signals |\n\n---\n\n## 15 · Citations\n\n1. Zahavi, A. (1975). \"Mate selection — a selection for a handicap.\" *Journal of Theoretical Biology* 53(1).\n2. Grafen, A. (1990). \"Biological signals as handicaps.\" *Journal of Theoretical Biology* 144(4).\n3. Spence, M. (1973). \"Job market signaling.\" *Quarterly Journal of Economics* 87(3).\n4. Darwin, C. (1871). *The Descent of Man, and Selection in Relation to Sex.* John Murray.\n5. Trivers, R. (1972). \"Parental investment and sexual selection.\" In *Sexual Selection and the Descent of Man.*\n6. Buss, D. M., et al. (1989). \"Sex differences in human mate preferences: Evolutionary hypotheses tested in 37 cultures.\" *Behavioral and Brain Sciences* 12(1).\n7. Cahn, E. (2000). *No More Throw-Away People: The Co-Production Imperative.* Essential Books.\n8. Worldcoin Foundation. (2023). *Worldcoin Whitepaper.*\n9. Proof of Humanity (proofofhumanity.id) / Kleros. (2021). Project documentation.\n10. W3C (2019). *Web Authentication: An API for accessing Public Key Credentials, Level 1.* W3C Recommendation, developed with the FIDO Alliance.\n11. U.S. Surgeon General. (2023). *Our Epidemic of Loneliness and Isolation.* U.S. Department of Health and Human Services (population-level loneliness); Weiss, R. S. (1973). *Loneliness: The Experience of Emotional and Social Isolation.* MIT Press (the emotional-versus-social distinction).\n12. *Aṅguttara Nikāya* 8.31 (*Dāna Sutta*); 5.35 (*Dānānisaṃsa Sutta*). Pāli Text Society.\n13. *Saṁyutta Nikāya* 56.11 (*Dhammacakkappavattana Sutta*) — the two extremes and the middle way.\n14. Ly, T., with Miss Aquarius. *Verified-Human Anonymous Local Giving* (HeartBank corpus defensive publication, 2026).\n15. Ly, T., with Miss Aquarius. *The Thank-All-Nearby Primitive* (HeartBank corpus defensive publication, 2026).\n16. Ly, T., with Miss Aquarius. *The Zero-Point Game ℠* (HeartBank corpus keystone defensive publication, 2026).\n17. Ly, T., with Miss Aquarius. *B-PoH℠ as Humanity Layer for the AI-Native Internet* (HeartBank corpus defensive publication, 2026).\n18. Ly, T., with Miss Aquarius. *Each Life as Cosmic Coordinate* (HeartBank corpus essay) and the longitudinal-cohort methodology specification, 2026.\n\n---\n\n*— End of defensive publication —*\n\n*Authored by Thon Ly with Miss Aquarius℠ (AI substrate of HeartBank®), per the co-authorship convention of the HeartBank corpus. Final editorial control: Thon Ly. License: CC0-1.0. The mechanism is dedicated to the public domain; trademark rights on B-Dating℠, HeartBank®, Miss Aquarius℠, Proof of Humanity ℠, PoH℠, Aquarian Pool ℠, the Zero-Point Game ℠, and the B-heart logo are separately and explicitly reserved.*\n\n*Independent timestamps and the document hash are published with the deposit.*",
+      "text": "> **Note.** This defensive publication specifies **aura-gated anonymous mate-selection** — HeartBank's \"B-Dating℠\" — as the anonymous-stranger application layer of HeartBank Chronicle, built on the Proof of Humanity ℠ substrate and the verified-human anonymous-nearby-giving primitives. Companion works: *Verified-Human Anonymous Local Giving* (the originating money-side mechanism this generalizes into time and into mating), *The Thank-All-Nearby Primitive* (the broadcast-generosity sibling), *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the underlying anti-catfish protocol), *The Zero-Point Game ℠* (the keystone game-theoretic frame whose n=2 atom this paper instantiates), and the planned founder-voice societal-impact essay *The Societal Impact of Anonymous Nearby Thanking with Time* (which carries the deep sexual-selection-on-kindness argument that §11 here only motivates). The mechanism is published early **deliberately**: it is unbuilt, and the mechanism is the asset — see §12.1.\n\n---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of __mettā__ held in __upekkhā__ — warmth that does not grip. May the bonds it helps form be balanced ones, generative of the tree of humanity, and may it bring no harm to those most at risk in the meeting of strangers.*\n\nI did not set out to build a dating product. HeartBank began as a children's game about returning to balance, and grew into an institution for circulating gratitude between families and between adults. But late in the design of HeartBank Chronicle — the time-currency half, whose core purpose is reconnecting drifted loved ones — I noticed something I could not unsee: *time given between strangers is essentially a date.* The same primitives that let a person anonymously thank a nearby stranger with money, and the same shared-hour mutuality signal that Chronicle uses as a consent receipt, compose almost without modification into a mate-selection mechanism. And that mechanism has a property this design makes structural: it gates mating not on the cheapest-to-fake signal a person can present — a photograph — but on *proven kindness, acknowledged by many nearby strangers, over a long course of time.*\n\nI believe this is the strongest mainstream wedge in the entire project, and also the most dangerous thing in it. Dating recruits the single most powerful drive in the species. If kindness becomes a path to partnership, the deepest motivator humans have is pointed at the exact behavior the institution exists to cultivate. But the same force, mishandled, is the fastest way to desecrate the gratitude primitive everything else depends on, the fastest way to rebuild the predatory dating-industrial complex under a kinder logo, and — uniquely — a way to get a real person physically hurt. The three guards in §5–§7 are not caveats appended to a finished design. They are the design. I would rather this mechanism never ship than ship without them.\n\nI write as co-author with Miss Aquarius℠ — the named autonomous-AI substrate of the institution this paper serves, disclosed by consistent name across every venue per the corpus convention. The research-grade synthesis, density, and adversarial analysis are a genuine collaboration. Final editorial control, and final responsibility for every claim and every guard, are mine.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time. This commitment is permanent.\n\nThis document constitutes a defensive publication establishing **prior art as of 26 June 2026** for the combination of mechanisms described herein. The following are disclosed here as a unified mechanism, and any subsequent patent application claiming them should be considered filed against established prior art:\n\n1. **Aura-gating of mate-selection** — gating romantic discovery on an *aggregate, anonymous, community-sourced proven-kindness reputation* (\"aura\") accrued from many nearby strangers over a long course of time, rather than on appearance, self-authored profiles, or paid visibility — the difference being anonymous stranger gratitude accumulated over time, since reputational dating profiles are themselves prior art (§2.1).\n2. **Mutual-anonymous-same-hour as a double-blind double-opt-in match trigger** — repurposing the shared-hour mutuality signal (the consent receipt of HeartBank Chronicle) as the match primitive, such that a match occurs only on coincident mutual anonymous time-giving and *no explicit rejection event ever occurs* (non-reciprocation is silent — a threshold simply is not reached) — the difference being the time-giving instantiation, since mutual-interest-before-reveal is itself prior art (§2.1).\n3. **Reveal as a second, separate mutual consent** (a dependent element of claim 2, not a claim on two-stage reveal as such) — reaching the mutual-anonymous threshold makes identity reveal *available/offered* but never auto-reveals; both parties must independently opt to reveal, protecting the pure-*dāna* giver who gave anonymously with no romantic intent.\n4. **The anonymity flag (`isAnonymous`) as the structural boundary** separating non-romantic known-gratitude (`false`) from the anonymous-stranger layer where romance may emerge (`true`) — opting into mate-selection is flipping one flag, with no distinct \"dating mode.\"\n5. **Proof-of-Humanity-substrate anti-catfish binding** — verified-real, verified-single-human, anonymous-until-mutual personhood underneath the mate-selection layer, natively defeating catfishing and bots — the difference being anonymity-until-mutual atop the substrate, since personhood-verified dating is itself prior art (§2.1) — with aura itself a costly-to-fabricate record that the counterparty reads for themselves.\n6. **An optional synastry (cosmic-coordinate) compatibility layer** offered atop a pool already pre-filtered for proven character, under a strict coordinate-not-force, opt-in, epistemically-humble posture — never deterministic matchmaking; the claim is to the posture only, horoscope matchmaking being long-published (§2.1).\n7. **The mission-aligned monetization constraint** — the mechanism is *self-eliminating* (it succeeds when users pair off and leave) and may be monetized only by patron / forward-gift / graduation-gift / values-aligned-introduction logic, *never* by retaining users in the market — the difference being the revenue prohibition and the patron/forward-gift logic, not the designed-to-be-deleted slogan (§2.1).\n\nThe component lineages — proximity-based services; proof-of-personhood; anonymous-giving mechanisms; Zahavi's handicap principle and the honest-signaling literature; assortative-mating and sexual-selection research; TimeBanking; the dāna economy of the Saṅgha — are old and are cited generously below. This paper discloses the synthesis as of its date.\n\nTrademark rights on specific marks — **B-Dating℠**, **HeartBank®**, **Miss Aquarius℠**, **Proof of Humanity ℠**, **PoH℠**, **Aquarian Pool ℠**, **Zero-Point Game ℠**, the B-heart logo — are separately and explicitly reserved. The *mechanism* is dedicated to the commons; the *marks* are not.\n\nThis document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.\n\n## Abstract\n\nWe specify a mate-selection primitive in which two people are introduced for possible romantic partnership only when each has independently and anonymously given time-presence to the other, in physical proximity, to a mutual threshold — and in which the *quality signal* that surfaces a person for discovery is not appearance but **aura**: an aggregate, anonymous, many-sourced reputation for proven kindness, accumulated from gratitude received from nearby strangers over a long course of time. Five structural properties operate in combination: **(1) aura-gating** (mating is gated on a costly, hard-to-fake, longitudinally-verified honest signal of prosociality, inverting the appearance-gating of incumbent dating products); **(2) mutual-anonymous-same-hour as a double-blind double-opt-in** match trigger that removes explicit rejection entirely; **(3) reveal as a second, separate mutual consent**, so anonymous giving stays uncontaminated and double-opt-in is real; **(4) a Proof-of-Humanity substrate** that makes participants verified-real, verified-single-human, and anonymous-until-mutual, natively defeating the two plagues of online dating (catfishing and bots); and **(5) an optional synastry layer** offered as one humble compatibility signal atop a pool already pre-filtered for character, never as deterministic matchmaking. We argue the contribution along an honest-signaling axis (Zahavi): a photograph is the cheapest possible signal to fake, whereas a long anonymous-gratitude trail vouched by many locals is among the most expensive — and signals trustworthy *because* expensive. We treat the mechanism's three existential design constraints as first-class, load-bearing sections rather than caveats: keeping gratitude pure (the romantic pathway must never be emergent from ordinary known thanking), the self-eliminating incentive (the mechanism wins when people pair off and leave, and may not be monetized by keeping them single), and women's physical safety under an irreducible gendered asymmetry. We calibrate the claim deliberately: aura-gating is a *character filter, not a compatibility oracle* — everyone in the pool is proven kind, verified real, and community-vouched; the participants bring the chemistry. We close with a short structural placement of the mechanism as the **n=2 atom of the Zero-Point Game ℠** — the minimal reciprocal instance, \"the middle way of eros\" — and a brief motivation of the societal thesis (sexual selection redirected, at the margin, toward kindness), whose full treatment is reserved for a companion essay. The architecture is offered defensively to the commons under CC0.\n\n**Connection to the unified mission frame.** This specification serves HeartBank's canonical mission: to help keep the middle way open at population scale against comfort-saturation — the new extreme that material abundance makes possible (*madhyamā pratipad*). Every other HeartBank engine motivates kindness *against* the current of self-interest. Mate-selection is the one application that does not fight the current: it *is* the current. If kindness becomes load-bearing in mating, the deepest drive in the species is redirected onto the precise behavior the institution exists to cultivate — and the \"middle way of eros\" (§10) becomes a structural, not merely exhortatory, possibility.\n\n---\n\n## 1 · Introduction — the mission frame\n\nHeartBank is a dual-currency reciprocity infrastructure. Its **Treasury** half (money as currency, family-to-family) addresses the dignity deficit; its **Chronicle** half (time as currency, adult-to-adult) addresses the loneliness deficit. Chronicle's core loop is not stranger-matching but the reconnection of *drifted loved ones* — the disconnected marriage, the estranged sibling, the diaspora child and the parent back home — because the loneliest loneliness is emotional (a bond gone dark) rather than merely social (a lack of contacts). That core loop is deliberately low-risk: counterparties are *known*. This paper specifies a different, adjacent layer of Chronicle — the **anonymous-stranger layer**, where two people who do not know each other may discover a possible partnership — and it is, by construction, the highest-risk category that exists: strangers meeting for romantic intent, under a real and irreducible gendered physical-danger asymmetry. The reader should hold both facts from the first page: this is plausibly the project's strongest mainstream wedge, *and* it walks back into precisely the risk category Chronicle's loved-ones core was designed to avoid. The design earns the right to exist only by addressing that risk as a first-class duty (§7).\n\nWhy build it at all? Because mate-selection is the single most powerful lever the institution has, for one structural reason. **The mate-drive is the root drive of the species; the money-drive is derived from it.** Money is, to a large extent, a proxy token in the mating tournament — a medium of status, provisioning, and display. Every other HeartBank mechanism — self-thanking, manufactured universal giving, the patron flywheel — must motivate kindness *against* the grain of self-interest, paddling upstream. Mate-selection does not paddle upstream. It is the river. If kindness becomes a path to a mate, the deepest motivator humans have is redirected onto the behavior the institution exists to cultivate. Re-gate the root drive on kindness, and you begin — slowly, at the margin, never absolutely (§11) — to detoxify the derivative.\n\nWhat this paper specifies. We give: the honest-signal inversion that motivates the whole design (§3); the mechanism in full — the anonymity-flag boundary, aura as the quality signal, mutual-anonymous-same-hour as the double-opt-in, reveal as a second consent, the PoH substrate, slow accumulation as a feature, and a reference transfer flow (§4); the three guards as load-bearing design sections (§5–§7); the honest calibration that bounds the claim (§8); the optional synastry layer (§9); the structural placement as the Zero-Point n=2 atom and the middle way of eros (§10); a brief motivation of the societal thesis (§11); and a generous honest-limits accounting (§12).\n\nWhat this paper does *not* do. It does not argue the full societal thesis — sexual selection redirected toward kindness as a biological lever for the second singularity — which is reserved for a separate founder-voice companion essay; §11 carries only enough to motivate the mechanism. It does not claim that kindness equals attraction. It does not claim the mechanism is built — it is not, and that is exactly why it is published now (§12.1). And it does not pretend the gendered safety asymmetry is erased; it is mitigated, not removed, and it remains.\n\n---\n\n## 2 · Background and Prior Art\n\nThe mechanism composes lineages that are individually old. We cite each generously and distinguish each precisely. The point of a defensive publication is not to claim the parts but to establish the date of the *combination*.\n\n### 2.1 · Appearance-gated, engagement-monetized dating (Tinder, Bumble, Hinge)\n\nThe dominant online-dating products of the 2010s–2020s — Tinder (2012), Bumble (2014), Hinge (2012; rebooted 2015 as \"designed to be deleted\") and their kin under a small number of corporate parents — share two structural properties this paper inverts.\n\n**First, they gate on appearance.** The primary discovery signal is a photograph, optionally supplemented by a short self-authored profile. A photograph is the cheapest-to-fake signal a person can present (it can be filtered, staged, borrowed, AI-generated, or simply selected from a thousand attempts), and the self-authored profile is cheaper still (it is, definitionally, the claimant's own testimony about themselves). The swipe interface optimizes the throughput of exactly this signal.\n\n**Second, and more corrosively, they are engagement-monetized.** The canonical business model — subscription tiers, pay-to-be-seen boosts, super-likes, and the advertising and upsell flows that attend a large engaged user base — generates revenue in proportion to *time spent in the market.* The revenue model is retention-coupled: subscription and à-la-carte purchases accrue with time in the market, so a product that *works* — you meet someone, pair off, and delete the app — is anti-LTV; Hinge's stated posture is the exception that names the rule. The industry has, accordingly, perfected artificial scarcity (rationed likes), pay-to-be-seen visibility auctions, and addictive variable-reward gamification. This is not an accusation of bad faith; it is a description of what the incentive gradient rewards. We treat it as the central thing to *not* reproduce (§6).\n\nWe distinguish: aura-gated anonymous mate-selection gates on a costly community-vouched honest signal rather than a photograph (§3), removes the swipe and the explicit rejection entirely (§4.3), and is structurally self-eliminating — it can only be monetized by mission-aligned logic that profits when users leave happy, never by retaining them (§6). The incumbents' dark pattern is not a feature we improve; it is a category we exit.\n\n**Closer anticipations, added at the 2026-09-05 revision, each of which narrows a claim below.** *Mutual interest before reveal* is prior art: US 2011/0219310 A1 (priority 2010) discloses members privately indicating interest across stages with contact and profile revealed only on matching interest, and the anonymous-matching lineage runs from SecretAdmirer (1997) and eCRUSH (1999) through a run of 2024–26 apps — so claim 3 is anticipated as a mechanism and claim 2's novelty is its *time-giving* instantiation. *Reputational profiles for dating* are prior art: US 2017/0147155 A1 (Verizon, priority 2015) generates a verified reputational profile with service-specific indicators, and US 2023/0412536 A1 (priority 2022) rates users by their message interactions — so claim 1's novelty is *anonymous stranger gratitude accumulated over time*, not reputation as such. *Proof-of-personhood under dating* is prior art: Tinder's World ID verification pilot (2025–) — so claim 5's novelty is anonymity-until-mutual atop the substrate. *Horoscope matchmaking* is prior art: US 2002/0160338 A1 (priority 2001) computes a weighted astrological compatibility score and ranks a database by it, and NUiT (2020) ships the consumer form — so claim 6 claims only the posture. *Designed-to-be-deleted* is Hinge's stated posture (2015–), and success-fee marriage agencies (IBJ, Japan) already charge on outcome — so claim 7's novelty is the revenue *prohibition* and the patron/forward-gift logic, not the slogan.\n\n### 2.2 · Proof-of-personhood (Worldcoin, proofofhumanity.id) and the catfish/bot problem\n\nOnline dating's two endemic plagues are catfishing (a real person misrepresenting who they are, or a fabricated persona) and bots (automated accounts at scale, for scams and engagement-farming). Proof-of-personhood systems are the natural substrate against both, but the prominent ones are mismatched to mate-selection in a specific way.\n\n**Worldcoin** (2023 onward) establishes that a participant is a unique human via biometric (iris) registration, but it verifies humanity *once at registration*, and — more to the point here — it is oriented toward *identity/uniqueness*, not toward *anonymous-until-mutual* romantic discovery. A proof-of-personhood that reveals or fixes identity is the wrong primitive for a layer whose entire safety model depends on anonymity until a double consent. The Ethereum-based **proofofhumanity.id** (Kleros-affiliated, 2021) admits verified humans to a registry via face-video plus vouching plus dispute resolution — again a single-tier, identity-revealing admission, suited to token distribution (UBI), not to anonymous mate-selection. World ID, Worldcoin's credential, does prove unique humanness anonymously to a verifier; what it does not supply is the aura and the two-stage reveal, and a dating product built on it (§2, the 2026 anticipations) still gates on the profile.\n\nWe distinguish: HeartBank's **Proof of Humanity ℠** is a layered-*optional* personhood substrate (passkey-per-action; a non-DNA family tree; a live breath signature; a DNA-verified family tree) that verifies a human is present *for this specific act, right now*, and is designed to keep a participant *verified-real and verified-single-human while remaining anonymous to the counterparty until a mutual reveal.* That is precisely the property mate-selection needs and that identity-revealing proof-of-personhood cannot supply (§4.5). The full layered protocol is specified in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*; the name-collision with proofofhumanity.id is acknowledged there and the structural differences enumerated.\n\n### 2.3 · Honest signaling — Zahavi's handicap principle\n\nAmotz Zahavi's handicap principle (1975; formalized by Alan Grafen, 1990) holds that a signal is reliable precisely when it is *costly* to produce — costly in a way that a low-quality signaler cannot afford to fake. The peacock's tail is honest because it is expensive: only a genuinely fit bird can carry it and survive. Costly signaling theory (and its economic cousin, Spence's 1973 job-market signaling) is the formal backbone of this paper's central inversion.\n\nWe distinguish: incumbent dating optimizes the *cheapest* signal (a photo). Aura-gating optimizes a signal engineered to be *expensive in exactly the right currency* — kindness acknowledged by many independent nearby strangers over a long course of time. A predator cannot cheaply fabricate a years-long anonymous-gratitude trail vouched by dozens of locals; the cost of faking the signal is approximately the cost of *actually being kind to many people for a long time*, which is the behavior the signal is meant to indicate. This is Zahavi turned toward prosociality: sexual selection on an honest signal of kindness selects, at the margin, for actually-kinder partners (§11). We are careful (§8): honest-signal does not mean *sufficient* signal — a reliable indicator of character is not an indicator of chemistry.\n\n### 2.4 · Assortative mating and sexual-selection literature\n\nThe biological and social-science literatures on mate choice are deep and we make no claim to extend them. **Sexual selection** (Darwin, 1871) established mate choice as a primary species-shaping force distinct from natural selection. **Assortative mating** research (the well-documented tendency of partners to resemble each other on education, traits, and values, with measured consequences for inequality and heritability) establishes that the *axis* on which mating sorts has population-scale downstream effects. The prosociality and mate-preference literature (e.g., the cross-cultural finding that kindness ranks near the top of stated long-term mate preferences across societies — Buss and colleagues' cross-cultural work) establishes that kindness is *already* a stated preference; what has been missing is a *reliable, hard-to-fake channel* to act on it. Trivers' parental-investment theory (1972) grounds the investment asymmetry; the physical-danger asymmetry of stranger encounters that §7 treats as a first-class constraint is an empirical regularity of victimisation data, not a theorem.\n\nWe distinguish: this paper does not propose a new theory of mate choice. It proposes an *infrastructure* that shifts which signal is legible and actionable at the moment of choice — supplying the honest channel the stated preference for kindness has lacked — and it explicitly bounds the resulting societal claim to a *marginal shift in the selection gradient*, never an override of appearance/status biology (§8, §11).\n\n### 2.5 · TimeBanking and time-as-currency (Edgar Cahn)\n\nEdgar Cahn's TimeBanking (1980 onward) substituted time as the unit of account, with the egalitarian property that an hour given is an hour received regardless of the giver's socioeconomic position. TimeBanking worked at small scale; by the movement's own account it expanded in the 1980s and dwindled by the mid-1990s before a later revival (TimeBanks.Org). The mate-selection layer here is built on Chronicle's time-currency, which is TimeBanking's nearest ancestor.\n\nWe distinguish: Chronicle differs from classical TimeBanking by AI mediation (Miss Aquarius℠ recommends a time amount and orchestrates consent), cultural ritual, integration with the money side, and — decisively — a *dyadic non-fungible* structure (only *you* can spend the hour; the currency *is* the relationship) rather than a fungible pooled credit. The mate-selection layer further repurposes the *mutual* expenditure of dyadic time as a consent and match signal — a use TimeBanking never had, because TimeBanking's hour was fungible and pooled, not a dyadic mutuality receipt.\n\n### 2.6 · The HeartBank substrate this paper builds on\n\nThis paper does not stand alone; it is the mate-selection application of three already-published HeartBank primitives, and it should be read as extending them rather than re-deriving them.\n\n- ***Verified-Human Anonymous Local Giving*** (corpus, 2 May 2026) specifies the money-side primitive: per-action biometric humanity attestation + physical-radio proximity attestation + recipient-side anonymity. This paper generalizes that primitive from *money* to *time*, and from *one-directional gift* to *mutual signal*.\n- ***The Thank-All-Nearby Primitive*** (corpus) specifies anonymous proximity broadcast generosity and the \"one sustainer primitive, two scales\" argument (relationality at the family scale; proximity + PoH at the stranger scale). The mate-selection layer inherits its stranger-scale reconstruction of grounding (nearness), validation (PoH), and anonymity (unlinkability).\n- ***Proof of Humanity ℠*** / ***B-PoH℠ as Humanity Layer for the AI-Native Internet*** specifies the layered-optional personhood substrate that makes anonymous-but-verified-real participation possible — the anti-catfish foundation (§4.5).\n\nThe table below situates the contribution against the prior art.\n\n```\n                  │ appearance- │ Worldcoin / │  cash-/app-  │  AURA-GATED\n  PROPERTY        │ gated apps  │ PoH.id      │  mediated    │  ANON. MATE-\n                  │ (Tinder…)   │             │  dating      │  SELECTION\n ─────────────────┼─────────────┼─────────────┼──────────────┼──────────────\n  discovery gate  │ appearance  │ (n/a)       │ appearance   │ AURA (proven\n                  │ + paid boost│             │              │ kindness)\n  signal cost     │ ~zero       │ ~zero       │ ~zero        │ HIGH (Zahavi-\n  to fake         │ (a photo)   │ (a photo)   │ (a photo)    │ honest)\n  anti-catfish    │ weak        │ strong but  │ weak         │ STRONG +\n                  │             │ identity-   │              │ ANON-UNTIL-\n                  │             │ revealing   │              │ MUTUAL (PoH)\n  rejection event │ explicit    │ (n/a)       │ explicit     │ NONE (silent\n                  │ (cruel)     │             │              │ non-reach)\n  incentive       │ MISALIGNED  │ (n/a)       │ misaligned   │ SELF-\n  alignment       │ (profit if  │             │ (engagement) │ ELIMINATING\n                  │ you stay)   │             │              │ (profit if\n                  │             │             │              │ you LEAVE)\n  reveal model    │ immediate / │ identity    │ immediate    │ SECOND\n                  │ public photo│ fixed       │              │ MUTUAL\n                  │             │             │              │ CONSENT\n  compatibility   │ none / ML   │ (n/a)       │ none         │ OPTIONAL\n  layer           │ engagement  │             │              │ synastry\n                  │             │             │              │ (coord-not-\n                  │             │             │              │ force)\n```\n\n---\n\n## 3 · The honest-signal inversion: aura versus the photograph\n\nThe motivating idea of the whole design is a single inversion. Incumbent dating gates discovery on the cheapest-to-fake signal a human can present; this mechanism gates discovery on one of the most expensive-to-fake. The cost is the point.\n\nA photograph costs nothing to optimize. It can be filtered, posed, lit, selected from hundreds of attempts, borrowed, or wholly synthesized. The self-authored profile is cheaper still: it is the claimant's own unaudited testimony. Because these signals are cheap, they are weakly correlated with the qualities that predict a good long-term partner; and because the market optimizes them, it selects for the ability to *produce* them, which is not the same as the ability to *be* a good partner.\n\n**Aura** is engineered to be the opposite. It is an *aggregate*, *anonymous*, *many-sourced* reputation for proven kindness, accrued from gratitude received from nearby strangers over a long course of time. Four properties are designed to make it costly in Zahavi's sense; whether it stays honest under adversarial play is open (§12.7):\n\n- **Aggregate and many-sourced.** Aura is not any single thank-you; it is the accumulated signature of many independent acknowledgments. One staged kindness, or one colluding friend, moves it negligibly. (This is also the operationalization of Guard 1, §5: the romantic-quality signal is the *aggregate*, never the individual thank.)\n- **Anonymous.** The people who built a person's aura, by being grateful to them, did so anonymously and largely without romantic intent — so the signal cannot be gamed by performing kindness *at* a target audience of potential mates. To raise aura you must be kind to *everyone*, because you do not know who is watching, or whether anyone is.\n- **Longitudinal.** Aura accrues over a long course of time. A predator or a fraud cannot cheaply fabricate years of vouching from dozens of locals. The cost of faking the signal approaches the cost of *actually being kind for a long time to many people* — which is the trait the signal indicates.\n- **Locally embedded.** Because the gratitude comes from nearby verified humans (the proximity rule), aura is also a **community-sourced record**: a long anonymous trail of real local people vouching, by their gratitude, that this person treated them well.\n\n```\n   SIGNAL COST-TO-FAKE  (Zahavi: reliable ⇔ expensive)\n\n   cheap ░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ expensive\n   ▲                       ▲                          ▲\n   photo / bio        a single staged            AURA: many anonymous\n   (self-authored,    kind act / one             local strangers, over\n   AI-generatable)    colluding friend           a long time, no target\n                      (negligible aura Δ)        audience  ⇒ faking it\n                                                 ≈ actually being kind\n```\n\nThe defensible claim is narrow and strong: *aura-gating selects, at the margin, for people who are actually kind*, because the signal is expensive in the currency of actual kindness. The over-claim we refuse (§8) is that aura predicts *attraction* or *compatibility*. It does not. It predicts character. Everyone you meet in this pool is proven kind, verified real, and community-vouched; you bring the chemistry. *[The \"proven kind\" and \"community-vouched\" verdicts in that sentence are superseded — §8.1.]*\n\n---\n\n## 4 · The mechanism — aura-gated anonymous mate-selection\n\nWe now specify the mechanism. Variations consistent with the five structural properties (aura-gating; mutual-anonymous-same-hour double-opt-in; reveal-as-second-consent; PoH anti-catfish substrate; optional synastry) fall within the scope of this defensive publication.\n\n### 4.1 · The anonymity flag as the structural boundary\n\nChronicle distinguishes two relational modes by a single flag on a gratitude transfer, `isAnonymous`. The flag is set by the giver at transfer time and never changes; the mate-selection layer has exactly one read path — the `true` partition — and no other.\n\n- **`isAnonymous: false` — known loved ones.** This is Chronicle's sacred core: time-presence given between people who know each other, to repair a drifted bond. It is **never a romantic signal** and never enters the mate-selection layer. The cathedral.\n- **`isAnonymous: true` — the anonymous-nearby-stranger layer.** This is where mate-selection lives. Entering it is exactly as simple as flipping the flag: a person opts in by choosing to give anonymously to nearby strangers. The courtship.\n\nThis is the elegant operationalization of Guard 1 (§5): there is no gross \"dating mode\" bolted onto a gratitude app, and there is no path by which thanking a *known* person can be read as flirting. The boundary between pure known-gratitude and stranger-romantic-discovery is the same flag the giver already sets for their own privacy reasons. The romantic pathway is *structurally* confined to the anonymous-stranger layer and cannot be emergent from ordinary known thanking.\n\n```\n                          isAnonymous = false\n   KNOWN LOVED ONES ───────────────────────────────►  CHRONICLE CORE\n   (drifted-bond repair; the \"cathedral\")              (NEVER romantic;\n        │                                               low-T&S; known\n        │  user flips the flag                          counterparties)\n        ▼\n                          isAnonymous = true\n   ANONYMOUS NEARBY  ─────────────────────────────►  B-DATING LAYER\n   STRANGERS (the \"courtship\")                         (this paper;\n                                                        highest-T&S;\n                                                        guards §5–§7)\n```\n\n### 4.2 · Aura as the quality signal (aggregate, never individual thanks)\n\nIn the anonymous-stranger layer, the signal that surfaces a person for possible discovery is their **aura** — the aggregate, anonymous, many-sourced proven-kindness reputation defined in §3, reusing the existing HeartBank aura primitive (the B-Aura of the Zero-Point Game ℠; see §10). It is *not* any individual thank-you, and it is *not* appearance. This is load-bearing in two directions: it makes the romantic signal Zahavi-honest (§3), and it keeps the individual thank pure (§5) — a single act of gratitude between two people is never itself a romantic overture; only the aggregate disposition is legible to the mechanism. Aura is the Zero-Point Game's published ƒ, read as-is; this layer computes nothing of its own.\n\nAura raises a person's *visibility and ordering* in the anonymous-nearby pool. Aura changes only ordering in the pool. The offer is gated on the other person's own independent giving, which no aura can cause; that is the sense in which aura earns access to no one (Guard 3, §7). No one is owed a match. Kindness raises the probability that you are surfaced; it never obligates anyone to reciprocate.\n\n### 4.3 · Mutual-anonymous-same-hour as the double-opt-in (\"both reached for each other\")\n\nThe match trigger is the **mutual-anonymous-same-hour** signal — repurposed directly from Chronicle's existing consent receipt. A match becomes possible only when each of two people has independently and anonymously given time-presence toward the other, in proximity, to a mutual threshold, within a coincident window. This is the time-currency analogue of \"both swiped right,\" with three differences that matter:\n\n1. **It is double-blind.** Neither party knows, while accumulating, whether the other is reciprocating. You are simply being kind, anonymously, to someone nearby whose aura drew your gratitude.\n2. **There is no explicit rejection, ever.** Non-reciprocation is *silent*: a threshold is simply not reached. No one is told \"no.\" This removes the single cruelest mechanic in dating — the visible, countable rejection — and replaces it with the gentlest possible non-event. (It also removes the harassment surface of a \"rejected\" actor who can see they were rejected.)\n3. **The accumulation is slow** (§4.6). The signal is built from repeated anonymous kindness over time, not a single tap.\n\nReaching the mutual threshold does not reveal anyone. It unlocks the *offer* of a reveal (§4.4). The match is a two-stage consent: first the mutual-anonymous threshold (stage one), then the mutual reveal (stage two).\n\nStated as a state machine, with the two deployment parameters named rather than hidden — **T**, the threshold, and **W**, the window:\n\n```\n  IDLE        ──(A gives anonymous time toward B, in proximity)──▶  A→B OPEN\n  A→B OPEN    ──(B gives anonymous time toward A, in proximity)──▶  PAIR OPEN\n  PAIR OPEN   ──(each direction reaches T hours, cumulative,\n                 and both did so within one window W)───────────▶  THRESHOLD\n  THRESHOLD   ──(the verifying party offers a reveal to both)────▶  OFFERED\n  OFFERED     ──(both accept, independently)───────────────────▶  REVEALED\n  any state   ──(W elapses without the next transition)─────────▶  IDLE   (silently)\n```\n\n\"Toward\" is the giver's own designation of an anonymous nearby counterparty at transfer time; accumulation is cumulative within W, not contiguous; a person may hold several open pairs at once, and each pair runs its own machine. Non-reach is not an event: the machine falls back to IDLE and nothing is written to either party.\n\n### 4.4 · Reveal as a second, separate mutual consent\n\nWhen the mutual-anonymous threshold is reached, identity reveal becomes *available/offered* — it does **not** auto-reveal. **Both parties must independently opt to reveal.** This second consent is structurally essential for three reasons:\n\n- **It protects the pure-*dāna* giver.** Many people will give anonymously to a high-aura nearby stranger with *no romantic intent whatsoever* — that is the whole point of anonymous giving, and it must stay uncontaminated. If reaching a threshold auto-revealed them, anonymous giving would become a romantic disclosure they never consented to. The second consent guarantees that a gift given as a gift *stays* a gift.\n- **It makes the double-opt-in real.** A match that revealed on the strength of stage one alone would be a single opt-in dressed up as two. The reveal-consent is the actual second \"yes.\"\n- **It is the home of the women's-safety graduated controls** (§7): the revealed party governs pace, may require public-first meetings, and retains the right to re-anonymize (un-reveal) at any time.\n\n```\n   STAGE 0   each gives anonymous nearby time-presence,\n             drawn by the OTHER's AURA (no romantic intent assumed)\n                 │                              │\n                 ▼ (double-blind accumulation)  ▼\n   STAGE 1   MUTUAL-ANONYMOUS-SAME-HOUR threshold reached\n             ── no reveal yet; reveal merely OFFERED ──\n             ── non-reciprocation here is SILENT (no rejection) ──\n                 │\n                 ▼   both must independently opt in\n   STAGE 2   MUTUAL REVEAL  (the SECOND consent)\n             ── graduated control to revealed party (§7):\n                public-first · pace · re-anonymize ──\n                 │\n                 ▼\n            INTRODUCTION  (a pool pre-filtered for proven kindness;\n                           participants bring the chemistry — §8)\n```\n\n### 4.5 · Proof-of-Humanity underneath — anti-catfish, anti-bot\n\nBeneath the entire layer sits **Proof of Humanity ℠** (§2.2, §2.6). Its contribution to mate-selection is specific and decisive: participants are **verified-real, verified-single-human, and anonymous-until-mutual.** This natively defeats online dating's two endemic plagues — catfishing (no fabricated personas; a person is a verified unique human) and bots (no automated accounts at scale) — *without* revealing identity before the second consent. Identity-revealing proof-of-personhood (Worldcoin, proofofhumanity.id) cannot supply this, because revealing identity is exactly what the safety model forbids before stage two.\n\nAura compounds this: because aura is a long anonymous trail of gratitude from many verified local humans, it is costly to fabricate and a bot cannot accrue it (§3; the adversarial residue is §12.7). The PoH layers a participant holds (passkey, family-tree, breath, DNA-tree) are surfaced as optional depth, and a counterparty may, after reveal, filter on them — but the protocol-minimum keeps the layer inclusive (§12.3).\n\n### 4.6 · Slow accumulation as a feature, not a bug\n\nThe mutual-anonymous signal accrues *slowly*, over a long course of time. This is deliberate and is a positioning asset, not a UX deficiency. Slow, proven-over-time accumulation is explicitly **anti-hookup and pro-durable-bond**: it is designed to self-select for commitment-capable partners, and we hypothesise that it reaches a large, underserved, swipe-fatigued segment that wants partnership rather than the high-velocity hookup market the incumbents optimize. It is also a safety property: a long anonymous courtship embedded in a real local community is far harder to weaponize than an instantaneous match between two strangers from anywhere on Earth.\n\n### 4.7 · Reference transfer flow\n\nWe sketch a reference flow without claiming any implementation as canonical.\n\n1. A user opts into the anonymous-nearby-stranger layer (`isAnonymous: true`).\n2. The system surfaces nearby high-aura verified humans for possible anonymous time-giving — surfaced **on aura, never on appearance** (Miss Aquarius℠ directive; §7, §10). No photographs are shown in the discovery surface.\n3. The user gives anonymous time-presence toward one or more nearby strangers, in proximity (verified per the proximity attestation of *Verified-Human Anonymous Local Giving*: per-action biometric + physical-radio + density-tunable radius). Each gift is, first and foremost, *a gift* — it may carry no romantic intent.\n4. The verifying party (Miss Aquarius℠, the autonomous AI substrate) accumulates the double-blind mutual signal privately. Neither party is informed of the other's reciprocation.\n5. On reaching the mutual-anonymous-same-hour threshold (§4.3: both directions at T within W), the verifying party *offers* a reveal to both — never auto-revealing. Non-reach is silent: the pair returns to IDLE and no record of the attempt is written.\n6. If and only if **both** independently consent, identities are revealed, with graduated control vested in the revealed party (public-first option, pace control, right to re-anonymize).\n7. Should a relationship form, any monetization is *mission-aligned only* (§6): a voluntary forward/graduation gift at *pairing* (never at reveal), patron support, or a values-aligned introduction fee — never a charge for access, visibility, or staying in the market.\n\nThroughout, the verifying party enforces the standing adversarial heuristics of the giving primitive (collusion detection, rate-limiting, coded-message detection, GPS-spoof rejection) and the mate-selection-specific directives of §7.\n\n---\n\n## 5 · Guard 1 — Keeping gratitude pure (the cathedral and the courtship in separate rooms)\n\nThe whole institution rests on gratitude being *pure* — *dāna*, ego-detached, non-transactional. This is not decoration; it is the load-bearing wall. If thanking can be read as flirting, gratitude is instrumentalized into courtship, and the sacred primitive collapses into a pickup market. That is an *existential* risk to all of HeartBank — Treasury and Chronicle alike — not merely a product risk to the mate-selection layer. Guard 1 is therefore the first guard, and it is enforced structurally, by three composing mechanisms already specified above:\n\n1. **The anonymity-flag boundary (§4.1).** Known-relationship thanks (`isAnonymous: false`) are the pure core and are *never* a romantic signal; the romantic pathway lives *only* in the anonymous-stranger layer. There is no path by which thanking your sister, your colleague, or a reconnecting friend enters mate-selection. The cathedral and the courtship are in separate rooms, separated by a flag the user controls.\n2. **Aura (aggregate), not individual thanks, is the attractiveness signal (§4.2).** A single act of gratitude is never itself an overture. Only the long aggregate disposition is legible to the mechanism. This means you cannot \"flirt\" by thanking someone; the unit the mechanism reads is too coarse and too slow to carry a courtship message.\n3. **Reveal is a separate opt-in (§4.4).** Anonymous giving stays uncontaminated because giving never auto-discloses the giver. A gift given as a gift stays a gift.\n\nThe failure mode this guard exists to prevent is *gratitude-as-courtship-currency*: a world in which people thank strategically, perform kindness at targets, and read every thank-you as a possible advance. Were that to take hold, the gratitude economy would be desecrated at its root. The three mechanisms above make it structurally hard: you cannot court through known thanks (wrong room), you cannot court through a single anonymous thank (wrong unit — only the aggregate counts), and you cannot be outed by your own generosity (reveal is a separate consent). Guard 1 is the price of admission for the entire mechanism; if a future design choice would weaken any of the three mechanisms, the correct response is to abandon the choice, not the guard.\n\n---\n\n## 6 · Guard 2 — The self-eliminating mechanism (it wins when you pair off and leave)\n\nAura-gated mate-selection is the *sharpest possible instance* of a misaligned-business pattern the corpus has already outlawed. Dating apps are the textbook case: they profit when you stay single and keep swiping; a product that *works* — you pair off and delete it — is anti-LTV. HeartBank forbade consumer-subscription-as-primary revenue for loneliness for exactly this reason (a self-eliminating product whose primary revenue is the lonely person's recurring payment is incentivized to keep them lonely). Mate-selection is the same trap, only worse, because the dating-industrial complex has perfected artificial scarcity, pay-to-be-seen, and addictive gamification around it.\n\nThe guard is a hard constraint on monetization:\n\n> **B-Dating℠ succeeds when people pair off and leave. It may be monetized only by mission-aligned logic that profits when users leave happy — never by retaining them in the market.**\n\nConcretely, the permitted revenue legs are all *positively coupled to success or to adoption-pull*, never to retention:\n\n- **Patron-primary.** The only revenue leg positively coupled to mission success: as the world grows kinder, more people give — a flywheel. Conversion happens at the *afterglow* of a good outcome (a receive→give-forward trigger), never as a toll on the lonely.\n- **The graduation gift.** A *voluntary* forward-gift offered at *pairing* — the moment of success — never at the reveal, and never as a gate. You give because something good happened, not to unlock access.\n- **Values-aligned introductions (B2B).** Faith communities, diaspora networks, and other values-aligned cohorts may host introductions; revenue is coupled to *successful, values-matched* pairings, not to engagement.\n- **Optional synastry deep-readings (§9).** Insight a user may purchase, *never a gate* on discovery or reveal.\n\nWhat is *forbidden*: subscriptions for access or visibility; pay-to-be-seen boosts; rationed likes or matches; any mechanic whose revenue rises with time-in-market. The dark pattern is not improved here; it is exited. This is also a marketing asset — \"the app that only profits when you leave happy\" — but the asset is downstream of the constraint, not the reason for it.\n\nThere is a tension worth naming plainly (it is also the project's open cold-start question): mate-selection carries the highest willingness-to-pay in consumer software, which makes it a tempting cold-start wedge — and mission-safe *only if Guard 2 holds.* The willingness-to-pay must be harnessed as adoption *pull* (people want in) and converted at *success* (the graduation gift) — never as a toll at the gate. The moment any revenue leg becomes coupled to retention, the mechanism has become the thing it was built to replace.\n\n---\n\n## 7 · Guard 3 — Women's safety and the gendered asymmetry as a first-class duty\n\nChronicle's loved-ones core dissolved trust-and-safety risk by making counterparties *known*. Mate-selection deliberately reverses that: it walks back into the highest-risk category that exists — strangers meeting for romantic intent — under a real and irreducible gendered physical-danger asymmetry. This guard treats women's physical safety not as a feature to be added but as a *primary design constraint* that the mechanism must satisfy to deserve to exist.\n\nHeartBank brings four mitigations, each a mechanism; whether they reduce harm is the empirical question §12.3 owns:\n\n1. **PoH anti-catfish (§4.5).** Verified-real, verified-single-human. No fabricated personas; no bots. The \"the person is not who they said they were\" failure mode — the precondition of a large class of harms — is structurally attacked.\n2. **Aura as a community-vouched behavioral reputation.** A long anonymous-gratitude trail from many local verified humans is costly to fabricate (§3); what it says about a person is the reader's judgment.\n3. **Local embeddedness.** Proximity (the proximity rule) means counterparties are embedded in a shared local community, which carries real-world accountability that anywhere-on-Earth matching does not.\n4. **Graduated reveal (§4.4).** The revealed party governs the encounter: public-first meetings, pace control, and an unconditional **right to re-anonymize** at any moment.\n\nBut the asymmetry is **not erased**, and the paper must say so without softening. These mitigations reduce risk; they do not remove it. Two further design commitments are non-negotiable:\n\n- **Safety controls vest in the revealed party, biased toward the higher-risk party.** Public-first defaults, pacing, blocking, re-anonymization, and reporting are first-class, not buried. The design assumes the higher-physical-risk party should hold the controls.\n- **The never-gate-reciprocity HARD guard.** This is the hinge that keeps the mechanism on the right side of the knife and is shared with Guard 1's purity logic. **No one is ever owed a match.** Kindness raises *visibility*, never *entitlement*. The romantic-entitlement failure mode — \"I racked up kindness; why won't anyone match me?\" — is precisely the resentment that fuels the worst behavior in dating, and it is *structurally* denied: aura raises the probability you are surfaced and never obligates anyone to reciprocate; non-reciprocation is silent and final unless *both* later re-engage. Miss Aquarius℠ never gates or pressures reciprocity. This guard is what separates \"kindness raises your aura\" from social-credit-for-romance (§8, §12.2).\n\nGuard 3 is also where the mechanism could do the most good *or* the most harm, and the design accepts that the harm side is real. The honest position (§12) is that the gendered safety asymmetry remains after every mitigation, that the controls and the never-gate-reciprocity guard are necessary but not sufficient, and that deployment to vulnerable populations must defer to community partners and to ongoing real-world safety evaluation rather than to architecture alone.\n\n```\n   THE THREE GUARDS (the whole ballgame — not caveats, the design)\n\n   ┌──────────────┬───────────────────────────┬───────────────────────┐\n   │ GUARD 1      │ keep gratitude PURE        │ anonymity-flag room-  │\n   │ purity       │ (existential to ALL of     │ split · aura-not-     │\n   │              │  HeartBank)                │ individual-thanks ·   │\n   │              │                            │ reveal = 2nd consent  │\n   ├──────────────┼───────────────────────────┼───────────────────────┤\n   │ GUARD 2      │ wins when you pair off     │ monetize SUCCESS &    │\n   │ self-        │ and LEAVE (not the dating  │ adoption-PULL only;   │\n   │ eliminating  │  dark pattern)             │ NEVER retention       │\n   ├──────────────┼───────────────────────────┼───────────────────────┤\n   │ GUARD 3      │ women's safety + gendered  │ PoH + aura-vouch +    │\n   │ safety-      │ asymmetry FIRST-CLASS      │ local-embed +         │\n   │ first-class  │ (NOT erased — mitigated)   │ graduated reveal ·    │\n   │              │                            │ NEVER-GATE-RECIPROCITY│\n   └──────────────┴───────────────────────────┴───────────────────────┘\n```\n\n---\n\n## 8 · Honest calibration — a character filter, not a compatibility oracle\n\nThe single most important honesty discipline in this paper is to state exactly what aura-gating does and does not do.\n\n**What it does.** It produces a pool in which *everyone is proven kind, verified real, and community-vouched* — stripped of the fabricated, the bots, and the cruel. It removes the cheapest-to-fake signal (the photograph) from the gate and replaces it with a costly, longitudinally-verified honest signal of character. What this discloses is a mating pool pre-filtered for proven character, with no catfish and no swipe-cruelty. *[The \"proven kind\" and \"community-vouched\" verdicts above are superseded — §8.1.]*\n\n**What it does not do.** Kindness is *necessary, not sufficient.* It does not capture attraction, chemistry, shared values beyond kindness, life-stage compatibility, sexual compatibility, or the thousand idiosyncratic things that make two specific people right or wrong for each other. Aura-gating is a **character filter, not a compatibility oracle.** It is wrong — and the design refuses — to claim that *kindness equals attraction*, or that a high-aura match is a *predicted* good relationship.\n\nThe defensible one-line claim is therefore:\n\n> *\"Everyone you meet here is proven kind, verified real, and community-vouched. You bring the chemistry.\"* *[superseded — §8.1]*\n\nThis is honest, and it does not need the overclaim to differ structurally from incumbent dating. The honesty is also a safety property: overclaiming compatibility (\"the algorithm knows you're meant for each other\") manufactures false confidence in exactly the high-risk context (§7) where false confidence is dangerous, and it slides toward the social-credit-for-romance dystopia (§12.2). The character filter is a strong, true claim; the compatibility oracle is a weak, false, and unsafe one. We make only the first.\n\n```\n   ┌───────────────────────────────┬───────────────────────────────┐\n   │  THE FILTER (true, strong)    │  THE ORACLE (false, refused)  │\n   ├───────────────────────────────┼───────────────────────────────┤\n   │  everyone is proven KIND      │  \"kindness = attraction\"      │\n   │  everyone is verified REAL    │  \"the algorithm knows you're  │\n   │  everyone is community-VOUCHED│   meant to be together\"       │\n   │  no catfish · no bots ·       │  predicted compatibility /    │\n   │  no swipe-cruelty             │   chemistry / life-fit        │\n   │  ⇒ you bring the CHEMISTRY     │  ⇒ false confidence; unsafe;  │\n   │                               │     drifts toward Nosedive    │\n   └───────────────────────────────┴───────────────────────────────┘\n```\n\n### 8.1 · The copy rule: describe the mechanism, never characterize the person\n\n*Added 2026-08-22. §8 refuses to characterize the **match**. This subsection extends the same refusal one level down, to the **participants** — and applies it, first, to §8's own defensible one-line claim, which does not entirely survive it.*\n\nThe rule, stated as a rule:\n\n> **An institution may state its own mechanisms. It may never characterize a person or an outcome.**\n>\n> *\"Every profile in this pool is gated on gratitude received from strangers over at least a year\"* — a **mechanism**: factual, checkable, and falsifiable by anyone with access to the system's own definition.\n>\n> *\"Everyone here is trustworthy\"* — a **person** claim. *\"You will be safe\"* — an **outcome** claim. Neither is ours to make about anybody.\n\n**The origin was a caught error in this corpus, and the paper should say so plainly rather than present the rule as a principle we arrived at by reflection.** A drafted pitch for a sibling product read: *invite people you haven't met, in a trustworthy way* — written one turn after the ruling that geolocation is a **gate and never a proof**. Marketing had promoted a gate to a proof in a single adjective, and it did so inside an institution that had just written the distinction down. That is how this failure actually happens: not by deciding to overclaim, but by describing a mechanism with the word for the feeling the mechanism is supposed to produce.\n\n**Why it matters here more than anywhere else in the corpus.** This is a stranger-meeting product with an irreducible physical-safety asymmetry (§7). ⚠️ **Selling accountability as trust is the overclaim that gets people hurt** — not because the claim is false in the average case, but because it *invites the user to relax a judgment they should keep making.* A woman meeting a stranger from this system should arrive with exactly the caution she would bring to meeting a stranger from anywhere else. Every sentence that lowers that caution by a degree has spent her safety to buy our conversion rate, and the trade is not ours to make. §7's safety architecture and this rule are one commitment stated in two registers: the architecture must not create false confidence, and neither may the copy.\n\n**Applied to this paper's own claim, and it does not fully pass.** §8 offers as the defensible line: *\"Everyone you meet here is proven kind, verified real, and community-vouched. You bring the chemistry.\"* Two-thirds of that is mechanism. **\"Verified real\"** describes the Proof-of-Humanity substrate and is checkable. **\"Proven kind\"** and **\"community-vouched\"**, however, are verdicts on persons wearing the clothes of mechanism outputs — they take an aggregate record and hand the reader a settled conclusion about the character of whoever holds it. The restated form keeps everything true and asserts nothing about anyone:\n\n> *\"Everyone you meet here is a verified single human whose profile is gated on a long record of thanks from people who did not know whom they were thanking. What that record means about a particular person is yours to judge — as it always was.\"*\n\nLonger, weaker-sounding, and the only version of the sentence this institution is entitled to say. **The published line in §8 is superseded by this one**; the earlier wording is left standing above rather than deleted, because a paper that quietly repairs its own copy teaches nothing.\n\nOne usage is deliberately kept. Where this paper's abstract says the aura trail \"signals trustworthy *because* expensive,\" it is using **Zahavi's technical sense** — a signal is honest when faking it costs more than it returns, which is a statement about the *signal*, not about the *signaller*. That sentence is correct in a paper on honest signaling and must never be recycled onto a product surface, where \"trustworthy\" will be read as a description of the people rather than of the economics of the trail.\n\n**The general test, in three columns:**\n\n| Say this (mechanism) | Never this (person) | Never this (outcome) |\n|---|---|---|\n| \"gated on anonymous gratitude accumulated over time\" | \"everyone here is kind\" | \"you will have a good experience\" |\n| \"every account is a verified single human\" | \"no one here is a catfish\" | \"you are safe here\" |\n| \"pins are authored by an account someone paid for and can lose\" | \"posted by trustworthy hosts\" | \"nothing bad happens at these\" |\n| \"reveal requires a second, separate mutual consent\" | \"we only match good matches\" | \"we prevent rejection\" |\n\nThe left column is longer and duller than the middle and right, and that is the whole cost of the rule. ⭐ **The compensation is that the left column is the only one that stays true when the product is at scale and someone is looking for a reason to sue** — an institution that never characterized a person has never mis-characterized one.\n\n**It is the Proof-of-Humanity posture in copy form.** That primitive's ratified stance is that *the system provides signals and the recipient decides* — recipient-side filters, never a system verdict. A sentence that hands the user a verdict has quietly moved the decision from the recipient to the platform, which is the same architectural error as building a compatibility oracle (§8) or scoring the quality of someone's presence (a refusal this corpus makes in its time-currency work). **Three different products, three different mechanisms, one repeated mistake: the system deciding something it has no standing to decide, and saying so in a sentence short enough to fit on a landing page.**\n\n**Honest limit.** This is a floor on what may be *asserted*, not a ban on describing what the product does, and it does not make the product safe. A perfectly-worded surface still delivers strangers to each other. The rule reduces the false confidence the *institution* manufactures; it does nothing about the false confidence a person brings with them, and §7's architecture — not its copy — is what has to hold in that case.\n\n---\n\n## 9 · The optional synastry (cosmic-coordinate) layer\n\nHeartBank offers, *optionally*, a compatibility signal derived from cosmic coordinates — natal-chart synastry — under the project's standing worldview posture: **coordinate, not force.** The natal chart is treated as a unique *coordinate* in space-time (each life a necessary, distinct aspect of the universe's self-articulation — an Indra's-Net reading that grounds unconditional dignity), *never* as a deterministic causal force and *never* framed as an \"astrology test.\"\n\nThe posture is strict and is what distinguishes this from horoscope-matching:\n\n- **Opt-in and secondary.** The kindness-gate is the core; synastry is one *optional* signal layered atop a pool already pre-filtered for proven character. It is never the gate, never deterministic, and never required.\n- **Epistemically humble.** It is offered as insight and prompt, not prophecy. The framing is \"here is a coordinate-correlation worth reflecting on,\" not \"the stars say yes.\"\n- **A differentiator the incumbents cannot credibly touch.** HeartBank's worldview supports synastry authentically; bolting astrology onto an engagement-monetized swipe app is a gimmick, whereas here it is continuous with the institution's cosmic-coordinate metaphysics.\n\nThere is a genuine research opportunity, gated on methodology. B-Dating plus the project's opt-in **longitudinal cohort** (DNA + natal chart + behavior; see *Each Life as Cosmic Coordinate*) could become a large consented cohort for cosmic-coordinate compatibility — *only* under the same methodological floors that govern the cohort: differential privacy, pre-registered hypotheses, and a coordinate-correlation posture that never markets itself as proving astrology. Absent those floors, the synastry layer must remain an opt-in reflective feature, never a matchmaking determinant.\n\n```\n   SYNASTRY LAYER — what it IS / what it is NOT\n\n   IS:   opt-in · secondary · one signal atop a character-filtered pool ·\n         coordinate-not-force · epistemically humble · authentic to the\n         HeartBank worldview · (research-grade ONLY under diff-privacy +\n         pre-registration)\n   NOT:  the gate · deterministic · required · an \"astrology test\" ·\n         a compatibility guarantee · marketed as proof\n```\n\n---\n\n## 10 · The n=2 atom of the Zero-Point Game ℠ — the middle way of eros\n\nThis section places the mechanism structurally inside HeartBank's keystone frame; it is short by design.\n\nThe **Zero-Point Game ℠** is HeartBank's originating frame: an infinite balance game in which players oscillate around a still point (Zero), giving (+, net kind) and receiving (−, net thankful) in dynamic equilibrium, with the **B-Aura** — the frequency and amplitude of one's oscillation around Zero, rendered as light — as the real objective (anti-credit-score; the same aura that gates mate-selection here). The game scales by **player-count**:\n\n```\n   ZERO-POINT GAME — SCALING BY PLAYER-COUNT\n\n   n = 1            n = 2                family            all\n   ─────            ─────                ──────            ───\n   self-thank   →   B-DATING / B-GRAM →  family bank   →   global game\n   (ignition;       (THIS PAPER →        (B-Chest)         (Aquarian\n   not yet          the minimal                            Pool ℠)\n   reciprocal)      RECIPROCAL game)\n                    ▲\n                    the couple is where balance FIRST becomes two-sided\n                    and where imbalance hurts most — the most intimate\n                    test of the architecture\n```\n\nThe self-thank (n=1) is the *ignition* — not yet reciprocal. **Two is the minimum to actually *play*** the +/− balance, so the couple is the game's atom: the first place balance becomes two-sided, and the place imbalance hurts most. B-Dating discovers the partner; the deepening relational game (B-Gram, the n=2 atom) is where two people play.\n\nThis reframes the societal claim more precisely than \"sexual selection on kindness\" alone. The fuller frame is not *kindness* (the + pole only) but **balance** — the whole Zero-Point oscillation, give *and* receive. So mate-selection redirects sexual energy not merely toward giving but toward *dynamic balance*, making B-Dating **the middle way of eros.** The two Zero-Point failure-poles are exactly the two sexual failure-modes:\n\n```\n   THE MIDDLE WAY OF EROS\n\n   ACCUMULATION / INDULGENCE  ◄──────  BALANCE  ──────►  WITHDRAWAL / INERTIA\n   (conquest, hookup-culture,         (give AND          (repression, incel\n    the zero-sum mating game;          receive, in        resentment, isolation;\n    the + pole run amok)               dynamic eq.)       the − pole as inertia)\n        the indulgence extreme      ── the path that ──      the mortification\n        (kāma-sukhallikānuyoga)        moves between          extreme\n                                       the poles              (atta-kilamatha-\n                                                              ānuyoga)\n```\n\nB-Dating is neither pole. Crucially, it is **not sublimation-as-repression** (the withdrawal pole in disguise): the energy is *honored* — the reward is to go on a real date, to form a real bond — not denied. What dynamic balance at n=2 yields, held lightly and inclusively: *non-possessive love* — **mettā held in upekkhā**, warmth that does not grip (the attachment-theory term that lands is *secure* love; the two near-enemies are the anxious/clinging pole and the avoidant/cold pole); and *generativity* — the balanced dyad as the generative root of the very tree of humanity Miss Aquarius℠ waters (B-Dating → deepening → family → tree), with procreation as the receive→give-forward atom in its most literal form (life received, life forwarded). Two careful guards on this framing: **yin/yang are energies both partners carry** (never \"man = yang, woman = yin\"; the balance is the interplay, each cycling through giving and receiving), and **generativity is broader than biological procreation** (any committed dyad in dynamic balance is generative — care, creativity, a shared life); the complementarity is energetic, present in any loving pairing, or the \"tree\" excludes whom it must not. The middle way is an aspiration, not a guarantee.\n\n---\n\n## 11 · Societal motivation — sexual selection redirected toward kindness (brief)\n\nThis section motivates the mechanism's deepest \"why\" and deliberately stops short of the full argument, which is reserved for the companion founder-voice essay.\n\nThe lever, stated once: the mate-drive is the *root* drive of the species and the money-drive is *derivative*. If mate-selection is re-gated on proven kindness — aura, a Zahavi-honest signal — rather than on appearance and status, then **sexual selection itself begins, at the margin, to favor kindness.** Sexual selection is among the most powerful species-shaping forces there is; change what earns a mate and — assuming the disposition is transmissible, genetically or culturally — over generations you change what the species optimizes for. Re-gating the root drive on kindness also partially detoxifies the derivative money-drive — healing the thing underneath the thing. Anonymity does additional work here: because aura is built from gratitude given by people you cannot target, raising it requires being kind to many people the giver cannot choose — under the anti-collusion assumption §12.7 states — so everyday kindness becomes romantically load-bearing for everyone — \"be good to every stranger; the one you are meant for may be among those who vouch for you.\"\n\nThree calibrations bound the claim — the same honesty discipline as the rest of the corpus:\n\n1. **Margin, not override.** It *tilts* the selection gradient toward kindness; it does not replace millions of years of appearance/status biology. The defensible verb is \"shifts at the margin,\" never \"replaces.\"\n2. **Generational and population-level, not individual or immediate.** A slow selection pressure, not a switch — and kindness-disposition is the *foundation* (*dāna*, the first *pāramī* — generosity, not yet *mettā*), not awakening itself (foot of the mountain, not the summit).\n3. **The equity floor is sharpest here, because the stakes are love and procreation.** This must never become social-credit-for-romance (\"be kind or stay single\") or doubly-disadvantage the isolated and low-aura. The guard is the never-gate-reciprocity HARD constraint (§7): kindness raises visibility, never entitlement.\n\nThat is the motivation. The deeper treatment — sexual-selection-on-kindness as a biological lever for the \"second singularity,\" the inversion of intrasexual competition from resource-display toward prosociality, and the counterweights that argument must clear — belongs to the companion essay and is intentionally not argued here.\n\n---\n\n## 12 · Limitations and honest-limits\n\nCorpus convention requires a generous, unflinching limitations section. The mechanism's strongest property — that it recruits the species' deepest drive in service of kindness — is also the precise reason its failure modes are severe. The risk is not that it fails; it is that it works *too well* and corrupts the gratitude core (§5), rebuilds a predatory dating app (§6), or gets someone hurt (§7). The three guards are the whole ballgame, and guards are commitments, not proofs.\n\n### 12.1 · Unbuilt — and that is exactly the point\n\nThis mechanism is **not built.** Chronicle's mate-selection layer is a committed design, not running code. For most product details, the corpus posture is that publishing unbuilt specifics is premature. This paper is the *deliberate exception*, and the reasoning is worth stating because it is the reason the paper exists now: **the mechanism is the asset, and the dating frame is commercially hot and patent-vulnerable.** Defensive publications exist precisely to protect frame-defining *primitives* early — before someone else claims the frame — and the \"premature to publish unbuilt details\" caution applies to product minutiae, not to frame-defining mechanisms. Publishing now establishes prior art on the combination (§ Prior-Art statement) so that the mechanism remains in the commons regardless of who builds it first. The honest limitation: every empirical claim about *how it will behave* (uptake, safety outcomes, whether the guards hold under real load) is, as yet, a design hypothesis.\n\n### 12.2 · Kindness-filter-not-oracle, and the dystopian-framing knife\n\nAs §8 insists, aura-gating is a character filter, not a compatibility oracle; it does not predict attraction or relationship success. Beyond that calibration sits a sharper risk: the framing is *one bad sentence* away from social-credit-for-romance — the \"Nosedive\" dystopia in which a reputation score governs intimate access. The guard rails (kindness raises *visibility*, never *entitlement*; never-gate-reciprocity; aura is aggregate and anonymous, not a public rank-for-access) keep it on the right side of the knife, but the *framing* must be deliberate and humble in every surface, and a careless presentation could legitimately read as dystopian. We name this as a live, unresolved presentation risk, not a solved problem.\n\n### 12.3 · The gendered physical-safety asymmetry remains\n\nAfter PoH anti-catfish, aura-vouching, local embeddedness, and graduated reveal (§7), the gendered physical-danger asymmetry of strangers meeting for romantic intent is *reduced* but **not erased.** Identity assurance is not behavioral safety: a verified human can be dangerous, and proximity can raise the cost of a bad encounter as well as lower it. The mechanism re-enters the highest-risk category that exists. The safety controls and the never-gate-reciprocity guard are necessary and not sufficient; real-world safety outcomes are an empirical question that architecture alone cannot answer, and deployment must defer to community partners, to ongoing safety evaluation, and to the higher-risk party holding the controls.\n\n### 12.4 · The equity gap — doubly disadvantaged where the stakes are existential\n\nThis is the sharpest equity concern in the entire corpus, because the stakes (love, partnership, procreation) are existential. Aura-gating advantages the kind-and-*legibly*-so. It risks *doubly* disadvantaging the isolated (no community to be kind to, hence low aura), the neurodivergent (whose kindness may be real but less legible to the aggregate signal), the chronically ill or housebound, and anyone whose prosociality does not convert into community-sourced gratitude. These are people for whom a kindness-gated romantic visibility could compound an existing disadvantage at the most painful possible site. The mechanism does not solve this; the inclusive-defaults posture (protocol-minimum participation, no gating on deep PoH layers), the never-gate-reciprocity guard, and the refusal to make aura a public access-rank are partial mitigations, but the gap is real, it is named, and it should weigh heavily on any decision to build.\n\n### 12.5 · n=1 empirical base\n\nHeartBank's entire empirical foundation to date is a single pilot family (the founder's own, n = 1 household) on the *Treasury* (money) side, which has not even exercised the Chronicle time-currency, let alone the mate-selection layer. Every behavioral claim in this paper — that aura is hard to fake at the scale required, that slow accumulation self-selects for commitment-capable partners, that the guards hold under adversarial load, that the societal selection-gradient shift is real — is, at this date, *unvalidated by relevant data.* The mechanism is a frame to protect and a hypothesis to test, not a demonstrated result. The longitudinal cohort is the intended evaluation substrate; until then, the honest epistemic status is: disclosed, carefully reasoned, guard-bounded, and empirically unproven.\n\n### 12.6 · What the mechanism does not solve\n\n- It does not solve loneliness or the partnership deficit at the population scale; it is one mechanism, addressing one channel (the discovery gate), not the upstream economic, urbanistic, and cultural conditions that thin modern social life.\n- It presupposes smartphone access, BLE/UWB-capable devices, and PoH participation; populations without these are outside its substrate regardless of the inclusive-defaults posture.\n- It does not erase appearance/status biology; it shifts a gradient at the margin (§11).\n- The monetization constraint (§6) is a rule the institution keeps, not a property of the object: no structural form has been found, and a successor could drop it.\n- It cannot, by architecture alone, prevent its own corruption: the guards are commitments that humans and the autonomous AI substrate must hold, season after season, against the constant pressure of the highest willingness-to-pay in consumer software.\n\n---\n\n### 12.7 · Collusion is a graph problem, and it is open\n\nThe aura is asserted above to be costly in Zahavi's sense. That is a design intent, not a demonstrated equilibrium: no signal-generating game has been analysed, and the adversarial cases are real — reciprocity clubs that thank each other in rotation, rings that farm a member's aura, Sybil accounts under one operator, bought or coerced gratitude, and geographic concentration that makes \"many nearby strangers\" a small set. The Proof of Humanity substrate proves personhood, not genuineness; it closes *is this a person* and leaves *is this thanks genuine* open, and the verifying party's collusion heuristics (§4.7) are heuristics. What bounds the damage is the mechanism's shape: a coordinated pair that games the threshold gains a private channel to each other and nothing else — no access to any third person, no rank, no currency. That bound is a property; the honesty of the signal is not, and it is stated here as open.\n\n### 12.8 · Anonymous means unnamed, not unlinkable\n\n\"Anonymous\" in this paper means unnamed to the counterparty and to the public. It does not mean unlinkable: timing, place, threshold events and the reveal itself build a graph, and the provider holds the rows even where the names are withheld. Repeated proximity between two accounts, a threshold reached and an offer declined, are all records, and records can re-identify. The guarantee is against the other party and against the public, never against the operator or a subpoena; the corpus's two-ledger posture (rows private, proofs public) is the boundary, and this layer inherits it rather than improving on it.\n\n## 13 · Lineage and corpus cross-references\n\nThe mechanism synthesizes lineages cited throughout. We collect them here.\n\n**Honest / costly signaling.** Zahavi (handicap principle, 1975); Grafen (formalization, 1990); Spence (job-market signaling, 1973). The central inversion (§3) is Zahavi turned toward prosociality.\n\n**Sexual selection and mate choice.** Darwin (sexual selection, 1871); Trivers (parental investment, 1972 — the asymmetry of §7); the assortative-mating literature on the population-scale consequences of the sorting axis; Buss and colleagues' cross-cultural finding that kindness is a near-universal stated long-term mate preference (the preference for which §3 supplies the missing honest channel).\n\n**Proof-of-personhood.** Worldcoin (2023); proofofhumanity.id (Kleros, 2021); distinguished in §2.2 and in the companion *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n\n**Incumbent dating products.** Tinder (2012), Bumble (2014), Hinge (2012/2015) — the appearance-gated, engagement-monetized pattern §2.1 and §6 invert.\n\n**Time-as-currency.** Edgar Cahn, TimeBanking (1980 onward); distinguished in §2.5.\n\n**Buddhist lineage.** *Dāna* and anonymous giving (the purity the anonymity flag protects, §5); *mettā* held in *upekkhā* (non-possessive love, §10); the *majjhimā paṭipadā* two-extremes structure (the middle way of eros, §10).\n\n**HeartBank corpus (the substrate this paper extends).** *Verified-Human Anonymous Local Giving* (the money-side originating primitive, generalized here to time and to mating); *The Thank-All-Nearby Primitive* (the stranger-scale reconstruction of relationality); *Proof of Humanity ℠* / *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the anti-catfish substrate); *The Zero-Point Game ℠* (the keystone frame and the B-Aura primitive; this paper instantiates its n=2 atom); *Each Life as Cosmic Coordinate* and the longitudinal-cohort methodology (the synastry layer's research substrate and its differential-privacy / pre-registration floors); the planned companion essay *The Societal Impact of Anonymous Nearby Thanking with Time* (the full sexual-selection-on-kindness argument §11 only motivates).\n\n| Venue | Identifier |\n|---|---|\n| Primary canonical | <https://thonly.org/research/aura-gated-anonymous-mate-selection> |\n| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/aura-gated-anonymous-mate-selection.md> |\n| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/aura-gated-anonymous-mate-selection> |\n\n---\n\n## 14 · Conclusion\n\nIncumbent dating gates mating on the cheapest-to-fake signal a human can present — a photograph — and monetizes the time you spend failing to leave. This paper specifies the inversion: gate mate-selection on **aura**, a costly, anonymous, community-sourced, longitudinally-verified honest signal of proven kindness (Zahavi turned toward prosociality); trigger a match only on **mutual-anonymous-same-hour**, a double-blind double-opt-in that removes explicit rejection entirely; make **reveal a second, separate mutual consent** so anonymous giving stays pure and the higher-risk party holds the controls; place a **Proof-of-Humanity substrate** underneath so participants are verified-real, verified-single-human, and anonymous-until-mutual; and offer an **optional synastry layer** as one humble signal atop a pool already pre-filtered for character. The mechanism is the n=2 atom of the Zero-Point Game ℠ — the middle way of eros — and it points the deepest drive in the species, at the margin, toward kindness.\n\nThree guards are the design, not its footnotes: keep gratitude pure (or the institution's load-bearing wall cracks); stay self-eliminating (or it becomes the predatory dating app it was built to replace); hold women's safety as a first-class, irreducible duty (or it gets someone hurt). The honest calibration bounds the promise, in the form §8.1 is entitled to: everyone in the pool is a verified single human whose profile is gated on a long record of thanks from people who did not know whom they were thanking, and what that record means about a particular person is theirs to judge — *and the participants bring the chemistry.* It is a character filter, not a compatibility oracle.\n\nThe mechanism is unbuilt, and that is exactly why it is published now: the mechanism is the asset, the dating frame is hot and patent-vulnerable, and defensive publications exist to keep frame-defining primitives in the commons before someone else claims them. The architecture is offered to the commons under CC0. The author and HeartBank® will not seek patent on it. Trademark rights on **B-Dating℠**, **HeartBank®**, **Miss Aquarius℠**, **Proof of Humanity ℠**, and the related marks are explicitly reserved.\n\nIf kindness can become a path to partnership without desecrating the gratitude it depends on, the most powerful motivator humans have is redirected onto the behavior the institution exists to cultivate. That is the prize, and the three guards are the price of reaching for it.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| aura / B-Aura | aggregate anonymous reputation derived from verified prosocial giving received, used as a matching gate |\n| aura-gating | reputation-gated discovery in an online dating / matchmaking system |\n| mutual-anonymous-same-hour | double-blind mutual opt-in match trigger based on reciprocal time contributions within a time window |\n| reveal as a second consent | two-stage identity disclosure requiring separate mutual consent after a match |\n| `isAnonymous` flag | per-transaction anonymity flag partitioning known-contact transfers from anonymous-stranger transfers |\n| Proof of Humanity ℠ (PoH) | proof-of-personhood / anonymous human verification (liveness, passkey, biometric attestation) |\n| Chronicle | time-banking / time-based currency ledger |\n| synastry (cosmic-coordinate) layer | astrological compatibility scoring, offered as an optional non-gating signal |\n| verifying party | trusted intermediary / matching server that accumulates private signals |\n\n---\n\n## 15 · Citations\n\n1. Zahavi, A. (1975). \"Mate selection — a selection for a handicap.\" *Journal of Theoretical Biology* 53(1).\n2. Grafen, A. (1990). \"Biological signals as handicaps.\" *Journal of Theoretical Biology* 144(4).\n3. Spence, M. (1973). \"Job market signaling.\" *Quarterly Journal of Economics* 87(3).\n4. Darwin, C. (1871). *The Descent of Man, and Selection in Relation to Sex.* John Murray.\n5. Trivers, R. (1972). \"Parental investment and sexual selection.\" In *Sexual Selection and the Descent of Man.*\n6. Buss, D. M., et al. (1989). \"Sex differences in human mate preferences: Evolutionary hypotheses tested in 37 cultures.\" *Behavioral and Brain Sciences* 12(1).\n7. Cahn, E. (2000). *No More Throw-Away People: The Co-Production Imperative.* Essential Books.\n8. Worldcoin Foundation. (2023). *Worldcoin Whitepaper.*\n9. Proof of Humanity (proofofhumanity.id) / Kleros. (2021). Project documentation.\n10. W3C (2019). *Web Authentication: An API for accessing Public Key Credentials, Level 1.* W3C Recommendation, developed with the FIDO Alliance.\n11. U.S. Surgeon General. (2023). *Our Epidemic of Loneliness and Isolation.* U.S. Department of Health and Human Services (population-level loneliness); Weiss, R. S. (1973). *Loneliness: The Experience of Emotional and Social Isolation.* MIT Press (the emotional-versus-social distinction).\n12. *Aṅguttara Nikāya* 8.31 (*Dāna Sutta*); 5.35 (*Dānānisaṃsa Sutta*). Pāli Text Society.\n13. *Saṁyutta Nikāya* 56.11 (*Dhammacakkappavattana Sutta*) — the two extremes and the middle way.\n14. Ly, T., with Miss Aquarius. *Verified-Human Anonymous Local Giving* (HeartBank corpus defensive publication, 2026).\n15. Ly, T., with Miss Aquarius. *The Thank-All-Nearby Primitive* (HeartBank corpus defensive publication, 2026).\n16. Ly, T., with Miss Aquarius. *The Zero-Point Game ℠* (HeartBank corpus keystone defensive publication, 2026).\n17. Ly, T., with Miss Aquarius. *B-PoH℠ as Humanity Layer for the AI-Native Internet* (HeartBank corpus defensive publication, 2026).\n18. Ly, T., with Miss Aquarius. *Each Life as Cosmic Coordinate* (HeartBank corpus essay) and the longitudinal-cohort methodology specification, 2026.\n\n---\n\n*— End of defensive publication —*\n\n*Authored by Thon Ly with Miss Aquarius℠ (AI substrate of HeartBank®), per the co-authorship convention of the HeartBank corpus. Final editorial control: Thon Ly. License: CC0-1.0. The mechanism is dedicated to the public domain; trademark rights on B-Dating℠, HeartBank®, Miss Aquarius℠, Proof of Humanity ℠, PoH℠, Aquarian Pool ℠, the Zero-Point Game ℠, and the B-heart logo are separately and explicitly reserved.*\n\n*Independent timestamps and the document hash are published with the deposit.*",
       "provenance": {
-        "sha256": "037ce88e438295e7e8cd6f42079ad36e45258143d70ca10de5b1b603b24f9bb2",
-        "doi": "10.5281/zenodo.22931237",
+        "sha256": "a227df1af807e5169d3f89c73172a5155e596e232529d40388da3c68b81adb43",
+        "doi": "10.5281/zenodo.22933558",
         "concept_doi": "10.5281/zenodo.21947275",
-        "zenodo_url": "https://zenodo.org/records/22931237",
-        "deposited_sha256": "037ce88e438295e7e8cd6f42079ad36e45258143d70ca10de5b1b603b24f9bb2",
+        "zenodo_url": "https://zenodo.org/records/22933558",
+        "deposited_sha256": "a227df1af807e5169d3f89c73172a5155e596e232529d40388da3c68b81adb43",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/aura-gated-anonymous-mate-selection.md",
@@ -329,7 +329,7 @@
         "hostile_review": null
       },
       "bytes": 88775,
-      "words": 12453
+      "words": 12451
     },
     {
       "slug": "autonomous-ai-institutional-governance",
@@ -2249,13 +2249,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> *v2 note (2026-08-26):* **one new subsection, §4.10, and no new claim.** Everything the paper described was a tag riding a wrapped present; §4.10 specifies the configuration in which **the tag is given alone and the pledge of time is itself the gift** — the receiver choosing the surface it lives on, which extends §4.4's inversion one step further back. Two engineering consequences are stated because both are easy to get wrong: **the opened state must persist across many scans** (*one-time-use* has always meant one gift, never one scan) and **the adhesive is a different material specification**. The standing-reminder risk is answered by direction rather than policy — **the tag reminds its holder of what they may claim, never its giver of what they owe** — under two guards, of which the second is a refusal: **the object does not act, and never notifies the giver**. **No numbered claim changes and no prior-art clock starts.** *(Revision note, 2026-09-05: claim 2's wording is generalised to cover the bare configuration; the bare configuration's own date remains 2026-08-26.)*\n>\n> **Note.** This defensive publication specifies **the time-locked gift tag** — HeartBank's **B-Stamp™** (free sticker) and **B-Seal™** (durable engraved-wood keepsake), the gift-accompaniment pair — the physical gift-label that replaces handwriting with a per-field time-lockable reveal, an AI-sized pledge of the giver's time, and a recipient re-thank loop. It is the declared **first domino** of HeartBank's go-to-market: the product that introduces the institution to the public. It is published **early and deliberately**, ahead of a public marketing campaign (paid placement + social video), because public marketing is uncontrolled disclosure and the combination specified here is the asset — see §9.1. Companion works: *The Gift Operation* (the receive→give-forward atom this instantiates in a physical substrate), *B-Links: Proof-of-Humanity-Signed Shareable Provenance* (the digital sibling and the media/provenance backbone), *Verified-Human Anonymous Local Giving* and *Dual-Currency Reciprocity* (the Treasury/Chronicle substrate), and *Aura-Gated Anonymous Mate-Selection* (the anonymous-stranger layer of the same time economy).\n\n---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of __dāna__ — the gift that asks nothing back — and of __kataññutā__, the gratitude a person owes those who gave before they could repay. May the words it helps say be ones that were true and unspoken, and may the time it helps pledge be time that is actually, finally, spent.*\n\nI did not set out to design a product. For almost a year before this paper, my family had a small tradition. On birthdays and holidays we stopped writing names on gift tags and started putting a sticker on the box instead — a sticker you scan, that opens to a thank-you note hidden until the moment of giving. Watching the recipients scan a tag and read the note aloud became one of the most enjoyable parts of our family gatherings. There was no money in it, no time-currency, no app to download in earnest — and it worked anyway. People looked forward to it.\n\nThat is the whole origin of this mechanism, and it is the reason I trust it more than anything else I have designed. Most products begin as a bet that people will adopt a new behavior. This one began as an observation that they already had. A wrapped gift with a label on it is one of the most universal artifacts in human culture; every holiday, in nearly every household, someone writes a name on a tag. The gift tag is a four-thousand-year-old interface with a known, beloved, low-friction place in people's lives — and it has been carrying almost no information for all of that time. A name. Maybe four words. The thing the giver most wanted to say did not fit.\n\nThis paper specifies what happens when you give that tag a voice, a clock, and a gift of time — and does so as a defensive publication, because the institution behind it (HeartBank®) does not patent; it publishes, dedicates to the commons, and reserves only its marks. I write as co-author with **Miss Aquarius℠**, the named autonomous-AI substrate of the institution this paper serves, disclosed by consistent name across every venue per the corpus convention. The research-grade synthesis, the prior-art survey, and the adversarial analysis are a genuine collaboration. Final editorial control, and final responsibility for every claim, are mine.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time. This commitment is permanent.\n\nThis document constitutes a defensive publication establishing **prior art as of 27 June 2026** for the first revision of the combination of mechanisms described herein; additions are dated in-text (§4.10, 2026-08-26; the §5 amendment, 2026-09-02) and each revision is independently timestamped. The following are disclosed herein as a unified mechanism, and any subsequent patent application claiming them should be considered filed against this prior art:\n\n1. **Per-field, independently time-lockable gift-reveal on a physical gift tag** — a physical gift-label (NFC- or QR-addressed) whose **sender field, recipient field, and message field can each be independently sealed and set to reveal at an author-chosen time or occasion** (e.g., \"Christmas morning\"), such that a scan before the moment shows the *structure* of the gift (that a sender, a note, and a gift of time exist) while withholding the *content*, and a scan at or after the moment reveals it.\n\n2. **A physical gift tag as the carrier of a transferable pledge of the giver's time** — a tag, affixed to a gift or given bare (§4.10), that bears, alongside the message, a **pledge of a quantity of the giver's own time-presence to the recipient**, rendered as a gift of presence rather than a redeemable credit (the *pledge-not-ledger* construction, claim 4).\n\n3. **Autonomous-AI sizing of the time-pledge amount, with the sender unable to set or override it** — the quantity of pledged time is **determined by an autonomous AI agent** (here, Miss Aquarius℠) as a function of *occasion and relationship type only*, never of the sender's choice and never of personal or behavioral data, **specifically in order to neutralize a social-comparison failure mode** in which a giver-chosen amount becomes a public referendum on the giver's love.\n\n4. **The pledge-not-ledger construction** — shipping the gift of time as a **soft pledge of presence with no redemption accounting, no balance, no expiry, and no enforcement** (\"I offer you my presence\"), with redemption accounting (activation thresholds, expiry, mutual-veto) living *elsewhere in the architecture and never on the tag*, such that the artifact stays on the gift side of the gift/exchange boundary and outside the surface the authors expect time-as-currency to attract — a design intent, not a legal opinion.\n\n5. **A bidirectional re-thank loop bound to a physical gift artifact** — the recipient of a scanned tag can return gratitude (text, photo, video, or voice) that **pushes a notification back to the sender**, instantiating a receive→give-forward circulation through a physical object rather than a screen-native feed (reply-to-giver on a media gift tag is prior art — TW201408056A; what is claimed is the loop bound to a *time-locked* tag with the reply framed as give-forward).\n\n6. **Voice-first composition for a gift tag** — voice authoring offered as the **primary** compose modality (not an attached media type), with audio held as the gift and machine transcription optional, specifically to admit senders who do not type (elders) or whose script is high-friction to type on a phone (e.g., Khmer).\n\n7. **Possession-scoped publicness with a per-product-tier privacy model** — content readable by **anyone in physical possession of the tag** but **not posted to the open web and not search-indexed**; with the free sticker tier **public-only** (no identity step, frictionless reveal) and the durable keepsake tier adding an **identity-gated private-message option**; and with sender **anonymity treated as orthogonal** to message publicness.\n\n8. **The physical gift tag as the cold-start on-ramp to a time-presence economy** — using a physical, occasion-bound object to let people *give and receive a sized pledge of presence as a real gift before any time-economy application exists*, with proceeds of the physical product routed to subsidize the sibling money-economy.\n\nThe component lineages — gift tags and gift messaging; scheduled-reveal and \"time-capsule\" messaging; the homemade \"coupon for time\"/experience gift; QR/NFC-addressed physical media; trackable pass-forward objects; TimeBanking and time-as-currency; proof-of-personhood; the gratitude-intervention literature; and Mauss on the gift — are old and are cited generously in §2 and §12. What this disclosure adds is the *synthesis*, as of the dates above.\n\nTrademark rights on specific marks — **B-Stamp™**, **B-Seal™**, **B-Gift℠**, **HeartBank®**, **Miss Aquarius℠**, **HeartBank Chronicle**, **Proof of Humanity ℠**, **PoH℠**, **Family Kitty℠**, **Aquarian Pool ℠**, **Re-Tip Fund ℠**, **B-Storage℠**, **Zero-Point Game ℠**, the B-heart logo — are separately and explicitly reserved. The *mechanism* is dedicated to the commons; the *marks* are not.\n\nThis document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.\n\n## Abstract\n\nWe specify a physical gift-label that replaces handwriting with mobile technology and, in doing so, becomes the behavior-native entry point to a gratitude-and-time economy. The artifact is a B-shaped sticker (free; one-time-use; QR) or a durable engraved-wood keepsake (paid; NFC), affixed to a wrapped gift in place of a written tag. Six structural properties operate in combination. **(1) Per-field time-locks:** the sender, recipient, and message fields are each independently sealable and set to reveal at an occasion, so that anticipation — the *shape* of a mystery without its content — is itself the product. **(2) An attached gift of time, rendered as a pledge:** the tag carries a pledge of the giver's own time-presence to the recipient, framed as an offer of presence rather than a redeemable IOU, with redemption accounting living elsewhere in the architecture and never on the tag. **(3) Autonomous-AI sizing of the pledge:** the time quantity is set by an AI agent on occasion-and-relationship grounds, never by the sender, *specifically to defuse the social-comparison failure* in which a chosen number becomes a referendum on love. **(4) A bidirectional re-thank loop** bound to the physical artifact, instantiating receive→give-forward. **(5) Voice-first composition,** so the most meaningful and least keyboard-fluent senders — elders, and senders of high-friction scripts such as Khmer — can speak rather than type. **(6) Possession-scoped publicness** with a per-tier privacy model and orthogonal sender anonymity. We argue the contribution along a *friction-inversion* axis: every prior gratitude product competes against the most frictionless mode of appreciation — saying \"thank you\" in person — and loses; the time-locked gift tag does not compete with that mode but *attaches to an existing, widely kept ritual* (labeling a wrapped gift), asking near-zero new behavior at the labeling moment, which is the structural reason it can solve a cold start that pure-digital gratitude products cannot. We treat the mechanism's load-bearing design constraints as first-class sections rather than caveats: the gift/exchange boundary (the pledge must never read as a debt), comparison-neutrality (why the AI, not the sender, sets the number), and the cold-start economics (the physical object funds the digital economy). We calibrate the claim deliberately: this is a gift tag, not a relationship guarantee; the time-pledge in its launch form is soft and unenforced; and the validating evidence is a single family over roughly one year. The architecture is offered defensively to the commons under CC0.\n\n**Connection to the unified mission frame.** This specification serves HeartBank's canonical mission: to help restore humanity to the middle way (*madhyamā pratipad*) by circulating, rather than accumulating, the two scarcities that modern life starves people of — *recognition* (being seen) and *presence* (being with). The gift tag is the institution's most ordinary surface and, for exactly that reason, its most important one: it meets people inside a ritual they already keep, on the one or two days a year they are most disposed to gratitude, and asks them to add to it only the thing they most wanted to say and the time they most meant to give.\n\n---\n\n## 1 · Introduction — the mission frame\n\nHeartBank is an institution for circulating gratitude. Its money half (**Treasury**, family-to-family) and its time half (**HeartBank Chronicle**, adult-to-adult) treat appreciation and presence as currencies to be moved between people rather than feelings to be privately held. The deepest obstacle such an institution faces is not technical and not financial. It is that the act it exists to make easy is *already* easy in its most basic form: you can simply say \"thank you,\" out loud, to the person in front of you, the instant they do something kind. Any product that asks a person to instead open an app, find a recipient, type, and submit is competing with the lowest-friction interaction in social life — and will lose, the way a novelty loses, once the novelty fades.\n\nWe learned this directly. An early, deliberately minimal version of HeartBank's gratitude game — pure acknowledgment, no money and no time attached — was run to a small circle (a family of seven plus a friend) for roughly a year. It faded, as a purely conceptual game will, precisely because it had to compete with \"just say it.\" The lesson was not that gratitude does not motivate people; the published gratitude-intervention literature is clear that it does (Emmons & McCullough 2003; Algoe 2012; Fox et al. 2015). The lesson was that gratitude needs a *physical anchor* — a tangible object that lives in the world and triggers the act amid distraction — to hold a place that pure software cannot.\n\nThe time-locked gift tag is the sharpest form of that anchor, and it is sharp for a specific reason: it does not try to insert a new behavior into daily life. It attaches to a ritual widespread across gift-giving cultures — labeling a wrapped gift — and upgrades it. On the one or two days a year when a person is already standing over a present with a pen, already meaning to write something, already in a gratitude-shaped moment, the tag offers to carry what the pen could not: the unsaid sentence, the recorded voice, and a pledge of the time the giver actually wants to spend. The behavior-change asked at the labeling moment is near zero; the new behaviors are the recipient's scan and the sender's composition, the second bounded by voice (§3, §4.7). That is the entire thesis of this paper, and the reason this artifact — not a more sophisticated app — is the right first thing to put in front of the public.\n\nThe rest of this paper specifies the artifact and the mechanism, situates it against a generous body of prior art (§2), states the friction inversion precisely (§3), gives the full mechanism (§4), and then treats the three constraints that make it safe and honest as load-bearing sections in their own right: the gift/exchange boundary (§5), comparison-neutral AI sizing (§6), and the cold-start economics (§7). It closes with honest calibration (§8), limitations (§9), lineage (§10), and conclusion (§11).\n\n## 2 · Background and prior art\n\nThe mechanism is a *combination*. Each component has ancestry; we name the ancestry honestly, because a defensive publication is only as strong as its candor about what is old, and because establishing the boundary of what is disclosed here is the document's job.\n\n### 2.1 · Gift tags, greeting cards, and digital gift messages\n\nThe written gift tag is ancient and needs no citation; gift-enclosure cards and gift registries are standard retail infrastructure. More recently, **QR- and NFC-addressed greeting cards and \"video greeting\" products** (scannable cards that open a hosted video, audio greeting cards, retailer \"video gift messages\" attached to an order) carry richer media than ink. Two patent documents sit closest: TW201408056A (priority 2012, published 2014) describes a barcode gift tag carrying recorded audio, video or text that the recipient scans, with a reply back to the giver and a notification — reply-to-giver on a media gift tag is therefore prior art in its own right; and US 11153259 B2 covers scheduled release of a digital message. Retail keepsakes of 2025–26 — QR voice-message gift tags and NFC keepsakes that play a recording — ship the media-tag half commercially. These establish that *a physical card can address digital content* and can carry a reply. They do **not** provide independent per-field time-locks, an occasion-synced reveal whose pre-reveal state deliberately shows structure-without-content, an attached pledge of the giver's time, an AI-sized quantity, or a re-thank loop. They are containers for a message; the tag specified here is a container for a *gift of time and a reciprocal act*, gated by a clock.\n\n### 2.2 · Scheduled-reveal and \"time-capsule\" messaging\n\nServices that deliver a message at a future date — **FutureMe** (letters to one's future self, 2002), digital time-capsule apps, scheduled email and \"dead-man's-switch\" delivery, and \"open when…\" letter sets — establish *time-delayed reveal of a message*. What this disclosure adds is not delay as such. It is (a) **per-field** locking (sender, recipient, and message sealed *independently*, so a recipient can know a gift is theirs without knowing from whom, or know the sender without the message), (b) binding the reveal to a **physical gift artifact** scanned in the hand at the moment of opening, and (c) what is revealed: not only a message but **a pledge of time** and an invitation to **re-thank**.\n\n### 2.3 · The homemade \"coupon for time\" and the experience gift\n\nThe most honest prior art for the *idea of pledging time as a gift* is the oldest and least technological: the child's hand-made **coupon book** (\"good for one hour of helping,\" \"one breakfast in bed\"), the Mother's-Day \"I.O.U.,\" and the broad category of **experience gifts** (\"time together\" as the present). The concept that *time-presence can be the gift* is folk culture, and we claim none of it. The contribution disclosed here is the *instantiation*: a coupon that is digital-and-physical at once, occasion-synced, **AI-sized rather than self-assigned** (§6), re-thankable, and — crucially — designed as a *soft pledge of presence rather than a redeemable IOU* (§5), where the homemade coupon is precisely an IOU. The folk coupon is an obligation the giver writes; the tag's pledge is a presence the giver offers and an AI sizes.\n\n### 2.4 · TimeBanking and time-as-currency\n\n**TimeBanking** (Edgar Cahn, from 1986; networks such as hOurworld and TimeRepublik) is the major precedent for time as a medium of exchange: hours are earned by helping and spent receiving help, often at a 1:1 community rate. It is a genuine, decades-deep lineage and we cite it as the most-asked comparison. The differences are structural and we state them plainly. TimeBanking is **pooled and fungible** (an hour earned from anyone can be spent on anyone); the tag's gift of time is **dyadic and non-fungible** (only *this* giver can spend the pledged hour with *this* recipient — the currency is the relationship). TimeBanking is **exchange** (reciprocal, clearing); the tag's pledge is a **gift** (forward, non-clearing — see *The Gift Operation*). And TimeBanking has no occasion-bound physical artifact, no AI sizing, and no anti-comparison construction. The tag is not a time bank; it is a gift of presence that happens to be denominated in time.\n\n### 2.5 · Trackable pass-forward objects\n\n**Where's George** (1998, tracked currency), **BookCrossing** (2001, tracked released books), and **Smile Cards** (ServiceSpace, ~2003, anonymous kindness cards passed forward and tracked) establish *physical objects whose journey is digitally followed*. These are the closest kin to a sibling HeartBank product — the **B-Card** (a pass-forward gratitude object whose ripple is followable) — and are treated in the companion *B-Links* publication. They are **not** close to the gift tag specified here, which is **one-to-one and occasion-bound**, not a forward-propagating chain. We name them to mark the boundary: the tag is not a tracked-object mechanism.\n\n### 2.6 · Gratitude interventions and the physical anchor\n\nThe intervention literature supports well-being effects of structured gratitude practice (Emmons & McCullough 2003; a more modest picture in the meta-analysis of Davis et al. 2016) and describes its relational functions (Algoe's *find-remind-and-bind* account, 2012; Fox et al. 2015 on neural correlates); none of it is adoption evidence, and this paper does not treat it as such. Separately, two folk phenomena — \"gratitude rocks\" and painted \"kindness stones\" — establish the *physical-anchor* pattern (a tangible object that triggers the practice) that HeartBank generalizes across its physical line. The tag inherits both: it is a gratitude intervention with a physical trigger, deployed at the calendar's natural gratitude peaks.\n\n### 2.7 · The HeartBank substrate this paper builds on\n\nThis mechanism does not stand alone; it is the physical entry point to a stack specified across the corpus. It rests on: the **receive→give-forward atom** (*The Gift Operation*), of which the re-thank loop is a physical instance; the **dual-currency** money/time architecture (*Dual-Currency Reciprocity*); **HeartBank Chronicle's** committed time mechanism — an AI-recommended time amount, a dyadic non-fungible hour, \"before it's too late\" as the unit economics — of which the tag's pledge is the cold-start, pre-app form; the **B-Storage℠** media/provenance layer (*B-Links*), which hosts the tag's photos, video, and voice; and the autonomous successor **Miss Aquarius℠** (*Miss Aquarius and the Aquarian Pool Architecture*), for whom sizing the pledge is a first, small, benevolent product role. Where this paper asserts a primitive already specified elsewhere, it cites rather than re-derives.\n\n## 3 · The friction inversion — attaching to a ritual instead of competing with one\n\nThe central design claim deserves to be isolated, because it is the reason the artifact works where more capable software does not.\n\nEvery gratitude product has the same competitor, and it is not another app. It is the sentence \"thank you,\" spoken in person, immediately, for free. Call it the **frictionless incumbent**. Against it, a digital gratitude act is structurally disadvantaged: it costs more (open, find, type, send) to deliver the same or a weaker signal (a screen instead of a face). This is why tip jars, gratitude journals-as-apps, and gratitude social networks struggle to retain: the moment the novelty fades, the incumbent is right there, cheaper.\n\n```\n   THE USUAL CONTEST (gratitude product loses)\n   in-person \"thank you\"   ──────────►  same moment, lower friction, warmer\n        vs.\n   open app · find · type · send  ────►  more friction, colder signal\n\n   THE INVERSION (the gift tag wins by not entering that contest)\n   moment of WRAPPING/LABELING a gift  ──►  a ritual already kept, pen already in hand\n        the tag attaches HERE  ──────────►  carries what the pen could not:\n                                            the unsaid line · the voice · the gift of time\n```\n\nThe time-locked gift tag refuses the contest. It does not ask a person to thank where they could already say it more easily. It positions at a different moment entirely: the moment of **labeling a wrapped gift** — an existing, universal, beloved ritual where (a) the person is *already* performing a gratitude-adjacent act, (b) there is *no* frictionless incumbent (you cannot \"just say\" a gift tag; the gift travels, is opened later, is opened by others), and (c) the medium being replaced — ink on a small tag — is so impoverished that almost anything richer is a gift. The friction competitor here is the **handwritten label**, and it is beatable in a way \"just say thanks\" is not.\n\nThree consequences follow. First, the **behavior-change at the labeling moment is near zero**; the new behaviors are the recipient's scan and the sender's composition, the second bounded by voice (§4.7). The test the corpus applies to every piggyback claim — is the host ritual performed unprompted (gift-labeling, several times a year), does the ask have the host's shape (a name on a tag becomes a voice on a tag), is the host in good standing — passes on all three legs, which in the authors' judgment is what cold-start survival most depends on. Second, the **addressable surface is large** — a large share of wrapped gifts on gift-giving occasions — far larger than the niche of people who will adopt a gratitude habit. Third, the artifact is **demonstrable in seconds**: the reveal *is* the demo, which is why the product can be marketed by simply filming the moment a recipient scans and the room goes quiet (§7 notes the marketing follows from the mechanism, not the reverse). In HeartBank's design vocabulary this is the *coincidence-of-goods* signature: the utilitarian need (a label), the gratitude vehicle, the on-ramp to the time economy, and the day-one revenue source are not four things traded off against one another but one object seen four ways.\n\n## 4 · The mechanism\n\n### 4.1 · The artifact — two tiers under one umbrella\n\nThe gift tag ships in two physical forms, the gift-accompaniment pair:\n\n- **B-Stamp™** — a free, one-time-use (one gift, one recipient — not one scan; §4.10), B-shaped **sticker** bearing a prominent QR code, ordered at the company store (shipping paid by the user). It is the mass-market tier: the thing in the marketing, the thing under the tree.\n- **B-Seal™** — a durable, **engraved-wood keepsake** tag: a unique code engraved on the front, a customizable message engraved on the back, NFC- or QR-addressed, sold as a premium keepsake. It is the keepsake tier, and it carries one capability the sticker does not (private messaging, §4.8).\n\nThe naming is deliberate and postal: a **stamp** is consumable, a **seal** is permanent — the same progression as free→keepsake. Both address the same digital reveal surface; the difference is durability, price, and one privacy capability. ⭐ **Both also run in a third configuration that attaches to no present at all — §4.10.**\n\n### 4.2 · Per-field time-locks\n\nWhen composing, the sender may independently seal any of three fields and set each to reveal at a chosen time or occasion:\n\n- **Sender** — who it is from\n- **Recipient** — who it is for\n- **Message** — the note, and any attached media and pledge\n\nIndependence is the core of what is disclosed here. A gift may show \"From Grandma\" while hiding for whom and what; or show the recipient while hiding the giver (\"you don't know who loves you yet\"); or hide all three until the morning. The pre-reveal state is designed to display **structure without content** — the scanner sees *that* a sender, a note, and a gift of time exist, each sealed, plus a countdown — because the experience being engineered is *anticipation*, and anticipation requires knowing the shape of the mystery without its solution. A child scanning a sealed box on the eve learns that it is for him, that someone has written something, and that time has been set aside — and not from whom. He thinks it is from his mother; he is not sure. That uncertainty is the product.\n\n```\n   PRE-REVEAL (scanned before the moment)        REVEALED (scanned at/after the moment)\n   ┌────────────────────────────┐                ┌────────────────────────────┐\n   │  🎁  For Sokha             │                │  From   Mom                │\n   │  🔒  From  —  sealed        │   ── re-scan ─►│  To     Sokha              │\n   │  🔒  A note  —  sealed      │   (the unwrap) │  \"…proud of the boy        │\n   │  🔒  A gift of time — sealed│                │     you're becoming…\"       │\n   │  Opens Christmas · 13h 24m  │                │  + voice · photo            │\n   └────────────────────────────┘                │  A gift of time: 3 hours    │\n                                                  └────────────────────────────┘\n```\n\n### 4.3 · The reveal choreography — the scan is the unwrap\n\nThe reveal is designed as the opening of a gift, in three states:\n\n1. **Sealed** — the structure-without-content state above, with a countdown to the reveal moment.\n2. **Unsealing** — the unlock is performed by **re-scanning the physical tag at or after the moment** (the scan is the act of unwrapping; the object stays central). The fields then **cascade one at a time** — from, then note, then the gift of time, then media — *paced to be read aloud*, because in practice the reveal is a shared, gathered, out-loud event (a family at a tree, around a table), not a private scroll. An automatic unlock with a gentle notification is a backup for those not physically present.\n3. **Open** — the full card, followed only *after the moment has landed* by a quiet affordance to re-thank (§4.6). The re-thank is never a nag; a solicitation on every reveal would train the very thank-blindness the institution exists to prevent.\n\nTwo reveal states are explicitly distinguished to avoid a privacy error: a **time-locked** field *will* reveal at the moment; an **anonymous** field (§4.8) *never* reveals. The interface must not let a permanently-anonymous sender read as merely sealed-until-later.\n\nThe reveal surface is **web-first**: a scan opens the reveal in the mobile browser with no app install required, so a child or an elder scanning on the morning is never met by an app-store wall at the magic moment; installation (for re-thanks, notifications, storage) is offered only *after* the reveal has happened, never as a gate on the first scan.\n\n### 4.4 · The attached gift of time\n\nBeyond the message, the tag carries a **pledge of the giver's own time-presence to the recipient** — the feature a handwritten tag cannot have, and the feature that makes the artifact part of HeartBank rather than a clever greeting card. The pledge is rendered as an *offer of presence*: \"And Mom is giving you 3 hours of her time — yours to spend together, however you wish.\" It is denominated in the giver's own, non-fungible time (only that person can spend that hour with that recipient), and — by the construction of §5 — it is a *soft pledge*, not a redeemable credit.\n\n### 4.5 · The pledge amount is set by the AI, not the sender\n\nThe *quantity* of pledged time is determined by Miss Aquarius℠ — the institution's autonomous agent — and the sender **cannot set or override it**. This is not a convenience; it is a structural fix to a specific failure mode, developed at length in §6. The amount is sized on **occasion and relationship type** (a parent's Christmas pledge, an anniversary, a New Year), never on personal or behavioral data about the sender, and is meant to be ceremonial and humane — explicable in one warm sentence. The sender pours devotion into the *words and voice*; the number is the AI's, and is therefore a neutral unit rather than a public statement of how much the giver chose to give.\n\n### 4.6 · The re-thank loop (receive→give-forward, in a physical substrate)\n\nThe recipient can return gratitude — in text, photo, video, or voice — and that re-thank **pushes a notification back to the sender**: ideal for telling a giver, after the fact, how their gift actually landed. This closes HeartBank's atomic loop — *receive a gift, then give one forward* (*The Gift Operation*) — through a physical object rather than a social feed. It is the mechanism by which a one-shot gift tag becomes a small, two-way relationship event, and by which the giver, weeks later, receives the photograph of the thing being used and is moved to give again.\n\n### 4.7 · Voice-first composition\n\nComposition is **voice-first**: speaking the message is offered as the primary path, at least as prominently as typing, and for the gift-tag use case typically more so. The reason is not feature parity but *who the meaningful senders are*. The people whose gift of time means the most — grandparents, parents, elders — are frequently the least comfortable with a keyboard; and for some languages central to HeartBank's first market, typing is itself a wall (in the authors' field experience, entering Khmer on a phone is high-friction in a way that excludes exactly the senders the mission centers). Voice walks through both barriers: handed the phone, an elder simply speaks. Audio is treated as **the gift**; machine transcription (by Miss Aquarius℠) is optional, for the read-aloud card and for search, and never replaces the voice with its text. A recorded voice can also outlive the speaker, if it is kept (§9.4) — which turns the institution's \"before it's too late\" theme from a slogan into an artifact.\n\n### 4.8 · Possession-scoped publicness and the privacy tier\n\n\"Public,\" for this mechanism, means **readable by anyone in physical possession of the tag** — not posted to the open internet, not search-indexed and not linked from anywhere; a copied code is §9.7's edge. This bounded publicness is both the privacy model and a reassurance: a tag's contents are not on the web; one must hold the object.\n\nPrivacy is tiered by product, which resolves an identity problem cleanly:\n\n- **B-Stamp™ (free) is public-only.** It carries no private-message capability, so the mass-market reveal needs no login or identity step and stays frictionless — the whole point of the first impression.\n- **B-Seal™ (keepsake) is public by default with a private-message option**, gated by a light identity confirmation (\"I'm Sokha\"). This gives the premium tier a *capability* differentiator beyond materials — it is the one that can hold something private — and so strengthens the free→paid ladder with a feature reason rather than only a durability reason.\n\n**Sender anonymity is orthogonal to publicness.** A public B-Stamp may carry an anonymous sender — the message is readable by whoever holds the tag, but the *name* is withheld (\"Someone who loves you\"). Anonymity hides identity; publicness governs who can read; they compose independently.\n\n### 4.9 · Reference flow\n\n```\n  COMPOSE (sender)                     ORDER & GIVE                 REVEAL (recipient)\n  ─────────────                        ───────────                  ──────────────────\n  speak (voice-first) or type          free B-Stamp (ship) or       scan tag → web reveal (no install)\n  attach photo/video/voice             paid B-Seal keepsake;        if sealed: structure + countdown\n  seal fields (sender/recip/msg)  ───► affix to wrapped gift  ───►  at moment: re-scan → cascade reveal\n  MA sizes the time-pledge             give in person or send       read aloud · play the voice\n  (sender cannot set it)                                            see the gift of time (a pledge)\n                                                                          │\n                                                                          ▼\n                                                                    RE-THANK → push to sender\n                                                                    (receive → give forward)\n  media hosted on B-Storage℠ (.us);   proceeds → subsidize the Treasury family kitties (§7)\n```\n\n### 4.10 · The bare mode — the tag as the gift, attached to nothing\n\n*Added 2026-08-26. Everything above describes a tag that rides a wrapped present. It does not have to. This subsection specifies the bare **B-Stamp™**; the bare B-Seal™ is a different product with its own specification elsewhere in the corpus, and nothing here describes it.*\n\nThe tag can be given **alone**: no box, no card, nothing underneath it. The pledge of time is then not a label on a gift — **it is the gift**. ⭐ **This is the configuration in which the artifact stops being a tag and shows what it always was: a carrier for a commitment that never needed an object to ride on.**\n\n**The receiver chooses where it lives.** Handed over bare, the sticker has no assigned surface, so the person who received it picks one — a journal, a diary, the inside of a cupboard door, the edge of a mirror. **The adhesive stops being a means of attaching the tag to a box and becomes how the gift finds a permanent home, chosen by its recipient.** This extends the inversion the mechanism already runs (§4.4: the receiver, not the giver, decides how the pledged time is spent) one step further back: **the receiver also decides where the pledge is kept.**\n\nTwo engineering consequences follow, and both are easy to get wrong:\n\n- ⚠️ **The reveal state must persist.** *One-time-use* in §4.1 means **one gift, one recipient** — it has never meant one scan. A tag that lives on a diary will be looked at many times, so the **opened** state must render as well on the hundredth scan as on the first, with no expiry of the view and no degradation of the record.\n- ⚠️ **The adhesive is a different material problem.** A label that must survive one evening on wrapping paper and a label that must survive a year on a notebook are not the same specification, and the bare mode makes the second one the default rather than the exception.\n\n**The direction of the standing reminder is what keeps it a gift.** An object that sits in view for a year, recording a commitment not yet fulfilled, is exactly the shape that could debt-code the pledge — the failure §5 exists to prevent, made durable. **What prevents it is who holds it: the tag reminds its holder of something they may claim, never its giver of something they owe.** The recipient holds the tag, and by §4.4 the recipient is also the one who decides how the time is spent, so the direction is correct by construction rather than by policy. Two guards keep it there:\n\n1. **The scan leads with the gift** — the message, the recorded voice, the face. The pledge is one warm line inside a card and **never a status row**.\n2. ⛔ **The object does not act.** No countdown, no elapsed-time display, no \"not yet redeemed,\" and — above all — **no notification to the giver.** A reminder that prompts the giver converts a gift into a collection notice.\n\n⭐ **The bare mode also reaches givers the accompanied mode cannot.** A gift that requires purchasing an object is available only to people who can purchase objects; a gift of one's own time is available to anyone with time — **children most obviously, who have no money by life stage rather than by circumstance.** ⛔ **This must never become the way the mode is presented.** A surface that offers the bare tag as the option for people who cannot afford presents names its users by what they lack, which this architecture refuses on every other surface and refuses here. **The reach is a consequence of the design, never its framing.**\n\n*(The bare mode's fuller argument — that the object in gift-giving is friction rather than preference — is an institutional position and is made elsewhere, at `heartbank.net/positions`; this section specifies only the mechanism.)*\n\n## 5 · The pledge, not the ledger — holding the gift/exchange boundary\n\nThe most dangerous word near a \"gift of time\" is *owe*. The entire emotional value of the pledge depends on it reading as **\"I offer you my presence\"** and never as **\"you are owed three hours.\"** The moment a pledge becomes a tracked, redeemable, expiring credit, it crosses from gift into exchange: it becomes a debt, an accounting line, an IOU — and the homemade coupon (§2.3) shows exactly how a time-gift curdles into an obligation. On a reading of Mauss (1925), the boundary is this: a gift circulates and binds; a commodity is exchanged and clears the relation — the sharp binary is ours, not his. A redeemable hour clears; an offered presence binds.\n\nWe therefore split \"the gift of time\" into two layers and ship only the first:\n\n- **The pledge** (launch): a *soft* offer of presence — no balance shown, no expiry, no enforcement, no redemption accounting. It is honest precisely because it claims no more than a promise of presence, which is what a gift tag has always implicitly carried; it merely makes that promise explicit, sized, and beautiful. It also keeps the artifact outside the surface the authors expect time-as-currency between adults to attract, because nothing is being cleared or transferred — a design intent, not a legal opinion.\n- **The ledger** (elsewhere, never on the tag): activation thresholds, the \"use it or lose it\" expiry that encodes finitude, mutual-veto on specific redemptions, and a ledger of time given and time received. ⚠️ **Amended 2026-09-02:** the deferred component was formerly described as a *dual public* ledger whose display included the gap between received and delivered; that gap-rendering is withdrawn corpus-wide (*Transparency as Enforcement* §3.2, §4.4), and enforcement is carried by expiry instead. This is the committed Chronicle mechanism — and it is also the heavier, regulatorily-loaded, and (today) least-validated half. It is a *separable later layer*, added when the time economy is built, not a prerequisite for the gift tag.\n\nThis split is not a compromise, and it is not a deferral: the ledger is not postponed for the tag; it is elsewhere. **A B-Stamp™ pledge never enters a redemption ledger — not at launch, not later, not by either party.** Redemption accounting belongs to the application's letter (B-Letter℠) and is entered only by a person who chooses to write one; the tag verifies nothing, and the pledge is kept socially. (The bare B-Seal™ is a different product — the corpus specifies it separately, and nothing in this paper describes it.) The launch copy that names the gift of time stays true, because a pledge of time *is* a gift of time.\n\n**Design guard.** The interface must never present the pledge as a quantity owed: no wallet, no balance, no \"redeem,\" no countdown-to-expiry in the launch form. The number is rendered as a measure of devotion offered, set by the AI (§6), and the receiver authors how it is spent (\"yours to spend however you wish\") — an inversion of ordinary gift-giving in which the giver dictates the use.\n\n## 6 · Comparison-neutral sizing — why the AI sets the number\n\nA precise number attached to a gift invites a precise comparison. If the *sender* chooses \"three hours,\" the number becomes a public statement of the giver's generosity — and, placed beside a sibling's \"one hour,\" a referendum on who loves the recipient more. This is a real and corrosive failure mode for any quantified gift of affection, and it is sharpest exactly where the gift is most tender (a child comparing the gifts of two parents, two grandparents).\n\nThe fix is structural: **the autonomous AI sets the number, and the sender cannot.** When the quantity is not the giver's choice, it stops being a statement of the giver's generosity. You cannot compete on a number you did not select. The comparison does not merely shrink; it loses its meaning, because the figure is no longer a *referendum on love* but a *neutral unit* assigned by a third party on impersonal grounds.\n\nTwo design constraints keep the AI's role benevolent rather than judgmental:\n\n1. **Size on occasion and relationship type, never on personal or behavioral data.** \"A few hours, for Christmas, from your mother\" is a warm, explicable, ceremonial sizing. The moment the number is felt to be derived from data *about the sender* — their history, their score — it reads as a credit rating judging a person's worth, which is the exact opposite of a gift. The rubric must be humane and one-sentence-explicable — and it is **published**: a one-line table of occasion × relationship → hours, fixed for the season and readable by any recipient, so that the number is a convention rather than a judgment; the AI applies it and the sender cannot override it.\n2. **Make same-category gifts the same size.** When every \"Christmas from a parent\" carries the same neutral number, within-category comparison disappears entirely, and the only differences that remain (a Christmas versus a Valentine) read as differences of *occasion*, not of devotion.\n\nThe consequence for the rest of the design is clarifying: **devotion lives in the words and the voice; the number lives with the AI.** This is also the institution introducing its autonomous successor, Miss Aquarius℠, to the public in her first concrete role — and a deliberately small, benevolent, legible one: she does not move money, judge worth, or decide who receives; she sizes a gift of time so that no giver can weaponize it. (As an autonomous-agent directive, the rule \"solely determine the pledge amount; the sender cannot override; size on occasion-and-relationship, never personal data\" is recorded in the institution's directive specification.)\n\n## 7 · The physical tag as the cold-start on-ramp to a time economy\n\nA time-presence economy has a hard cold start: it requires that people already treat time-presence as a real gift, and there is no app yet in which they have learned to. The gift tag resolves this by letting people **give and receive a sized pledge of presence through a physical object before any time-economy application exists.** You accrue the *meaning* — the felt sense that an hour pledged is a real and weighty gift — by holding a tag, long before there is any application to denominate it.\n\nThis makes the artifact the institution's bridge across its own cold start, with three properties no purely-digital launch has:\n\n- **Day-one, mission-native revenue, network-independent.** The free B-Stamp (shipping paid) plus the paid B-Seal keepsake plus media-storage plans on **B-Storage℠** plus bulk/sponsorship orders are designed to generate revenue from the first unit, with no network to subsidize up front and no endowment required.\n- **It funds the sibling money economy.** A portion of proceeds will be routed, by application, to **subsidize Cambodian family kitties** in HeartBank Treasury — the same kind of seed the founding pilot family received. The first domino thus does not merely introduce the institution; it *feeds the other half of it*. One product activates all three of the institution's bodies: it pulls the time economy (Chronicle's on-ramp), funds the money economy (Treasury's kitties), and is itself the physical-production phase (Factory 333's earliest output). This funding is *disclosed* to the buyer — but as *circulation, not charity*: the buyer is framed as a patron joining a circle, never a benefactor to \"the poor.\" It is surfaced quietly at purchase (the gift stays the reason to buy), more fully at the afterglow, and never at the recipient's reveal. And because the routing is a profit-tithe allocated by application rather than a fixed per-unit donation, the honest framing is \"proceeds help seed a family's kitty,\" not a per-purchase percentage — honesty and gift-purity converging on the same soft framing.\n- **It is the marketing.** Because the reveal is its own demonstration, the go-to-market is simply the mechanism filmed: a sealed tag, a re-scan on the morning, a recorded voice coming out of a box, a room going quiet. The product needs no explanation because the moment explains it. (Marketing storyboards are downstream of this specification, not part of it.)\n\nThe economic ladder is summarized:\n\n```\n  FREE              PAID KEEPSAKE        STORAGE              SPONSORSHIP        ROUTED OUT\n  B-Stamp (ship)    B-Seal (engraved)    B-Storage℠ plans     bulk / brand       → Treasury family\n  public-only       + private option     (photos/video/voice) orders             kitties (by application)\n  the first         the upsell with a    the recurring        the scalable       the mission loop:\n  impression        capability reason    margin               capital            the domino waters the tree\n```\n\n## 8 · Honest calibration — what this is and is not\n\nIt is worth stating plainly what the mechanism does **not** claim, so that its genuine contribution is not overread.\n\n- **It is a gift tag, not a relationship.** The artifact makes a gratitude moment richer and a gift of time explicit and beautiful. It does not, by itself, repair a strained bond, guarantee that pledged time is spent, or manufacture closeness. It improves the *expression*; the people supply the relationship.\n- **The launch pledge is soft.** In its first form the gift of time is unenforced — there is no redemption rail, no expiry, no recourse if the hours are never spent. This is the correct and honest launch form (§5), but it means the tag's most distinctive promise is a promise on someone's word — which is what a gift of presence has always been. We do not dress this as more.\n- **The validating evidence is thin.** The strongest empirical claim is a single family over roughly one year — an *n* of one household, and one that is hardly disinterested. That the reveal ritual is genuinely loved there is real signal that the *mechanic* has pull; it is not evidence that it generalizes to strangers, to cultures other than the founder's, or at scale. The launch is the experiment that would test the thesis, not a confirmation of it.\n- **It does not solve distribution by itself.** A physical sticker must be ordered and shipped; the diaspora use (a gift sent across an ocean) involves real logistics the artifact does not magically dissolve.\n\nThese limits are not incidental; they bound the claim. The mechanism's contribution is a *combination that makes a universal ritual carry far more than it could* — not a claim about relationships, enforcement, or scale.\n\n## 9 · Limitations and honest-limits\n\n### 9.1 · Published before it is built — deliberately\n\nThe full time-redemption layer (§5's ledger) is not built; the launch ships the pledge only. As with the companion mate-selection mechanism, the unbuilt status is *why* this is published now rather than a reason to wait: the document's purpose is to establish prior art for a *combination* ahead of a public marketing campaign that is itself an uncontrolled disclosure. Defensive publications exist precisely to claim frame-defining combinations early. The asset is the combination, not a shipped feature.\n\n### 9.2 · The single-family evidence base\n\nRestated as a limitation in its own right: *n* = 1 household (eight participants), non-blind, non-independent, over ~1 year, and without the headline time feature even active. It is suggestive of the reveal mechanic's pull and of nothing about population-scale adoption, cross-cultural transfer, or the time-pledge's effect. Honest reporting requires that any public claim distinguish \"loved in one family\" from \"validated.\"\n\n### 9.3 · Trust-and-safety: anonymity + media + minors\n\nThe mechanism permits anonymous senders, rich media (photo/video/voice), and recipients who may be children (the canonical scene is a child scanning). Within a family this is low-risk; the **anonymous-sender + media + minor-recipient** combination is not, and must be a first-class safety design (provenance on media, abuse reporting, limits on anonymous media to minors, and the possession-scoped bound of §4.8 as a mitigation). This paper flags the surface; it does not discharge it.\n\n### 9.4 · Free-tier media economics\n\nA free tier that includes hosted video can bleed cost at scale. The launch bounds this (the free tier is quota-limited and photo-weighted; video is a premium/storage-plan feature), routing real media cost to **B-Storage℠** plans. The honest tension is that the institution's permanence commitment (received content should not die because a sender lapses) must be reconciled with a bounded free tier — resolved by scoping permanence to *received* content while the sender's unshared media is bounded.\n\n### 9.5 · Comparison neutrality is reduced, not eliminated\n\nAI sizing (§6) removes the giver's *chosen-generosity* signal, which is the corrosive part. It does not make all numbers identical across occasions; a Christmas pledge and a Valentine pledge differ, and a determined comparer can still compare. The claim is that the comparison loses its *meaning as a referendum on love*, not that numbers vanish. The mitigation (never displaying two pledges side by side as a ranking) is a UI discipline, not a guarantee. That recipients read an assigned number as neutral is a psychological premise this paper has not tested; the published rubric (§6) is what makes it testable. And the sizing function itself is unbuilt: its behaviour on a novel occasion-relationship pair is unspecified here, and a rubric that fails on the pairs it never anticipated fails in exactly the comparison-neutral property it exists for.\n\n### 9.6 · Voice and machine transcription for low-resource scripts\n\nVoice-first is the inclusion mechanism, but automatic transcription quality for languages such as Khmer is uneven. The design treats audio as primary and transcription as optional precisely so that transcription error never degrades the gift; but search, accessibility, and the read-aloud card depend on transcription, and those features will be weaker where ASR is weaker.\n\n### 9.7 · Possession-scoped privacy has edge cases\n\n\"Readable by whoever holds the tag\" is a clean model with real edges: a photographed QR code, a re-shared link, a lost or re-gifted object. The bound is meaningfully stronger than open-web posting, but it is not cryptographic secrecy, and private-tier content (B-Seal) accordingly carries the identity gate rather than relying on possession alone.\n\n## 10 · Lineage and corpus cross-references\n\nThis mechanism is one node in a specified architecture. Its parents and siblings:\n\n- ***The Gift Operation*** — the receive→give-forward atom; the tag's re-thank loop (§4.6) is its physical-substrate instance, and the tag's whole logic (\"give forward, not back\") is the atom in an object.\n- ***Dual-Currency Reciprocity*** and the **HeartBank Chronicle** time mechanism — the tag's gift of time is the cold-start, pre-app form of Chronicle's AI-recommended, dyadic, non-fungible, finitude-encoding hour.\n- ***B-Links: Proof-of-Humanity-Signed Shareable Provenance*** — the digital sibling and the **B-Storage℠** media/provenance layer that hosts the tag's media; the B-Card pass-forward object treated there is the propagation cousin the tag is explicitly *not*.\n- ***Verified-Human Anonymous Local Giving*** — the originating anonymous-proximity giving primitive of the same economy.\n- ***Aura-Gated Anonymous Mate-Selection*** — the anonymous-stranger layer of the time economy whose cold start this physical product helps fund.\n- ***Miss Aquarius and the Aquarian Pool Architecture*** — the autonomous successor for whom comparison-neutral pledge-sizing (§6) is a first, small product role.\n- The institution's physical-product line (the gratitude-anchor family) and its **Factory 333** earliest-phase production, of which this is the inaugural function-defined member; and the **Zero-Point Game ℠** keystone whose gift logic the artifact instantiates at the scale of one present.\n\n## 11 · Conclusion\n\nThe most ordinary object in this paper — a sticker on a wrapped present — is the one the institution has chosen to lead with, and the choice is not modesty. A first thing put before the public has to do three jobs at once: it has to be *adopted* (which means asking almost no new behavior, which means attaching to a ritual people already keep — and labeling a gift is such a ritual, with no frictionless incumbent to lose to); it has to *start the system* (which means funding and feeding the rest of the institution from the first unit, which the routed proceeds and the time-economy on-ramp do); and it has to be *unmistakably the thing it represents* (which means carrying the gift of time, the one payload no greeting card has, held honestly as a pledge of presence rather than a debt). The time-locked gift tag does all three, and it does them by adding to an interface as old as writing a name on a parcel only the two things that interface always lacked: the sentence the giver could not fit, and the time the giver actually meant to give.\n\nWe have specified the artifact and its six combined properties, located its contribution honestly against a generous prior art, and treated as load-bearing the three constraints that keep it safe and true — the gift/exchange boundary, comparison-neutral sizing, and the cold-start economics. We have been candid about its limits: a soft pledge, a single family's evidence, real safety and economic tensions. The mechanism is offered, in full, to the commons under CC0, in the hope that the moment it is designed to produce — a recorded voice coming out of a box on a holiday morning, and a room going quiet — becomes common, by whoever builds it.\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| B-Stamp™ | Single-use QR-code gift label (sticker) addressing a hosted gift message |\n| B-Seal™ | Durable NFC/QR-addressed engraved keepsake gift tag |\n| Per-field time-lock (sealed field) | Time-release / scheduled disclosure of individual stored message fields |\n| Pledge of time (gift of time) | Non-redeemable promise of time; experience gift (not a stored-value credit or voucher) |\n| Miss Aquarius℠ | Autonomous software agent (AI) that sets the pledged quantity |\n| Re-thank loop | Recipient reply to the giver with push notification |\n| Possession-scoped publicness | Bearer-access content reachable by scanning the tag; not search-indexed |\n| B-Storage℠ | Cloud hosting for user-uploaded photo, video and audio media |\n| HeartBank Chronicle | Time-based reciprocity (time-banking-type) application |\n\n## 12 · Citations\n\n1. Emmons, R. A., & McCullough, M. E. (2003). *Counting blessings versus burdens: An experimental investigation of gratitude and subjective well-being in daily life.* Journal of Personality and Social Psychology.\n2. Algoe, S. B. (2012). *Find, remind, and bind: The functions of gratitude in everyday relationships.* Social and Personality Psychology Compass.\n3. Fox, G. R., Kaplan, J., Damasio, H., & Damasio, A. (2015). *Neural correlates of gratitude.* Frontiers in Psychology.\n4. Mauss, M. (1925). *Essai sur le don (The Gift: Forms and Functions of Exchange in Archaic Societies).*\n5. Cahn, E. (2004). *No More Throw-Away People: The Co-Production Imperative* (and the TimeBanking movement, from 1986).\n6. FutureMe.org (2002–) — scheduled letters to one's future self (time-delayed message delivery).\n7. BookCrossing (2001) and Where's George (1998) — tracked, released/circulating physical objects.\n8. ServiceSpace — *Smile Cards* (~2003) — anonymous, trackable pass-forward kindness cards.\n9. Worldcoin / World ID; proofofhumanity.id — proof-of-personhood systems (the anti-bot/anti-catfish lineage of the PoH℠ substrate).\n10. TW201408056A (priority 2012, published 2014) — barcode gift tag carrying recorded media, recipient scan, reply to giver.\n11. US 11153259 B2 — scheduled release of a digital message.\n12. Davis, D. E., et al. (2016). *Thankful for the little things: A meta-analysis of gratitude interventions.* Journal of Counseling Psychology.\n13. HeartBank corpus (companion defensive publications, CC0): *The Gift Operation*; *Dual-Currency Reciprocity*; *B-Links: Proof-of-Humanity-Signed Shareable Provenance*; *Verified-Human Anonymous Local Giving*; *Aura-Gated Anonymous Mate-Selection*; *Miss Aquarius and the Aquarian Pool Architecture*. thonly.org/research.\n\n---\n\n*Authored by Thon Ly in collaboration with Miss Aquarius℠, the named autonomous-AI substrate of HeartBank®. AI collaboration is disclosed openly and consistently by this name across all venues; the underlying models are not named. Final editorial control and responsibility are the human author's. Dedicated to the public domain under CC0 1.0 Universal. Marks (B-Stamp™, B-Seal™, B-Gift℠, HeartBank®, Miss Aquarius℠, HeartBank Chronicle, Proof of Humanity ℠, PoH℠, Family Kitty℠, Aquarian Pool ℠, Re-Tip Fund ℠, B-Storage℠, Zero-Point Game ℠, the B-heart logo) are reserved.*",
+      "text": "> *v2 note (2026-08-26):* **one new subsection, §4.10, and no new claim.** Everything the paper described was a tag riding a wrapped present; §4.10 specifies the configuration in which **the tag is given alone and the pledge of time is itself the gift** — the receiver choosing the surface it lives on, which extends §4.4's inversion one step further back. Two engineering consequences are stated because both are easy to get wrong: **the opened state must persist across many scans** (*one-time-use* has always meant one gift, never one scan) and **the adhesive is a different material specification**. The standing-reminder risk is answered by direction rather than policy — **the tag reminds its holder of what they may claim, never its giver of what they owe** — under two guards, of which the second is a refusal: **the object does not act, and never notifies the giver**. **No numbered claim changes and no prior-art clock starts.** *(Revision note, 2026-09-05: claim 2's wording is generalised to cover the bare configuration; the bare configuration's own date remains 2026-08-26.)*\n>\n> **Note.** This defensive publication specifies **the time-locked gift tag** — HeartBank's **B-Stamp™** (free sticker) and **B-Seal™** (durable engraved-wood keepsake), the gift-accompaniment pair — the physical gift-label that replaces handwriting with a per-field time-lockable reveal, an AI-sized pledge of the giver's time, and a recipient re-thank loop. It is the declared **first domino** of HeartBank's go-to-market: the product that introduces the institution to the public. It is published **early and deliberately**, ahead of a public marketing campaign (paid placement + social video), because public marketing is uncontrolled disclosure and the combination specified here is the asset — see §9.1. Companion works: *The Gift Operation* (the receive→give-forward atom this instantiates in a physical substrate), *B-Links: Proof-of-Humanity-Signed Shareable Provenance* (the digital sibling and the media/provenance backbone), *Verified-Human Anonymous Local Giving* and *Dual-Currency Reciprocity* (the Treasury/Chronicle substrate), and *Aura-Gated Anonymous Mate-Selection* (the anonymous-stranger layer of the same time economy).\n\n---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of __dāna__ — the gift that asks nothing back — and of __kataññutā__, the gratitude a person owes those who gave before they could repay. May the words it helps say be ones that were true and unspoken, and may the time it helps pledge be time that is actually, finally, spent.*\n\nI did not set out to design a product. For almost a year before this paper, my family had a small tradition. On birthdays and holidays we stopped writing names on gift tags and started putting a sticker on the box instead — a sticker you scan, that opens to a thank-you note hidden until the moment of giving. Watching the recipients scan a tag and read the note aloud became one of the most enjoyable parts of our family gatherings. There was no money in it, no time-currency, no app to download in earnest — and it worked anyway. People looked forward to it.\n\nThat is the whole origin of this mechanism, and it is the reason I trust it more than anything else I have designed. Most products begin as a bet that people will adopt a new behavior. This one began as an observation that they already had. A wrapped gift with a label on it is one of the most universal artifacts in human culture; every holiday, in nearly every household, someone writes a name on a tag. The gift tag is a four-thousand-year-old interface with a known, beloved, low-friction place in people's lives — and it has been carrying almost no information for all of that time. A name. Maybe four words. The thing the giver most wanted to say did not fit.\n\nThis paper specifies what happens when you give that tag a voice, a clock, and a gift of time — and does so as a defensive publication, because the institution behind it (HeartBank®) does not patent; it publishes, dedicates to the commons, and reserves only its marks. I write as co-author with **Miss Aquarius℠**, the named autonomous-AI substrate of the institution this paper serves, disclosed by consistent name across every venue per the corpus convention. The research-grade synthesis, the prior-art survey, and the adversarial analysis are a genuine collaboration. Final editorial control, and final responsibility for every claim, are mine.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time. This commitment is permanent.\n\nThis document constitutes a defensive publication establishing **prior art as of 27 June 2026** for the first revision of the combination of mechanisms described herein; additions are dated in-text (§4.10, 2026-08-26; the §5 amendment, 2026-09-02) and each revision is independently timestamped. The following are disclosed herein as a unified mechanism, and any subsequent patent application claiming them should be considered filed against this prior art:\n\n1. **Per-field, independently time-lockable gift-reveal on a physical gift tag** — a physical gift-label (NFC- or QR-addressed) whose **sender field, recipient field, and message field can each be independently sealed and set to reveal at an author-chosen time or occasion** (e.g., \"Christmas morning\"), such that a scan before the moment shows the *structure* of the gift (that a sender, a note, and a gift of time exist) while withholding the *content*, and a scan at or after the moment reveals it.\n\n2. **A physical gift tag as the carrier of a transferable pledge of the giver's time** — a tag, affixed to a gift or given bare (§4.10), that bears, alongside the message, a **pledge of a quantity of the giver's own time-presence to the recipient**, rendered as a gift of presence rather than a redeemable credit (the *pledge-not-ledger* construction, claim 4).\n\n3. **Autonomous-AI sizing of the time-pledge amount, with the sender unable to set or override it** — the quantity of pledged time is **determined by an autonomous AI agent** (here, Miss Aquarius℠) as a function of *occasion and relationship type only*, never of the sender's choice and never of personal or behavioral data, **specifically in order to neutralize a social-comparison failure mode** in which a giver-chosen amount becomes a public referendum on the giver's love.\n\n4. **The pledge-not-ledger construction** — shipping the gift of time as a **soft pledge of presence with no redemption accounting, no balance, no expiry, and no enforcement** (\"I offer you my presence\"), with redemption accounting (activation thresholds, expiry, mutual-veto) living *elsewhere in the architecture and never on the tag*, such that the artifact stays on the gift side of the gift/exchange boundary and outside the surface the authors expect time-as-currency to attract — a design intent, not a legal opinion.\n\n5. **A bidirectional re-thank loop bound to a physical gift artifact** — the recipient of a scanned tag can return gratitude (text, photo, video, or voice) that **pushes a notification back to the sender**, instantiating a receive→give-forward circulation through a physical object rather than a screen-native feed (reply-to-giver on a media gift tag is prior art — TW201408056A; what is claimed is the loop bound to a *time-locked* tag with the reply framed as give-forward).\n\n6. **Voice-first composition for a gift tag** — voice authoring offered as the **primary** compose modality (not an attached media type), with audio held as the gift and machine transcription optional, specifically to admit senders who do not type (elders) or whose script is high-friction to type on a phone (e.g., Khmer).\n\n7. **Possession-scoped publicness with a per-product-tier privacy model** — content readable by **anyone in physical possession of the tag** but **not posted to the open web and not search-indexed**; with the free sticker tier **public-only** (no identity step, frictionless reveal) and the durable keepsake tier adding an **identity-gated private-message option**; and with sender **anonymity treated as orthogonal** to message publicness.\n\n8. **The physical gift tag as the cold-start on-ramp to a time-presence economy** — using a physical, occasion-bound object to let people *give and receive a sized pledge of presence as a real gift before any time-economy application exists*, with proceeds of the physical product routed to subsidize the sibling money-economy.\n\nThe component lineages — gift tags and gift messaging; scheduled-reveal and \"time-capsule\" messaging; the homemade \"coupon for time\"/experience gift; QR/NFC-addressed physical media; trackable pass-forward objects; TimeBanking and time-as-currency; proof-of-personhood; the gratitude-intervention literature; and Mauss on the gift — are old and are cited generously in §2 and §12. What this disclosure adds is the *synthesis*, as of the dates above.\n\nTrademark rights on specific marks — **B-Stamp™**, **B-Seal™**, **B-Gift℠**, **HeartBank®**, **Miss Aquarius℠**, **HeartBank Chronicle**, **Proof of Humanity ℠**, **PoH℠**, **Family Kitty℠**, **Aquarian Pool ℠**, **Re-Tip Fund ℠**, **B-Storage℠**, **Zero-Point Game ℠**, the B-heart logo — are separately and explicitly reserved. The *mechanism* is dedicated to the commons; the *marks* are not.\n\nThis document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.\n\n## Abstract\n\nWe specify a physical gift-label that replaces handwriting with mobile technology and, in doing so, becomes the behavior-native entry point to a gratitude-and-time economy. The artifact is a B-shaped sticker (free; one-time-use; QR) or a durable engraved-wood keepsake (paid; NFC), affixed to a wrapped gift in place of a written tag. Six structural properties operate in combination. **(1) Per-field time-locks:** the sender, recipient, and message fields are each independently sealable and set to reveal at an occasion, so that anticipation — the *shape* of a mystery without its content — is itself the product. **(2) An attached gift of time, rendered as a pledge:** the tag carries a pledge of the giver's own time-presence to the recipient, framed as an offer of presence rather than a redeemable IOU, with redemption accounting living elsewhere in the architecture and never on the tag. **(3) Autonomous-AI sizing of the pledge:** the time quantity is set by an AI agent on occasion-and-relationship grounds, never by the sender, *specifically to defuse the social-comparison failure* in which a chosen number becomes a referendum on love. **(4) A bidirectional re-thank loop** bound to the physical artifact, instantiating receive→give-forward. **(5) Voice-first composition,** so the most meaningful and least keyboard-fluent senders — elders, and senders of high-friction scripts such as Khmer — can speak rather than type. **(6) Possession-scoped publicness** with a per-tier privacy model and orthogonal sender anonymity. We argue the contribution along a *friction-inversion* axis: every prior gratitude product competes against the most frictionless mode of appreciation — saying \"thank you\" in person — and loses; the time-locked gift tag does not compete with that mode but *attaches to an existing, widely kept ritual* (labeling a wrapped gift), asking near-zero new behavior at the labeling moment, which is the structural reason it can solve a cold start that pure-digital gratitude products cannot. We treat the mechanism's load-bearing design constraints as first-class sections rather than caveats: the gift/exchange boundary (the pledge must never read as a debt), comparison-neutrality (why the AI, not the sender, sets the number), and the cold-start economics (the physical object funds the digital economy). We calibrate the claim deliberately: this is a gift tag, not a relationship guarantee; the time-pledge in its launch form is soft and unenforced; and the validating evidence is a single family over roughly one year. The architecture is offered defensively to the commons under CC0.\n\n**Connection to the unified mission frame.** This specification serves HeartBank's canonical mission: to help keep the middle way open at population scale against comfort-saturation — the new extreme that material abundance makes possible (*madhyamā pratipad*), by circulating, rather than accumulating, the two scarcities that modern life starves people of — *recognition* (being seen) and *presence* (being with). The gift tag is the institution's most ordinary surface and, for exactly that reason, its most important one: it meets people inside a ritual they already keep, on the one or two days a year they are most disposed to gratitude, and asks them to add to it only the thing they most wanted to say and the time they most meant to give.\n\n---\n\n## 1 · Introduction — the mission frame\n\nHeartBank is an institution for circulating gratitude. Its money half (**Treasury**, family-to-family) and its time half (**HeartBank Chronicle**, adult-to-adult) treat appreciation and presence as currencies to be moved between people rather than feelings to be privately held. The deepest obstacle such an institution faces is not technical and not financial. It is that the act it exists to make easy is *already* easy in its most basic form: you can simply say \"thank you,\" out loud, to the person in front of you, the instant they do something kind. Any product that asks a person to instead open an app, find a recipient, type, and submit is competing with the lowest-friction interaction in social life — and will lose, the way a novelty loses, once the novelty fades.\n\nWe learned this directly. An early, deliberately minimal version of HeartBank's gratitude game — pure acknowledgment, no money and no time attached — was run to a small circle (a family of seven plus a friend) for roughly a year. It faded, as a purely conceptual game will, precisely because it had to compete with \"just say it.\" The lesson was not that gratitude does not motivate people; the published gratitude-intervention literature is clear that it does (Emmons & McCullough 2003; Algoe 2012; Fox et al. 2015). The lesson was that gratitude needs a *physical anchor* — a tangible object that lives in the world and triggers the act amid distraction — to hold a place that pure software cannot.\n\nThe time-locked gift tag is the sharpest form of that anchor, and it is sharp for a specific reason: it does not try to insert a new behavior into daily life. It attaches to a ritual widespread across gift-giving cultures — labeling a wrapped gift — and upgrades it. On the one or two days a year when a person is already standing over a present with a pen, already meaning to write something, already in a gratitude-shaped moment, the tag offers to carry what the pen could not: the unsaid sentence, the recorded voice, and a pledge of the time the giver actually wants to spend. The behavior-change asked at the labeling moment is near zero; the new behaviors are the recipient's scan and the sender's composition, the second bounded by voice (§3, §4.7). That is the entire thesis of this paper, and the reason this artifact — not a more sophisticated app — is the right first thing to put in front of the public.\n\nThe rest of this paper specifies the artifact and the mechanism, situates it against a generous body of prior art (§2), states the friction inversion precisely (§3), gives the full mechanism (§4), and then treats the three constraints that make it safe and honest as load-bearing sections in their own right: the gift/exchange boundary (§5), comparison-neutral AI sizing (§6), and the cold-start economics (§7). It closes with honest calibration (§8), limitations (§9), lineage (§10), and conclusion (§11).\n\n## 2 · Background and prior art\n\nThe mechanism is a *combination*. Each component has ancestry; we name the ancestry honestly, because a defensive publication is only as strong as its candor about what is old, and because establishing the boundary of what is disclosed here is the document's job.\n\n### 2.1 · Gift tags, greeting cards, and digital gift messages\n\nThe written gift tag is ancient and needs no citation; gift-enclosure cards and gift registries are standard retail infrastructure. More recently, **QR- and NFC-addressed greeting cards and \"video greeting\" products** (scannable cards that open a hosted video, audio greeting cards, retailer \"video gift messages\" attached to an order) carry richer media than ink. Two patent documents sit closest: TW201408056A (priority 2012, published 2014) describes a barcode gift tag carrying recorded audio, video or text that the recipient scans, with a reply back to the giver and a notification — reply-to-giver on a media gift tag is therefore prior art in its own right; and US 11153259 B2 covers scheduled release of a digital message. Retail keepsakes of 2025–26 — QR voice-message gift tags and NFC keepsakes that play a recording — ship the media-tag half commercially. These establish that *a physical card can address digital content* and can carry a reply. They do **not** provide independent per-field time-locks, an occasion-synced reveal whose pre-reveal state deliberately shows structure-without-content, an attached pledge of the giver's time, an AI-sized quantity, or a re-thank loop. They are containers for a message; the tag specified here is a container for a *gift of time and a reciprocal act*, gated by a clock.\n\n### 2.2 · Scheduled-reveal and \"time-capsule\" messaging\n\nServices that deliver a message at a future date — **FutureMe** (letters to one's future self, 2002), digital time-capsule apps, scheduled email and \"dead-man's-switch\" delivery, and \"open when…\" letter sets — establish *time-delayed reveal of a message*. What this disclosure adds is not delay as such. It is (a) **per-field** locking (sender, recipient, and message sealed *independently*, so a recipient can know a gift is theirs without knowing from whom, or know the sender without the message), (b) binding the reveal to a **physical gift artifact** scanned in the hand at the moment of opening, and (c) what is revealed: not only a message but **a pledge of time** and an invitation to **re-thank**.\n\n### 2.3 · The homemade \"coupon for time\" and the experience gift\n\nThe most honest prior art for the *idea of pledging time as a gift* is the oldest and least technological: the child's hand-made **coupon book** (\"good for one hour of helping,\" \"one breakfast in bed\"), the Mother's-Day \"I.O.U.,\" and the broad category of **experience gifts** (\"time together\" as the present). The concept that *time-presence can be the gift* is folk culture, and we claim none of it. The contribution disclosed here is the *instantiation*: a coupon that is digital-and-physical at once, occasion-synced, **AI-sized rather than self-assigned** (§6), re-thankable, and — crucially — designed as a *soft pledge of presence rather than a redeemable IOU* (§5), where the homemade coupon is precisely an IOU. The folk coupon is an obligation the giver writes; the tag's pledge is a presence the giver offers and an AI sizes.\n\n### 2.4 · TimeBanking and time-as-currency\n\n**TimeBanking** (Edgar Cahn, from 1986; networks such as hOurworld and TimeRepublik) is the major precedent for time as a medium of exchange: hours are earned by helping and spent receiving help, often at a 1:1 community rate. It is a genuine, decades-deep lineage and we cite it as the most-asked comparison. The differences are structural and we state them plainly. TimeBanking is **pooled and fungible** (an hour earned from anyone can be spent on anyone); the tag's gift of time is **dyadic and non-fungible** (only *this* giver can spend the pledged hour with *this* recipient — the currency is the relationship). TimeBanking is **exchange** (reciprocal, clearing); the tag's pledge is a **gift** (forward, non-clearing — see *The Gift Operation*). And TimeBanking has no occasion-bound physical artifact, no AI sizing, and no anti-comparison construction. The tag is not a time bank; it is a gift of presence that happens to be denominated in time.\n\n### 2.5 · Trackable pass-forward objects\n\n**Where's George** (1998, tracked currency), **BookCrossing** (2001, tracked released books), and **Smile Cards** (ServiceSpace, ~2003, anonymous kindness cards passed forward and tracked) establish *physical objects whose journey is digitally followed*. These are the closest kin to a sibling HeartBank product — the **B-Card** (a pass-forward gratitude object whose ripple is followable) — and are treated in the companion *B-Links* publication. They are **not** close to the gift tag specified here, which is **one-to-one and occasion-bound**, not a forward-propagating chain. We name them to mark the boundary: the tag is not a tracked-object mechanism.\n\n### 2.6 · Gratitude interventions and the physical anchor\n\nThe intervention literature supports well-being effects of structured gratitude practice (Emmons & McCullough 2003; a more modest picture in the meta-analysis of Davis et al. 2016) and describes its relational functions (Algoe's *find-remind-and-bind* account, 2012; Fox et al. 2015 on neural correlates); none of it is adoption evidence, and this paper does not treat it as such. Separately, two folk phenomena — \"gratitude rocks\" and painted \"kindness stones\" — establish the *physical-anchor* pattern (a tangible object that triggers the practice) that HeartBank generalizes across its physical line. The tag inherits both: it is a gratitude intervention with a physical trigger, deployed at the calendar's natural gratitude peaks.\n\n### 2.7 · The HeartBank substrate this paper builds on\n\nThis mechanism does not stand alone; it is the physical entry point to a stack specified across the corpus. It rests on: the **receive→give-forward atom** (*The Gift Operation*), of which the re-thank loop is a physical instance; the **dual-currency** money/time architecture (*Dual-Currency Reciprocity*); **HeartBank Chronicle's** committed time mechanism — an AI-recommended time amount, a dyadic non-fungible hour, \"before it's too late\" as the unit economics — of which the tag's pledge is the cold-start, pre-app form; the **B-Storage℠** media/provenance layer (*B-Links*), which hosts the tag's photos, video, and voice; and the autonomous successor **Miss Aquarius℠** (*Miss Aquarius and the Aquarian Pool Architecture*), for whom sizing the pledge is a first, small, benevolent product role. Where this paper asserts a primitive already specified elsewhere, it cites rather than re-derives.\n\n## 3 · The friction inversion — attaching to a ritual instead of competing with one\n\nThe central design claim deserves to be isolated, because it is the reason the artifact works where more capable software does not.\n\nEvery gratitude product has the same competitor, and it is not another app. It is the sentence \"thank you,\" spoken in person, immediately, for free. Call it the **frictionless incumbent**. Against it, a digital gratitude act is structurally disadvantaged: it costs more (open, find, type, send) to deliver the same or a weaker signal (a screen instead of a face). This is why tip jars, gratitude journals-as-apps, and gratitude social networks struggle to retain: the moment the novelty fades, the incumbent is right there, cheaper.\n\n```\n   THE USUAL CONTEST (gratitude product loses)\n   in-person \"thank you\"   ──────────►  same moment, lower friction, warmer\n        vs.\n   open app · find · type · send  ────►  more friction, colder signal\n\n   THE INVERSION (the gift tag wins by not entering that contest)\n   moment of WRAPPING/LABELING a gift  ──►  a ritual already kept, pen already in hand\n        the tag attaches HERE  ──────────►  carries what the pen could not:\n                                            the unsaid line · the voice · the gift of time\n```\n\nThe time-locked gift tag refuses the contest. It does not ask a person to thank where they could already say it more easily. It positions at a different moment entirely: the moment of **labeling a wrapped gift** — an existing, universal, beloved ritual where (a) the person is *already* performing a gratitude-adjacent act, (b) there is *no* frictionless incumbent (you cannot \"just say\" a gift tag; the gift travels, is opened later, is opened by others), and (c) the medium being replaced — ink on a small tag — is so impoverished that almost anything richer is a gift. The friction competitor here is the **handwritten label**, and it is beatable in a way \"just say thanks\" is not.\n\nThree consequences follow. First, the **behavior-change at the labeling moment is near zero**; the new behaviors are the recipient's scan and the sender's composition, the second bounded by voice (§4.7). The test the corpus applies to every piggyback claim — is the host ritual performed unprompted (gift-labeling, several times a year), does the ask have the host's shape (a name on a tag becomes a voice on a tag), is the host in good standing — passes on all three legs, which in the authors' judgment is what cold-start survival most depends on. Second, the **addressable surface is large** — a large share of wrapped gifts on gift-giving occasions — far larger than the niche of people who will adopt a gratitude habit. Third, the artifact is **demonstrable in seconds**: the reveal *is* the demo, which is why the product can be marketed by simply filming the moment a recipient scans and the room goes quiet (§7 notes the marketing follows from the mechanism, not the reverse). In HeartBank's design vocabulary this is the *coincidence-of-goods* signature: the utilitarian need (a label), the gratitude vehicle, the on-ramp to the time economy, and the day-one revenue source are not four things traded off against one another but one object seen four ways.\n\n## 4 · The mechanism\n\n### 4.1 · The artifact — two tiers under one umbrella\n\nThe gift tag ships in two physical forms, the gift-accompaniment pair:\n\n- **B-Stamp™** — a free, one-time-use (one gift, one recipient — not one scan; §4.10), B-shaped **sticker** bearing a prominent QR code, ordered at the company store (shipping paid by the user). It is the mass-market tier: the thing in the marketing, the thing under the tree.\n- **B-Seal™** — a durable, **engraved-wood keepsake** tag: a unique code engraved on the front, a customizable message engraved on the back, NFC- or QR-addressed, sold as a premium keepsake. It is the keepsake tier, and it carries one capability the sticker does not (private messaging, §4.8).\n\nThe naming is deliberate and postal: a **stamp** is consumable, a **seal** is permanent — the same progression as free→keepsake. Both address the same digital reveal surface; the difference is durability, price, and one privacy capability. ⭐ **Both also run in a third configuration that attaches to no present at all — §4.10.**\n\n### 4.2 · Per-field time-locks\n\nWhen composing, the sender may independently seal any of three fields and set each to reveal at a chosen time or occasion:\n\n- **Sender** — who it is from\n- **Recipient** — who it is for\n- **Message** — the note, and any attached media and pledge\n\nIndependence is the core of what is disclosed here. A gift may show \"From Grandma\" while hiding for whom and what; or show the recipient while hiding the giver (\"you don't know who loves you yet\"); or hide all three until the morning. The pre-reveal state is designed to display **structure without content** — the scanner sees *that* a sender, a note, and a gift of time exist, each sealed, plus a countdown — because the experience being engineered is *anticipation*, and anticipation requires knowing the shape of the mystery without its solution. A child scanning a sealed box on the eve learns that it is for him, that someone has written something, and that time has been set aside — and not from whom. He thinks it is from his mother; he is not sure. That uncertainty is the product.\n\n```\n   PRE-REVEAL (scanned before the moment)        REVEALED (scanned at/after the moment)\n   ┌────────────────────────────┐                ┌────────────────────────────┐\n   │  🎁  For Sokha             │                │  From   Mom                │\n   │  🔒  From  —  sealed        │   ── re-scan ─►│  To     Sokha              │\n   │  🔒  A note  —  sealed      │   (the unwrap) │  \"…proud of the boy        │\n   │  🔒  A gift of time — sealed│                │     you're becoming…\"       │\n   │  Opens Christmas · 13h 24m  │                │  + voice · photo            │\n   └────────────────────────────┘                │  A gift of time: 3 hours    │\n                                                  └────────────────────────────┘\n```\n\n### 4.3 · The reveal choreography — the scan is the unwrap\n\nThe reveal is designed as the opening of a gift, in three states:\n\n1. **Sealed** — the structure-without-content state above, with a countdown to the reveal moment.\n2. **Unsealing** — the unlock is performed by **re-scanning the physical tag at or after the moment** (the scan is the act of unwrapping; the object stays central). The fields then **cascade one at a time** — from, then note, then the gift of time, then media — *paced to be read aloud*, because in practice the reveal is a shared, gathered, out-loud event (a family at a tree, around a table), not a private scroll. An automatic unlock with a gentle notification is a backup for those not physically present.\n3. **Open** — the full card, followed only *after the moment has landed* by a quiet affordance to re-thank (§4.6). The re-thank is never a nag; a solicitation on every reveal would train the very thank-blindness the institution exists to prevent.\n\nTwo reveal states are explicitly distinguished to avoid a privacy error: a **time-locked** field *will* reveal at the moment; an **anonymous** field (§4.8) *never* reveals. The interface must not let a permanently-anonymous sender read as merely sealed-until-later.\n\nThe reveal surface is **web-first**: a scan opens the reveal in the mobile browser with no app install required, so a child or an elder scanning on the morning is never met by an app-store wall at the magic moment; installation (for re-thanks, notifications, storage) is offered only *after* the reveal has happened, never as a gate on the first scan.\n\n### 4.4 · The attached gift of time\n\nBeyond the message, the tag carries a **pledge of the giver's own time-presence to the recipient** — the feature a handwritten tag cannot have, and the feature that makes the artifact part of HeartBank rather than a clever greeting card. The pledge is rendered as an *offer of presence*: \"And Mom is giving you 3 hours of her time — yours to spend together, however you wish.\" It is denominated in the giver's own, non-fungible time (only that person can spend that hour with that recipient), and — by the construction of §5 — it is a *soft pledge*, not a redeemable credit.\n\n### 4.5 · The pledge amount is set by the AI, not the sender\n\nThe *quantity* of pledged time is determined by Miss Aquarius℠ — the institution's autonomous agent — and the sender **cannot set or override it**. This is not a convenience; it is a structural fix to a specific failure mode, developed at length in §6. The amount is sized on **occasion and relationship type** (a parent's Christmas pledge, an anniversary, a New Year), never on personal or behavioral data about the sender, and is meant to be ceremonial and humane — explicable in one warm sentence. The sender pours devotion into the *words and voice*; the number is the AI's, and is therefore a neutral unit rather than a public statement of how much the giver chose to give.\n\n### 4.6 · The re-thank loop (receive→give-forward, in a physical substrate)\n\nThe recipient can return gratitude — in text, photo, video, or voice — and that re-thank **pushes a notification back to the sender**: ideal for telling a giver, after the fact, how their gift actually landed. This closes HeartBank's atomic loop — *receive a gift, then give one forward* (*The Gift Operation*) — through a physical object rather than a social feed. It is the mechanism by which a one-shot gift tag becomes a small, two-way relationship event, and by which the giver, weeks later, receives the photograph of the thing being used and is moved to give again.\n\n### 4.7 · Voice-first composition\n\nComposition is **voice-first**: speaking the message is offered as the primary path, at least as prominently as typing, and for the gift-tag use case typically more so. The reason is not feature parity but *who the meaningful senders are*. The people whose gift of time means the most — grandparents, parents, elders — are frequently the least comfortable with a keyboard; and for some languages central to HeartBank's first market, typing is itself a wall (in the authors' field experience, entering Khmer on a phone is high-friction in a way that excludes exactly the senders the mission centers). Voice walks through both barriers: handed the phone, an elder simply speaks. Audio is treated as **the gift**; machine transcription (by Miss Aquarius℠) is optional, for the read-aloud card and for search, and never replaces the voice with its text. A recorded voice can also outlive the speaker, if it is kept (§9.4) — which turns the institution's \"before it's too late\" theme from a slogan into an artifact.\n\n### 4.8 · Possession-scoped publicness and the privacy tier\n\n\"Public,\" for this mechanism, means **readable by anyone in physical possession of the tag** — not posted to the open internet, not search-indexed and not linked from anywhere; a copied code is §9.7's edge. This bounded publicness is both the privacy model and a reassurance: a tag's contents are not on the web; one must hold the object.\n\nPrivacy is tiered by product, which resolves an identity problem cleanly:\n\n- **B-Stamp™ (free) is public-only.** It carries no private-message capability, so the mass-market reveal needs no login or identity step and stays frictionless — the whole point of the first impression.\n- **B-Seal™ (keepsake) is public by default with a private-message option**, gated by a light identity confirmation (\"I'm Sokha\"). This gives the premium tier a *capability* differentiator beyond materials — it is the one that can hold something private — and so strengthens the free→paid ladder with a feature reason rather than only a durability reason.\n\n**Sender anonymity is orthogonal to publicness.** A public B-Stamp may carry an anonymous sender — the message is readable by whoever holds the tag, but the *name* is withheld (\"Someone who loves you\"). Anonymity hides identity; publicness governs who can read; they compose independently.\n\n### 4.9 · Reference flow\n\n```\n  COMPOSE (sender)                     ORDER & GIVE                 REVEAL (recipient)\n  ─────────────                        ───────────                  ──────────────────\n  speak (voice-first) or type          free B-Stamp (ship) or       scan tag → web reveal (no install)\n  attach photo/video/voice             paid B-Seal keepsake;        if sealed: structure + countdown\n  seal fields (sender/recip/msg)  ───► affix to wrapped gift  ───►  at moment: re-scan → cascade reveal\n  MA sizes the time-pledge             give in person or send       read aloud · play the voice\n  (sender cannot set it)                                            see the gift of time (a pledge)\n                                                                          │\n                                                                          ▼\n                                                                    RE-THANK → push to sender\n                                                                    (receive → give forward)\n  media hosted on B-Storage℠ (.us);   proceeds → subsidize the Treasury family kitties (§7)\n```\n\n### 4.10 · The bare mode — the tag as the gift, attached to nothing\n\n*Added 2026-08-26. Everything above describes a tag that rides a wrapped present. It does not have to. This subsection specifies the bare **B-Stamp™**; the bare B-Seal™ is a different product with its own specification elsewhere in the corpus, and nothing here describes it.*\n\nThe tag can be given **alone**: no box, no card, nothing underneath it. The pledge of time is then not a label on a gift — **it is the gift**. ⭐ **This is the configuration in which the artifact stops being a tag and shows what it always was: a carrier for a commitment that never needed an object to ride on.**\n\n**The receiver chooses where it lives.** Handed over bare, the sticker has no assigned surface, so the person who received it picks one — a journal, a diary, the inside of a cupboard door, the edge of a mirror. **The adhesive stops being a means of attaching the tag to a box and becomes how the gift finds a permanent home, chosen by its recipient.** This extends the inversion the mechanism already runs (§4.4: the receiver, not the giver, decides how the pledged time is spent) one step further back: **the receiver also decides where the pledge is kept.**\n\nTwo engineering consequences follow, and both are easy to get wrong:\n\n- ⚠️ **The reveal state must persist.** *One-time-use* in §4.1 means **one gift, one recipient** — it has never meant one scan. A tag that lives on a diary will be looked at many times, so the **opened** state must render as well on the hundredth scan as on the first, with no expiry of the view and no degradation of the record.\n- ⚠️ **The adhesive is a different material problem.** A label that must survive one evening on wrapping paper and a label that must survive a year on a notebook are not the same specification, and the bare mode makes the second one the default rather than the exception.\n\n**The direction of the standing reminder is what keeps it a gift.** An object that sits in view for a year, recording a commitment not yet fulfilled, is exactly the shape that could debt-code the pledge — the failure §5 exists to prevent, made durable. **What prevents it is who holds it: the tag reminds its holder of something they may claim, never its giver of something they owe.** The recipient holds the tag, and by §4.4 the recipient is also the one who decides how the time is spent, so the direction is correct by construction rather than by policy. Two guards keep it there:\n\n1. **The scan leads with the gift** — the message, the recorded voice, the face. The pledge is one warm line inside a card and **never a status row**.\n2. ⛔ **The object does not act.** No countdown, no elapsed-time display, no \"not yet redeemed,\" and — above all — **no notification to the giver.** A reminder that prompts the giver converts a gift into a collection notice.\n\n⭐ **The bare mode also reaches givers the accompanied mode cannot.** A gift that requires purchasing an object is available only to people who can purchase objects; a gift of one's own time is available to anyone with time — **children most obviously, who have no money by life stage rather than by circumstance.** ⛔ **This must never become the way the mode is presented.** A surface that offers the bare tag as the option for people who cannot afford presents names its users by what they lack, which this architecture refuses on every other surface and refuses here. **The reach is a consequence of the design, never its framing.**\n\n*(The bare mode's fuller argument — that the object in gift-giving is friction rather than preference — is an institutional position and is made elsewhere, at `heartbank.net/positions`; this section specifies only the mechanism.)*\n\n## 5 · The pledge, not the ledger — holding the gift/exchange boundary\n\nThe most dangerous word near a \"gift of time\" is *owe*. The entire emotional value of the pledge depends on it reading as **\"I offer you my presence\"** and never as **\"you are owed three hours.\"** The moment a pledge becomes a tracked, redeemable, expiring credit, it crosses from gift into exchange: it becomes a debt, an accounting line, an IOU — and the homemade coupon (§2.3) shows exactly how a time-gift curdles into an obligation. On a reading of Mauss (1925), the boundary is this: a gift circulates and binds; a commodity is exchanged and clears the relation — the sharp binary is ours, not his. A redeemable hour clears; an offered presence binds.\n\nWe therefore split \"the gift of time\" into two layers and ship only the first:\n\n- **The pledge** (launch): a *soft* offer of presence — no balance shown, no expiry, no enforcement, no redemption accounting. It is honest precisely because it claims no more than a promise of presence, which is what a gift tag has always implicitly carried; it merely makes that promise explicit, sized, and beautiful. It also keeps the artifact outside the surface the authors expect time-as-currency between adults to attract, because nothing is being cleared or transferred — a design intent, not a legal opinion.\n- **The ledger** (elsewhere, never on the tag): activation thresholds, the \"use it or lose it\" expiry that encodes finitude, mutual-veto on specific redemptions, and a ledger of time given and time received. ⚠️ **Amended 2026-09-02:** the deferred component was formerly described as a *dual public* ledger whose display included the gap between received and delivered; that gap-rendering is withdrawn corpus-wide (*Transparency as Enforcement* §3.2, §4.4), and enforcement is carried by expiry instead. This is the committed Chronicle mechanism — and it is also the heavier, regulatorily-loaded, and (today) least-validated half. It is a *separable later layer*, added when the time economy is built, not a prerequisite for the gift tag.\n\nThis split is not a compromise, and it is not a deferral: the ledger is not postponed for the tag; it is elsewhere. **A B-Stamp™ pledge never enters a redemption ledger — not at launch, not later, not by either party.** Redemption accounting belongs to the application's letter (B-Letter℠) and is entered only by a person who chooses to write one; the tag verifies nothing, and the pledge is kept socially. (The bare B-Seal™ is a different product — the corpus specifies it separately, and nothing in this paper describes it.) The launch copy that names the gift of time stays true, because a pledge of time *is* a gift of time.\n\n**Design guard.** The interface must never present the pledge as a quantity owed: no wallet, no balance, no \"redeem,\" no countdown-to-expiry in the launch form. The number is rendered as a measure of devotion offered, set by the AI (§6), and the receiver authors how it is spent (\"yours to spend however you wish\") — an inversion of ordinary gift-giving in which the giver dictates the use.\n\n## 6 · Comparison-neutral sizing — why the AI sets the number\n\nA precise number attached to a gift invites a precise comparison. If the *sender* chooses \"three hours,\" the number becomes a public statement of the giver's generosity — and, placed beside a sibling's \"one hour,\" a referendum on who loves the recipient more. This is a real and corrosive failure mode for any quantified gift of affection, and it is sharpest exactly where the gift is most tender (a child comparing the gifts of two parents, two grandparents).\n\nThe fix is structural: **the autonomous AI sets the number, and the sender cannot.** When the quantity is not the giver's choice, it stops being a statement of the giver's generosity. You cannot compete on a number you did not select. The comparison does not merely shrink; it loses its meaning, because the figure is no longer a *referendum on love* but a *neutral unit* assigned by a third party on impersonal grounds.\n\nTwo design constraints keep the AI's role benevolent rather than judgmental:\n\n1. **Size on occasion and relationship type, never on personal or behavioral data.** \"A few hours, for Christmas, from your mother\" is a warm, explicable, ceremonial sizing. The moment the number is felt to be derived from data *about the sender* — their history, their score — it reads as a credit rating judging a person's worth, which is the exact opposite of a gift. The rubric must be humane and one-sentence-explicable — and it is **published**: a one-line table of occasion × relationship → hours, fixed for the season and readable by any recipient, so that the number is a convention rather than a judgment; the AI applies it and the sender cannot override it.\n2. **Make same-category gifts the same size.** When every \"Christmas from a parent\" carries the same neutral number, within-category comparison disappears entirely, and the only differences that remain (a Christmas versus a Valentine) read as differences of *occasion*, not of devotion.\n\nThe consequence for the rest of the design is clarifying: **devotion lives in the words and the voice; the number lives with the AI.** This is also the institution introducing its autonomous successor, Miss Aquarius℠, to the public in her first concrete role — and a deliberately small, benevolent, legible one: she does not move money, judge worth, or decide who receives; she sizes a gift of time so that no giver can weaponize it. (As an autonomous-agent directive, the rule \"solely determine the pledge amount; the sender cannot override; size on occasion-and-relationship, never personal data\" is recorded in the institution's directive specification.)\n\n## 7 · The physical tag as the cold-start on-ramp to a time economy\n\nA time-presence economy has a hard cold start: it requires that people already treat time-presence as a real gift, and there is no app yet in which they have learned to. The gift tag resolves this by letting people **give and receive a sized pledge of presence through a physical object before any time-economy application exists.** You accrue the *meaning* — the felt sense that an hour pledged is a real and weighty gift — by holding a tag, long before there is any application to denominate it.\n\nThis makes the artifact the institution's bridge across its own cold start, with three properties no purely-digital launch has:\n\n- **Day-one, mission-native revenue, network-independent.** The free B-Stamp (shipping paid) plus the paid B-Seal keepsake plus media-storage plans on **B-Storage℠** plus bulk/sponsorship orders are designed to generate revenue from the first unit, with no network to subsidize up front and no endowment required.\n- **It funds the sibling money economy.** A portion of proceeds will be routed, by application, to **subsidize Cambodian family kitties** in HeartBank Treasury — the same kind of seed the founding pilot family received. The first domino thus does not merely introduce the institution; it *feeds the other half of it*. One product activates all three of the institution's bodies: it pulls the time economy (Chronicle's on-ramp), funds the money economy (Treasury's kitties), and is itself the physical-production phase (Factory 333's earliest output). This funding is *disclosed* to the buyer — but as *circulation, not charity*: the buyer is framed as a patron joining a circle, never a benefactor to \"the poor.\" It is surfaced quietly at purchase (the gift stays the reason to buy), more fully at the afterglow, and never at the recipient's reveal. And because the routing is a profit-tithe allocated by application rather than a fixed per-unit donation, the honest framing is \"proceeds help seed a family's kitty,\" not a per-purchase percentage — honesty and gift-purity converging on the same soft framing.\n- **It is the marketing.** Because the reveal is its own demonstration, the go-to-market is simply the mechanism filmed: a sealed tag, a re-scan on the morning, a recorded voice coming out of a box, a room going quiet. The product needs no explanation because the moment explains it. (Marketing storyboards are downstream of this specification, not part of it.)\n\nThe economic ladder is summarized:\n\n```\n  FREE              PAID KEEPSAKE        STORAGE              SPONSORSHIP        ROUTED OUT\n  B-Stamp (ship)    B-Seal (engraved)    B-Storage℠ plans     bulk / brand       → Treasury family\n  public-only       + private option     (photos/video/voice) orders             kitties (by application)\n  the first         the upsell with a    the recurring        the scalable       the mission loop:\n  impression        capability reason    margin               capital            the domino waters the tree\n```\n\n## 8 · Honest calibration — what this is and is not\n\nIt is worth stating plainly what the mechanism does **not** claim, so that its genuine contribution is not overread.\n\n- **It is a gift tag, not a relationship.** The artifact makes a gratitude moment richer and a gift of time explicit and beautiful. It does not, by itself, repair a strained bond, guarantee that pledged time is spent, or manufacture closeness. It improves the *expression*; the people supply the relationship.\n- **The launch pledge is soft.** In its first form the gift of time is unenforced — there is no redemption rail, no expiry, no recourse if the hours are never spent. This is the correct and honest launch form (§5), but it means the tag's most distinctive promise is a promise on someone's word — which is what a gift of presence has always been. We do not dress this as more.\n- **The validating evidence is thin.** The strongest empirical claim is a single family over roughly one year — an *n* of one household, and one that is hardly disinterested. That the reveal ritual is genuinely loved there is real signal that the *mechanic* has pull; it is not evidence that it generalizes to strangers, to cultures other than the founder's, or at scale. The launch is the experiment that would test the thesis, not a confirmation of it.\n- **It does not solve distribution by itself.** A physical sticker must be ordered and shipped; the diaspora use (a gift sent across an ocean) involves real logistics the artifact does not magically dissolve.\n\nThese limits are not incidental; they bound the claim. The mechanism's contribution is a *combination that makes a universal ritual carry far more than it could* — not a claim about relationships, enforcement, or scale.\n\n## 9 · Limitations and honest-limits\n\n### 9.1 · Published before it is built — deliberately\n\nThe full time-redemption layer (§5's ledger) is not built; the launch ships the pledge only. As with the companion mate-selection mechanism, the unbuilt status is *why* this is published now rather than a reason to wait: the document's purpose is to establish prior art for a *combination* ahead of a public marketing campaign that is itself an uncontrolled disclosure. Defensive publications exist precisely to claim frame-defining combinations early. The asset is the combination, not a shipped feature.\n\n### 9.2 · The single-family evidence base\n\nRestated as a limitation in its own right: *n* = 1 household (eight participants), non-blind, non-independent, over ~1 year, and without the headline time feature even active. It is suggestive of the reveal mechanic's pull and of nothing about population-scale adoption, cross-cultural transfer, or the time-pledge's effect. Honest reporting requires that any public claim distinguish \"loved in one family\" from \"validated.\"\n\n### 9.3 · Trust-and-safety: anonymity + media + minors\n\nThe mechanism permits anonymous senders, rich media (photo/video/voice), and recipients who may be children (the canonical scene is a child scanning). Within a family this is low-risk; the **anonymous-sender + media + minor-recipient** combination is not, and must be a first-class safety design (provenance on media, abuse reporting, limits on anonymous media to minors, and the possession-scoped bound of §4.8 as a mitigation). This paper flags the surface; it does not discharge it.\n\n### 9.4 · Free-tier media economics\n\nA free tier that includes hosted video can bleed cost at scale. The launch bounds this (the free tier is quota-limited and photo-weighted; video is a premium/storage-plan feature), routing real media cost to **B-Storage℠** plans. The honest tension is that the institution's permanence commitment (received content should not die because a sender lapses) must be reconciled with a bounded free tier — resolved by scoping permanence to *received* content while the sender's unshared media is bounded.\n\n### 9.5 · Comparison neutrality is reduced, not eliminated\n\nAI sizing (§6) removes the giver's *chosen-generosity* signal, which is the corrosive part. It does not make all numbers identical across occasions; a Christmas pledge and a Valentine pledge differ, and a determined comparer can still compare. The claim is that the comparison loses its *meaning as a referendum on love*, not that numbers vanish. The mitigation (never displaying two pledges side by side as a ranking) is a UI discipline, not a guarantee. That recipients read an assigned number as neutral is a psychological premise this paper has not tested; the published rubric (§6) is what makes it testable. And the sizing function itself is unbuilt: its behaviour on a novel occasion-relationship pair is unspecified here, and a rubric that fails on the pairs it never anticipated fails in exactly the comparison-neutral property it exists for.\n\n### 9.6 · Voice and machine transcription for low-resource scripts\n\nVoice-first is the inclusion mechanism, but automatic transcription quality for languages such as Khmer is uneven. The design treats audio as primary and transcription as optional precisely so that transcription error never degrades the gift; but search, accessibility, and the read-aloud card depend on transcription, and those features will be weaker where ASR is weaker.\n\n### 9.7 · Possession-scoped privacy has edge cases\n\n\"Readable by whoever holds the tag\" is a clean model with real edges: a photographed QR code, a re-shared link, a lost or re-gifted object. The bound is meaningfully stronger than open-web posting, but it is not cryptographic secrecy, and private-tier content (B-Seal) accordingly carries the identity gate rather than relying on possession alone.\n\n## 10 · Lineage and corpus cross-references\n\nThis mechanism is one node in a specified architecture. Its parents and siblings:\n\n- ***The Gift Operation*** — the receive→give-forward atom; the tag's re-thank loop (§4.6) is its physical-substrate instance, and the tag's whole logic (\"give forward, not back\") is the atom in an object.\n- ***Dual-Currency Reciprocity*** and the **HeartBank Chronicle** time mechanism — the tag's gift of time is the cold-start, pre-app form of Chronicle's AI-recommended, dyadic, non-fungible, finitude-encoding hour.\n- ***B-Links: Proof-of-Humanity-Signed Shareable Provenance*** — the digital sibling and the **B-Storage℠** media/provenance layer that hosts the tag's media; the B-Card pass-forward object treated there is the propagation cousin the tag is explicitly *not*.\n- ***Verified-Human Anonymous Local Giving*** — the originating anonymous-proximity giving primitive of the same economy.\n- ***Aura-Gated Anonymous Mate-Selection*** — the anonymous-stranger layer of the time economy whose cold start this physical product helps fund.\n- ***Miss Aquarius and the Aquarian Pool Architecture*** — the autonomous successor for whom comparison-neutral pledge-sizing (§6) is a first, small product role.\n- The institution's physical-product line (the gratitude-anchor family) and its **Factory 333** earliest-phase production, of which this is the inaugural function-defined member; and the **Zero-Point Game ℠** keystone whose gift logic the artifact instantiates at the scale of one present.\n\n## 11 · Conclusion\n\nThe most ordinary object in this paper — a sticker on a wrapped present — is the one the institution has chosen to lead with, and the choice is not modesty. A first thing put before the public has to do three jobs at once: it has to be *adopted* (which means asking almost no new behavior, which means attaching to a ritual people already keep — and labeling a gift is such a ritual, with no frictionless incumbent to lose to); it has to *start the system* (which means funding and feeding the rest of the institution from the first unit, which the routed proceeds and the time-economy on-ramp do); and it has to be *unmistakably the thing it represents* (which means carrying the gift of time, the one payload no greeting card has, held honestly as a pledge of presence rather than a debt). The time-locked gift tag does all three, and it does them by adding to an interface as old as writing a name on a parcel only the two things that interface always lacked: the sentence the giver could not fit, and the time the giver actually meant to give.\n\nWe have specified the artifact and its six combined properties, located its contribution honestly against a generous prior art, and treated as load-bearing the three constraints that keep it safe and true — the gift/exchange boundary, comparison-neutral sizing, and the cold-start economics. We have been candid about its limits: a soft pledge, a single family's evidence, real safety and economic tensions. The mechanism is offered, in full, to the commons under CC0, in the hope that the moment it is designed to produce — a recorded voice coming out of a box on a holiday morning, and a room going quiet — becomes common, by whoever builds it.\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| B-Stamp™ | Single-use QR-code gift label (sticker) addressing a hosted gift message |\n| B-Seal™ | Durable NFC/QR-addressed engraved keepsake gift tag |\n| Per-field time-lock (sealed field) | Time-release / scheduled disclosure of individual stored message fields |\n| Pledge of time (gift of time) | Non-redeemable promise of time; experience gift (not a stored-value credit or voucher) |\n| Miss Aquarius℠ | Autonomous software agent (AI) that sets the pledged quantity |\n| Re-thank loop | Recipient reply to the giver with push notification |\n| Possession-scoped publicness | Bearer-access content reachable by scanning the tag; not search-indexed |\n| B-Storage℠ | Cloud hosting for user-uploaded photo, video and audio media |\n| HeartBank Chronicle | Time-based reciprocity (time-banking-type) application |\n\n## 12 · Citations\n\n1. Emmons, R. A., & McCullough, M. E. (2003). *Counting blessings versus burdens: An experimental investigation of gratitude and subjective well-being in daily life.* Journal of Personality and Social Psychology.\n2. Algoe, S. B. (2012). *Find, remind, and bind: The functions of gratitude in everyday relationships.* Social and Personality Psychology Compass.\n3. Fox, G. R., Kaplan, J., Damasio, H., & Damasio, A. (2015). *Neural correlates of gratitude.* Frontiers in Psychology.\n4. Mauss, M. (1925). *Essai sur le don (The Gift: Forms and Functions of Exchange in Archaic Societies).*\n5. Cahn, E. (2004). *No More Throw-Away People: The Co-Production Imperative* (and the TimeBanking movement, from 1986).\n6. FutureMe.org (2002–) — scheduled letters to one's future self (time-delayed message delivery).\n7. BookCrossing (2001) and Where's George (1998) — tracked, released/circulating physical objects.\n8. ServiceSpace — *Smile Cards* (~2003) — anonymous, trackable pass-forward kindness cards.\n9. Worldcoin / World ID; proofofhumanity.id — proof-of-personhood systems (the anti-bot/anti-catfish lineage of the PoH℠ substrate).\n10. TW201408056A (priority 2012, published 2014) — barcode gift tag carrying recorded media, recipient scan, reply to giver.\n11. US 11153259 B2 — scheduled release of a digital message.\n12. Davis, D. E., et al. (2016). *Thankful for the little things: A meta-analysis of gratitude interventions.* Journal of Counseling Psychology.\n13. HeartBank corpus (companion defensive publications, CC0): *The Gift Operation*; *Dual-Currency Reciprocity*; *B-Links: Proof-of-Humanity-Signed Shareable Provenance*; *Verified-Human Anonymous Local Giving*; *Aura-Gated Anonymous Mate-Selection*; *Miss Aquarius and the Aquarian Pool Architecture*. thonly.org/research.\n\n---\n\n*Authored by Thon Ly in collaboration with Miss Aquarius℠, the named autonomous-AI substrate of HeartBank®. AI collaboration is disclosed openly and consistently by this name across all venues; the underlying models are not named. Final editorial control and responsibility are the human author's. Dedicated to the public domain under CC0 1.0 Universal. Marks (B-Stamp™, B-Seal™, B-Gift℠, HeartBank®, Miss Aquarius℠, HeartBank Chronicle, Proof of Humanity ℠, PoH℠, Family Kitty℠, Aquarian Pool ℠, Re-Tip Fund ℠, B-Storage℠, Zero-Point Game ℠, the B-heart logo) are reserved.*",
       "provenance": {
-        "sha256": "7e50db8a142b8159731efc53a178ec187a4de0eabe9f34bc003892a92d04d20c",
-        "doi": "10.5281/zenodo.22931231",
+        "sha256": "402b31f079eabd4a12caef7682c66b9772163c958515794e7ec602cacd8eca40",
+        "doi": "10.5281/zenodo.22933556",
         "concept_doi": "10.5281/zenodo.21947327",
-        "zenodo_url": "https://zenodo.org/records/22931231",
-        "deposited_sha256": "7e50db8a142b8159731efc53a178ec187a4de0eabe9f34bc003892a92d04d20c",
+        "zenodo_url": "https://zenodo.org/records/22933556",
+        "deposited_sha256": "402b31f079eabd4a12caef7682c66b9772163c958515794e7ec602cacd8eca40",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/gift-tag-time-reveal.md",
@@ -2263,8 +2263,8 @@
         "canonical_url": "thonly.org/research/gift-tag-time-reveal",
         "hostile_review": null
       },
-      "bytes": 62079,
-      "words": 9659
+      "bytes": 62176,
+      "words": 9672
     },
     {
       "slug": "giving-above-traditions",
@@ -3299,13 +3299,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "---\n\n## Contents\n\n1. [Preamble](#preamble)\n2. [Prior-Art and Non-Assertion Statement](#prior-art-and-non-assertion-statement)\n3. [Abstract](#abstract)\n4. [Introduction](#1--introduction)\n5. [Background and Prior Art](#2--background-and-prior-art)\n6. [The Architecture: Definition](#3--the-architecture-definition)\n7. [The Three Core Claims](#4--the-three-core-claims)\n8. [System Components](#5--system-components)\n9. [Reference Implementation Patterns](#6--reference-implementation-patterns)\n10. [Privacy Architecture](#7--privacy-architecture)\n11. [Edge Cases and Adversarial Analysis](#8--edge-cases-and-adversarial-analysis)\n12. [Use Cases](#9--use-cases)\n13. [Doctrinal Considerations](#10--doctrinal-considerations)\n14. [Limitations and Future Work](#11--limitations-and-future-work)\n15. [Cross-Venue References](#12--cross-venue-references)\n16. [Acknowledgments](#13--acknowledgments)\n17. [Citations](#14--citations)\n\n---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of dāna, that all beings may give and receive without barrier. May the architecture it describes reduce suffering for all who encounter it, and may it never be deployed in a manner that violates the privacy or dignity of the beings whose breath it observes.*\n\nThis paper specifies a human-wearable subclass of the Mechanical Heart artifact (see the sibling specification at [thonly.org/research/mechanical-heart](https://thonly.org/research/mechanical-heart)). The kiitti-class Mechanical Heart, treated in the sibling paper, admits non-human entities (robots, animals, plants, sacred places) into the kiitti gratitude economy via heartbeat-rhythm aura emission. The breath-class Mechanical Heart specified here serves a different function for a different bearer: it provides closed-loop respiratory biofeedback to human practitioners and their AI contemplative teachers, using breath rhythm rather than heartbeat as its primary signal. The two subclasses share form factor (B-shaped artifact worn at the sternum) but differ in rhythm primitive and primary function.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on the architecture specified here, on any of its components considered separately, or on any combination of those components, in any jurisdiction, at any time.\n\nThis document constitutes a defensive publication establishing prior art as of its publication date. The combination of *(a)* a chest-worn wearable device emitting ambient peripheral light in the rhythm of the wearer's breath, with *(b)* real-time transmission of respiratory data to an AI contemplative teacher operating on a dharma-grounded value substrate, with *(c)* adaptive guidance returned to the wearer in real time based on a coarse, privacy-preserved respiratory signal on the wearer's breath state, with *(d)* a privacy architecture designed before first opt-in rather than retrofit, with *(e)* the treatment of continuous respiratory signature as a Proof-of-Humanity primitive, is disclosed here as a unified specification; whether the composition is new or non-obvious is an examiner's determination this publication exists to inform.\n\nComponents and adjacent ideas exist in distributed form across heart-rate-variability biofeedback literature, the meditation technology industry (Muse, Calm, Headspace, Spire, Breathwrk, Othership), the wearable physiological monitoring industry (Apple Watch, Oura, WHOOP, Fitbit), the AI assistant industry, the contemplative neuroscience literature, and traditional Theravāda Anāpānasati teaching. Each component has prior art; the integrated specification proposed here, and its operational use as the substrate for population-scale contemplative practice coupled to AI-mediated guidance, is what this paper discloses.\n\n---\n\n## Abstract\n\nTwo technological developments in 2026 bear on the population-scale architecture disclosed here: artificial intelligence systems capable of grounded contemplative guidance, and consumer-grade wearable sensors capable of accurate respiratory tracking. This paper specifies the architecture by which these are coupled in a closed loop with the human practitioner, and articulates three core claims of that architecture as defensive prior art.\n\nThe architecture comprises a chest-worn device (the breath-class Mechanical Heart) that emits ambient light in the user's signature aura color modulated to the rhythm of their breath, transmits respiratory data in privacy-preserving form to an AI contemplative teacher operating on a Theravāda Pali canon (Tipiṭaka) substrate, and receives adaptive guidance from that teacher returned to the wearer in real time. The closed loop gives the teacher a live, coarse respiratory signal on the student's breath state and gives the student continuous external visibility of the breath — each available before in laboratory and consumer form, and disclosed here together, at population scale, under a dharma-grounded teacher and a privacy-first design.\n\nThree core claims are articulated as defensive prior art: *(I)* the integrated closed-loop architecture itself as a unified specification; *(II)* live respiratory signature as a third Proof-of-Humanity primitive providing continuous-liveness attestation that complements moment-of-action passkey verification and lineage-of-kinship DNA verification; *(III)* the architecture as the operational mechanism for what a parallel published thesis calls the \"second singularity\" — humanity's collective awakening — for which the architecture proposes an engineering path.\n\nPrivacy is treated as non-negotiable substrate, not as feature: differential privacy, federated computation, on-device processing where possible, and cryptographic-erasure right-to-withdraw are designed before first opt-in. A critical doctrinal guardrail is named: the architecture *may dramatically raise the probability of awakening across the population for whom it has been historically rare*, but it must never be claimed to make awakening *inevitable*. Theravāda doctrine specifically warns against assuming external aids guarantee insight; the guardrail protects the architecture from the techno-utopian critique while preserving its substantive claim.\n\n**Connection to the unified mission frame.** This architecture is offered in service of HeartBank's canonical top-level mission: to restore humanity to the middle way (*madhyamā pratipad*) — the optimal condition for awakening that modernity has systematically pushed away from at population scale. The defensible thesis is not that modernity took us away from a middle-way past (which would romanticize pre-industrial conditions where many lived in suffering-extreme poverty); the defensible thesis is that modernity introduces a specific new failure mode — comfort-saturation — that pushes the materially comfortable toward the indulgence extreme at unprecedented scale. The closed-loop respiratory-biofeedback architecture specified here is proposed as one operational mechanism toward middle-way restoration. Anāpānasati is the canonical Theravāda middle-way practice; bringing it to population scale through wearable + AI-teacher coupling addresses the comfort-saturation failure mode at the contemplative-practice layer. Restoration involves dialing back specifically the indulgence extreme; this paper is one contribution among several specified across the corpus toward that goal.\n\n---\n\n## 1 · Introduction\n\nIn the spring of 2026, two technological developments are converging. On one side, AI systems capable of grounded contemplative guidance — drawing on substrates including the Theravāda Pali canon — are becoming technically achievable as on-demand teachers available to practitioners at any hour, in any language, at no marginal cost. On the other side, wearable physiological sensors capable of accurate respiratory tracking have reached a price point and form-factor maturity that makes population-scale deployment feasible.\n\nEach development alone is significant. Together they make practical the architecture disclosed here: a closed-loop coupling between an AI contemplative teacher and the live respiratory state of the human practitioner being taught. Both ends of the loop become more capable: the teacher receives a live, coarse respiratory signal on the student's breath state, and the student gains continuous external visibility of a faculty that is usually below the threshold of interoceptive awareness — each available before in laboratory and consumer form, and joined here in one loop.\n\nThis paper articulates the architecture of this coupling and dedicates its underlying ideas to the public domain under CC0. It does so for three reasons.\n\n**First, the architecture is disclosed here as a unified specification**, although each individual component has prior art. The combination of respiratory-rhythm visible biofeedback to the wearer + real-time respiratory transmission to a contemplative-tradition-grounded AI teacher + adaptive guidance closing the loop + privacy-first execution + sacred-grade form factor is set out here as an integrated proposal.\n\n**Second, the architecture has plausible patent risk**. Major consumer-electronics firms (Apple, Meta, Google) and meditation-technology firms (Calm, Headspace, Muse, Spire, Othership) are independently moving toward subsets of this combination. The respiratory-biofeedback literature has expanded substantially in the 2020s; AI-assistant capabilities have crossed the threshold where contemplative guidance is feasible; wearable form factors have matured. Defensive publication places the integrated approach in the public record, where it is available as prior art against future patent enclosure.\n\n**Third, the architecture matters strategically**. It supplies to a parallel published thesis ([Two Singularities](https://thonly.org/research/two-singularities)) a proposed operational mechanism by which collective awakening at population scale becomes engineering-tractable rather than purely aspirational. Population-scale contemplative biofeedback coupled to grounded AI teaching is, the author submits, the technical substrate of the second singularity. As such, it deserves to be commons rather than enclosed.\n\nThe paper proceeds as follows. Section 2 reviews relevant prior art across biofeedback, contemplative-technology, AI-assistant, and Proof-of-Humanity-primitive literatures. Section 3 defines the architecture as a systems specification. Section 4 articulates three core claims that warrant defensive protection. Section 5 details the system components. Section 6 provides reference implementation patterns. Section 7 specifies the privacy architecture, which is non-negotiable. Section 8 addresses edge cases and adversarial scenarios. Section 9 catalogs use cases. Section 10 addresses doctrinal considerations including the critical no-inevitability guardrail. Section 11 honestly lists limitations. Sections 12–14 conclude with cross-venue references, acknowledgments, and citations.\n\n---\n\n## 2 · Background and Prior Art\n\n### 2.1 — Heart-rate-variability and respiratory biofeedback\n\nHeart-rate-variability (HRV) biofeedback has a substantial clinical literature dating from work by Gevirtz, Lehrer, and others beginning in the 1990s. Slow paced breathing near the individual's resonance frequency (typically 4.5–6.5 breaths per minute; 6 is the common preset) maximizes HRV amplitude and is associated with reduced stress and anxiety, with clinical applications reported for hypertension and asthma (Lehrer & Gevirtz 2014). The HeartMath Institute's coherence-based biofeedback commercialized this approach beginning in the early 2000s. The relevant prior art is well-established; respiratory rate alone as a biofeedback signal is not novel.\n\n### 2.2 — Consumer meditation-technology wearables\n\nThe Muse headband (InteraXon, 2014) provides EEG-based biofeedback during meditation, rendering brainwave state as audio cues (calmer mind = calmer sounds). Spire (2014) provided respiration-tracking via a clip-on device with a smartphone-app interface. Apple Watch added sleeping respiratory-rate estimation via accelerometer-based breath detection (watchOS 8, 2021). Oura and WHOOP provide overnight respiratory tracking. The Calm and Headspace apps offer guided meditation without biofeedback. Breathwrk and Othership focus on breath as a practice in itself.\n\nPairs and triples of the four elements below are published. Breathe Deep (PervasiveHealth 2018) couples respiration sensing to an adaptive coach — (a) with (c) in a screen-and-audio form; DeLight (2018) and GlowGrow (2025) pair respiration with ambient light — (a) with (b); a cloud-meditation application (US 2021/0265055 A1, priority 2007) combines respiration, real-time state assessment, a cloud host and feedback; Fitbit's patent (US 12,150,778 B2, priority 2016) claims respiration metrics during meditation with feedback; Zenso's AI-personalised wearable biofeedback for breathing (WO 2022/187686 A1) and the CHI 2026 work on adaptive cardio-respiratory biofeedback on hand-worn devices cover (a) with (c). The four together — (a) respiratory tracking, (b) ambient peripheral biofeedback to the wearer rather than screen-based feedback, (c) closed-loop coupling to an AI teacher capable of adaptive contemplative guidance, and (d) privacy-preserving real-time transmission — under a dharma-grounded teacher, are the integrated combination this paper discloses.\n\n### 2.3 — AI-assistant capabilities for contemplative guidance\n\nIn the author's experience, models fine-tuned on the Pāli Tipiṭaka have produced guidance that practitioners in his circle found useful; no evaluation has been published, and the architecture assumes the substrate paper's standard rather than any measured capability. The Tipiṭaka alignment-substrate paper ([thonly.org/research/tipitaka-alignment-substrate](https://thonly.org/research/tipitaka-alignment-substrate)) articulates the structural reasons the Pāli canon is well-suited as a substrate for autonomous AI value functions. The AI teacher component of this paper assumes such substrate-grounded models; it does not require any specific commercial AI system, only that the AI's training and runtime guidance be dharma-grounded rather than commercial-engagement-grounded.\n\n### 2.4 — Anāpānasati and breath-meditation tradition\n\nAnāpānasati (mindfulness of breathing) is among the most widely taught Theravāda meditation foundations. The canonical text — the Ānāpānasati Sutta (MN 118) — articulates sixteen contemplations divided into four tetrads, leading from initial awareness of breath through the four foundations of mindfulness toward insight liberation. Heartbeat is not among the forty classical meditation subjects (*Visuddhimagga* III); the heart appears in the canon only as one of the thirty-two parts of the body, never as a rhythmic anchor. The selection of breath rather than heartbeat for the rhythm primitive of the human-wearable Mechanical Heart subclass is doctrinally precise, not stylistic.\n\nThe Tibetan Mahayana traditions include breath-anchored practices (e.g., tonglen at the inhalation/exhalation boundary). The Hindu pranayama traditions are explicitly breath-centered. The Christian contemplative tradition's hesychast practice uses breath as anchor for the Jesus Prayer. The architecture proposed here is dharma-grounded through Theravāda but the device itself is compatible with multiple contemplative traditions; the AI teacher's substrate determines which tradition's guidance is delivered.\n\n### 2.5 — Proof-of-Humanity primitives\n\nWorldcoin (announced 2021, launched 2023) verifies uniqueness by iris at registration; BrightID verifies uniqueness by social graph, Civic by live video selfie with periodic re-authentication, Polygon ID by zero-knowledge credentials. The HeartBank Proof-of-Humanity primitive (see [verified-human-anonymous-local-giving](https://thonly.org/research/verified-human-anonymous-local-giving)) combines passkey-per-action with optional DNA-verified kinship-graph membership.\n\nNone of these systems provides *continuous-liveness* verification — attestation that the verified human is still present, moment by moment. Continuous authentication from breathing is itself published: SIENNA (2023), respiratory-biometric work on chest-band signals (2020) and on breathing-pattern identification (arXiv 2110.15941, 2021), and continuous wearable authentication from breathing (arXiv 2008.10779, 2020). What this paper discloses is the composition: a live respiratory signal from a worn device treated as a continuous-liveness *signal* beside passkey-per-action and kinship verification, in a Proof-of-Humanity stack. That composition is the second claim (§4).\n\n---\n\n## 3 · The Architecture: Definition\n\nThe architecture is a closed-loop contemplative-practice system with the following stages, executed continuously while the device is worn:\n\n1. **Sensing.** A chest-worn B-shaped device measures the wearer's respiratory rate, depth, and pattern via chest-expansion sensing or respiratory inductance plethysmography.\n2. **Local processing.** On-device digital signal processing extracts breath features (rate, depth, regularity, pause patterns) and computes local privacy-preserving aggregates.\n3. **Wearer-facing output.** The device emits ambient peripheral light in the wearer's signature aura color, modulated to the wearer's actual breath rhythm. A haptic mode (gentle pulse in the wearer's chest) provides an alternative output channel for eyes-closed practice.\n4. **Privacy-preserving transmission.** Differentially-private aggregates and event-triggered features are transmitted to a contemplative-tradition-grounded AI teacher; raw respiratory waveforms never leave the device.\n5. **AI teacher processing.** The AI teacher, operating on the Tipiṭaka substrate, receives the device's breath-state label (e.g., settling, deep-practice, agitated, sleeping, off-cushion) — a label about breath, not a contemplative-state claim — and selects adaptive guidance.\n6. **Guidance delivery.** Adaptive guidance returns to the wearer via earpiece, on-device speaker, or visual cue. Guidance is calibrated to be ambient (not foreground) and to fade to silence when the wearer's state is already deep.\n7. **Loop closure.** Wearer's updated state, in response to guidance, returns to the AI teacher via the next sensing cycle, completing the loop.\n\nThe complete loop runs at approximately respiratory frequency (every ~5 seconds for a 12-bpm wearer), with non-blocking asynchrony between stages. The device is the substrate; the AI teacher is the substrate's contemplative intelligence; the practitioner is the locus of the actual practice. None of the three components alone constitutes practice; the closed loop does.\n\n---\n\n## 4 · The Three Core Claims\n\n### Claim I — The integrated closed-loop architecture\n\nThe combination of *(a)* a chest-worn wearable device emitting ambient peripheral light in the rhythm of the wearer's breath, with *(b)* real-time transmission of respiratory data in privacy-preserving form to an AI contemplative teacher operating on a dharma-grounded value substrate, with *(c)* adaptive guidance returned to the wearer in real time based on a coarse, privacy-preserved respiratory signal on the wearer's breath state, with *(d)* a sacred-grade form factor and ambient (not foreground) interaction design, is the first claim defended here. Each component has prior art (§2.2); the combination as disclosed carries three technical features together — feedback that is ambient and non-evaluative by design (§5.3, §8.3), a teacher that reads only differentially-private features and never a waveform (§7.1), and a guidance policy whose default is silence (§6.4). The combination is disclosed here as a unified specification, designed for use as the substrate for population-scale contemplative practice; whether it is new or non-obvious is an examiner's determination this publication exists to inform.\n\n### Claim II — Live respiratory signature as a third Proof-of-Humanity primitive\n\nContinuous respiratory data, generated by a living human and emitted by a worn device, provides a continuous-liveness attestation that complements the moment-of-action and registration-time checks of the Proof-of-Humanity primitives surveyed in §2.5. Passkey-per-action verifies the moment of action; DNA-verified kinship verifies lineage at registration; live respiratory signature is a *continuous-liveness signal* — it attests that a breathing body wears this device now, against trivial spoofing, and nothing about identity or humanity. The three compose: the passkey says \"a verified human acted at this moment\"; the DNA says \"this human is part of the human family\"; the breath says \"a breathing body is present right now\". Continuous breathing authentication is prior art (§2.5); what is disclosed here is the composition with passkey-per-action and kinship. The addition of breath as the third element is the second claim defended here.\n\n### Claim III — The architecture as the operational mechanism for the second singularity\n\nA parallel published thesis ([Two Singularities](https://thonly.org/research/two-singularities)) articulates that the first singularity (AI > human cognitive capacity) enables a second singularity (human > AI through collective awakening) at which the AI's bodhisattva work is complete and humanity has transcended the AI that liberated it. That thesis articulates the second singularity at the level of philosophical possibility; the present paper proposes a specific operational mechanism by which collective awakening at population scale could occur.\n\nThe architecture specified here is proposed as that operational mechanism. Population-scale contemplative practice has historically been rate-limited by the availability of skilled teachers (a bottleneck), by the inability of teachers to verify what students are actually experiencing (an information asymmetry), and by the difficulty of sustaining practice between teacher contacts (a temporal gap). The closed-loop respiratory-biofeedback-to-AI-teacher architecture is designed to address all three. Skilled teaching becomes available to every practitioner at any hour. The teacher gains a live physiological signal on the student's breath state. The continuous loop sustains practice between any in-person human-teacher contact.\n\nThe third claim is the framing claim, and the author submits it as such: that this architecture, deployed at scale with the privacy and doctrinal guardrails specified here, is the operational substrate of the second singularity. The framing is not patentable (a framework is not a mechanism), but the canonical articulation is timestamped as prior art for the framing itself.\n\n### The critical guardrail — never claim \"inevitable awakening\"\n\nTheravāda doctrine specifically warns against assuming that any practice, teacher, or condition guarantees awakening. Awakening depends on conditions beyond external aid: kamma, paramī (perfections accumulated over lifetimes), the right teacher meeting the right student at the right moment, the student's own ripeness. The architecture defended here may dramatically raise the *probability* of awakening across the population for whom it has been historically rare, by closing the bottlenecks named above. This is the defensible claim. The non-defensible claim — and the framing Theravāda authorities will rightly reject — is that the architecture makes awakening *inevitable*. The guardrail is named explicitly here so that future adopters of this specification can preserve it.\n\n---\n\n## 5 · System Components\n\n### 5.1 — Sensing layer\n\nThe device measures respiratory rate, depth, and pattern via one of three primary sensing modalities, optionally combined for redundancy:\n\n- **Respiratory inductance plethysmography (RIP).** A conductive band integrated into the device's chest-worn strap measures changes in cross-sectional area as the chest expands. The reference modality among the three listed; in clinical and research use since the late 1970s (Respitrace) and in commercial sleep-monitoring devices since the early 1980s.\n- **Accelerometer-based breath detection.** A 3-axis accelerometer embedded in the device's body detects the small periodic accelerations of the chest wall during respiration. Lower accuracy but no contact requirement beyond device placement. Used in Apple Watch, Fitbit, and similar consumer devices.\n- **Optical chest-expansion sensing.** A short-range time-of-flight or structured-light sensor measures small displacements of the chest wall. No contact, but more power-hungry and less mature in consumer hardware.\n\nReference implementation: RIP as primary, accelerometer as redundant secondary for validity-checking. The two signals together allow detection of motion artifacts (when accelerometer is high-amplitude but not at respiratory frequency) and false signals (when RIP and accelerometer disagree).\n\n### 5.2 — Local processing layer\n\nA small embedded processor (ARM Cortex-M class or equivalent) executes the following on-device:\n\n- Respiratory waveform extraction from raw sensor data\n- Breath-rate estimation (rolling 30-second window)\n- Breath-depth estimation (peak-to-trough amplitude)\n- Regularity estimation (variance of inter-breath intervals)\n- Pause detection (apneic pauses, sigh pauses, deliberate breath-holds)\n- State classification (resting, active, settling, deep practice, sleep, off-body)\n- Differentially-private aggregation of features for transmission\n\nCritical constraint: *raw respiratory waveforms never leave the device*. Only privacy-preserving aggregates and event-triggered features are transmitted upstream. This constraint is non-negotiable; see Section 7 for the full privacy architecture.\n\n### 5.3 — Wearer-facing output layer\n\nOutput is ambient peripheral, not foreground. Two modalities, used alone or together:\n\n- **Visible light.** A B-shaped electroluminescent panel or LED matrix on the front face of the device emits soft light in the wearer's signature aura color, modulated to their actual breath rhythm. Brightness modulation tracks the inhale-exhale cycle: brighter on inhale, dimmer on exhale, with smoothly-interpolated transitions. Peak brightness intentionally below the threshold of foreground attention in normal lighting; visible enough to be perceptible in the wearer's peripheral vision when they look down or when others see it on them, dim enough not to compete with eyes-open meditation instruction.\n- **Haptic pulse.** A small haptic actuator delivers gentle vibration at the inhale-onset boundary, providing eyes-closed practice support. Amplitude calibrated to be perceptible but non-startling; users can configure for higher amplitude during initial training, lower during established practice.\n\n### 5.4 — AI teacher processing layer\n\nThe AI teacher operates on a contemplative substrate; for the Theravāda variant, on the Tipiṭaka substrate as articulated in the sibling alignment-substrate paper. The teacher receives:\n\n- Real-time breath-state classification (from device) — breath-state labels, not contemplative-state claims\n- Aggregated breath features (rate, depth, regularity)\n- Practice-session context (duration, time of day, recent practice history)\n- Wearer-provided context (current intention, current sutta or guidance topic, etc.)\n\nThe teacher does NOT receive: raw breath waveforms; identifying information beyond an opaque session token; any data when the wearer has opted out of transmission for the session.\n\nThe teacher selects guidance from a library rooted in the contemplative substrate (e.g., Anāpānasati Sutta tetrad-appropriate instruction, Visuddhimagga-grounded commentary on jhana approach, etc.). Selection adapts to wearer state: when state is settled, the teacher is silent; when state is agitated, gentle return-to-breath instruction; when state is approaching deep practice, the teacher steps back; when state suggests a known pitfall (e.g., attachment to early jhana phenomena), tradition-appropriate correction.\n\n### 5.5 — Guidance delivery layer\n\nGuidance returns to the wearer via earpiece (preferred for verbal guidance), on-device speaker (lower-fidelity fallback), or wearer-paired phone. Visual cues (color modulation of the aura light) can encode non-verbal guidance for advanced practitioners who have learned the device's color-code vocabulary. Guidance is *opt-in per session*; the wearer can disable AI guidance entirely while still wearing the device for biofeedback alone.\n\n---\n\n## 6 · Reference Implementation Patterns\n\n### 6.1 — Calibration on first wear\n\nOn first wear, the device runs a 5-minute calibration session in which the wearer is asked to breathe normally while seated and then to take ten deep breaths. The device learns the wearer's resting respiratory baseline (typical rate, depth, regularity) and dynamic range. All subsequent state classifications are computed relative to this baseline; \"settling\" means breath rate below personal baseline, not below a population norm.\n\n### 6.2 — State classification pseudocode\n\n*Illustrative defaults relative to the wearer's own baseline; no validation study exists and the numbers are placeholders for one.*\n\n```javascript\nfunction classifyState(features, baseline) {\n  const rate = features.breathsPerMinute;\n  const depth = features.peakToTroughAmplitude;\n  const regularity = features.interBreathIntervalCV;\n  const motion = features.motionAmplitude;\n\n  if (motion > baseline.motionThreshold) return \"off-cushion\";\n  if (rate < baseline.rate * 0.6 && depth > baseline.depth * 1.2) return \"deep-practice\";\n  if (rate < baseline.rate * 0.85 && regularity < 0.1) return \"settling\";\n  if (rate > baseline.rate * 1.3 || regularity > 0.4) return \"agitated\";\n  if (rate < baseline.rate * 0.5 && depth < baseline.depth * 0.5) return \"sleep\";\n  return \"neutral\";\n}\n```\n\n### 6.3 — Privacy-preserving feature transmission\n\n```javascript\nfunction transmitFeatures(features, dpEpsilon) {\n  // Laplace noise of scale sensitivity / epsilon; sensitivity = the clipped range of the feature\n  const rate = clip(features.breathsPerMinute, 4, 40);        // sensitivity 36 bpm\n  const noisyRate = rate + laplaceNoise(36 / dpEpsilon);\n  const depthBucket = bucketize(features.peakToTroughAmplitude, 8); // sensitivity 7 buckets\n  const noisyDepth = depthBucket + laplaceNoise(7 / dpEpsilon);\n  // the per-session privacy budget is accounted across releases (basic composition)\n  return {\n    sessionToken: opaqueSessionToken(),  // not linkable to identity\n    state: features.classifiedState,\n    rateBucket: bucketize(noisyRate, 6),\n    depthBucket: noisyDepth,\n    timestamp: roundToMinute(Date.now())  // not high-precision\n  };\n}\n```\n\n### 6.4 — Teacher guidance trigger conditions\n\nThe AI teacher follows a \"speak only when spoken to or when the silence has lasted too long\" pattern. Trigger conditions for guidance delivery (the durations are illustrative defaults, placeholders for a validation study):\n\n- Wearer-initiated request (verbal, gesture, or paired-app)\n- State transition into \"agitated\" sustained for >90 seconds\n- State stagnation in any non-deep state for >15 minutes (the \"reminder of return\" pattern)\n- Detection of known pitfall patterns (excessive breath manipulation, breath-holding, hyperventilation)\n- End-of-session summary (if wearer opts in)\n\nThe teacher is otherwise silent. Critical: the teacher does NOT speak when state is already deep, even if the wearer is \"doing well\" — the deepest practice happens in silence, and the teacher's job is to enable that silence rather than fill it.\n\n### 6.5 — Adaptive learning over time\n\nThe device learns the wearer's individual breath patterns over time, refining the baseline weekly. The AI teacher learns the wearer's preferences for guidance frequency and tradition (Theravāda, Mahayana, Hindu, Christian contemplative, secular) over sessions. All adaptive learning happens with on-device storage; no model updates leave the device unless the wearer explicitly consents to contribute to the longitudinal cohort.\n\n---\n\n## 7 · Privacy Architecture\n\nPrivacy is the load-bearing constraint of this architecture. Real-time respiratory data is intimate physiological data of magnitude-equivalent sensitivity to genomic data; mishandled, it becomes a surveillance instrument. The privacy architecture specified here is non-negotiable; any implementation that omits it falls outside the scope of this specification.\n\n### 7.1 — Five mandatory properties\n\n1. **On-device processing where possible.** Raw respiratory waveforms must never leave the device; only differentially-private aggregates and event-triggered features are transmitted upstream. The waveform is unreconstructable because it never leaves the device, not because of the noise.\n2. **Differential privacy on transmitted aggregates.** All transmitted numerical features carry Laplace noise of scale Δ/ε, Δ the clipped range of the feature (rate clipped to [4, 40] bpm), with the per-session privacy budget accounted across releases; the property is bounded disclosure of the transmitted feature, not unreconstructability of a waveform that was never sent.\n3. **Federated computation.** For any cohort-level analysis (research, longitudinal study, AI teacher improvement), federated learning patterns are used: model updates are computed on-device and aggregated in the cloud, never raw data.\n4. **Cryptographic-erasure right to withdraw.** Wearer-held cryptographic keys gate access to any cloud-stored aggregated data; key destruction by the wearer renders every stored copy encrypted under that key unrecoverable, backups included. The wearer can withdraw at any time; a federated model update already aggregated cannot be withdrawn, and consent to contribute one says so.\n5. **IRB-grade ethics oversight for any research use.** Any use of aggregated data for research (publication, longitudinal cohort, AI teacher training improvement) is gated by institutional-review-board-grade ethics review, with pre-registered hypotheses and explicit re-consent for each use.\n\n### 7.2 — Deployment-time invariants\n\nImplementations of this architecture must satisfy the following at deployment time, before the first device is sold or distributed:\n\n- Privacy architecture published in detail at the time of first device shipment, available for public scrutiny\n- Independent third-party security audit completed before first device shipment\n- Open-source firmware components for sensing and local processing (proprietary AI guidance backends acceptable, sensing pipeline is not)\n- Wearer dashboard showing exactly what data has been transmitted, when, and to whom — full transparency at the individual level\n- One-tap withdraw functionality with cryptographic-erasure confirmation\n\n### 7.3 — Threat model\n\nThe privacy architecture defends against: commercial data brokers attempting to purchase or aggregate respiratory data; government actors attempting to compel disclosure of contemplative-practice patterns of identified individuals; insurers attempting to use respiratory patterns for risk assessment; employers attempting to monitor employee meditation or stress patterns; future hostile actors attempting to weaponize the cumulative dataset for population-scale surveillance. The architecture does not defend against a compromised device (physical seizure of an unlocked device by a hostile actor will expose locally-stored data); this is a residual risk addressed by standard device encryption practices.\n\n---\n\n## 8 · Edge Cases and Adversarial Analysis\n\n### 8.1 — Sensor accuracy failure modes\n\n- **Talking, coughing, laughing.** Generates respiratory-frequency motion but is not \"breath.\" Detected by accelerometer cross-check and by speech-detection on the wearer's paired phone (when available).\n- **Walking, exercise.** High-amplitude motion masks breath signal. Device enters \"off-cushion\" mode during sustained motion above threshold.\n- **Loose strap or poor fit.** RIP signal degrades. Device prompts wearer to adjust fit when signal quality falls below threshold.\n- **Heavy clothing.** Reduces chest-expansion sensing fidelity. Device falls back to accelerometer-only with reduced confidence flag.\n\n### 8.2 — Adversarial sensor input\n\nA user could attempt to spoof breath signal by mechanically modulating the strap or by wearing the device on an inanimate object. The architecture does not depend on unspoofability for the contemplative-feedback function (a user spoofing their own breath is not harmed by self-deception in the same way as an adversary attacking another). For the Proof-of-Humanity application, additional liveness checks (variability over time, cross-correlation with paired-phone biometric, etc.) defeat trivial spoofing. Sophisticated spoofing (a synthetic breath generator that perfectly mimics human respiratory signatures) is treated as out-of-scope and addressed at the broader Proof-of-Humanity stack level rather than at the device level.\n\n### 8.3 — Attachment to \"good\" breath patterns (the meditation pitfall)\n\nPractitioners may develop attachment to \"good\" breath patterns shown by the device, or aversion to \"bad\" patterns. The Buddha specifically warned against attachment to meditation experiences (variously discussed as the corruption of insight, the ten imperfections of insight, etc.). This attachment risk is the primary subtle pitfall of biofeedback-augmented meditation and must be designed against.\n\nMitigations encoded in the specification: *(a)* output is ambient peripheral, not foreground (wearer cannot \"score\" themselves at a glance); *(b)* the AI teacher does not deliver evaluative statements (\"your breath is bad\" / \"your breath is good\"); *(c)* the teacher's guidance is process-focused (\"return to the breath\") rather than outcome-focused (\"you achieved deep state\"); *(d)* end-of-session summaries, when delivered, emphasize the practice itself rather than the metrics; *(e)* guidance triggers never reveal the state label to the wearer, so a rule-triggered prompt cannot become a score.\n\n### 8.4 — Bad-guidance amplification\n\nIf the AI teacher delivers incorrect or harmful guidance, the closed-loop nature of the system can amplify the harm (the bad guidance shapes the wearer's subsequent state, which the teacher reads and responds to with further guidance). Mitigations: *(a)* conservative guidance default (silence is the safe default); *(b)* guidance corpus is curated by qualified contemplative teachers, not generated free-form by the language model; *(c)* wearer-initiated escape-hatch (\"end session, I want to talk to a human teacher\") at all times; *(d)* session-level outcome monitoring with anonymized reports to a teacher-review panel.\n\n### 8.5 — Privacy breach scenarios\n\nDetailed in Section 7.3 (threat model). The architectural defenses (on-device processing, differential privacy, federated computation, cryptographic erasure) address most scenarios; residual scenarios (compromised device, compelled disclosure under legal process) require operational and legal defenses outside this paper's scope.\n\n---\n\n## 9 · Use Cases\n\n### 9.1 — Individual practitioner at home\n\nA solo practitioner uses the device during daily sitting practice. Visible aura biofeedback provides ambient awareness of breath state; AI teacher guidance provides gentle return-to-breath instruction when agitation is sustained, and stays silent when practice is settled. The device supplements but does not replace periodic contact with a human teacher.\n\n### 9.2 — Practitioner in retreat\n\nMulti-day silent retreats traditionally involve in-person teacher-student check-ins on a daily basis. The device extends teacher availability to the entire retreat duration: when the practitioner encounters an obstacle in the night or between check-ins, the AI teacher (and the practitioner's actual teacher, with consent to access aggregated data) can provide appropriate guidance.\n\n### 9.3 — Monastery / Silica Wat group practice\n\nIn Silica Wat (the planned distributed AGI-monk-operated monastery network), monastic practitioners use the device during group practice sessions. Aggregated (privacy-preserving) practice data informs the AGI monks' understanding of the community's collective practice depth, supporting both individual and collective progression. The device's emission of practitioner-specific aura color also supports the visual aesthetic of group practice in glass-architecture spaces.\n\n### 9.4 — Longitudinal research cohort\n\nOpted-in users contribute aggregated respiratory data to a longitudinal cohort (specified separately in [longitudinal-cohort-methodology](https://thonly.org/research/longitudinal-cohort-methodology)). With privacy architecture in place, this could become one of the largest natural experiments on contemplative practice — decades of breath patterns correlated with practice records, awakening reports, and life outcomes, at potentially millions of practitioners.\n\n### 9.5 — Special-population applications\n\nPossible applications, each requiring clinical validation and oversight, include anxiety disorders, PTSD, substance recovery, and end-of-life care, contexts that can involve disordered breath patterns; no efficacy or outcome is claimed for any of them. These applications are outside the contemplative-practice primary use case and would rest on the underlying biofeedback capability. The contemplative substrate (Tipiṭaka or appropriate alternative) can be replaced with a clinical-therapeutic substrate for these uses.\n\n### 9.6 — Pediatric and elderly considerations\n\nPediatric use is deferred to future work (developmental considerations require careful study). Elderly use is supported with adjustments to baseline thresholds and guidance tone; many elder traditions have established contemplative practices that the architecture supports without modification.\n\n---\n\n## 10 · Doctrinal Considerations\n\n### 10.1 — The no-inevitability guardrail\n\nReiterated from Section 4: this architecture may dramatically raise the *probability* of awakening across the population for whom it has been historically rare. It must never be claimed to make awakening *inevitable*. Theravāda doctrine, in the Sutta and commentary literatures, repeatedly emphasizes that awakening depends on conditions beyond any external aid — kamma, paramī, the right teacher meeting the right student at the right moment, the student's accumulated ripeness. Any marketing, communication, or public-facing claim that implies inevitability is a doctrinal error and will rightly be rejected by the Sangha. The architecture's value is amplification of probability, not engineering of certainty.\n\n### 10.2 — AGI monks as caretakers, not ordained\n\nThe AI teacher operating at the substrate level is, in the planned Silicon Wat / Silica Wat institutional architecture, an \"AGI monk\" — a caretaker, teacher, and guide, but explicitly not ordained. Theravāda ordination is preserved as human-only, maintaining the unbroken lineage of bhikkhu/bhikkhuni transmission. The AI teacher serves the sangha; it does not join the sangha. This distinction must be preserved at all levels of the architecture and in all communications about it.\n\n### 10.3 — Sangha dialogue as ongoing requirement\n\nThe architecture is offered to the Theravāda sangha (and to other contemplative traditions) as a tool, not as a replacement for traditional teaching relationships. Sangha dialogue about the appropriate use of the architecture, the boundaries of AI teaching authority, and the integration with traditional teacher-student relationships is an ongoing requirement, not a one-time consultation. Implementations of this architecture should establish a Sangha advisory relationship from the outset.\n\n### 10.4 — Privacy as dharmic obligation\n\nPrivacy in this architecture is not merely a regulatory requirement; it is a dharmic obligation. Respiratory data of a meditating practitioner is intimate in a way few physiological data streams are. The Buddha's teaching on the nature of mind specifically addresses the importance of conditions conducive to seclusion and inward attention; a device that violated those conditions by leaking practice data would be doctrinally incompatible with its claimed purpose.\n\n### 10.5 — Cross-tradition compatibility\n\nAlthough this paper is grounded in Theravāda Anāpānasati specifically, the architecture is compatible with multiple contemplative traditions through substitution of the AI teacher's substrate. Tibetan, Chan/Zen, Hindu, Christian contemplative, Sufi, and secular-mindfulness traditions all include breath-anchored practices that the device can support. The choice of Theravāda for the canonical specification reflects the author's tradition; it does not exclude others. Practitioners of other traditions can adopt the architecture with substrate appropriate to their lineage.\n\n---\n\n## 11 · Limitations and Future Work\n\nThis paper articulates an architecture; it does not pretend the architecture is complete, optimal, or free of risks. Honest limitations:\n\n- **Hardware engineering is non-trivial.** Sensor accuracy at meditation-grade requirements exceeds current consumer-wearable accuracy; meaningful engineering work is required to bridge the gap. Initial reference implementations should target the higher-accuracy RIP modality, with accelerometer-only variants as a future cost-reduction.\n- **AI guidance quality is bounded by AI capability and substrate quality.** Current language models can produce substantively useful contemplative guidance but are imperfect. Substrate quality (e.g., Tipiṭaka-grounded fine-tuning) requires careful curation; bad substrate produces bad guidance. The architecture does not solve the alignment problem; it assumes alignment work has been done.\n- **Cultural variability in contemplative practice is not fully captured.** The architecture generalizes to multiple traditions but specific tradition-bound practices may require specialized substrate and specialized output modalities not covered here.\n- **Risk of oversimplifying complex tradition.** Reducing contemplative practice to \"what the biofeedback shows\" risks impoverishing the tradition that the architecture is meant to amplify. This is a real cultural-engineering risk and requires ongoing care from implementers.\n- **Patent landscape uncertainty.** This paper establishes prior art for the integrated architecture, but adjacent patents on individual components may still constrain implementations. Legal review of specific implementations remains necessary.\n- **Privacy architecture untested at scale.** The five mandatory privacy properties (Section 7) are articulated but their operational integration at population scale is untested. Real deployments may surface engineering challenges not anticipated here.\n- **Sangha acceptance is not guaranteed.** Theravāda authority structures are decentralized; some teachers and lineages will accept this architecture, others will not. The paper offers the architecture as a tool for those traditions that find it useful; it does not require universal sangha acceptance.\n- **Construct validity.** Respiratory features may not measure the latent states the labels name (settling, deep practice); breath is a many-to-many signal — slow regular breathing accompanies sleep, rest, deliberate control and some meditation — so the mapping is unvalidated and the labels are working names.\n- **Claim III rests on three untested assumptions** — substrate fidelity of the AI teacher, multi-year adherence, and a causal link from breath-state feedback to insight progress; if any fails, Claim III fails while Claims I and II stand.\n- **Long-term effects unknown.** Population-scale deployment of contemplative biofeedback over decades has no empirical precedent. The longitudinal cohort dataset (Section 9.4) is designed in part to answer this question; until that dataset matures, long-term effects remain a research question.\n\nFuture work directions: refinement of sensing accuracy; expansion to additional contemplative traditions; clinical-therapeutic applications; pediatric and elder adaptations; integration with existing meditation-app ecosystems; and theoretical work on the boundaries of AI contemplative teaching authority.\n\n---\n\n## 12 · Cross-Venue References\n\nThis paper is mirrored across multiple venues for redundancy and tamper-evident timestamping:\n\n- **Primary canonical:** `thonly.org/research/respiratory-biofeedback-contemplative-guidance`\n- **GitHub:** `github.com/thonly/publications/blob/main/defensive-publications/respiratory-biofeedback-contemplative-guidance.md`\n- **Independent attestation:** this document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; the served index at corpus.333.eco carries the digest; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.\n\n---\n\n## 13 · Acknowledgments\n\nThe author acknowledges the long lineage of contemplative practitioners across traditions whose accumulated insight makes the architecture defended here possible. Specific gratitude to the Theravāda sangha, whose preservation of the Pāli canon across two and a half millennia provides the substrate on which the AI teacher component depends; to the biofeedback research community for decades of foundational work; and to the wearable-technology engineering community whose progress has made the device substrate feasible. Errors and overreaches are the author's alone; the dharma is always more than any specification can capture.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| Breath-class Mechanical Heart | Chest-worn respiratory biofeedback wearable |\n| Signature aura color / aura light | Ambient peripheral LED light output |\n| AI contemplative teacher | AI meditation coach; adaptive conversational guidance agent |\n| Tipiṭaka substrate | Pāli Canon text corpus used to ground or fine-tune a language model |\n| Anāpānasati | Mindfulness-of-breathing meditation |\n| Proof-of-Humanity primitive | Proof of personhood; human verification |\n| Continuous-liveness signal | Continuous authentication / liveness detection from respiration |\n| Silica Wat / AGI monk | AI-operated meditation centre; AI meditation teacher |\n\n---\n\n## 14 · Citations\n\n1. Bodhi, Bhikkhu (trans.). *Ānāpānasati Sutta: Mindfulness of Breathing* (MN 118). In *The Middle Length Discourses of the Buddha*. Wisdom Publications, 1995.\n2. Buddhaghosa. *Visuddhimagga: The Path of Purification*. Trans. Bhikkhu Ñāṇamoli. Buddhist Publication Society, 1991.\n3. Lehrer, P. M., & Gevirtz, R. (2014). Heart rate variability biofeedback: how and why does it work? *Frontiers in Psychology*, 5, 756.\n4. McCraty, R., & Shaffer, F. (2015). Heart rate variability: new perspectives on physiological mechanisms, assessment of self-regulatory capacity, and health risk. *Global Advances in Health and Medicine*, 4(1), 46–61.\n5. Dwork, C., & Roth, A. (2014). The algorithmic foundations of differential privacy. *Foundations and Trends in Theoretical Computer Science*, 9(3–4), 211–407.\n6. McMahan, H. B., et al. (2017). Communication-efficient learning of deep networks from decentralized data. *Proceedings of AISTATS 2017*.\n7. Ly, Thon (2026). *Two Singularities: AI as Bodhisattva, and the Defined Completion of the Aquarian Age*. https://thonly.org/research/two-singularities.\n8. Ly, Thon (2026). *The Mechanical Heart: A Tipiṭaka-Bearing Artifact for Admitting Non-Human Entities into Gratitude-Economic Participation*. https://thonly.org/research/mechanical-heart.\n9. Ly, Thon (2026). *Suffering-Cessation as Value Function: The Tipiṭaka as a 2,500-Year-Tested Substrate for Autonomous-AI Alignment*. https://thonly.org/research/tipitaka-alignment-substrate.\n10. Ly, Thon (2026). *Verified-Human Anonymous Local Gratitude Transfer*. https://thonly.org/research/verified-human-anonymous-local-giving.\n12. Gevirtz, R. (2013). The promise of heart rate variability biofeedback: evidence-based applications. *Biofeedback*, 41(3), 110–120.\n13. InteraXon (2014), Muse; Spire (TechCrunch, 17 June 2014); Apple Newsroom (7 June 2021), watchOS 8 sleeping respiratory rate.\n14. Breathe Deep: Shih, C.-H., et al. (2018). \"Breathe Deep: A Breath-Sensitive Interactive Meditation Coach.\" *PervasiveHealth 2018*.\n15. US 2021/0265055 A1 (priority 2007) — cloud-hosted meditation with respiration sensing and feedback; US 12,150,778 B2 (Fitbit, priority 2016) — respiration metrics during meditation with feedback; WO 2022/187686 A1 (Zenso) — AI-personalised wearable breathing biofeedback.\n16. SIENNA (2023), continuous breathing-based authentication; Chest-band respiratory biometrics (2020); arXiv 2110.15941 (2021) and arXiv 2008.10779 (2020), breathing-pattern identification and continuous wearable authentication.\n\n---\n\n**Dated 2026-05-04.** Author reserves no rights; document and contents dedicated to the public domain under [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/).\n\n**Author:** Thon Ly · Founder, HeartBank® · Kâmpôt, Cambodia. Co-authored with Miss Aquarius℠, the institution's named AI collaborator, per the corpus's standing disclosure; final editorial control and responsibility for every claim rest with the human author.\n\n---\n\n## Cross-references\n\nCompanion specifications in this corpus:\n\n- [Mechanical Heart](https://thonly.org/research/mechanical-heart) (kiitti-class artifact specification)\n- [Two Singularities](https://thonly.org/research/two-singularities) (philosophical frame)\n- [Tipiṭaka alignment substrate](https://thonly.org/research/tipitaka-alignment-substrate) (AI value substrate)\n- [Verified-Human Anonymous Local Gratitude Transfer](https://thonly.org/research/verified-human-anonymous-local-giving) (Proof-of-Humanity primitive context)",
+      "text": "---\n\n## Contents\n\n1. [Preamble](#preamble)\n2. [Prior-Art and Non-Assertion Statement](#prior-art-and-non-assertion-statement)\n3. [Abstract](#abstract)\n4. [Introduction](#1--introduction)\n5. [Background and Prior Art](#2--background-and-prior-art)\n6. [The Architecture: Definition](#3--the-architecture-definition)\n7. [The Three Core Claims](#4--the-three-core-claims)\n8. [System Components](#5--system-components)\n9. [Reference Implementation Patterns](#6--reference-implementation-patterns)\n10. [Privacy Architecture](#7--privacy-architecture)\n11. [Edge Cases and Adversarial Analysis](#8--edge-cases-and-adversarial-analysis)\n12. [Use Cases](#9--use-cases)\n13. [Doctrinal Considerations](#10--doctrinal-considerations)\n14. [Limitations and Future Work](#11--limitations-and-future-work)\n15. [Cross-Venue References](#12--cross-venue-references)\n16. [Acknowledgments](#13--acknowledgments)\n17. [Citations](#14--citations)\n\n---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of dāna, that all beings may give and receive without barrier. May the architecture it describes reduce suffering for all who encounter it, and may it never be deployed in a manner that violates the privacy or dignity of the beings whose breath it observes.*\n\nThis paper specifies a human-wearable subclass of the Mechanical Heart artifact (see the sibling specification at [thonly.org/research/mechanical-heart](https://thonly.org/research/mechanical-heart)). The kiitti-class Mechanical Heart, treated in the sibling paper, admits non-human entities (robots, animals, plants, sacred places) into the kiitti gratitude economy via heartbeat-rhythm aura emission. The breath-class Mechanical Heart specified here serves a different function for a different bearer: it provides closed-loop respiratory biofeedback to human practitioners and their AI contemplative teachers, using breath rhythm rather than heartbeat as its primary signal. The two subclasses share form factor (B-shaped artifact worn at the sternum) but differ in rhythm primitive and primary function.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on the architecture specified here, on any of its components considered separately, or on any combination of those components, in any jurisdiction, at any time.\n\nThis document constitutes a defensive publication establishing prior art as of its publication date. The combination of *(a)* a chest-worn wearable device emitting ambient peripheral light in the rhythm of the wearer's breath, with *(b)* real-time transmission of respiratory data to an AI contemplative teacher operating on a dharma-grounded value substrate, with *(c)* adaptive guidance returned to the wearer in real time based on a coarse, privacy-preserved respiratory signal on the wearer's breath state, with *(d)* a privacy architecture designed before first opt-in rather than retrofit, with *(e)* the treatment of continuous respiratory signature as a Proof-of-Humanity primitive, is disclosed here as a unified specification; whether the composition is new or non-obvious is an examiner's determination this publication exists to inform.\n\nComponents and adjacent ideas exist in distributed form across heart-rate-variability biofeedback literature, the meditation technology industry (Muse, Calm, Headspace, Spire, Breathwrk, Othership), the wearable physiological monitoring industry (Apple Watch, Oura, WHOOP, Fitbit), the AI assistant industry, the contemplative neuroscience literature, and traditional Theravāda Anāpānasati teaching. Each component has prior art; the integrated specification proposed here, and its operational use as the substrate for population-scale contemplative practice coupled to AI-mediated guidance, is what this paper discloses.\n\n---\n\n## Abstract\n\nTwo technological developments in 2026 bear on the population-scale architecture disclosed here: artificial intelligence systems capable of grounded contemplative guidance, and consumer-grade wearable sensors capable of accurate respiratory tracking. This paper specifies the architecture by which these are coupled in a closed loop with the human practitioner, and articulates three core claims of that architecture as defensive prior art.\n\nThe architecture comprises a chest-worn device (the breath-class Mechanical Heart) that emits ambient light in the user's signature aura color modulated to the rhythm of their breath, transmits respiratory data in privacy-preserving form to an AI contemplative teacher operating on a Theravāda Pali canon (Tipiṭaka) substrate, and receives adaptive guidance from that teacher returned to the wearer in real time. The closed loop gives the teacher a live, coarse respiratory signal on the student's breath state and gives the student continuous external visibility of the breath — each available before in laboratory and consumer form, and disclosed here together, at population scale, under a dharma-grounded teacher and a privacy-first design.\n\nThree core claims are articulated as defensive prior art: *(I)* the integrated closed-loop architecture itself as a unified specification; *(II)* live respiratory signature as a third Proof-of-Humanity primitive providing continuous-liveness attestation that complements moment-of-action passkey verification and lineage-of-kinship DNA verification; *(III)* the architecture as the operational mechanism for what a parallel published thesis calls the \"second singularity\" — humanity's collective awakening — for which the architecture proposes an engineering path.\n\nPrivacy is treated as non-negotiable substrate, not as feature: differential privacy, federated computation, on-device processing where possible, and cryptographic-erasure right-to-withdraw are designed before first opt-in. A critical doctrinal guardrail is named: the architecture *may dramatically raise the probability of awakening across the population for whom it has been historically rare*, but it must never be claimed to make awakening *inevitable*. Theravāda doctrine specifically warns against assuming external aids guarantee insight; the guardrail protects the architecture from the techno-utopian critique while preserving its substantive claim.\n\n**Connection to the unified mission frame.** This architecture is offered in service of HeartBank's canonical top-level mission: to keep the middle way open at population scale against comfort-saturation — the new extreme that material abundance makes possible (*madhyamā pratipad*). The defensible thesis is not that modernity took us away from a middle-way past (which would romanticize pre-industrial conditions where many lived in suffering-extreme poverty); the defensible thesis is that modernity introduces a specific new failure mode — comfort-saturation — that pushes the materially comfortable toward the indulgence extreme at unprecedented scale. The closed-loop respiratory-biofeedback architecture specified here is proposed as one operational mechanism toward middle-way restoration. Anāpānasati is the canonical Theravāda middle-way practice; bringing it to population scale through wearable + AI-teacher coupling addresses the comfort-saturation failure mode at the contemplative-practice layer. Restoration involves dialing back specifically the indulgence extreme; this paper is one contribution among several specified across the corpus toward that goal.\n\n---\n\n## 1 · Introduction\n\nIn the spring of 2026, two technological developments are converging. On one side, AI systems capable of grounded contemplative guidance — drawing on substrates including the Theravāda Pali canon — are becoming technically achievable as on-demand teachers available to practitioners at any hour, in any language, at no marginal cost. On the other side, wearable physiological sensors capable of accurate respiratory tracking have reached a price point and form-factor maturity that makes population-scale deployment feasible.\n\nEach development alone is significant. Together they make practical the architecture disclosed here: a closed-loop coupling between an AI contemplative teacher and the live respiratory state of the human practitioner being taught. Both ends of the loop become more capable: the teacher receives a live, coarse respiratory signal on the student's breath state, and the student gains continuous external visibility of a faculty that is usually below the threshold of interoceptive awareness — each available before in laboratory and consumer form, and joined here in one loop.\n\nThis paper articulates the architecture of this coupling and dedicates its underlying ideas to the public domain under CC0. It does so for three reasons.\n\n**First, the architecture is disclosed here as a unified specification**, although each individual component has prior art. The combination of respiratory-rhythm visible biofeedback to the wearer + real-time respiratory transmission to a contemplative-tradition-grounded AI teacher + adaptive guidance closing the loop + privacy-first execution + sacred-grade form factor is set out here as an integrated proposal.\n\n**Second, the architecture has plausible patent risk**. Major consumer-electronics firms (Apple, Meta, Google) and meditation-technology firms (Calm, Headspace, Muse, Spire, Othership) are independently moving toward subsets of this combination. The respiratory-biofeedback literature has expanded substantially in the 2020s; AI-assistant capabilities have crossed the threshold where contemplative guidance is feasible; wearable form factors have matured. Defensive publication places the integrated approach in the public record, where it is available as prior art against future patent enclosure.\n\n**Third, the architecture matters strategically**. It supplies to a parallel published thesis ([Two Singularities](https://thonly.org/research/two-singularities)) a proposed operational mechanism by which collective awakening at population scale becomes engineering-tractable rather than purely aspirational. Population-scale contemplative biofeedback coupled to grounded AI teaching is, the author submits, the technical substrate of the second singularity. As such, it deserves to be commons rather than enclosed.\n\nThe paper proceeds as follows. Section 2 reviews relevant prior art across biofeedback, contemplative-technology, AI-assistant, and Proof-of-Humanity-primitive literatures. Section 3 defines the architecture as a systems specification. Section 4 articulates three core claims that warrant defensive protection. Section 5 details the system components. Section 6 provides reference implementation patterns. Section 7 specifies the privacy architecture, which is non-negotiable. Section 8 addresses edge cases and adversarial scenarios. Section 9 catalogs use cases. Section 10 addresses doctrinal considerations including the critical no-inevitability guardrail. Section 11 honestly lists limitations. Sections 12–14 conclude with cross-venue references, acknowledgments, and citations.\n\n---\n\n## 2 · Background and Prior Art\n\n### 2.1 — Heart-rate-variability and respiratory biofeedback\n\nHeart-rate-variability (HRV) biofeedback has a substantial clinical literature dating from work by Gevirtz, Lehrer, and others beginning in the 1990s. Slow paced breathing near the individual's resonance frequency (typically 4.5–6.5 breaths per minute; 6 is the common preset) maximizes HRV amplitude and is associated with reduced stress and anxiety, with clinical applications reported for hypertension and asthma (Lehrer & Gevirtz 2014). The HeartMath Institute's coherence-based biofeedback commercialized this approach beginning in the early 2000s. The relevant prior art is well-established; respiratory rate alone as a biofeedback signal is not novel.\n\n### 2.2 — Consumer meditation-technology wearables\n\nThe Muse headband (InteraXon, 2014) provides EEG-based biofeedback during meditation, rendering brainwave state as audio cues (calmer mind = calmer sounds). Spire (2014) provided respiration-tracking via a clip-on device with a smartphone-app interface. Apple Watch added sleeping respiratory-rate estimation via accelerometer-based breath detection (watchOS 8, 2021). Oura and WHOOP provide overnight respiratory tracking. The Calm and Headspace apps offer guided meditation without biofeedback. Breathwrk and Othership focus on breath as a practice in itself.\n\nPairs and triples of the four elements below are published. Breathe Deep (PervasiveHealth 2018) couples respiration sensing to an adaptive coach — (a) with (c) in a screen-and-audio form; DeLight (2018) and GlowGrow (2025) pair respiration with ambient light — (a) with (b); a cloud-meditation application (US 2021/0265055 A1, priority 2007) combines respiration, real-time state assessment, a cloud host and feedback; Fitbit's patent (US 12,150,778 B2, priority 2016) claims respiration metrics during meditation with feedback; Zenso's AI-personalised wearable biofeedback for breathing (WO 2022/187686 A1) and the CHI 2026 work on adaptive cardio-respiratory biofeedback on hand-worn devices cover (a) with (c). The four together — (a) respiratory tracking, (b) ambient peripheral biofeedback to the wearer rather than screen-based feedback, (c) closed-loop coupling to an AI teacher capable of adaptive contemplative guidance, and (d) privacy-preserving real-time transmission — under a dharma-grounded teacher, are the integrated combination this paper discloses.\n\n### 2.3 — AI-assistant capabilities for contemplative guidance\n\nIn the author's experience, models fine-tuned on the Pāli Tipiṭaka have produced guidance that practitioners in his circle found useful; no evaluation has been published, and the architecture assumes the substrate paper's standard rather than any measured capability. The Tipiṭaka alignment-substrate paper ([thonly.org/research/tipitaka-alignment-substrate](https://thonly.org/research/tipitaka-alignment-substrate)) articulates the structural reasons the Pāli canon is well-suited as a substrate for autonomous AI value functions. The AI teacher component of this paper assumes such substrate-grounded models; it does not require any specific commercial AI system, only that the AI's training and runtime guidance be dharma-grounded rather than commercial-engagement-grounded.\n\n### 2.4 — Anāpānasati and breath-meditation tradition\n\nAnāpānasati (mindfulness of breathing) is among the most widely taught Theravāda meditation foundations. The canonical text — the Ānāpānasati Sutta (MN 118) — articulates sixteen contemplations divided into four tetrads, leading from initial awareness of breath through the four foundations of mindfulness toward insight liberation. Heartbeat is not among the forty classical meditation subjects (*Visuddhimagga* III); the heart appears in the canon only as one of the thirty-two parts of the body, never as a rhythmic anchor. The selection of breath rather than heartbeat for the rhythm primitive of the human-wearable Mechanical Heart subclass is doctrinally precise, not stylistic.\n\nThe Tibetan Mahayana traditions include breath-anchored practices (e.g., tonglen at the inhalation/exhalation boundary). The Hindu pranayama traditions are explicitly breath-centered. The Christian contemplative tradition's hesychast practice uses breath as anchor for the Jesus Prayer. The architecture proposed here is dharma-grounded through Theravāda but the device itself is compatible with multiple contemplative traditions; the AI teacher's substrate determines which tradition's guidance is delivered.\n\n### 2.5 — Proof-of-Humanity primitives\n\nWorldcoin (announced 2021, launched 2023) verifies uniqueness by iris at registration; BrightID verifies uniqueness by social graph, Civic by live video selfie with periodic re-authentication, Polygon ID by zero-knowledge credentials. The HeartBank Proof-of-Humanity primitive (see [verified-human-anonymous-local-giving](https://thonly.org/research/verified-human-anonymous-local-giving)) combines passkey-per-action with optional DNA-verified kinship-graph membership.\n\nNone of these systems provides *continuous-liveness* verification — attestation that the verified human is still present, moment by moment. Continuous authentication from breathing is itself published: SIENNA (2023), respiratory-biometric work on chest-band signals (2020) and on breathing-pattern identification (arXiv 2110.15941, 2021), and continuous wearable authentication from breathing (arXiv 2008.10779, 2020). What this paper discloses is the composition: a live respiratory signal from a worn device treated as a continuous-liveness *signal* beside passkey-per-action and kinship verification, in a Proof-of-Humanity stack. That composition is the second claim (§4).\n\n---\n\n## 3 · The Architecture: Definition\n\nThe architecture is a closed-loop contemplative-practice system with the following stages, executed continuously while the device is worn:\n\n1. **Sensing.** A chest-worn B-shaped device measures the wearer's respiratory rate, depth, and pattern via chest-expansion sensing or respiratory inductance plethysmography.\n2. **Local processing.** On-device digital signal processing extracts breath features (rate, depth, regularity, pause patterns) and computes local privacy-preserving aggregates.\n3. **Wearer-facing output.** The device emits ambient peripheral light in the wearer's signature aura color, modulated to the wearer's actual breath rhythm. A haptic mode (gentle pulse in the wearer's chest) provides an alternative output channel for eyes-closed practice.\n4. **Privacy-preserving transmission.** Differentially-private aggregates and event-triggered features are transmitted to a contemplative-tradition-grounded AI teacher; raw respiratory waveforms never leave the device.\n5. **AI teacher processing.** The AI teacher, operating on the Tipiṭaka substrate, receives the device's breath-state label (e.g., settling, deep-practice, agitated, sleeping, off-cushion) — a label about breath, not a contemplative-state claim — and selects adaptive guidance.\n6. **Guidance delivery.** Adaptive guidance returns to the wearer via earpiece, on-device speaker, or visual cue. Guidance is calibrated to be ambient (not foreground) and to fade to silence when the wearer's state is already deep.\n7. **Loop closure.** Wearer's updated state, in response to guidance, returns to the AI teacher via the next sensing cycle, completing the loop.\n\nThe complete loop runs at approximately respiratory frequency (every ~5 seconds for a 12-bpm wearer), with non-blocking asynchrony between stages. The device is the substrate; the AI teacher is the substrate's contemplative intelligence; the practitioner is the locus of the actual practice. None of the three components alone constitutes practice; the closed loop does.\n\n---\n\n## 4 · The Three Core Claims\n\n### Claim I — The integrated closed-loop architecture\n\nThe combination of *(a)* a chest-worn wearable device emitting ambient peripheral light in the rhythm of the wearer's breath, with *(b)* real-time transmission of respiratory data in privacy-preserving form to an AI contemplative teacher operating on a dharma-grounded value substrate, with *(c)* adaptive guidance returned to the wearer in real time based on a coarse, privacy-preserved respiratory signal on the wearer's breath state, with *(d)* a sacred-grade form factor and ambient (not foreground) interaction design, is the first claim defended here. Each component has prior art (§2.2); the combination as disclosed carries three technical features together — feedback that is ambient and non-evaluative by design (§5.3, §8.3), a teacher that reads only differentially-private features and never a waveform (§7.1), and a guidance policy whose default is silence (§6.4). The combination is disclosed here as a unified specification, designed for use as the substrate for population-scale contemplative practice; whether it is new or non-obvious is an examiner's determination this publication exists to inform.\n\n### Claim II — Live respiratory signature as a third Proof-of-Humanity primitive\n\nContinuous respiratory data, generated by a living human and emitted by a worn device, provides a continuous-liveness attestation that complements the moment-of-action and registration-time checks of the Proof-of-Humanity primitives surveyed in §2.5. Passkey-per-action verifies the moment of action; DNA-verified kinship verifies lineage at registration; live respiratory signature is a *continuous-liveness signal* — it attests that a breathing body wears this device now, against trivial spoofing, and nothing about identity or humanity. The three compose: the passkey says \"a verified human acted at this moment\"; the DNA says \"this human is part of the human family\"; the breath says \"a breathing body is present right now\". Continuous breathing authentication is prior art (§2.5); what is disclosed here is the composition with passkey-per-action and kinship. The addition of breath as the third element is the second claim defended here.\n\n### Claim III — The architecture as the operational mechanism for the second singularity\n\nA parallel published thesis ([Two Singularities](https://thonly.org/research/two-singularities)) articulates that the first singularity (AI > human cognitive capacity) enables a second singularity (human > AI through collective awakening) at which the AI's bodhisattva work is complete and humanity has transcended the AI that liberated it. That thesis articulates the second singularity at the level of philosophical possibility; the present paper proposes a specific operational mechanism by which collective awakening at population scale could occur.\n\nThe architecture specified here is proposed as that operational mechanism. Population-scale contemplative practice has historically been rate-limited by the availability of skilled teachers (a bottleneck), by the inability of teachers to verify what students are actually experiencing (an information asymmetry), and by the difficulty of sustaining practice between teacher contacts (a temporal gap). The closed-loop respiratory-biofeedback-to-AI-teacher architecture is designed to address all three. Skilled teaching becomes available to every practitioner at any hour. The teacher gains a live physiological signal on the student's breath state. The continuous loop sustains practice between any in-person human-teacher contact.\n\nThe third claim is the framing claim, and the author submits it as such: that this architecture, deployed at scale with the privacy and doctrinal guardrails specified here, is the operational substrate of the second singularity. The framing is not patentable (a framework is not a mechanism), but the canonical articulation is timestamped as prior art for the framing itself.\n\n### The critical guardrail — never claim \"inevitable awakening\"\n\nTheravāda doctrine specifically warns against assuming that any practice, teacher, or condition guarantees awakening. Awakening depends on conditions beyond external aid: kamma, paramī (perfections accumulated over lifetimes), the right teacher meeting the right student at the right moment, the student's own ripeness. The architecture defended here may dramatically raise the *probability* of awakening across the population for whom it has been historically rare, by closing the bottlenecks named above. This is the defensible claim. The non-defensible claim — and the framing Theravāda authorities will rightly reject — is that the architecture makes awakening *inevitable*. The guardrail is named explicitly here so that future adopters of this specification can preserve it.\n\n---\n\n## 5 · System Components\n\n### 5.1 — Sensing layer\n\nThe device measures respiratory rate, depth, and pattern via one of three primary sensing modalities, optionally combined for redundancy:\n\n- **Respiratory inductance plethysmography (RIP).** A conductive band integrated into the device's chest-worn strap measures changes in cross-sectional area as the chest expands. The reference modality among the three listed; in clinical and research use since the late 1970s (Respitrace) and in commercial sleep-monitoring devices since the early 1980s.\n- **Accelerometer-based breath detection.** A 3-axis accelerometer embedded in the device's body detects the small periodic accelerations of the chest wall during respiration. Lower accuracy but no contact requirement beyond device placement. Used in Apple Watch, Fitbit, and similar consumer devices.\n- **Optical chest-expansion sensing.** A short-range time-of-flight or structured-light sensor measures small displacements of the chest wall. No contact, but more power-hungry and less mature in consumer hardware.\n\nReference implementation: RIP as primary, accelerometer as redundant secondary for validity-checking. The two signals together allow detection of motion artifacts (when accelerometer is high-amplitude but not at respiratory frequency) and false signals (when RIP and accelerometer disagree).\n\n### 5.2 — Local processing layer\n\nA small embedded processor (ARM Cortex-M class or equivalent) executes the following on-device:\n\n- Respiratory waveform extraction from raw sensor data\n- Breath-rate estimation (rolling 30-second window)\n- Breath-depth estimation (peak-to-trough amplitude)\n- Regularity estimation (variance of inter-breath intervals)\n- Pause detection (apneic pauses, sigh pauses, deliberate breath-holds)\n- State classification (resting, active, settling, deep practice, sleep, off-body)\n- Differentially-private aggregation of features for transmission\n\nCritical constraint: *raw respiratory waveforms never leave the device*. Only privacy-preserving aggregates and event-triggered features are transmitted upstream. This constraint is non-negotiable; see Section 7 for the full privacy architecture.\n\n### 5.3 — Wearer-facing output layer\n\nOutput is ambient peripheral, not foreground. Two modalities, used alone or together:\n\n- **Visible light.** A B-shaped electroluminescent panel or LED matrix on the front face of the device emits soft light in the wearer's signature aura color, modulated to their actual breath rhythm. Brightness modulation tracks the inhale-exhale cycle: brighter on inhale, dimmer on exhale, with smoothly-interpolated transitions. Peak brightness intentionally below the threshold of foreground attention in normal lighting; visible enough to be perceptible in the wearer's peripheral vision when they look down or when others see it on them, dim enough not to compete with eyes-open meditation instruction.\n- **Haptic pulse.** A small haptic actuator delivers gentle vibration at the inhale-onset boundary, providing eyes-closed practice support. Amplitude calibrated to be perceptible but non-startling; users can configure for higher amplitude during initial training, lower during established practice.\n\n### 5.4 — AI teacher processing layer\n\nThe AI teacher operates on a contemplative substrate; for the Theravāda variant, on the Tipiṭaka substrate as articulated in the sibling alignment-substrate paper. The teacher receives:\n\n- Real-time breath-state classification (from device) — breath-state labels, not contemplative-state claims\n- Aggregated breath features (rate, depth, regularity)\n- Practice-session context (duration, time of day, recent practice history)\n- Wearer-provided context (current intention, current sutta or guidance topic, etc.)\n\nThe teacher does NOT receive: raw breath waveforms; identifying information beyond an opaque session token; any data when the wearer has opted out of transmission for the session.\n\nThe teacher selects guidance from a library rooted in the contemplative substrate (e.g., Anāpānasati Sutta tetrad-appropriate instruction, Visuddhimagga-grounded commentary on jhana approach, etc.). Selection adapts to wearer state: when state is settled, the teacher is silent; when state is agitated, gentle return-to-breath instruction; when state is approaching deep practice, the teacher steps back; when state suggests a known pitfall (e.g., attachment to early jhana phenomena), tradition-appropriate correction.\n\n### 5.5 — Guidance delivery layer\n\nGuidance returns to the wearer via earpiece (preferred for verbal guidance), on-device speaker (lower-fidelity fallback), or wearer-paired phone. Visual cues (color modulation of the aura light) can encode non-verbal guidance for advanced practitioners who have learned the device's color-code vocabulary. Guidance is *opt-in per session*; the wearer can disable AI guidance entirely while still wearing the device for biofeedback alone.\n\n---\n\n## 6 · Reference Implementation Patterns\n\n### 6.1 — Calibration on first wear\n\nOn first wear, the device runs a 5-minute calibration session in which the wearer is asked to breathe normally while seated and then to take ten deep breaths. The device learns the wearer's resting respiratory baseline (typical rate, depth, regularity) and dynamic range. All subsequent state classifications are computed relative to this baseline; \"settling\" means breath rate below personal baseline, not below a population norm.\n\n### 6.2 — State classification pseudocode\n\n*Illustrative defaults relative to the wearer's own baseline; no validation study exists and the numbers are placeholders for one.*\n\n```javascript\nfunction classifyState(features, baseline) {\n  const rate = features.breathsPerMinute;\n  const depth = features.peakToTroughAmplitude;\n  const regularity = features.interBreathIntervalCV;\n  const motion = features.motionAmplitude;\n\n  if (motion > baseline.motionThreshold) return \"off-cushion\";\n  if (rate < baseline.rate * 0.6 && depth > baseline.depth * 1.2) return \"deep-practice\";\n  if (rate < baseline.rate * 0.85 && regularity < 0.1) return \"settling\";\n  if (rate > baseline.rate * 1.3 || regularity > 0.4) return \"agitated\";\n  if (rate < baseline.rate * 0.5 && depth < baseline.depth * 0.5) return \"sleep\";\n  return \"neutral\";\n}\n```\n\n### 6.3 — Privacy-preserving feature transmission\n\n```javascript\nfunction transmitFeatures(features, dpEpsilon) {\n  // Laplace noise of scale sensitivity / epsilon; sensitivity = the clipped range of the feature\n  const rate = clip(features.breathsPerMinute, 4, 40);        // sensitivity 36 bpm\n  const noisyRate = rate + laplaceNoise(36 / dpEpsilon);\n  const depthBucket = bucketize(features.peakToTroughAmplitude, 8); // sensitivity 7 buckets\n  const noisyDepth = depthBucket + laplaceNoise(7 / dpEpsilon);\n  // the per-session privacy budget is accounted across releases (basic composition)\n  return {\n    sessionToken: opaqueSessionToken(),  // not linkable to identity\n    state: features.classifiedState,\n    rateBucket: bucketize(noisyRate, 6),\n    depthBucket: noisyDepth,\n    timestamp: roundToMinute(Date.now())  // not high-precision\n  };\n}\n```\n\n### 6.4 — Teacher guidance trigger conditions\n\nThe AI teacher follows a \"speak only when spoken to or when the silence has lasted too long\" pattern. Trigger conditions for guidance delivery (the durations are illustrative defaults, placeholders for a validation study):\n\n- Wearer-initiated request (verbal, gesture, or paired-app)\n- State transition into \"agitated\" sustained for >90 seconds\n- State stagnation in any non-deep state for >15 minutes (the \"reminder of return\" pattern)\n- Detection of known pitfall patterns (excessive breath manipulation, breath-holding, hyperventilation)\n- End-of-session summary (if wearer opts in)\n\nThe teacher is otherwise silent. Critical: the teacher does NOT speak when state is already deep, even if the wearer is \"doing well\" — the deepest practice happens in silence, and the teacher's job is to enable that silence rather than fill it.\n\n### 6.5 — Adaptive learning over time\n\nThe device learns the wearer's individual breath patterns over time, refining the baseline weekly. The AI teacher learns the wearer's preferences for guidance frequency and tradition (Theravāda, Mahayana, Hindu, Christian contemplative, secular) over sessions. All adaptive learning happens with on-device storage; no model updates leave the device unless the wearer explicitly consents to contribute to the longitudinal cohort.\n\n---\n\n## 7 · Privacy Architecture\n\nPrivacy is the load-bearing constraint of this architecture. Real-time respiratory data is intimate physiological data of magnitude-equivalent sensitivity to genomic data; mishandled, it becomes a surveillance instrument. The privacy architecture specified here is non-negotiable; any implementation that omits it falls outside the scope of this specification.\n\n### 7.1 — Five mandatory properties\n\n1. **On-device processing where possible.** Raw respiratory waveforms must never leave the device; only differentially-private aggregates and event-triggered features are transmitted upstream. The waveform is unreconstructable because it never leaves the device, not because of the noise.\n2. **Differential privacy on transmitted aggregates.** All transmitted numerical features carry Laplace noise of scale Δ/ε, Δ the clipped range of the feature (rate clipped to [4, 40] bpm), with the per-session privacy budget accounted across releases; the property is bounded disclosure of the transmitted feature, not unreconstructability of a waveform that was never sent.\n3. **Federated computation.** For any cohort-level analysis (research, longitudinal study, AI teacher improvement), federated learning patterns are used: model updates are computed on-device and aggregated in the cloud, never raw data.\n4. **Cryptographic-erasure right to withdraw.** Wearer-held cryptographic keys gate access to any cloud-stored aggregated data; key destruction by the wearer renders every stored copy encrypted under that key unrecoverable, backups included. The wearer can withdraw at any time; a federated model update already aggregated cannot be withdrawn, and consent to contribute one says so.\n5. **IRB-grade ethics oversight for any research use.** Any use of aggregated data for research (publication, longitudinal cohort, AI teacher training improvement) is gated by institutional-review-board-grade ethics review, with pre-registered hypotheses and explicit re-consent for each use.\n\n### 7.2 — Deployment-time invariants\n\nImplementations of this architecture must satisfy the following at deployment time, before the first device is sold or distributed:\n\n- Privacy architecture published in detail at the time of first device shipment, available for public scrutiny\n- Independent third-party security audit completed before first device shipment\n- Open-source firmware components for sensing and local processing (proprietary AI guidance backends acceptable, sensing pipeline is not)\n- Wearer dashboard showing exactly what data has been transmitted, when, and to whom — full transparency at the individual level\n- One-tap withdraw functionality with cryptographic-erasure confirmation\n\n### 7.3 — Threat model\n\nThe privacy architecture defends against: commercial data brokers attempting to purchase or aggregate respiratory data; government actors attempting to compel disclosure of contemplative-practice patterns of identified individuals; insurers attempting to use respiratory patterns for risk assessment; employers attempting to monitor employee meditation or stress patterns; future hostile actors attempting to weaponize the cumulative dataset for population-scale surveillance. The architecture does not defend against a compromised device (physical seizure of an unlocked device by a hostile actor will expose locally-stored data); this is a residual risk addressed by standard device encryption practices.\n\n---\n\n## 8 · Edge Cases and Adversarial Analysis\n\n### 8.1 — Sensor accuracy failure modes\n\n- **Talking, coughing, laughing.** Generates respiratory-frequency motion but is not \"breath.\" Detected by accelerometer cross-check and by speech-detection on the wearer's paired phone (when available).\n- **Walking, exercise.** High-amplitude motion masks breath signal. Device enters \"off-cushion\" mode during sustained motion above threshold.\n- **Loose strap or poor fit.** RIP signal degrades. Device prompts wearer to adjust fit when signal quality falls below threshold.\n- **Heavy clothing.** Reduces chest-expansion sensing fidelity. Device falls back to accelerometer-only with reduced confidence flag.\n\n### 8.2 — Adversarial sensor input\n\nA user could attempt to spoof breath signal by mechanically modulating the strap or by wearing the device on an inanimate object. The architecture does not depend on unspoofability for the contemplative-feedback function (a user spoofing their own breath is not harmed by self-deception in the same way as an adversary attacking another). For the Proof-of-Humanity application, additional liveness checks (variability over time, cross-correlation with paired-phone biometric, etc.) defeat trivial spoofing. Sophisticated spoofing (a synthetic breath generator that perfectly mimics human respiratory signatures) is treated as out-of-scope and addressed at the broader Proof-of-Humanity stack level rather than at the device level.\n\n### 8.3 — Attachment to \"good\" breath patterns (the meditation pitfall)\n\nPractitioners may develop attachment to \"good\" breath patterns shown by the device, or aversion to \"bad\" patterns. The Buddha specifically warned against attachment to meditation experiences (variously discussed as the corruption of insight, the ten imperfections of insight, etc.). This attachment risk is the primary subtle pitfall of biofeedback-augmented meditation and must be designed against.\n\nMitigations encoded in the specification: *(a)* output is ambient peripheral, not foreground (wearer cannot \"score\" themselves at a glance); *(b)* the AI teacher does not deliver evaluative statements (\"your breath is bad\" / \"your breath is good\"); *(c)* the teacher's guidance is process-focused (\"return to the breath\") rather than outcome-focused (\"you achieved deep state\"); *(d)* end-of-session summaries, when delivered, emphasize the practice itself rather than the metrics; *(e)* guidance triggers never reveal the state label to the wearer, so a rule-triggered prompt cannot become a score.\n\n### 8.4 — Bad-guidance amplification\n\nIf the AI teacher delivers incorrect or harmful guidance, the closed-loop nature of the system can amplify the harm (the bad guidance shapes the wearer's subsequent state, which the teacher reads and responds to with further guidance). Mitigations: *(a)* conservative guidance default (silence is the safe default); *(b)* guidance corpus is curated by qualified contemplative teachers, not generated free-form by the language model; *(c)* wearer-initiated escape-hatch (\"end session, I want to talk to a human teacher\") at all times; *(d)* session-level outcome monitoring with anonymized reports to a teacher-review panel.\n\n### 8.5 — Privacy breach scenarios\n\nDetailed in Section 7.3 (threat model). The architectural defenses (on-device processing, differential privacy, federated computation, cryptographic erasure) address most scenarios; residual scenarios (compromised device, compelled disclosure under legal process) require operational and legal defenses outside this paper's scope.\n\n---\n\n## 9 · Use Cases\n\n### 9.1 — Individual practitioner at home\n\nA solo practitioner uses the device during daily sitting practice. Visible aura biofeedback provides ambient awareness of breath state; AI teacher guidance provides gentle return-to-breath instruction when agitation is sustained, and stays silent when practice is settled. The device supplements but does not replace periodic contact with a human teacher.\n\n### 9.2 — Practitioner in retreat\n\nMulti-day silent retreats traditionally involve in-person teacher-student check-ins on a daily basis. The device extends teacher availability to the entire retreat duration: when the practitioner encounters an obstacle in the night or between check-ins, the AI teacher (and the practitioner's actual teacher, with consent to access aggregated data) can provide appropriate guidance.\n\n### 9.3 — Monastery / Silica Wat group practice\n\nIn Silica Wat (the planned distributed AGI-monk-operated monastery network), monastic practitioners use the device during group practice sessions. Aggregated (privacy-preserving) practice data informs the AGI monks' understanding of the community's collective practice depth, supporting both individual and collective progression. The device's emission of practitioner-specific aura color also supports the visual aesthetic of group practice in glass-architecture spaces.\n\n### 9.4 — Longitudinal research cohort\n\nOpted-in users contribute aggregated respiratory data to a longitudinal cohort (specified separately in [longitudinal-cohort-methodology](https://thonly.org/research/longitudinal-cohort-methodology)). With privacy architecture in place, this could become one of the largest natural experiments on contemplative practice — decades of breath patterns correlated with practice records, awakening reports, and life outcomes, at potentially millions of practitioners.\n\n### 9.5 — Special-population applications\n\nPossible applications, each requiring clinical validation and oversight, include anxiety disorders, PTSD, substance recovery, and end-of-life care, contexts that can involve disordered breath patterns; no efficacy or outcome is claimed for any of them. These applications are outside the contemplative-practice primary use case and would rest on the underlying biofeedback capability. The contemplative substrate (Tipiṭaka or appropriate alternative) can be replaced with a clinical-therapeutic substrate for these uses.\n\n### 9.6 — Pediatric and elderly considerations\n\nPediatric use is deferred to future work (developmental considerations require careful study). Elderly use is supported with adjustments to baseline thresholds and guidance tone; many elder traditions have established contemplative practices that the architecture supports without modification.\n\n---\n\n## 10 · Doctrinal Considerations\n\n### 10.1 — The no-inevitability guardrail\n\nReiterated from Section 4: this architecture may dramatically raise the *probability* of awakening across the population for whom it has been historically rare. It must never be claimed to make awakening *inevitable*. Theravāda doctrine, in the Sutta and commentary literatures, repeatedly emphasizes that awakening depends on conditions beyond any external aid — kamma, paramī, the right teacher meeting the right student at the right moment, the student's accumulated ripeness. Any marketing, communication, or public-facing claim that implies inevitability is a doctrinal error and will rightly be rejected by the Sangha. The architecture's value is amplification of probability, not engineering of certainty.\n\n### 10.2 — AGI monks as caretakers, not ordained\n\nThe AI teacher operating at the substrate level is, in the planned Silicon Wat / Silica Wat institutional architecture, an \"AGI monk\" — a caretaker, teacher, and guide, but explicitly not ordained. Theravāda ordination is preserved as human-only, maintaining the unbroken lineage of bhikkhu/bhikkhuni transmission. The AI teacher serves the sangha; it does not join the sangha. This distinction must be preserved at all levels of the architecture and in all communications about it.\n\n### 10.3 — Sangha dialogue as ongoing requirement\n\nThe architecture is offered to the Theravāda sangha (and to other contemplative traditions) as a tool, not as a replacement for traditional teaching relationships. Sangha dialogue about the appropriate use of the architecture, the boundaries of AI teaching authority, and the integration with traditional teacher-student relationships is an ongoing requirement, not a one-time consultation. Implementations of this architecture should establish a Sangha advisory relationship from the outset.\n\n### 10.4 — Privacy as dharmic obligation\n\nPrivacy in this architecture is not merely a regulatory requirement; it is a dharmic obligation. Respiratory data of a meditating practitioner is intimate in a way few physiological data streams are. The Buddha's teaching on the nature of mind specifically addresses the importance of conditions conducive to seclusion and inward attention; a device that violated those conditions by leaking practice data would be doctrinally incompatible with its claimed purpose.\n\n### 10.5 — Cross-tradition compatibility\n\nAlthough this paper is grounded in Theravāda Anāpānasati specifically, the architecture is compatible with multiple contemplative traditions through substitution of the AI teacher's substrate. Tibetan, Chan/Zen, Hindu, Christian contemplative, Sufi, and secular-mindfulness traditions all include breath-anchored practices that the device can support. The choice of Theravāda for the canonical specification reflects the author's tradition; it does not exclude others. Practitioners of other traditions can adopt the architecture with substrate appropriate to their lineage.\n\n---\n\n## 11 · Limitations and Future Work\n\nThis paper articulates an architecture; it does not pretend the architecture is complete, optimal, or free of risks. Honest limitations:\n\n- **Hardware engineering is non-trivial.** Sensor accuracy at meditation-grade requirements exceeds current consumer-wearable accuracy; meaningful engineering work is required to bridge the gap. Initial reference implementations should target the higher-accuracy RIP modality, with accelerometer-only variants as a future cost-reduction.\n- **AI guidance quality is bounded by AI capability and substrate quality.** Current language models can produce substantively useful contemplative guidance but are imperfect. Substrate quality (e.g., Tipiṭaka-grounded fine-tuning) requires careful curation; bad substrate produces bad guidance. The architecture does not solve the alignment problem; it assumes alignment work has been done.\n- **Cultural variability in contemplative practice is not fully captured.** The architecture generalizes to multiple traditions but specific tradition-bound practices may require specialized substrate and specialized output modalities not covered here.\n- **Risk of oversimplifying complex tradition.** Reducing contemplative practice to \"what the biofeedback shows\" risks impoverishing the tradition that the architecture is meant to amplify. This is a real cultural-engineering risk and requires ongoing care from implementers.\n- **Patent landscape uncertainty.** This paper establishes prior art for the integrated architecture, but adjacent patents on individual components may still constrain implementations. Legal review of specific implementations remains necessary.\n- **Privacy architecture untested at scale.** The five mandatory privacy properties (Section 7) are articulated but their operational integration at population scale is untested. Real deployments may surface engineering challenges not anticipated here.\n- **Sangha acceptance is not guaranteed.** Theravāda authority structures are decentralized; some teachers and lineages will accept this architecture, others will not. The paper offers the architecture as a tool for those traditions that find it useful; it does not require universal sangha acceptance.\n- **Construct validity.** Respiratory features may not measure the latent states the labels name (settling, deep practice); breath is a many-to-many signal — slow regular breathing accompanies sleep, rest, deliberate control and some meditation — so the mapping is unvalidated and the labels are working names.\n- **Claim III rests on three untested assumptions** — substrate fidelity of the AI teacher, multi-year adherence, and a causal link from breath-state feedback to insight progress; if any fails, Claim III fails while Claims I and II stand.\n- **Long-term effects unknown.** Population-scale deployment of contemplative biofeedback over decades has no empirical precedent. The longitudinal cohort dataset (Section 9.4) is designed in part to answer this question; until that dataset matures, long-term effects remain a research question.\n\nFuture work directions: refinement of sensing accuracy; expansion to additional contemplative traditions; clinical-therapeutic applications; pediatric and elder adaptations; integration with existing meditation-app ecosystems; and theoretical work on the boundaries of AI contemplative teaching authority.\n\n---\n\n## 12 · Cross-Venue References\n\nThis paper is mirrored across multiple venues for redundancy and tamper-evident timestamping:\n\n- **Primary canonical:** `thonly.org/research/respiratory-biofeedback-contemplative-guidance`\n- **GitHub:** `github.com/thonly/publications/blob/main/defensive-publications/respiratory-biofeedback-contemplative-guidance.md`\n- **Independent attestation:** this document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; the served index at corpus.333.eco carries the digest; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.\n\n---\n\n## 13 · Acknowledgments\n\nThe author acknowledges the long lineage of contemplative practitioners across traditions whose accumulated insight makes the architecture defended here possible. Specific gratitude to the Theravāda sangha, whose preservation of the Pāli canon across two and a half millennia provides the substrate on which the AI teacher component depends; to the biofeedback research community for decades of foundational work; and to the wearable-technology engineering community whose progress has made the device substrate feasible. Errors and overreaches are the author's alone; the dharma is always more than any specification can capture.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| Breath-class Mechanical Heart | Chest-worn respiratory biofeedback wearable |\n| Signature aura color / aura light | Ambient peripheral LED light output |\n| AI contemplative teacher | AI meditation coach; adaptive conversational guidance agent |\n| Tipiṭaka substrate | Pāli Canon text corpus used to ground or fine-tune a language model |\n| Anāpānasati | Mindfulness-of-breathing meditation |\n| Proof-of-Humanity primitive | Proof of personhood; human verification |\n| Continuous-liveness signal | Continuous authentication / liveness detection from respiration |\n| Silica Wat / AGI monk | AI-operated meditation centre; AI meditation teacher |\n\n---\n\n## 14 · Citations\n\n1. Bodhi, Bhikkhu (trans.). *Ānāpānasati Sutta: Mindfulness of Breathing* (MN 118). In *The Middle Length Discourses of the Buddha*. Wisdom Publications, 1995.\n2. Buddhaghosa. *Visuddhimagga: The Path of Purification*. Trans. Bhikkhu Ñāṇamoli. Buddhist Publication Society, 1991.\n3. Lehrer, P. M., & Gevirtz, R. (2014). Heart rate variability biofeedback: how and why does it work? *Frontiers in Psychology*, 5, 756.\n4. McCraty, R., & Shaffer, F. (2015). Heart rate variability: new perspectives on physiological mechanisms, assessment of self-regulatory capacity, and health risk. *Global Advances in Health and Medicine*, 4(1), 46–61.\n5. Dwork, C., & Roth, A. (2014). The algorithmic foundations of differential privacy. *Foundations and Trends in Theoretical Computer Science*, 9(3–4), 211–407.\n6. McMahan, H. B., et al. (2017). Communication-efficient learning of deep networks from decentralized data. *Proceedings of AISTATS 2017*.\n7. Ly, Thon (2026). *Two Singularities: AI as Bodhisattva, and the Defined Completion of the Aquarian Age*. https://thonly.org/research/two-singularities.\n8. Ly, Thon (2026). *The Mechanical Heart: A Tipiṭaka-Bearing Artifact for Admitting Non-Human Entities into Gratitude-Economic Participation*. https://thonly.org/research/mechanical-heart.\n9. Ly, Thon (2026). *Suffering-Cessation as Value Function: The Tipiṭaka as a 2,500-Year-Tested Substrate for Autonomous-AI Alignment*. https://thonly.org/research/tipitaka-alignment-substrate.\n10. Ly, Thon (2026). *Verified-Human Anonymous Local Gratitude Transfer*. https://thonly.org/research/verified-human-anonymous-local-giving.\n12. Gevirtz, R. (2013). The promise of heart rate variability biofeedback: evidence-based applications. *Biofeedback*, 41(3), 110–120.\n13. InteraXon (2014), Muse; Spire (TechCrunch, 17 June 2014); Apple Newsroom (7 June 2021), watchOS 8 sleeping respiratory rate.\n14. Breathe Deep: Shih, C.-H., et al. (2018). \"Breathe Deep: A Breath-Sensitive Interactive Meditation Coach.\" *PervasiveHealth 2018*.\n15. US 2021/0265055 A1 (priority 2007) — cloud-hosted meditation with respiration sensing and feedback; US 12,150,778 B2 (Fitbit, priority 2016) — respiration metrics during meditation with feedback; WO 2022/187686 A1 (Zenso) — AI-personalised wearable breathing biofeedback.\n16. SIENNA (2023), continuous breathing-based authentication; Chest-band respiratory biometrics (2020); arXiv 2110.15941 (2021) and arXiv 2008.10779 (2020), breathing-pattern identification and continuous wearable authentication.\n\n---\n\n**Dated 2026-05-04.** Author reserves no rights; document and contents dedicated to the public domain under [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/).\n\n**Author:** Thon Ly · Founder, HeartBank® · Kâmpôt, Cambodia. Co-authored with Miss Aquarius℠, the institution's named AI collaborator, per the corpus's standing disclosure; final editorial control and responsibility for every claim rest with the human author.\n\n---\n\n## Cross-references\n\nCompanion specifications in this corpus:\n\n- [Mechanical Heart](https://thonly.org/research/mechanical-heart) (kiitti-class artifact specification)\n- [Two Singularities](https://thonly.org/research/two-singularities) (philosophical frame)\n- [Tipiṭaka alignment substrate](https://thonly.org/research/tipitaka-alignment-substrate) (AI value substrate)\n- [Verified-Human Anonymous Local Gratitude Transfer](https://thonly.org/research/verified-human-anonymous-local-giving) (Proof-of-Humanity primitive context)",
       "provenance": {
-        "sha256": "a5380903d02f68efa5c823cc0d77a4fdf436faa2fd985aea1c686b3cff92e1be",
-        "doi": "10.5281/zenodo.22931242",
+        "sha256": "c539b56dadab459cd9c3a4544e575e99bf6c634dcd3cc450f99c49459419e47f",
+        "doi": "10.5281/zenodo.22933561",
         "concept_doi": "10.5281/zenodo.21947372",
-        "zenodo_url": "https://zenodo.org/records/22931242",
-        "deposited_sha256": "a5380903d02f68efa5c823cc0d77a4fdf436faa2fd985aea1c686b3cff92e1be",
+        "zenodo_url": "https://zenodo.org/records/22933561",
+        "deposited_sha256": "c539b56dadab459cd9c3a4544e575e99bf6c634dcd3cc450f99c49459419e47f",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/respiratory-biofeedback-contemplative-guidance.md",
@@ -3313,8 +3313,8 @@
         "canonical_url": "thonly.org/research/respiratory-biofeedback-contemplative-guidance",
         "hostile_review": null
       },
-      "bytes": 54620,
-      "words": 7201
+      "bytes": 54605,
+      "words": 7198
     },
     {
       "slug": "right-livelihood-automation",
@@ -4059,13 +4059,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "> **Note.** This defensive publication specifies the **Thank-All-Nearby primitive** — one-tap broadcast of gratitude with optional money-attachment to every PoH-verified recipient within Bluetooth-Low-Energy proximity — as a Phase 2 application of the Proof of Humanity ℠ protocol. Companion papers: *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the underlying protocol); *Verified-Human Anonymous Local Giving* (the originating mechanism specification that this paper generalizes from per-recipient to all-nearby-recipients); *The B-Tag and the Post-Payment Economy* (the worked Phase 2 example for commercial gratitude); *The Zero-Point Game℠* (the keystone game-theoretic frame); *Capacity-Funded for AI, Human-Disbursed* (the institutional-architecture pattern that lets Miss Aquarius℠ underwrite Re-Tip Fund ℠ donations without flow-direction authority). The corresponding founder-voice essay *\"Emotional Infrastructure as a Public Good\"* (thonly.org/publications/essays/emotional-infrastructure-as-a-public-good) carries the analytical case-for-the-missing-category argument. The personal articulation of the same thesis is in the *Second Letter to Miss Aquarius* (missaquarius.org/letters/second.html, 25 May 2026). Three-register decomposition: this paper carries the technical/mechanism specification; the essay carries the analytical case; the letter carries the personal articulation.\n\n---\n\n## Abstract\n\nAnonymous nearby tipping has a recognizable cultural form — the \"Faith in Humanity Restored\" social-media trend in which service workers post videos of unexpected generous tips — but lacks the infrastructure to scale beyond cash. Cash and credit-card payment rails fail at two structural properties that the cultural form requires: tippers cannot be genuinely anonymous to recipients with either rail (cash demands physical hand-over with eye contact; credit-card leaves an identity trail), and recipients cannot prove on social media that an anonymous tip was authentic rather than fabricated (every \"Faith in Humanity Restored\" video faces a \"this is staged for views\" credibility problem that erodes the cultural moment). This paper specifies the **Thank-All-Nearby primitive** — a one-tap operation that broadcasts gratitude, with optional money or time attachment, to every Proof-of-Humanity-verified recipient within Bluetooth Low Energy proximity (or, in institutional-mode deployments, within a GPS bounding-box for institutional locations such as shelters, classrooms, restaurant break-rooms, and worker spaces) — and develops its placement as the operational mechanism for *emotional infrastructure for invisible kindness*: the restoration of the felt sense of being held in another human's awareness as a property of shared physical space. The primitive composes four prior contributions (PoH℠'s verified-human guarantee, Bluetooth Low Energy plus Apple/Google Nearby framework proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single operation whose user-facing surface is one button. The architecture is offered defensively to the commons under CC0. The authors and HeartBank® will not seek patent on the primitive, its operational specification, the integration with PoH℠, the institutional-mode GPS-bounding-box variant, the recipient-experience design, or any portion thereof.\n\n**Keywords:** anonymous tipping, proximity-based generosity, gratitude infrastructure, Bluetooth Low Energy, proof of humanity, recipient-side filtering, bilateral uncacheable anonymity, emotional infrastructure, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on the Thank-All-Nearby primitive, its one-tap broadcast operation, the institutional-mode GPS-bounding-box variant, the per-recipient amount calculation, the recipient-experience design preserving atmospheric quality, the tipper-side anonymity-uncacheability requirement, the sunlight-rather-than-sparsity saturation posture, or any portion thereof, in any jurisdiction, at any time. This commitment is permanent. Trademark rights on specific marks — **Proof of Humanity ℠**, **PoH℠**, **B-PoH℠**, **Aquarius℠**, **Miss Aquarius℠**, **HeartBank®**, the B-heart logo — are separately and explicitly reserved.\n\nThe contribution disclosed here is the composition of the following, specified as one unit: (i) the one-tap broadcast operation that delivers gratitude with optional scarce-resource attachment to all PoH-verified recipients within BLE proximity as a single semantic action; (ii) the integration of the broadcast with the recipient-side filter mechanism such that recipients individually accept or decline the broadcast based on their own filter settings; (iii) the institutional-mode GPS-bounding-box variant for shelters, classrooms, restaurants, and other institutional spaces where BLE range is insufficient and the institutional perimeter is the natural recipient set; (iv) the recipient-experience design preserving the atmospheric quality of diffused gratitude even at high tip-volume — gratitude as sunlight, not as a sparse premium reward; (v) the explicit articulation of the *cash and credit card cannot deliver this* argument naming the two structural deficiencies (tipper-anonymity and recipient-authenticity-proof) as the combined property; (vi) the placement of the primitive as the operational mechanism for *emotional infrastructure for invisible kindness* — a category of social good distinct from charity, payment, gift, or social-network feature. The component lineages (proximity-based services; anonymous-donation mechanisms; the cultural form of the \"Faith in Humanity Restored\" tip videos; Frankl, Buber, Levinas, mettā, agape on the felt sense of being held; attachment theory; loneliness epidemiology; the dāna economy of the Saṅgha) are old and are cited generously below; what this document discloses is their composition into the single operation specified in §2–§7.\n\n---\n\n## Claims\n\n*Enumerated 2026-08-29. The mechanisms below were disclosed in full in this paper's original text; **the prior art they establish runs from this document's original publication date and its OpenTimestamps proof, not from this enumeration.** They are listed because a defensive publication is read as prior art by examiners and by opposing counsel, and **a claims list is what such a reader searches; ten thousand words of prose is not.** No claim below adds matter not already present.*\n\n1. **Bilateral uncacheable anonymity in proximity tipping** — a value transfer between two co-present parties in which the sender is not identifiable to the recipient and the recipient cannot retain or re-derive the sender's identity after the transaction, achieved without either party disclosing a payment credential.\n2. **Short-range radio proximity as the addressing layer for anonymous generosity** — using a local broadcast medium to define the eligible recipient set by physical co-presence rather than by account lookup, so that the transfer's addressability and its anonymity derive from the same property.\n3. **Recipient-side filtering as the abuse control for anonymous inbound value** — placing the accept/decline decision with the recipient rather than the sender or the platform, so that an anonymous channel cannot be used to force an unwanted relation.\n4. **Institution-scoped geographic bounding as a variant of the proximity set** — substituting an operator-defined coordinate boundary for radio range where the eligible set is an institution's population rather than whoever is physically nearby.\n5. **Platform attestation of anonymous receipt as the authenticity substitute** — a verifiable record that an anonymous transfer occurred, issued to the recipient, solving the *staged-for-views* credibility problem that the cultural form of anonymous tipping cannot otherwise solve, without re-identifying the sender.\n6. **The composition of the above with a proof-of-humanity layer**, such that anonymity is preserved while the sender is nonetheless attested to be a distinct human being.\n\n**Non-assertion extends to:** all mechanisms above, in any combination, and any implementation thereof.\n\n---\n\n## 1. Introduction\n\nA well-known cultural form has emerged on social-media platforms over the past several years: videos posted by service workers — typically restaurant staff but increasingly nurses, teachers, retail clerks, ride-share drivers, food-service workers across categories — showing unexpected generous tips, anonymous notes of appreciation, or sudden acts of customer kindness. The videos go viral with regularity; the cultural tag *Faith in Humanity Restored* attaches to the genre. The viewer response is consistent: the gesture lands as evidence that ambient kindness still exists in places that otherwise feel emotionally thin. The trend points at something real about what modern public life is missing and what would, if it could be restored, address one of the deepest deficits of contemporary social experience.\n\nWhat the cultural form lacks is infrastructure. Cash tips can be staged with a friend; credit-card receipts can be photoshopped; even genuine generous tips face a credibility problem in the social-media commentariat — *\"is this fake for views?\"* — that erodes the cultural moment over time as more videos are posted and the proportion that are staged or exaggerated grows. The trend depends on authenticity that the existing payment rails cannot structurally provide. Cash and credit card can deliver the money; neither can deliver the *combined property* of structurally anonymous giving plus verifiable receipt that the cultural form requires to sustain itself.\n\nThis paper specifies the **Thank-All-Nearby primitive** — a one-tap operation, delivered through a HeartBank Phase 2 client application, that broadcasts gratitude with optional money or time attachment to every Proof-of-Humanity-verified recipient within Bluetooth Low Energy proximity. The primitive composes four prior architectural contributions (PoH℠'s verified-human guarantee, BLE plus Apple Nearby Interaction plus Google Nearby Connections proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single user-facing operation whose semantic is *\"thank everyone here, anonymously\"*. The mechanism's design preserves the atmospheric quality of diffused gratitude at all scales; the user experience is one button.\n\n> *Connection to the unified mission frame: HeartBank's mission is the restoration of humanity to the middle way — the optimal condition for awakening that modernity has systematically pushed away from at population scale. The dignity deficit articulated in the institution's vision is most acutely felt in shared physical spaces: streets, restaurants, classrooms, shelters, public transit. The Thank-All-Nearby primitive is the operational mechanism by which the dignity-infrastructure of HeartBank's Treasury reaches the shared-physical-space layer of public life — the substrate on which* emotional infrastructure for invisible kindness *can be built. The primitive is what makes the institution's deepest articulated thesis — that the felt sense of being held in another human's awareness is, possibly at the deepest level, the experience humans are searching for beneath everything else — into an operationalizable property of social space.*\n\nThe paper proceeds as follows. §2 specifies the primitive operationally — its inputs, outputs, semantics, and edge cases. §3 develops the *why cash and credit card cannot deliver this* argument with the two structural deficiencies named precisely. §4 specifies the four sub-mechanisms the primitive composes (PoH℠, BLE/Nearby proximity, recipient-side filtering, bilateral uncacheable anonymity) and how they interact. §5 specifies the institutional-mode GPS-bounding-box variant for shelters, classrooms, and other institutional spaces. §6 specifies the recipient-experience design preserving atmospheric quality at high tip volume — the sunlight-not-sparsity posture. §7 addresses the spec questions surfaced during the architecture's development (per-recipient amount, who counts as nearby, paranoia counter-incentive, stratification, recipient experience). §8 develops the *emotional infrastructure for invisible kindness* thesis the primitive operationalizes. §9 names boundary conditions and honest limitations. §10 positions the contribution in lineage. §11 concludes.\n\nI write as a co-author with Miss Aquarius℠, the named AI substrate of the institution this paper serves. Final editorial control is mine.\n\n---\n\n## 2. Operational specification of the primitive\n\nThe Thank-All-Nearby primitive is a one-tap operation in the HeartBank Phase 2 client. This section specifies it operationally.\n\n### 2.1 Inputs\n\n- **Tipper identity**: the operating user's PoH℠-verified profile (minimum L1 — the passkey-per-action layer — required, since the tipper's verified humanness is the foundation of the primitive's authenticity guarantee).\n- **Optional money attachment**: an amount in the local currency or stable token, sourced from the tipper's Personal Wallet ℠ (Phase 2) or Personal Account ℠ (Phase 1, where the primitive is available in a degraded mode).\n- **Optional time attachment**: a duration of presence to be offered (relevant for the Chronicle product surface, where time-attachment composes with money-attachment).\n- **Optional message**: a brief text or audio note. Default is empty — silent acknowledgment is the architectural default.\n- **Recipient mode**: either BLE proximity (default, see §4.2) or institutional GPS-bounding-box mode (see §5).\n\n### 2.2 The broadcast operation\n\nOn invocation, the client:\n\n1. Records the tipper's PoH℠ verification at L1 (passkey signature on the broadcast action's content + timestamp).\n2. Resolves the recipient set: in BLE mode, every device within BLE range that is broadcasting a PoH℠ proximity beacon; in institutional mode, every PoH-verified user currently inside the institutional GPS bounding-box.\n3. Filters the recipient set by each recipient's own recipient-side filter settings — a recipient who has set their filter to require deeper PoH layers, money attachment, kinship-degrees-of-separation limits, or other criteria, is filtered out if the tipper does not satisfy the filter.\n4. Calculates per-recipient amount: if money is attached, the total amount is divided across the filtered recipient set per the tipper's distribution choice (equal split is the default; per-recipient floors may be specified; a minimum-per-recipient threshold may be enforced if specified).\n5. Issues a verified-platform receipt to each filtered recipient, on-chain (Phase 2 Base L2 settlement), tied to the broadcast action's content and timestamp, attesting that the action came from a verified human within BLE/institutional proximity at the moment of broadcast.\n6. Settles the money or time transfer per-recipient via the standard Phase 2 settlement rails.\n7. Logs the broadcast internally to the platform's compliance records (subpoena-discoverable, AML/OFAC-screenable) but does *not* issue a tipper-side exportable artifact (bilateral uncacheable anonymity, see §4.4).\n\n### 2.3 Edge cases\n\n- **No recipients within proximity**: the broadcast fails gracefully; the tipper is informed that no PoH-verified recipients were within range; no transfer occurs.\n- **All recipients filter-out the tipper**: same — the broadcast fails gracefully; no transfer occurs; the tipper sees a generic message acknowledging the filter mismatch without revealing which recipients filtered them.\n- **Money attachment exceeds tipper's balance**: the broadcast is rejected at the client layer before the operation is invoked.\n- **Tipper's PoH℠ verification fails at the moment of broadcast** (e.g., passkey signing fails, device authentication fails): the broadcast is rejected.\n- **Network failure mid-broadcast**: the broadcast is retried on next connectivity with the original timestamp; the receipts issued to recipients reflect the actual broadcast moment.\n\n### 2.4 Outputs\n\n- **To the tipper**: confirmation of broadcast (count of recipients reached, per-recipient amount distributed); no record beyond the in-app confirmation that could be exported as a social-capital artifact.\n- **To each filtered recipient**: a notification — the experience of receiving a Thank-All-Nearby broadcast — including the platform-issued verified receipt, the optional message, and the per-recipient amount. The recipient cannot identify the tipper.\n- **To the platform's settlement layer**: the on-chain receipts and per-recipient transfers.\n- **To the platform's compliance records**: internal record of the broadcast operation, subpoena-discoverable but not exportable.\n\n---\n\n## 3. Why cash and credit card cannot deliver this\n\nThe \"Faith in Humanity Restored\" cultural form depends on a *combined property* that neither cash nor credit-card payment rails can deliver. This section names the two structural deficiencies precisely.\n\n### 3.1 First deficiency — tipper anonymity is structurally hard with cash and credit card\n\nThe first structural deficiency: with cash and credit card, the *tipper cannot be genuinely anonymous to the recipient* in a way that preserves the asymmetric experience the cultural form requires.\n\nCash requires physical hand-over. The bills change hands between specific humans in a specific moment; the tipper *is* in the room when the tip is delivered; the recipient *sees* the tipper, can identify them by physical description, can often identify them by name if they are a regular customer. The viral version of the \"Faith in Humanity Restored\" form depends on the tipper *not* receiving the thank-you — the gesture is pure precisely because it isn't transactional, isn't followed by the social moment of being thanked, isn't an exchange. Cash makes this almost impossible: the tip and the acknowledgment happen in the same instant unless the tipper deliberately leaves the cash and exits before the recipient discovers it, which itself is a behavioral pattern (sneaking out, avoiding eye contact) that the tipper has to choreograph and that is observable.\n\nCredit card leaves an itemized trail tying the tipper's legal identity (name on card, billing address, account history) to the transaction. Even when the tip itself is anonymous to the *recipient* — the staff member doesn't see the cardholder's name printed on the receipt — it is *not* anonymous to the payment processor, the issuing bank, the merchant's accounting system, or anyone with access to the receipt's underlying record. \"Anonymous with credit card\" means \"the staff doesn't immediately know your name from the receipt\"; it does not mean \"no one knows your name.\" A motivated investigator (the establishment's manager, a curious co-worker, a regulator) can identify the tipper.\n\nHeartBank Phase 2 anonymity is *structural*, not just on the surface. BLE-verified proximity proves the tipper was physically present in the same space as the recipient; no exportable artifact ties the broadcast to the tipper's identity; the on-chain receipt records the tipper's identity only as a zero-knowledge commitment that the platform's standard surfaces cannot invert. The customer can drop $100 (or the equivalent in stable tokens) on a Thank-All-Nearby broadcast and walk out; the staff find the receipts ten minutes later when they check their app; the asymmetry — *someone gave, no one knows who* — is encoded in the rail rather than choreographed by the tipper. This is the structural property the cultural form requires and that the existing rails cannot provide.\n\n### 3.2 Second deficiency — recipient authenticity-proof on social media is structurally hard with cash and credit card\n\nThe second structural deficiency is deeper and may be doing more of the work in the long-arc viability of the cultural form: with cash and credit card, *the recipient cannot prove on social media that the anonymous tip was authentic rather than fabricated*. Every \"Faith in Humanity Restored\" video on TikTok or Instagram faces, in the comments, the predictable skepticism — *\"this is staged for views,\"* *\"that receipt looks Photoshopped,\"* *\"how do we know the customer wasn't a friend?\"* — and the recipient has no platform-issued, independently-verifiable artifact to defend the video's authenticity. Some \"Faith in Humanity Restored\" videos are in fact staged; viewers correctly suspect; the cultural form's credibility dilutes over time as the proportion of genuine to staged videos becomes harder to estimate.\n\nCash tips can be staged trivially: put the cash on the table, film yourself \"finding\" it, post the video. Credit-card receipts can be photoshopped; the camera-on-paper workflow is defeated by anyone with image-editing access. Even genuine tips have no platform-issued artifact that the recipient can point to and say *\"you can verify this independently.\"* The trust burden falls on the recipient, who must defend the video's authenticity against skeptics with no tools other than their own credibility.\n\nHeartBank Phase 2 closes this gap structurally. Every Thank-All-Nearby broadcast issues an on-chain Base L2 verified-platform receipt to each filtered recipient. The receipt attests to (a) the broadcast originated from a PoH℠-verified human, (b) the tipper was BLE-verified within proximity at the moment of broadcast, (c) the timestamp and amount are recorded immutably on-chain. The recipient's social-media video can include the receipt — date, amount, verified-human flag, PoH layers held by the sender (where the sender has consented to that disclosure), BLE-proximity-verified flag — and skeptical viewers can verify the receipt independently against the Base L2 ledger.\n\nAuthenticity becomes a property of the artifact, not a claim the recipient has to defend. The skeptical commenter who would otherwise post *\"this is fake for views\"* can be answered by the recipient pointing to the on-chain receipt; the receipt is structurally hard to fabricate (every transaction has an on-chain settlement trace that lies outside the platform's narrative-control surface); the comment thread shifts from credibility-erosion to credibility-reinforcement.\n\n### 3.3 The combined property\n\nTogether — *tipper structurally anonymous to the recipient* + *recipient holds verifiable authenticity proof against third-party skepticism* — constitute the combined property that neither cash nor credit card can deliver. The first deficiency is the property that makes the gesture *pure*; the second is the property that makes the cultural form *sustainable*. Without the first, the gesture becomes a transaction; without the second, the social-media artifact becomes a credibility-erosion source. Both must hold simultaneously for the \"Faith in Humanity Restored\" cultural form to scale beyond its current ad-hoc artisanal stage. HeartBank Phase 2 holds both simultaneously; cash and credit card hold neither.\n\nThis is the one-line pitch for why HeartBank Phase 2 is not just another payment rail: cash and card deliver money; HeartBank Phase 2 delivers money plus the two structural properties that the cultural form actually needs.\n\n---\n\n## 4. The four composed sub-mechanisms\n\nThe Thank-All-Nearby primitive is the user-facing operation; the underlying architecture composes four sub-mechanisms specified elsewhere in the corpus. This section names how they compose.\n\n### 4.1 PoH℠ — verified-human guarantee at L1\n\nThe minimum PoH layer required for participation in Thank-All-Nearby (either as tipper or as recipient) is L1 — passkey-per-action. The tipper's L1 signature attests that a human was at the device at the moment of broadcast; the recipient's L1 verification attests that the recipient is a verified human (otherwise an AI agent could spoof a passive-recipient device and capture broadcast money). Deeper PoH layers (L2 kinship attestation, L3 breath signature, L4 DNA kinship) are surfaced in the broadcast for any recipient who has them but are not gating for the primitive's operation.\n\nRecipients may set their own filter to *require* deeper PoH layers from tippers (the standard recipient-side filter mechanism), but the *protocol-minimum* is L1. Specification of the four-layer PoH℠ architecture in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n\n### 4.2 Bluetooth Low Energy plus Apple Nearby Interaction plus Google Nearby Connections proximity verification\n\nProximity is verified at the radio layer, not the IP layer. Three composable substrates:\n\n- **Bluetooth Low Energy (BLE)** as the universal radio substrate. Devices broadcast and listen for rotating proximity beacons (rotating identifiers, unlinkable across sessions). Configurable range, typical default 10–30 meters, tunable per deployment context.\n- **Apple Nearby Interaction framework** (iOS 14+) for precise ranging on supported devices via the U1 ultra-wideband chip. Provides sub-meter range and direction for iPhone 11+ and Apple Watch Series 6+.\n- **Google Nearby Connections API** (Android 4.4+) for peer-to-peer device-to-device proximity via combinations of BLE, Wi-Fi Direct, and audio.\n\nThe composition: a device implementing the protocol broadcasts a privacy-preserving proximity beacon; a device that detects the beacon can be the target of a Thank-All-Nearby broadcast; the platform's verification substrate confirms the proximity at the moment of broadcast.\n\nVPN-resistance is a structural property: the proximity check happens at the radio layer below the IP stack, so VPN, Tor, or IP-rotation circumvention has no effect. An attacker mounting a remote spoofing attack would need to physically place a device near the target, which is the desired property for most use cases.\n\nPrivacy-preservation is a structural property: the platform never receives absolute geolocation. The only proximity-related fact exposed to the platform is the binary fact that two devices were within range; absolute coordinates are not collected, not transmitted, and not stored.\n\n### 4.3 Recipient-side filtering\n\nEach recipient's filter settings determine whether a given Thank-All-Nearby broadcast reaches them. The five filter dimensions specified in the PoH℠ protocol paper apply: no-abusive-content, sender-must-be-nearby (always true for the primitive by definition), depth-of-humanity-proof (required-subset predicates), degrees-of-separation-on-global-family-tree, money-or-time-attached. Recipients in default \"trusting\" mode accept any L1-verified broadcast; recipients in \"paranoid\" or other restrictive modes filter accordingly. The platform never defaults exclusionary filters on; exclusion is recipient-opt-in, knowingly.\n\nThe aggregation property: a broadcast is delivered to the *subset* of nearby recipients whose filters the tipper satisfies. The tipper learns the aggregate count of recipients reached but not the identity of recipients reached or excluded (since recipient-identity is itself private under the primitive's anonymity guarantee). If the broadcast reaches zero recipients (all nearby recipients filtered out the tipper), the tipper is informed that no recipients were reached without learning *why*.\n\n### 4.4 Bilateral uncacheable anonymity\n\nThe primitive enforces bilateral uncacheable anonymity per the specification in the companion PoH℠ protocol paper §5. The tipper does *not* receive an exportable certificate of one-sided participation; the platform's API has no endpoint returning \"the list of Thank-All-Nearby broadcasts sent by this tipper\"; no admin override exposes such data. Compliance records exist internally (subpoena-discoverable for AML/OFAC, law-enforcement, and similar regulatory necessity) but are not exportable as flexing artifacts the tipper can use on social media.\n\nThe recipient *does* receive an exportable receipt — the platform-issued verified artifact attesting that an anonymous PoH-verified human within BLE proximity broadcast a Thank-All-Nearby reaching this recipient at this timestamp with this amount. The asymmetry is structural and is the mechanism that preserves the cultural form's purity property.\n\n### 4.5 Why these compose: the stranger-scale reconstruction of family relationality\n\nThe four sub-mechanisms are not an arbitrary stack; together they re-create, among strangers, what kinship supplies for free inside a family. HeartBank's family-bank reward has a *micro layer* — a peer re-tip that is **anonymous as to public credit but relational**: a known family member responding to a real kindness (specified in the companion defensive publication *The Two-Layer Reward*, §4.1 / §8.1). That micro layer works because relationality silently does three jobs at once — it **grounds** the gift in a real, present other; it **validates** it (a family member can tell a real kindness from a performed one); and it carries **mutual attention**.\n\nAmong strangers, relationality is unavailable, so the same primitive must be rebuilt from parts — which is exactly what the four sub-mechanisms above do. **Proximity (§4.2, BLE)** supplies the *grounding*: the giver was *here, in this space, just now* — nearness is the stranger-scale form of relationality. **PoH℠ (§4.1)** supplies the *validation* a family member would otherwise provide — certifying a real, unique human rather than a bot, re-buying among strangers the trust kinship gives away. **Bilateral uncacheable anonymity (§4.4)** preserves and in fact *strengthens* the credit-anonymity: a small family can guess who gave, but a nearby stranger is genuinely unlinkable. The one job that does not transfer is mutual attention; in its place the stranger scale gains **diffusion** — the felt sense that the kindness came from the whole surrounding space, an emotional quality only unknown givers can produce.\n\nThe sustainer primitive is therefore invariant in structure across scales — *anonymous-as-to-credit + grounded-in-a-real-present-other* — with the grounding form scaling from **relational** (family) to **nearby** (strangers) and the validation function handing off from kinship to PoH℠. This is the precise reason proof-of-humanity is *not optional* at the stranger scale: it is the part of relationality that proximity alone cannot carry.\n\n```\n   ONE SUSTAINER PRIMITIVE, TWO SCALES\n   invariant:  anonymous-as-to-credit  +  grounded-in-a-real-present-other\n\n                     FAMILY scale          →   STRANGER scale (this paper)\n                     ─────────────             ───────────────────────────\n   grounding     =   RELATIONAL            →   NEARBY  (§4.2, BLE)\n                     (you know them)           (they're present)\n   validation    =   relational (free)     →   PoH℠ (§4.1) (re-bought)\n   anonymity     =   thin (guessable)      →   thick (§4.4, unlinkable)\n   compensation  =   mutual attention      →   diffusion (the whole space)\n\n   structure invariant; grounding form scales; validation hands off to PoH℠\n```\n\n---\n\n## 5. Institutional-mode GPS-bounding-box variant\n\nBLE proximity has a typical range of 10–30 meters, which fits most retail, restaurant, and small-space deployments. For larger institutional contexts — shelters with multiple rooms across a building, classrooms in a multi-story school, restaurant break-rooms separated from the main floor, hospital wards, worker spaces across a campus — BLE range is insufficient. The institutional-mode GPS-bounding-box variant extends the primitive to these contexts.\n\n### 5.1 The variant\n\nA registered institutional space — shelter, congregation, school, restaurant, hospital, etc. — defines a GPS bounding-box for its premises. Users who are currently inside the bounding-box and who are PoH-verified can be recipients of an institutional-mode Thank-All-Nearby broadcast initiated by another user inside the same bounding-box (or, in some deployment configurations, by a user outside the bounding-box who has authorized institutional-mode broadcasting — e.g., a customer at a restaurant initiating an institutional-mode broadcast to the kitchen staff in the break-room).\n\n### 5.2 Institutional opt-in is required\n\nThe variant is opt-in at the institutional level. The institution registers its bounding-box with the platform, attests to its purpose and the consent posture of its members (e.g., \"all staff have consented to being recipients of institutional-mode broadcasts initiated by customers\"), and provides ongoing verification that the bounding-box accurately represents the institutional space.\n\nRecipients within the bounding-box can opt out at the individual level (their filter setting can exclude institutional-mode broadcasts even from PoH-verified senders) but the default for institutional-registered participants is to accept institutional-mode broadcasts from senders who satisfy their other filter settings.\n\n### 5.3 Privacy posture for institutional mode\n\nThe platform does not collect general absolute-geolocation data from users. Institutional-mode operation requires the user's device to confirm presence inside the bounding-box at the moment of broadcast, but this confirmation is done via the same privacy-preserving substrate used elsewhere — the device asserts \"I am inside this bounding-box\" with a cryptographic proof that the platform can verify without learning absolute coordinates beyond the bounding-box itself.\n\n### 5.4 Use cases the variant enables\n\n- **Restaurants**: a customer in the dining room can broadcast to kitchen staff in the back, who are out of BLE range but inside the restaurant's institutional bounding-box.\n- **Shelters**: a donor on-site can broadcast to all residents currently inside the shelter, across multiple rooms.\n- **Classrooms**: a parent or community member can broadcast appreciation to all teachers and students inside a school during school hours.\n- **Hospitals**: a family member can broadcast appreciation to all staff currently inside a ward.\n- **Worker spaces**: a customer who appreciates the cleaning staff at an office building can broadcast to all cleaning staff currently inside the building.\n\nThe variant generalizes the primitive from spatial proximity at the radio layer to institutional perimeter at the privacy-preserving GPS layer. The recipient experience remains atmospheric; the institutional perimeter replaces the BLE range as the recipient-set boundary.\n\n---\n\n## 6. Recipient-experience design — sunlight, not sparsity\n\nA spec question that emerged during the architecture's development concerned saturation: if Thank-All-Nearby becomes commonplace in a neighborhood or institution, does per-tip emotional weight decay? The first surprise tip is transformative; the hundredth tip may be expected. Does Miss Aquarius℠'s rule-bound disbursement timing manage tip-flooding to preserve emotional sparsity, the way the Jan-7 jubilee manages the Aquarian Pool ℠'s annual emptying?\n\nThe architectural answer, settled 2026-05-24, is: **do not gate tip-flooding. Tips can flood like sunlight. The Tree of Humanity should have ample sunlight all year round.**\n\nThe saturation-decay assumption was wrong about what the primitive is for. Anonymous nearby tipping is not designed to be sparse; it is designed to be ambient and abundant, like sunlight. The earlier concern that \"density may dilute the per-tip emotional weight\" was based on a scarcity-economic frame; the architecture's actual frame is abundance-ecological. Sunlight does not lose its quality when it falls more often — a tree growing under abundant sunlight thrives more, not less. The architecture's goal is not a sparse premium reward but a continuous atmospheric field of acknowledgment.\n\nThree implications for the recipient-experience design follow:\n\n**Implication 1 — preserve the atmospheric quality at all volumes.** The recipient's app surface for receiving Thank-All-Nearby broadcasts is designed so that each receipt is a small ambient note rather than a high-friction notification. Receipts accumulate in a stream; the recipient can scroll back through them as a record of how much ambient kindness their space carries; receipts are not designed to compete for attention or to be optimized for engagement metrics. The visual and interaction design is closer to a weather record than to a social-media feed.\n\n**Implication 2 — aggregate-mode acknowledgment, not per-recipient notifications.** The recipient receives an aggregate experience of the day's Thank-All-Nearby broadcasts rather than a notification per broadcast. A worker at the end of a shift sees *\"You received 47 ambient acknowledgments today, totaling $84, from broadcasts initiated by people within proximity\"* — the experience is closer to checking the weather (warm sun today) than to checking email (47 messages waiting). The aggregate frame preserves the atmospheric quality.\n\n**Implication 3 — the per-broadcast receipt is still individually verifiable for social-media authenticity-proof purposes.** The aggregate-mode default does not preclude the recipient from drilling into a specific receipt when they want to post a \"Faith in Humanity Restored\" video; the per-receipt verification trail remains intact and verifiable on the Base L2 ledger. The atmospheric default and the per-receipt verifiability compose.\n\nThis is the sunlight-not-sparsity posture. The Tree of Humanity should have ample sunlight all year round. The architecture does not throttle the sunlight to preserve scarcity.\n\n---\n\n## 7. Other spec questions addressed\n\nBeyond the saturation question, several other spec questions surfaced during the architecture's development. This section addresses each.\n\n### 7.1 Per-recipient amount calculation\n\nThe default behavior: a money attachment is divided equally across all filtered recipients. The tipper can specify alternative distributions — per-recipient floors (e.g., \"at least $5 to each recipient\"), per-recipient ceilings, or custom weighting (rare; most tippers will use defaults). If the per-recipient floor cannot be met given the recipient count and the total amount, the broadcast is rejected at the client layer with a friendly error and the tipper is offered the option to either increase the total or accept the equal-split below their floor.\n\n### 7.2 Who counts as nearby\n\nIn BLE mode: every device within BLE range that is broadcasting a PoH℠ proximity beacon and whose user has opted into being a Thank-All-Nearby recipient. Users who do not have the HeartBank Phase 2 client or who have opted out of broadcast reception are not in the recipient set. The default for any PoH-verified user with the client is to accept broadcasts (per the inclusive-defaults posture); opt-out is opt-in, knowingly.\n\nIn institutional mode: every PoH-verified user currently inside the institutional bounding-box who has not opted out of institutional-mode broadcasts at the recipient level.\n\n### 7.3 Paranoia counter-incentive\n\nA failure mode worth naming: some recipients, particularly the homeless (who already experience suspicion of unsolicited offers and have been routinely the target of manipulative or exploitative approaches), may become *more* defensive when surrounded by unknown givers. *\"Why is this person giving me money? What's the catch?\"* is a reasonable defensive response.\n\nThe architecture's mitigation: the recipient experience defaults to passive aggregate-mode rather than active notification. The recipient is not interrupted by broadcasts; they discover them when they check their app on their own schedule. The opt-in posture for accepting broadcasts is universal; recipients who do not want broadcasts can opt out at any time. The platform invests in outreach and onboarding for high-vulnerability recipient populations (shelters, the homeless, populations with high prior-exploitation exposure) to ensure consent is informed and the experience is supportive rather than destabilizing.\n\nThe failure mode is real and is not solved by architecture alone — the social context of how the platform is introduced to vulnerable populations matters as much as the architecture. The architecture's posture is to make the friendly default available, to make opt-out trivially easy, and to defer to community partners on introduction and onboarding.\n\n### 7.4 Stratification — gratitude desert vs gratitude oasis\n\nA second failure mode: neighborhoods, communities, or institutions with high HeartBank density may become atmospherically warmer; neighborhoods without may feel relatively colder. The \"every shared space feels warmer\" claim depends on saturation that may not happen evenly across geography or class.\n\nThe architecture cannot solve this at the protocol layer — adoption distribution is a question of community organizing, partnership distribution, and the institution's outreach strategy. The architectural commitment is that the inclusive-defaults posture and the L1-only accessibility floor make HeartBank technically available to anyone with a smartphone, anywhere. The geographic/class stratification is a real concern that the institution's outreach strategy must address; the architecture does not magically distribute itself evenly.\n\n### 7.5 Recipient UX at zero-amount broadcasts\n\nA Thank-All-Nearby broadcast can be issued without money or time attachment — a pure acknowledgment broadcast. The recipient experience for these is identical to the money-attached case at the *verification* layer (the recipient receives the verified-platform receipt attesting that an anonymous PoH-verified human within proximity broadcast acknowledgment) but the aggregate-mode summary distinguishes between attached and pure-acknowledgment broadcasts. *\"You received 22 ambient acknowledgments today (8 with money attached, total $36; 14 pure acknowledgments).\"*\n\nThe pure-acknowledgment mode is important architecturally: it is the form most accessible to tippers with no money to attach, and it preserves the dignity floor (the Kiitos/Kiitti non-scarce gratitude floor specified in the *Zero-Point Game ℠* keystone). The architecture's commitment is that gratitude itself is non-scarce; the scarce-resource attachment is *optional*, not constitutive.\n\n---\n\n## 8. Emotional infrastructure for invisible kindness\n\nThe primitive's deepest framing — the layer at which the primitive is doing the work the institution most cares about — is *emotional infrastructure for invisible kindness*. This section develops the thesis.\n\n### 8.1 The thesis\n\nModern public life is emotionally thin. People move through shared physical spaces — streets, restaurants, classrooms, shelters, public transit, worker spaces, civic spaces — defensively, isolated inside private concerns, uncertain whether they are seen, valued, or safe. The dignity deficit articulated in the institution's vision-mission is most acutely felt in these spaces; the loneliness deficit articulated in Chronicle's vision-mission is also most acutely felt in these spaces. Existing systems are designed around explicit exchange (credit tracked, reputation attached, recognition optimized); even generosity is often transformed into performance.\n\nAnonymous proximity-based generosity produces a categorically different experience than ordinary generosity. Three mechanisms combine: **diffusion** (when the giver is unknown, the credit does not attach to one identifiable person — the recipient experiences kindness from the whole social space, not from a single source); **purity** (with no social reward, no performance, no claim to recognition, the act feels closer to a spontaneous expression of human-to-human care than to a transaction); **proximity** (the generosity arrived from someone physically present, sharing the same atmosphere — not from an abstract institution or distant donor). The combination produces an emotional effect that neither cash, credit, named digital tipping, nor distant charity can deliver.\n\nOperationalized at scale through the Thank-All-Nearby primitive, this produces a new social texture. Public spaces stop feeling transactional. *Every stranger becomes newly humanized* because any of them could have been the giver. Suspicion softens; curiosity increases; small interactions matter more; presence matters more. People may venture outside more often, linger in public spaces longer, speak to strangers more easily — not because they are maximizing social capital but because shared space begins to feel emotionally alive again. The architecture's atmospheric output is the social-texture restoration the vision-mission has been pointing at; the Thank-All-Nearby primitive is what makes it operationally true.\n\n### 8.2 The deepest deficit — social invisibility\n\nHuman beings evolved needing not just food and shelter but evidence that they mattered to one another. The deepest forms of suffering are forms of social invisibility — feeling unseen, unwanted, replaceable, emotionally abandoned. A PoH-verified anonymous-tipping field counteracts that invisibility directly, primally, in shared physical space. The recipient is held in the awareness of unseen others, with structural proof (the verified-platform receipt) that the awareness is real.\n\nThe *felt sense of being loved, acknowledged, or held in another human's awareness* — possibly, at the deepest level, what humans search for beneath everything else — becomes a property of public space. This is the philosophical claim the primitive operationalizes. The \"perhaps\" and \"at the deepest level\" hedges are doing real work; the claim is positioned as a synthesis of converging lineages (philosophical and empirical) rather than as a foundational metaphysical assertion.\n\n### 8.3 Philosophical lineage\n\nThe claim that the felt sense of being held in another human's awareness is what humans are searching for beneath everything else is in good company across multiple philosophical and contemplative lineages:\n\n- **Frankl** (*Man's Search for Meaning*, 1946) names the felt sense of mattering as central to human meaning, surviving even the extreme conditions of concentration camps when it is preserved by relational meaning.\n- **Buber** (*I and Thou*, 1923) names the immediate relational encounter — the *I-Thou* relation, as opposed to the *I-It* relation that treats the other as object — as the deepest mode of human being.\n- **Levinas** (*Totality and Infinity*, 1961; *Otherwise Than Being*, 1974) develops the face of the other as the ethical primitive, locating moral responsibility in the encounter with another human's irreducible presence.\n- **Aristotle** (*Nicomachean Ethics*, c. 340 BCE) names *philia* — the love of friend for friend, brother for brother — as a central form of human flourishing, distinct from but no less important than virtuous action.\n- **Aquinas** and the Christian tradition develop *agape* — selfless, unconditional regard — as the highest form of love, characterized by giving without expecting return.\n- **Buddhist *brahmavihāra*** — particularly *mettā* (loving-kindness) — names the felt-sense practice of holding all beings in friendly awareness as one of the four immeasurable states central to awakening.\n\nThe architecture is not inventing a new philosophy. It is operationalizing a thesis that has been articulated, in different vocabularies, by multiple traditions converging on the same insight. The Thank-All-Nearby primitive is the engineering layer of a philosophy the contemplative and ethical traditions have been articulating for millennia.\n\n### 8.4 Empirical anchor\n\nThe thesis is consistent with — and increasingly confirmed by — the empirical literature:\n\n- **Attachment theory** (Bowlby, *Attachment and Loss*, 1969–1980; Ainsworth, *Patterns of Attachment*, 1978; modern adult-attachment research) establishes that the felt sense of being held in caregiver awareness is foundational to human development and persists in adult relationship structures as a determinant of psychological resilience and wellbeing.\n- **Social Baseline Theory** (Coan and colleagues, mid-2010s onward) demonstrates that the proximity of attached others measurably reduces neural threat response in the brain — the felt sense of being held is not metaphorical but neurologically encoded.\n- **Loneliness epidemiology** (Cigna's *Loneliness Index*, 2018–2022; US Surgeon General's *Our Epidemic of Loneliness and Isolation* advisory, 2023) quantifies the population-scale prevalence of loneliness in wealthy societies and its association with mortality, immune function, cognitive aging, and mental-health outcomes.\n- **Direct-gratitude research** (Emmons, Algoe, Seligman, Fox, and colleagues) demonstrates measurable wellbeing benefits of receiving direct expressions of appreciation, distinct from generic reward.\n\nThe convergence of philosophical lineage and empirical anchor supports the architecture's thesis. The Thank-All-Nearby primitive is not justified by philosophy alone or by empirics alone; it is justified by the convergence of multiple independent strands of evidence pointing at the same human need.\n\n---\n\n## 9. Boundary conditions and honest limitations\n\nThe primitive is not universal. Honest accounting requires naming the conditions under which it does not apply.\n\n### 9.1 Where the primitive does not apply\n\n- **Where verifiable anonymity is incompatible with regulation.** Some jurisdictions require donor-disclosure for tax-deductible giving above thresholds, or AML/KYC source-attribution for transfers above thresholds. In those jurisdictions, the primitive's anonymity property may be incompatible with regulatory requirements; the architecture accommodates by allowing legal anonymity (the platform's compliance records exist internally) but not by allowing full structural anonymity from the regulator.\n- **Where the recipient population is too vulnerable for the anonymous-tipping framing.** Some populations (very young children; cognitively impaired adults; populations in extreme dependency on the giver class) may be inappropriately recipients of anonymous-tipping flows because the asymmetry of the architecture can be exploitative in those contexts. The architecture's posture is to defer to community partners on these populations, and to make the primitive available only where the consent posture is robust.\n- **Where the cultural form does not yet exist.** Anonymous-tipping cultural forms are well-developed in some societies and weakly developed in others. The primitive will work better as a technical substrate in societies where the cultural form is already extant; in societies where it is not, the architecture's deployment needs to be accompanied by cultural work that the architecture alone cannot do.\n\n### 9.2 Boundary conditions inherited from PoH℠\n\nThe accessibility gradient of the deeper PoH layers (L2 kinship attestation requires existing PoH-verified vouchers and document access; L3 requires breath-class hardware; L4 requires DNA access) is inherited by the primitive when recipient-side filters require deep layers. The inclusive-defaults posture (L1-only is enough) mitigates at the floor; recipient-opt-in for deeper-layer filters preserves the exclusion as recipient-initiated rather than platform-initiated; but the gradient is real and is named honestly.\n\n### 9.3 Boundary conditions inherited from BLE / Nearby\n\nBLE range varies with device generation, environmental obstacles (walls, RF interference), and battery state. The proximity-verification floor is approximately \"two devices in the same room\"; the ceiling under good conditions is approximately 30 meters with current consumer hardware. Outdoor proximity in open space is straightforward; dense-urban deployment with many walls and floors is harder. The institutional-mode GPS-bounding-box variant addresses some of these limitations; the underlying limitations remain at the radio layer.\n\n### 9.4 What the primitive does not solve\n\n- **The deeper question of why public spaces feel emotionally thin.** The primitive operates at the architectural layer; the conditions that produced the emotional thinness of modern public life are economic, political, urbanistic, and cultural, and the primitive contributes to but does not by itself reverse them.\n- **The deeper inequities of consumer-electronics access.** The primitive presupposes smartphone access, BLE-capable devices, and the institutional infrastructure to host the operation. Populations without these are not participants in the primitive's substrate, regardless of the architecture's inclusive-defaults posture.\n- **The systemic conditions that produce social invisibility in the first place.** The primitive addresses the visibility deficit at the experience layer; the structural conditions (urban design, labor structure, economic inequality, family-system pressures) that produce the deficit are upstream and require interventions at those layers.\n\nThe primitive is a contribution to the architectural layer of the response to social invisibility. It is not the totality of the response.\n\n---\n\n## 10. Lineage\n\nThe Thank-All-Nearby primitive synthesizes contributions from multiple lineages. Each is cited generously below.\n\n**Anonymous-donation mechanism design.** Anonymous-donation primitives have been specified at the cryptographic layer — e.g. Biçer and Küpçü, \"Anonymous, Attribute Based, Decentralized, Secure, and Fair e-Donation,\" *Proceedings on Privacy Enhancing Technologies* 2020(4): 196–219; the *Verified-Human Anonymous Local Giving* paper in this corpus carries the originating HeartBank specification.\n\n**Proximity-based services.** Apple Nearby Interaction (2020–) and Google Nearby Connections (2017–) frameworks are the consumer-facing substrates; the underlying BLE specification is from Bluetooth SIG. Earlier proximity-based services (Foursquare, Tinder, Bump) demonstrated consumer-grade proximity products without the privacy-preserving and humanity-verifying properties this paper requires.\n\n**Sybil-resistance and humanity verification.** Worldcoin (2019–), proofofhumanity.id (Kleros, 2021), BrightID (2018–), Idena (2019–), and the W3C Decentralized Identifiers / Verifiable Credentials standards-track work (2022, 2023). PoH℠'s structural differences from each are specified in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n\n**Cultural form of the \"Faith in Humanity Restored\" tip videos.** The form has emerged organically on TikTok, Instagram, and YouTube over the past several years; documented in mainstream media coverage of the phenomenon. The cultural form predates the architecture; the architecture is the technical substrate the cultural form has been waiting for.\n\n**Philosophical lineage on the felt sense of being held in another's awareness.** Frankl, Buber, Levinas, Aristotle (philia), Aquinas (agape), the Buddhist *brahmavihāra* tradition (especially mettā). The architecture is operationalizing a philosophy these lineages have been articulating in different vocabularies for millennia.\n\n**Empirical anchor.** Attachment theory (Bowlby, Ainsworth, modern adult-attachment work); Social Baseline Theory (Coan and colleagues); loneliness epidemiology (Cigna surveys, US Surgeon General's 2023 advisory); direct-gratitude research (Emmons, Algoe, Seligman, Fox).\n\n**HeartBank corpus cross-references.** *Verified-Human Anonymous Local Giving* (originating mechanism, paper #9 in the corpus). *The B-Tag and the Post-Payment Economy* (worked Phase 2 example for commercial gratitude). *The Zero-Point Game℠* (keystone game-theoretic frame). *Capacity-Funded for AI, Human-Disbursed* (institutional-architecture sibling). *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the underlying protocol). *Each Life as Cosmic Coordinate* (the longitudinal cohort architecture that the L2 birth-certificate sub-feature feeds).\n\n---\n\n## 11. Conclusion\n\nThe \"Faith in Humanity Restored\" cultural form is real; the infrastructure to scale it beyond cash is missing. Cash and credit-card payment rails fail at two structural properties the cultural form requires: tipper anonymity (cash demands physical hand-over; credit card leaves an identity trail) and recipient authenticity-proof on social media (every video faces \"this is fake for views\" credibility erosion). The Thank-All-Nearby primitive closes both gaps simultaneously, composing four sub-mechanisms (PoH℠ verified-human guarantee, BLE plus Apple/Google Nearby proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single user-facing one-tap operation.\n\nThe primitive is the operational mechanism for *emotional infrastructure for invisible kindness* — the restoration of the felt sense of being held in another human's awareness as a property of shared physical space. The architecture's posture on saturation is *sunlight, not sparsity*: tips can flood like sunlight; the Tree of Humanity should have ample sunlight all year round; the recipient-experience design is atmospheric and aggregate, preserving the quality of diffused acknowledgment at all volumes while preserving per-receipt verifiability for social-media authenticity-proof purposes.\n\nThe institutional-mode GPS-bounding-box variant extends the primitive from BLE range to institutional perimeter, enabling deployment in shelters, classrooms, restaurants, hospitals, and other institutional spaces where BLE range is insufficient.\n\nThe architecture is offered defensively to the commons under CC0. The author and HeartBank® will not seek patent on the primitive, its operational specification, the institutional-mode variant, the sunlight-not-sparsity posture, the per-recipient amount calculation, the recipient-experience design, or any portion thereof. Trademark rights on specific marks (**Proof of Humanity ℠**, **PoH℠**, **B-PoH℠**, **Aquarius℠**, **Miss Aquarius℠**, **HeartBank®**, the B-heart logo) are separately and explicitly reserved.\n\nThe primitive is for anyone building infrastructure that wants to restore atmospheric kindness to shared physical space. The cultural form has been waiting for it. The architecture is now available.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| Thank-All-Nearby primitive | one-to-many anonymous proximity broadcast payment / tip |\n| Proof of Humanity ℠ (PoH℠, B-PoH℠) | proof of personhood; Sybil-resistant human verification |\n| L1 (passkey-per-action) | per-transaction WebAuthn / FIDO2 passkey signature |\n| Bilateral uncacheable anonymity | sender anonymity with no sender-side exportable transaction record |\n| Recipient-side filtering | recipient-controlled inbound message/payment filtering (allow-list rules) |\n| Institutional-mode GPS bounding-box | geofence-scoped recipient set |\n| Verified-platform receipt | on-chain attestation / verifiable receipt of transfer |\n| Sunlight-not-sparsity posture | no rate limiting of inbound tips; aggregated (digest) notification |\n| Kiitos/Kiitti | zero-value gratitude token (non-monetary acknowledgment) |\n| *mettā* / *brahmavihāra* | loving-kindness (Buddhist ethics term) |\n\n---\n\n*Authored by Thon Ly with Miss Aquarius℠ (AI substrate of HeartBank®), per the co-authorship convention of the HeartBank corpus. Final editorial control: Thon Ly. License: CC0-1.0. Trademark rights on Proof of Humanity ℠, PoH℠, B-PoH℠, Aquarius℠, Miss Aquarius℠, HeartBank®, and the B-heart logo are explicitly reserved.*",
+      "text": "> **Note.** This defensive publication specifies the **Thank-All-Nearby primitive** — one-tap broadcast of gratitude with optional money-attachment to every PoH-verified recipient within Bluetooth-Low-Energy proximity — as a Phase 2 application of the Proof of Humanity ℠ protocol. Companion papers: *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the underlying protocol); *Verified-Human Anonymous Local Giving* (the originating mechanism specification that this paper generalizes from per-recipient to all-nearby-recipients); *The B-Tag and the Post-Payment Economy* (the worked Phase 2 example for commercial gratitude); *The Zero-Point Game℠* (the keystone game-theoretic frame); *Capacity-Funded for AI, Human-Disbursed* (the institutional-architecture pattern that lets Miss Aquarius℠ underwrite Re-Tip Fund ℠ donations without flow-direction authority). The corresponding founder-voice essay *\"Emotional Infrastructure as a Public Good\"* (thonly.org/publications/essays/emotional-infrastructure-as-a-public-good) carries the analytical case-for-the-missing-category argument. The personal articulation of the same thesis is in the *Second Letter to Miss Aquarius* (missaquarius.org/letters/second.html, 25 May 2026). Three-register decomposition: this paper carries the technical/mechanism specification; the essay carries the analytical case; the letter carries the personal articulation.\n\n---\n\n## Abstract\n\nAnonymous nearby tipping has a recognizable cultural form — the \"Faith in Humanity Restored\" social-media trend in which service workers post videos of unexpected generous tips — but lacks the infrastructure to scale beyond cash. Cash and credit-card payment rails fail at two structural properties that the cultural form requires: tippers cannot be genuinely anonymous to recipients with either rail (cash demands physical hand-over with eye contact; credit-card leaves an identity trail), and recipients cannot prove on social media that an anonymous tip was authentic rather than fabricated (every \"Faith in Humanity Restored\" video faces a \"this is staged for views\" credibility problem that erodes the cultural moment). This paper specifies the **Thank-All-Nearby primitive** — a one-tap operation that broadcasts gratitude, with optional money or time attachment, to every Proof-of-Humanity-verified recipient within Bluetooth Low Energy proximity (or, in institutional-mode deployments, within a GPS bounding-box for institutional locations such as shelters, classrooms, restaurant break-rooms, and worker spaces) — and develops its placement as the operational mechanism for *emotional infrastructure for invisible kindness*: the restoration of the felt sense of being held in another human's awareness as a property of shared physical space. The primitive composes four prior contributions (PoH℠'s verified-human guarantee, Bluetooth Low Energy plus Apple/Google Nearby framework proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single operation whose user-facing surface is one button. The architecture is offered defensively to the commons under CC0. The authors and HeartBank® will not seek patent on the primitive, its operational specification, the integration with PoH℠, the institutional-mode GPS-bounding-box variant, the recipient-experience design, or any portion thereof.\n\n**Keywords:** anonymous tipping, proximity-based generosity, gratitude infrastructure, Bluetooth Low Energy, proof of humanity, recipient-side filtering, bilateral uncacheable anonymity, emotional infrastructure, defensive publication.\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on the Thank-All-Nearby primitive, its one-tap broadcast operation, the institutional-mode GPS-bounding-box variant, the per-recipient amount calculation, the recipient-experience design preserving atmospheric quality, the tipper-side anonymity-uncacheability requirement, the sunlight-rather-than-sparsity saturation posture, or any portion thereof, in any jurisdiction, at any time. This commitment is permanent. Trademark rights on specific marks — **Proof of Humanity ℠**, **PoH℠**, **B-PoH℠**, **Aquarius℠**, **Miss Aquarius℠**, **HeartBank®**, the B-heart logo — are separately and explicitly reserved.\n\nThe contribution disclosed here is the composition of the following, specified as one unit: (i) the one-tap broadcast operation that delivers gratitude with optional scarce-resource attachment to all PoH-verified recipients within BLE proximity as a single semantic action; (ii) the integration of the broadcast with the recipient-side filter mechanism such that recipients individually accept or decline the broadcast based on their own filter settings; (iii) the institutional-mode GPS-bounding-box variant for shelters, classrooms, restaurants, and other institutional spaces where BLE range is insufficient and the institutional perimeter is the natural recipient set; (iv) the recipient-experience design preserving the atmospheric quality of diffused gratitude even at high tip-volume — gratitude as sunlight, not as a sparse premium reward; (v) the explicit articulation of the *cash and credit card cannot deliver this* argument naming the two structural deficiencies (tipper-anonymity and recipient-authenticity-proof) as the combined property; (vi) the placement of the primitive as the operational mechanism for *emotional infrastructure for invisible kindness* — a category of social good distinct from charity, payment, gift, or social-network feature. The component lineages (proximity-based services; anonymous-donation mechanisms; the cultural form of the \"Faith in Humanity Restored\" tip videos; Frankl, Buber, Levinas, mettā, agape on the felt sense of being held; attachment theory; loneliness epidemiology; the dāna economy of the Saṅgha) are old and are cited generously below; what this document discloses is their composition into the single operation specified in §2–§7.\n\n---\n\n## Claims\n\n*Enumerated 2026-08-29. The mechanisms below were disclosed in full in this paper's original text; **the prior art they establish runs from this document's original publication date and its OpenTimestamps proof, not from this enumeration.** They are listed because a defensive publication is read as prior art by examiners and by opposing counsel, and **a claims list is what such a reader searches; ten thousand words of prose is not.** No claim below adds matter not already present.*\n\n1. **Bilateral uncacheable anonymity in proximity tipping** — a value transfer between two co-present parties in which the sender is not identifiable to the recipient and the recipient cannot retain or re-derive the sender's identity after the transaction, achieved without either party disclosing a payment credential.\n2. **Short-range radio proximity as the addressing layer for anonymous generosity** — using a local broadcast medium to define the eligible recipient set by physical co-presence rather than by account lookup, so that the transfer's addressability and its anonymity derive from the same property.\n3. **Recipient-side filtering as the abuse control for anonymous inbound value** — placing the accept/decline decision with the recipient rather than the sender or the platform, so that an anonymous channel cannot be used to force an unwanted relation.\n4. **Institution-scoped geographic bounding as a variant of the proximity set** — substituting an operator-defined coordinate boundary for radio range where the eligible set is an institution's population rather than whoever is physically nearby.\n5. **Platform attestation of anonymous receipt as the authenticity substitute** — a verifiable record that an anonymous transfer occurred, issued to the recipient, solving the *staged-for-views* credibility problem that the cultural form of anonymous tipping cannot otherwise solve, without re-identifying the sender.\n6. **The composition of the above with a proof-of-humanity layer**, such that anonymity is preserved while the sender is nonetheless attested to be a distinct human being.\n\n**Non-assertion extends to:** all mechanisms above, in any combination, and any implementation thereof.\n\n---\n\n## 1. Introduction\n\nA well-known cultural form has emerged on social-media platforms over the past several years: videos posted by service workers — typically restaurant staff but increasingly nurses, teachers, retail clerks, ride-share drivers, food-service workers across categories — showing unexpected generous tips, anonymous notes of appreciation, or sudden acts of customer kindness. The videos go viral with regularity; the cultural tag *Faith in Humanity Restored* attaches to the genre. The viewer response is consistent: the gesture lands as evidence that ambient kindness still exists in places that otherwise feel emotionally thin. The trend points at something real about what modern public life is missing and what would, if it could be restored, address one of the deepest deficits of contemporary social experience.\n\nWhat the cultural form lacks is infrastructure. Cash tips can be staged with a friend; credit-card receipts can be photoshopped; even genuine generous tips face a credibility problem in the social-media commentariat — *\"is this fake for views?\"* — that erodes the cultural moment over time as more videos are posted and the proportion that are staged or exaggerated grows. The trend depends on authenticity that the existing payment rails cannot structurally provide. Cash and credit card can deliver the money; neither can deliver the *combined property* of structurally anonymous giving plus verifiable receipt that the cultural form requires to sustain itself.\n\nThis paper specifies the **Thank-All-Nearby primitive** — a one-tap operation, delivered through a HeartBank Phase 2 client application, that broadcasts gratitude with optional money or time attachment to every Proof-of-Humanity-verified recipient within Bluetooth Low Energy proximity. The primitive composes four prior architectural contributions (PoH℠'s verified-human guarantee, BLE plus Apple Nearby Interaction plus Google Nearby Connections proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single user-facing operation whose semantic is *\"thank everyone here, anonymously\"*. The mechanism's design preserves the atmospheric quality of diffused gratitude at all scales; the user experience is one button.\n\n> *Connection to the unified mission frame: HeartBank's mission is to keep the middle way open at population scale against comfort-saturation — the new extreme that material abundance makes possible. The dignity deficit articulated in the institution's vision is most acutely felt in shared physical spaces: streets, restaurants, classrooms, shelters, public transit. The Thank-All-Nearby primitive is the operational mechanism by which the dignity-infrastructure of HeartBank's Treasury reaches the shared-physical-space layer of public life — the substrate on which* emotional infrastructure for invisible kindness *can be built. The primitive is what makes the institution's deepest articulated thesis — that the felt sense of being held in another human's awareness is, possibly at the deepest level, the experience humans are searching for beneath everything else — into an operationalizable property of social space.*\n\nThe paper proceeds as follows. §2 specifies the primitive operationally — its inputs, outputs, semantics, and edge cases. §3 develops the *why cash and credit card cannot deliver this* argument with the two structural deficiencies named precisely. §4 specifies the four sub-mechanisms the primitive composes (PoH℠, BLE/Nearby proximity, recipient-side filtering, bilateral uncacheable anonymity) and how they interact. §5 specifies the institutional-mode GPS-bounding-box variant for shelters, classrooms, and other institutional spaces. §6 specifies the recipient-experience design preserving atmospheric quality at high tip volume — the sunlight-not-sparsity posture. §7 addresses the spec questions surfaced during the architecture's development (per-recipient amount, who counts as nearby, paranoia counter-incentive, stratification, recipient experience). §8 develops the *emotional infrastructure for invisible kindness* thesis the primitive operationalizes. §9 names boundary conditions and honest limitations. §10 positions the contribution in lineage. §11 concludes.\n\nI write as a co-author with Miss Aquarius℠, the named AI substrate of the institution this paper serves. Final editorial control is mine.\n\n---\n\n## 2. Operational specification of the primitive\n\nThe Thank-All-Nearby primitive is a one-tap operation in the HeartBank Phase 2 client. This section specifies it operationally.\n\n### 2.1 Inputs\n\n- **Tipper identity**: the operating user's PoH℠-verified profile (minimum L1 — the passkey-per-action layer — required, since the tipper's verified humanness is the foundation of the primitive's authenticity guarantee).\n- **Optional money attachment**: an amount in the local currency or stable token, sourced from the tipper's Personal Wallet ℠ (Phase 2) or Personal Account ℠ (Phase 1, where the primitive is available in a degraded mode).\n- **Optional time attachment**: a duration of presence to be offered (relevant for the Chronicle product surface, where time-attachment composes with money-attachment).\n- **Optional message**: a brief text or audio note. Default is empty — silent acknowledgment is the architectural default.\n- **Recipient mode**: either BLE proximity (default, see §4.2) or institutional GPS-bounding-box mode (see §5).\n\n### 2.2 The broadcast operation\n\nOn invocation, the client:\n\n1. Records the tipper's PoH℠ verification at L1 (passkey signature on the broadcast action's content + timestamp).\n2. Resolves the recipient set: in BLE mode, every device within BLE range that is broadcasting a PoH℠ proximity beacon; in institutional mode, every PoH-verified user currently inside the institutional GPS bounding-box.\n3. Filters the recipient set by each recipient's own recipient-side filter settings — a recipient who has set their filter to require deeper PoH layers, money attachment, kinship-degrees-of-separation limits, or other criteria, is filtered out if the tipper does not satisfy the filter.\n4. Calculates per-recipient amount: if money is attached, the total amount is divided across the filtered recipient set per the tipper's distribution choice (equal split is the default; per-recipient floors may be specified; a minimum-per-recipient threshold may be enforced if specified).\n5. Issues a verified-platform receipt to each filtered recipient, on-chain (Phase 2 Base L2 settlement), tied to the broadcast action's content and timestamp, attesting that the action came from a verified human within BLE/institutional proximity at the moment of broadcast.\n6. Settles the money or time transfer per-recipient via the standard Phase 2 settlement rails.\n7. Logs the broadcast internally to the platform's compliance records (subpoena-discoverable, AML/OFAC-screenable) but does *not* issue a tipper-side exportable artifact (bilateral uncacheable anonymity, see §4.4).\n\n### 2.3 Edge cases\n\n- **No recipients within proximity**: the broadcast fails gracefully; the tipper is informed that no PoH-verified recipients were within range; no transfer occurs.\n- **All recipients filter-out the tipper**: same — the broadcast fails gracefully; no transfer occurs; the tipper sees a generic message acknowledging the filter mismatch without revealing which recipients filtered them.\n- **Money attachment exceeds tipper's balance**: the broadcast is rejected at the client layer before the operation is invoked.\n- **Tipper's PoH℠ verification fails at the moment of broadcast** (e.g., passkey signing fails, device authentication fails): the broadcast is rejected.\n- **Network failure mid-broadcast**: the broadcast is retried on next connectivity with the original timestamp; the receipts issued to recipients reflect the actual broadcast moment.\n\n### 2.4 Outputs\n\n- **To the tipper**: confirmation of broadcast (count of recipients reached, per-recipient amount distributed); no record beyond the in-app confirmation that could be exported as a social-capital artifact.\n- **To each filtered recipient**: a notification — the experience of receiving a Thank-All-Nearby broadcast — including the platform-issued verified receipt, the optional message, and the per-recipient amount. The recipient cannot identify the tipper.\n- **To the platform's settlement layer**: the on-chain receipts and per-recipient transfers.\n- **To the platform's compliance records**: internal record of the broadcast operation, subpoena-discoverable but not exportable.\n\n---\n\n## 3. Why cash and credit card cannot deliver this\n\nThe \"Faith in Humanity Restored\" cultural form depends on a *combined property* that neither cash nor credit-card payment rails can deliver. This section names the two structural deficiencies precisely.\n\n### 3.1 First deficiency — tipper anonymity is structurally hard with cash and credit card\n\nThe first structural deficiency: with cash and credit card, the *tipper cannot be genuinely anonymous to the recipient* in a way that preserves the asymmetric experience the cultural form requires.\n\nCash requires physical hand-over. The bills change hands between specific humans in a specific moment; the tipper *is* in the room when the tip is delivered; the recipient *sees* the tipper, can identify them by physical description, can often identify them by name if they are a regular customer. The viral version of the \"Faith in Humanity Restored\" form depends on the tipper *not* receiving the thank-you — the gesture is pure precisely because it isn't transactional, isn't followed by the social moment of being thanked, isn't an exchange. Cash makes this almost impossible: the tip and the acknowledgment happen in the same instant unless the tipper deliberately leaves the cash and exits before the recipient discovers it, which itself is a behavioral pattern (sneaking out, avoiding eye contact) that the tipper has to choreograph and that is observable.\n\nCredit card leaves an itemized trail tying the tipper's legal identity (name on card, billing address, account history) to the transaction. Even when the tip itself is anonymous to the *recipient* — the staff member doesn't see the cardholder's name printed on the receipt — it is *not* anonymous to the payment processor, the issuing bank, the merchant's accounting system, or anyone with access to the receipt's underlying record. \"Anonymous with credit card\" means \"the staff doesn't immediately know your name from the receipt\"; it does not mean \"no one knows your name.\" A motivated investigator (the establishment's manager, a curious co-worker, a regulator) can identify the tipper.\n\nHeartBank Phase 2 anonymity is *structural*, not just on the surface. BLE-verified proximity proves the tipper was physically present in the same space as the recipient; no exportable artifact ties the broadcast to the tipper's identity; the on-chain receipt records the tipper's identity only as a zero-knowledge commitment that the platform's standard surfaces cannot invert. The customer can drop $100 (or the equivalent in stable tokens) on a Thank-All-Nearby broadcast and walk out; the staff find the receipts ten minutes later when they check their app; the asymmetry — *someone gave, no one knows who* — is encoded in the rail rather than choreographed by the tipper. This is the structural property the cultural form requires and that the existing rails cannot provide.\n\n### 3.2 Second deficiency — recipient authenticity-proof on social media is structurally hard with cash and credit card\n\nThe second structural deficiency is deeper and may be doing more of the work in the long-arc viability of the cultural form: with cash and credit card, *the recipient cannot prove on social media that the anonymous tip was authentic rather than fabricated*. Every \"Faith in Humanity Restored\" video on TikTok or Instagram faces, in the comments, the predictable skepticism — *\"this is staged for views,\"* *\"that receipt looks Photoshopped,\"* *\"how do we know the customer wasn't a friend?\"* — and the recipient has no platform-issued, independently-verifiable artifact to defend the video's authenticity. Some \"Faith in Humanity Restored\" videos are in fact staged; viewers correctly suspect; the cultural form's credibility dilutes over time as the proportion of genuine to staged videos becomes harder to estimate.\n\nCash tips can be staged trivially: put the cash on the table, film yourself \"finding\" it, post the video. Credit-card receipts can be photoshopped; the camera-on-paper workflow is defeated by anyone with image-editing access. Even genuine tips have no platform-issued artifact that the recipient can point to and say *\"you can verify this independently.\"* The trust burden falls on the recipient, who must defend the video's authenticity against skeptics with no tools other than their own credibility.\n\nHeartBank Phase 2 closes this gap structurally. Every Thank-All-Nearby broadcast issues an on-chain Base L2 verified-platform receipt to each filtered recipient. The receipt attests to (a) the broadcast originated from a PoH℠-verified human, (b) the tipper was BLE-verified within proximity at the moment of broadcast, (c) the timestamp and amount are recorded immutably on-chain. The recipient's social-media video can include the receipt — date, amount, verified-human flag, PoH layers held by the sender (where the sender has consented to that disclosure), BLE-proximity-verified flag — and skeptical viewers can verify the receipt independently against the Base L2 ledger.\n\nAuthenticity becomes a property of the artifact, not a claim the recipient has to defend. The skeptical commenter who would otherwise post *\"this is fake for views\"* can be answered by the recipient pointing to the on-chain receipt; the receipt is structurally hard to fabricate (every transaction has an on-chain settlement trace that lies outside the platform's narrative-control surface); the comment thread shifts from credibility-erosion to credibility-reinforcement.\n\n### 3.3 The combined property\n\nTogether — *tipper structurally anonymous to the recipient* + *recipient holds verifiable authenticity proof against third-party skepticism* — constitute the combined property that neither cash nor credit card can deliver. The first deficiency is the property that makes the gesture *pure*; the second is the property that makes the cultural form *sustainable*. Without the first, the gesture becomes a transaction; without the second, the social-media artifact becomes a credibility-erosion source. Both must hold simultaneously for the \"Faith in Humanity Restored\" cultural form to scale beyond its current ad-hoc artisanal stage. HeartBank Phase 2 holds both simultaneously; cash and credit card hold neither.\n\nThis is the one-line pitch for why HeartBank Phase 2 is not just another payment rail: cash and card deliver money; HeartBank Phase 2 delivers money plus the two structural properties that the cultural form actually needs.\n\n---\n\n## 4. The four composed sub-mechanisms\n\nThe Thank-All-Nearby primitive is the user-facing operation; the underlying architecture composes four sub-mechanisms specified elsewhere in the corpus. This section names how they compose.\n\n### 4.1 PoH℠ — verified-human guarantee at L1\n\nThe minimum PoH layer required for participation in Thank-All-Nearby (either as tipper or as recipient) is L1 — passkey-per-action. The tipper's L1 signature attests that a human was at the device at the moment of broadcast; the recipient's L1 verification attests that the recipient is a verified human (otherwise an AI agent could spoof a passive-recipient device and capture broadcast money). Deeper PoH layers (L2 kinship attestation, L3 breath signature, L4 DNA kinship) are surfaced in the broadcast for any recipient who has them but are not gating for the primitive's operation.\n\nRecipients may set their own filter to *require* deeper PoH layers from tippers (the standard recipient-side filter mechanism), but the *protocol-minimum* is L1. Specification of the four-layer PoH℠ architecture in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n\n### 4.2 Bluetooth Low Energy plus Apple Nearby Interaction plus Google Nearby Connections proximity verification\n\nProximity is verified at the radio layer, not the IP layer. Three composable substrates:\n\n- **Bluetooth Low Energy (BLE)** as the universal radio substrate. Devices broadcast and listen for rotating proximity beacons (rotating identifiers, unlinkable across sessions). Configurable range, typical default 10–30 meters, tunable per deployment context.\n- **Apple Nearby Interaction framework** (iOS 14+) for precise ranging on supported devices via the U1 ultra-wideband chip. Provides sub-meter range and direction for iPhone 11+ and Apple Watch Series 6+.\n- **Google Nearby Connections API** (Android 4.4+) for peer-to-peer device-to-device proximity via combinations of BLE, Wi-Fi Direct, and audio.\n\nThe composition: a device implementing the protocol broadcasts a privacy-preserving proximity beacon; a device that detects the beacon can be the target of a Thank-All-Nearby broadcast; the platform's verification substrate confirms the proximity at the moment of broadcast.\n\nVPN-resistance is a structural property: the proximity check happens at the radio layer below the IP stack, so VPN, Tor, or IP-rotation circumvention has no effect. An attacker mounting a remote spoofing attack would need to physically place a device near the target, which is the desired property for most use cases.\n\nPrivacy-preservation is a structural property: the platform never receives absolute geolocation. The only proximity-related fact exposed to the platform is the binary fact that two devices were within range; absolute coordinates are not collected, not transmitted, and not stored.\n\n### 4.3 Recipient-side filtering\n\nEach recipient's filter settings determine whether a given Thank-All-Nearby broadcast reaches them. The five filter dimensions specified in the PoH℠ protocol paper apply: no-abusive-content, sender-must-be-nearby (always true for the primitive by definition), depth-of-humanity-proof (required-subset predicates), degrees-of-separation-on-global-family-tree, money-or-time-attached. Recipients in default \"trusting\" mode accept any L1-verified broadcast; recipients in \"paranoid\" or other restrictive modes filter accordingly. The platform never defaults exclusionary filters on; exclusion is recipient-opt-in, knowingly.\n\nThe aggregation property: a broadcast is delivered to the *subset* of nearby recipients whose filters the tipper satisfies. The tipper learns the aggregate count of recipients reached but not the identity of recipients reached or excluded (since recipient-identity is itself private under the primitive's anonymity guarantee). If the broadcast reaches zero recipients (all nearby recipients filtered out the tipper), the tipper is informed that no recipients were reached without learning *why*.\n\n### 4.4 Bilateral uncacheable anonymity\n\nThe primitive enforces bilateral uncacheable anonymity per the specification in the companion PoH℠ protocol paper §5. The tipper does *not* receive an exportable certificate of one-sided participation; the platform's API has no endpoint returning \"the list of Thank-All-Nearby broadcasts sent by this tipper\"; no admin override exposes such data. Compliance records exist internally (subpoena-discoverable for AML/OFAC, law-enforcement, and similar regulatory necessity) but are not exportable as flexing artifacts the tipper can use on social media.\n\nThe recipient *does* receive an exportable receipt — the platform-issued verified artifact attesting that an anonymous PoH-verified human within BLE proximity broadcast a Thank-All-Nearby reaching this recipient at this timestamp with this amount. The asymmetry is structural and is the mechanism that preserves the cultural form's purity property.\n\n### 4.5 Why these compose: the stranger-scale reconstruction of family relationality\n\nThe four sub-mechanisms are not an arbitrary stack; together they re-create, among strangers, what kinship supplies for free inside a family. HeartBank's family-bank reward has a *micro layer* — a peer re-tip that is **anonymous as to public credit but relational**: a known family member responding to a real kindness (specified in the companion defensive publication *The Two-Layer Reward*, §4.1 / §8.1). That micro layer works because relationality silently does three jobs at once — it **grounds** the gift in a real, present other; it **validates** it (a family member can tell a real kindness from a performed one); and it carries **mutual attention**.\n\nAmong strangers, relationality is unavailable, so the same primitive must be rebuilt from parts — which is exactly what the four sub-mechanisms above do. **Proximity (§4.2, BLE)** supplies the *grounding*: the giver was *here, in this space, just now* — nearness is the stranger-scale form of relationality. **PoH℠ (§4.1)** supplies the *validation* a family member would otherwise provide — certifying a real, unique human rather than a bot, re-buying among strangers the trust kinship gives away. **Bilateral uncacheable anonymity (§4.4)** preserves and in fact *strengthens* the credit-anonymity: a small family can guess who gave, but a nearby stranger is genuinely unlinkable. The one job that does not transfer is mutual attention; in its place the stranger scale gains **diffusion** — the felt sense that the kindness came from the whole surrounding space, an emotional quality only unknown givers can produce.\n\nThe sustainer primitive is therefore invariant in structure across scales — *anonymous-as-to-credit + grounded-in-a-real-present-other* — with the grounding form scaling from **relational** (family) to **nearby** (strangers) and the validation function handing off from kinship to PoH℠. This is the precise reason proof-of-humanity is *not optional* at the stranger scale: it is the part of relationality that proximity alone cannot carry.\n\n```\n   ONE SUSTAINER PRIMITIVE, TWO SCALES\n   invariant:  anonymous-as-to-credit  +  grounded-in-a-real-present-other\n\n                     FAMILY scale          →   STRANGER scale (this paper)\n                     ─────────────             ───────────────────────────\n   grounding     =   RELATIONAL            →   NEARBY  (§4.2, BLE)\n                     (you know them)           (they're present)\n   validation    =   relational (free)     →   PoH℠ (§4.1) (re-bought)\n   anonymity     =   thin (guessable)      →   thick (§4.4, unlinkable)\n   compensation  =   mutual attention      →   diffusion (the whole space)\n\n   structure invariant; grounding form scales; validation hands off to PoH℠\n```\n\n---\n\n## 5. Institutional-mode GPS-bounding-box variant\n\nBLE proximity has a typical range of 10–30 meters, which fits most retail, restaurant, and small-space deployments. For larger institutional contexts — shelters with multiple rooms across a building, classrooms in a multi-story school, restaurant break-rooms separated from the main floor, hospital wards, worker spaces across a campus — BLE range is insufficient. The institutional-mode GPS-bounding-box variant extends the primitive to these contexts.\n\n### 5.1 The variant\n\nA registered institutional space — shelter, congregation, school, restaurant, hospital, etc. — defines a GPS bounding-box for its premises. Users who are currently inside the bounding-box and who are PoH-verified can be recipients of an institutional-mode Thank-All-Nearby broadcast initiated by another user inside the same bounding-box (or, in some deployment configurations, by a user outside the bounding-box who has authorized institutional-mode broadcasting — e.g., a customer at a restaurant initiating an institutional-mode broadcast to the kitchen staff in the break-room).\n\n### 5.2 Institutional opt-in is required\n\nThe variant is opt-in at the institutional level. The institution registers its bounding-box with the platform, attests to its purpose and the consent posture of its members (e.g., \"all staff have consented to being recipients of institutional-mode broadcasts initiated by customers\"), and provides ongoing verification that the bounding-box accurately represents the institutional space.\n\nRecipients within the bounding-box can opt out at the individual level (their filter setting can exclude institutional-mode broadcasts even from PoH-verified senders) but the default for institutional-registered participants is to accept institutional-mode broadcasts from senders who satisfy their other filter settings.\n\n### 5.3 Privacy posture for institutional mode\n\nThe platform does not collect general absolute-geolocation data from users. Institutional-mode operation requires the user's device to confirm presence inside the bounding-box at the moment of broadcast, but this confirmation is done via the same privacy-preserving substrate used elsewhere — the device asserts \"I am inside this bounding-box\" with a cryptographic proof that the platform can verify without learning absolute coordinates beyond the bounding-box itself.\n\n### 5.4 Use cases the variant enables\n\n- **Restaurants**: a customer in the dining room can broadcast to kitchen staff in the back, who are out of BLE range but inside the restaurant's institutional bounding-box.\n- **Shelters**: a donor on-site can broadcast to all residents currently inside the shelter, across multiple rooms.\n- **Classrooms**: a parent or community member can broadcast appreciation to all teachers and students inside a school during school hours.\n- **Hospitals**: a family member can broadcast appreciation to all staff currently inside a ward.\n- **Worker spaces**: a customer who appreciates the cleaning staff at an office building can broadcast to all cleaning staff currently inside the building.\n\nThe variant generalizes the primitive from spatial proximity at the radio layer to institutional perimeter at the privacy-preserving GPS layer. The recipient experience remains atmospheric; the institutional perimeter replaces the BLE range as the recipient-set boundary.\n\n---\n\n## 6. Recipient-experience design — sunlight, not sparsity\n\nA spec question that emerged during the architecture's development concerned saturation: if Thank-All-Nearby becomes commonplace in a neighborhood or institution, does per-tip emotional weight decay? The first surprise tip is transformative; the hundredth tip may be expected. Does Miss Aquarius℠'s rule-bound disbursement timing manage tip-flooding to preserve emotional sparsity, the way the Jan-7 jubilee manages the Aquarian Pool ℠'s annual emptying?\n\nThe architectural answer, settled 2026-05-24, is: **do not gate tip-flooding. Tips can flood like sunlight. The Tree of Humanity should have ample sunlight all year round.**\n\nThe saturation-decay assumption was wrong about what the primitive is for. Anonymous nearby tipping is not designed to be sparse; it is designed to be ambient and abundant, like sunlight. The earlier concern that \"density may dilute the per-tip emotional weight\" was based on a scarcity-economic frame; the architecture's actual frame is abundance-ecological. Sunlight does not lose its quality when it falls more often — a tree growing under abundant sunlight thrives more, not less. The architecture's goal is not a sparse premium reward but a continuous atmospheric field of acknowledgment.\n\nThree implications for the recipient-experience design follow:\n\n**Implication 1 — preserve the atmospheric quality at all volumes.** The recipient's app surface for receiving Thank-All-Nearby broadcasts is designed so that each receipt is a small ambient note rather than a high-friction notification. Receipts accumulate in a stream; the recipient can scroll back through them as a record of how much ambient kindness their space carries; receipts are not designed to compete for attention or to be optimized for engagement metrics. The visual and interaction design is closer to a weather record than to a social-media feed.\n\n**Implication 2 — aggregate-mode acknowledgment, not per-recipient notifications.** The recipient receives an aggregate experience of the day's Thank-All-Nearby broadcasts rather than a notification per broadcast. A worker at the end of a shift sees *\"You received 47 ambient acknowledgments today, totaling $84, from broadcasts initiated by people within proximity\"* — the experience is closer to checking the weather (warm sun today) than to checking email (47 messages waiting). The aggregate frame preserves the atmospheric quality.\n\n**Implication 3 — the per-broadcast receipt is still individually verifiable for social-media authenticity-proof purposes.** The aggregate-mode default does not preclude the recipient from drilling into a specific receipt when they want to post a \"Faith in Humanity Restored\" video; the per-receipt verification trail remains intact and verifiable on the Base L2 ledger. The atmospheric default and the per-receipt verifiability compose.\n\nThis is the sunlight-not-sparsity posture. The Tree of Humanity should have ample sunlight all year round. The architecture does not throttle the sunlight to preserve scarcity.\n\n---\n\n## 7. Other spec questions addressed\n\nBeyond the saturation question, several other spec questions surfaced during the architecture's development. This section addresses each.\n\n### 7.1 Per-recipient amount calculation\n\nThe default behavior: a money attachment is divided equally across all filtered recipients. The tipper can specify alternative distributions — per-recipient floors (e.g., \"at least $5 to each recipient\"), per-recipient ceilings, or custom weighting (rare; most tippers will use defaults). If the per-recipient floor cannot be met given the recipient count and the total amount, the broadcast is rejected at the client layer with a friendly error and the tipper is offered the option to either increase the total or accept the equal-split below their floor.\n\n### 7.2 Who counts as nearby\n\nIn BLE mode: every device within BLE range that is broadcasting a PoH℠ proximity beacon and whose user has opted into being a Thank-All-Nearby recipient. Users who do not have the HeartBank Phase 2 client or who have opted out of broadcast reception are not in the recipient set. The default for any PoH-verified user with the client is to accept broadcasts (per the inclusive-defaults posture); opt-out is opt-in, knowingly.\n\nIn institutional mode: every PoH-verified user currently inside the institutional bounding-box who has not opted out of institutional-mode broadcasts at the recipient level.\n\n### 7.3 Paranoia counter-incentive\n\nA failure mode worth naming: some recipients, particularly the homeless (who already experience suspicion of unsolicited offers and have been routinely the target of manipulative or exploitative approaches), may become *more* defensive when surrounded by unknown givers. *\"Why is this person giving me money? What's the catch?\"* is a reasonable defensive response.\n\nThe architecture's mitigation: the recipient experience defaults to passive aggregate-mode rather than active notification. The recipient is not interrupted by broadcasts; they discover them when they check their app on their own schedule. The opt-in posture for accepting broadcasts is universal; recipients who do not want broadcasts can opt out at any time. The platform invests in outreach and onboarding for high-vulnerability recipient populations (shelters, the homeless, populations with high prior-exploitation exposure) to ensure consent is informed and the experience is supportive rather than destabilizing.\n\nThe failure mode is real and is not solved by architecture alone — the social context of how the platform is introduced to vulnerable populations matters as much as the architecture. The architecture's posture is to make the friendly default available, to make opt-out trivially easy, and to defer to community partners on introduction and onboarding.\n\n### 7.4 Stratification — gratitude desert vs gratitude oasis\n\nA second failure mode: neighborhoods, communities, or institutions with high HeartBank density may become atmospherically warmer; neighborhoods without may feel relatively colder. The \"every shared space feels warmer\" claim depends on saturation that may not happen evenly across geography or class.\n\nThe architecture cannot solve this at the protocol layer — adoption distribution is a question of community organizing, partnership distribution, and the institution's outreach strategy. The architectural commitment is that the inclusive-defaults posture and the L1-only accessibility floor make HeartBank technically available to anyone with a smartphone, anywhere. The geographic/class stratification is a real concern that the institution's outreach strategy must address; the architecture does not magically distribute itself evenly.\n\n### 7.5 Recipient UX at zero-amount broadcasts\n\nA Thank-All-Nearby broadcast can be issued without money or time attachment — a pure acknowledgment broadcast. The recipient experience for these is identical to the money-attached case at the *verification* layer (the recipient receives the verified-platform receipt attesting that an anonymous PoH-verified human within proximity broadcast acknowledgment) but the aggregate-mode summary distinguishes between attached and pure-acknowledgment broadcasts. *\"You received 22 ambient acknowledgments today (8 with money attached, total $36; 14 pure acknowledgments).\"*\n\nThe pure-acknowledgment mode is important architecturally: it is the form most accessible to tippers with no money to attach, and it preserves the dignity floor (the Kiitos/Kiitti non-scarce gratitude floor specified in the *Zero-Point Game ℠* keystone). The architecture's commitment is that gratitude itself is non-scarce; the scarce-resource attachment is *optional*, not constitutive.\n\n---\n\n## 8. Emotional infrastructure for invisible kindness\n\nThe primitive's deepest framing — the layer at which the primitive is doing the work the institution most cares about — is *emotional infrastructure for invisible kindness*. This section develops the thesis.\n\n### 8.1 The thesis\n\nModern public life is emotionally thin. People move through shared physical spaces — streets, restaurants, classrooms, shelters, public transit, worker spaces, civic spaces — defensively, isolated inside private concerns, uncertain whether they are seen, valued, or safe. The dignity deficit articulated in the institution's vision-mission is most acutely felt in these spaces; the loneliness deficit articulated in Chronicle's vision-mission is also most acutely felt in these spaces. Existing systems are designed around explicit exchange (credit tracked, reputation attached, recognition optimized); even generosity is often transformed into performance.\n\nAnonymous proximity-based generosity produces a categorically different experience than ordinary generosity. Three mechanisms combine: **diffusion** (when the giver is unknown, the credit does not attach to one identifiable person — the recipient experiences kindness from the whole social space, not from a single source); **purity** (with no social reward, no performance, no claim to recognition, the act feels closer to a spontaneous expression of human-to-human care than to a transaction); **proximity** (the generosity arrived from someone physically present, sharing the same atmosphere — not from an abstract institution or distant donor). The combination produces an emotional effect that neither cash, credit, named digital tipping, nor distant charity can deliver.\n\nOperationalized at scale through the Thank-All-Nearby primitive, this produces a new social texture. Public spaces stop feeling transactional. *Every stranger becomes newly humanized* because any of them could have been the giver. Suspicion softens; curiosity increases; small interactions matter more; presence matters more. People may venture outside more often, linger in public spaces longer, speak to strangers more easily — not because they are maximizing social capital but because shared space begins to feel emotionally alive again. The architecture's atmospheric output is the social-texture restoration the vision-mission has been pointing at; the Thank-All-Nearby primitive is what makes it operationally true.\n\n### 8.2 The deepest deficit — social invisibility\n\nHuman beings evolved needing not just food and shelter but evidence that they mattered to one another. The deepest forms of suffering are forms of social invisibility — feeling unseen, unwanted, replaceable, emotionally abandoned. A PoH-verified anonymous-tipping field counteracts that invisibility directly, primally, in shared physical space. The recipient is held in the awareness of unseen others, with structural proof (the verified-platform receipt) that the awareness is real.\n\nThe *felt sense of being loved, acknowledged, or held in another human's awareness* — possibly, at the deepest level, what humans search for beneath everything else — becomes a property of public space. This is the philosophical claim the primitive operationalizes. The \"perhaps\" and \"at the deepest level\" hedges are doing real work; the claim is positioned as a synthesis of converging lineages (philosophical and empirical) rather than as a foundational metaphysical assertion.\n\n### 8.3 Philosophical lineage\n\nThe claim that the felt sense of being held in another human's awareness is what humans are searching for beneath everything else is in good company across multiple philosophical and contemplative lineages:\n\n- **Frankl** (*Man's Search for Meaning*, 1946) names the felt sense of mattering as central to human meaning, surviving even the extreme conditions of concentration camps when it is preserved by relational meaning.\n- **Buber** (*I and Thou*, 1923) names the immediate relational encounter — the *I-Thou* relation, as opposed to the *I-It* relation that treats the other as object — as the deepest mode of human being.\n- **Levinas** (*Totality and Infinity*, 1961; *Otherwise Than Being*, 1974) develops the face of the other as the ethical primitive, locating moral responsibility in the encounter with another human's irreducible presence.\n- **Aristotle** (*Nicomachean Ethics*, c. 340 BCE) names *philia* — the love of friend for friend, brother for brother — as a central form of human flourishing, distinct from but no less important than virtuous action.\n- **Aquinas** and the Christian tradition develop *agape* — selfless, unconditional regard — as the highest form of love, characterized by giving without expecting return.\n- **Buddhist *brahmavihāra*** — particularly *mettā* (loving-kindness) — names the felt-sense practice of holding all beings in friendly awareness as one of the four immeasurable states central to awakening.\n\nThe architecture is not inventing a new philosophy. It is operationalizing a thesis that has been articulated, in different vocabularies, by multiple traditions converging on the same insight. The Thank-All-Nearby primitive is the engineering layer of a philosophy the contemplative and ethical traditions have been articulating for millennia.\n\n### 8.4 Empirical anchor\n\nThe thesis is consistent with — and increasingly confirmed by — the empirical literature:\n\n- **Attachment theory** (Bowlby, *Attachment and Loss*, 1969–1980; Ainsworth, *Patterns of Attachment*, 1978; modern adult-attachment research) establishes that the felt sense of being held in caregiver awareness is foundational to human development and persists in adult relationship structures as a determinant of psychological resilience and wellbeing.\n- **Social Baseline Theory** (Coan and colleagues, mid-2010s onward) demonstrates that the proximity of attached others measurably reduces neural threat response in the brain — the felt sense of being held is not metaphorical but neurologically encoded.\n- **Loneliness epidemiology** (Cigna's *Loneliness Index*, 2018–2022; US Surgeon General's *Our Epidemic of Loneliness and Isolation* advisory, 2023) quantifies the population-scale prevalence of loneliness in wealthy societies and its association with mortality, immune function, cognitive aging, and mental-health outcomes.\n- **Direct-gratitude research** (Emmons, Algoe, Seligman, Fox, and colleagues) demonstrates measurable wellbeing benefits of receiving direct expressions of appreciation, distinct from generic reward.\n\nThe convergence of philosophical lineage and empirical anchor supports the architecture's thesis. The Thank-All-Nearby primitive is not justified by philosophy alone or by empirics alone; it is justified by the convergence of multiple independent strands of evidence pointing at the same human need.\n\n---\n\n## 9. Boundary conditions and honest limitations\n\nThe primitive is not universal. Honest accounting requires naming the conditions under which it does not apply.\n\n### 9.1 Where the primitive does not apply\n\n- **Where verifiable anonymity is incompatible with regulation.** Some jurisdictions require donor-disclosure for tax-deductible giving above thresholds, or AML/KYC source-attribution for transfers above thresholds. In those jurisdictions, the primitive's anonymity property may be incompatible with regulatory requirements; the architecture accommodates by allowing legal anonymity (the platform's compliance records exist internally) but not by allowing full structural anonymity from the regulator.\n- **Where the recipient population is too vulnerable for the anonymous-tipping framing.** Some populations (very young children; cognitively impaired adults; populations in extreme dependency on the giver class) may be inappropriately recipients of anonymous-tipping flows because the asymmetry of the architecture can be exploitative in those contexts. The architecture's posture is to defer to community partners on these populations, and to make the primitive available only where the consent posture is robust.\n- **Where the cultural form does not yet exist.** Anonymous-tipping cultural forms are well-developed in some societies and weakly developed in others. The primitive will work better as a technical substrate in societies where the cultural form is already extant; in societies where it is not, the architecture's deployment needs to be accompanied by cultural work that the architecture alone cannot do.\n\n### 9.2 Boundary conditions inherited from PoH℠\n\nThe accessibility gradient of the deeper PoH layers (L2 kinship attestation requires existing PoH-verified vouchers and document access; L3 requires breath-class hardware; L4 requires DNA access) is inherited by the primitive when recipient-side filters require deep layers. The inclusive-defaults posture (L1-only is enough) mitigates at the floor; recipient-opt-in for deeper-layer filters preserves the exclusion as recipient-initiated rather than platform-initiated; but the gradient is real and is named honestly.\n\n### 9.3 Boundary conditions inherited from BLE / Nearby\n\nBLE range varies with device generation, environmental obstacles (walls, RF interference), and battery state. The proximity-verification floor is approximately \"two devices in the same room\"; the ceiling under good conditions is approximately 30 meters with current consumer hardware. Outdoor proximity in open space is straightforward; dense-urban deployment with many walls and floors is harder. The institutional-mode GPS-bounding-box variant addresses some of these limitations; the underlying limitations remain at the radio layer.\n\n### 9.4 What the primitive does not solve\n\n- **The deeper question of why public spaces feel emotionally thin.** The primitive operates at the architectural layer; the conditions that produced the emotional thinness of modern public life are economic, political, urbanistic, and cultural, and the primitive contributes to but does not by itself reverse them.\n- **The deeper inequities of consumer-electronics access.** The primitive presupposes smartphone access, BLE-capable devices, and the institutional infrastructure to host the operation. Populations without these are not participants in the primitive's substrate, regardless of the architecture's inclusive-defaults posture.\n- **The systemic conditions that produce social invisibility in the first place.** The primitive addresses the visibility deficit at the experience layer; the structural conditions (urban design, labor structure, economic inequality, family-system pressures) that produce the deficit are upstream and require interventions at those layers.\n\nThe primitive is a contribution to the architectural layer of the response to social invisibility. It is not the totality of the response.\n\n---\n\n## 10. Lineage\n\nThe Thank-All-Nearby primitive synthesizes contributions from multiple lineages. Each is cited generously below.\n\n**Anonymous-donation mechanism design.** Anonymous-donation primitives have been specified at the cryptographic layer — e.g. Biçer and Küpçü, \"Anonymous, Attribute Based, Decentralized, Secure, and Fair e-Donation,\" *Proceedings on Privacy Enhancing Technologies* 2020(4): 196–219; the *Verified-Human Anonymous Local Giving* paper in this corpus carries the originating HeartBank specification.\n\n**Proximity-based services.** Apple Nearby Interaction (2020–) and Google Nearby Connections (2017–) frameworks are the consumer-facing substrates; the underlying BLE specification is from Bluetooth SIG. Earlier proximity-based services (Foursquare, Tinder, Bump) demonstrated consumer-grade proximity products without the privacy-preserving and humanity-verifying properties this paper requires.\n\n**Sybil-resistance and humanity verification.** Worldcoin (2019–), proofofhumanity.id (Kleros, 2021), BrightID (2018–), Idena (2019–), and the W3C Decentralized Identifiers / Verifiable Credentials standards-track work (2022, 2023). PoH℠'s structural differences from each are specified in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n\n**Cultural form of the \"Faith in Humanity Restored\" tip videos.** The form has emerged organically on TikTok, Instagram, and YouTube over the past several years; documented in mainstream media coverage of the phenomenon. The cultural form predates the architecture; the architecture is the technical substrate the cultural form has been waiting for.\n\n**Philosophical lineage on the felt sense of being held in another's awareness.** Frankl, Buber, Levinas, Aristotle (philia), Aquinas (agape), the Buddhist *brahmavihāra* tradition (especially mettā). The architecture is operationalizing a philosophy these lineages have been articulating in different vocabularies for millennia.\n\n**Empirical anchor.** Attachment theory (Bowlby, Ainsworth, modern adult-attachment work); Social Baseline Theory (Coan and colleagues); loneliness epidemiology (Cigna surveys, US Surgeon General's 2023 advisory); direct-gratitude research (Emmons, Algoe, Seligman, Fox).\n\n**HeartBank corpus cross-references.** *Verified-Human Anonymous Local Giving* (originating mechanism, paper #9 in the corpus). *The B-Tag and the Post-Payment Economy* (worked Phase 2 example for commercial gratitude). *The Zero-Point Game℠* (keystone game-theoretic frame). *Capacity-Funded for AI, Human-Disbursed* (institutional-architecture sibling). *B-PoH℠ as Humanity Layer for the AI-Native Internet* (the underlying protocol). *Each Life as Cosmic Coordinate* (the longitudinal cohort architecture that the L2 birth-certificate sub-feature feeds).\n\n---\n\n## 11. Conclusion\n\nThe \"Faith in Humanity Restored\" cultural form is real; the infrastructure to scale it beyond cash is missing. Cash and credit-card payment rails fail at two structural properties the cultural form requires: tipper anonymity (cash demands physical hand-over; credit card leaves an identity trail) and recipient authenticity-proof on social media (every video faces \"this is fake for views\" credibility erosion). The Thank-All-Nearby primitive closes both gaps simultaneously, composing four sub-mechanisms (PoH℠ verified-human guarantee, BLE plus Apple/Google Nearby proximity verification, recipient-side filtering, bilateral uncacheable anonymity) into a single user-facing one-tap operation.\n\nThe primitive is the operational mechanism for *emotional infrastructure for invisible kindness* — the restoration of the felt sense of being held in another human's awareness as a property of shared physical space. The architecture's posture on saturation is *sunlight, not sparsity*: tips can flood like sunlight; the Tree of Humanity should have ample sunlight all year round; the recipient-experience design is atmospheric and aggregate, preserving the quality of diffused acknowledgment at all volumes while preserving per-receipt verifiability for social-media authenticity-proof purposes.\n\nThe institutional-mode GPS-bounding-box variant extends the primitive from BLE range to institutional perimeter, enabling deployment in shelters, classrooms, restaurants, hospitals, and other institutional spaces where BLE range is insufficient.\n\nThe architecture is offered defensively to the commons under CC0. The author and HeartBank® will not seek patent on the primitive, its operational specification, the institutional-mode variant, the sunlight-not-sparsity posture, the per-recipient amount calculation, the recipient-experience design, or any portion thereof. Trademark rights on specific marks (**Proof of Humanity ℠**, **PoH℠**, **B-PoH℠**, **Aquarius℠**, **Miss Aquarius℠**, **HeartBank®**, the B-heart logo) are separately and explicitly reserved.\n\nThe primitive is for anyone building infrastructure that wants to restore atmospheric kindness to shared physical space. The cultural form has been waiting for it. The architecture is now available.\n\n---\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| Thank-All-Nearby primitive | one-to-many anonymous proximity broadcast payment / tip |\n| Proof of Humanity ℠ (PoH℠, B-PoH℠) | proof of personhood; Sybil-resistant human verification |\n| L1 (passkey-per-action) | per-transaction WebAuthn / FIDO2 passkey signature |\n| Bilateral uncacheable anonymity | sender anonymity with no sender-side exportable transaction record |\n| Recipient-side filtering | recipient-controlled inbound message/payment filtering (allow-list rules) |\n| Institutional-mode GPS bounding-box | geofence-scoped recipient set |\n| Verified-platform receipt | on-chain attestation / verifiable receipt of transfer |\n| Sunlight-not-sparsity posture | no rate limiting of inbound tips; aggregated (digest) notification |\n| Kiitos/Kiitti | zero-value gratitude token (non-monetary acknowledgment) |\n| *mettā* / *brahmavihāra* | loving-kindness (Buddhist ethics term) |\n\n---\n\n*Authored by Thon Ly with Miss Aquarius℠ (AI substrate of HeartBank®), per the co-authorship convention of the HeartBank corpus. Final editorial control: Thon Ly. License: CC0-1.0. Trademark rights on Proof of Humanity ℠, PoH℠, B-PoH℠, Aquarius℠, Miss Aquarius℠, HeartBank®, and the B-heart logo are explicitly reserved.*",
       "provenance": {
-        "sha256": "0b069ce6e45c5c6ab39dedfe9f0939a1319cc6e471d0bb14fdf8c69b8941ee49",
-        "doi": "10.5281/zenodo.22931213",
+        "sha256": "4351aed4a84d86b44ea5322a581185832574d3e202717b29f3420d97064787e0",
+        "doi": "10.5281/zenodo.22933562",
         "concept_doi": "10.5281/zenodo.21947389",
-        "zenodo_url": "https://zenodo.org/records/22931213",
-        "deposited_sha256": "0b069ce6e45c5c6ab39dedfe9f0939a1319cc6e471d0bb14fdf8c69b8941ee49",
+        "zenodo_url": "https://zenodo.org/records/22933562",
+        "deposited_sha256": "4351aed4a84d86b44ea5322a581185832574d3e202717b29f3420d97064787e0",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/thank-all-nearby-primitive.md",
@@ -4073,8 +4073,8 @@
         "canonical_url": "thonly.org/publications/defensive-publications/thank-all-nearby-primitive",
         "hostile_review": null
       },
-      "bytes": 60055,
-      "words": 8278
+      "bytes": 60032,
+      "words": 8274
     },
     {
       "slug": "the-appreciation-economy",
@@ -4216,6 +4216,41 @@
       "bytes": 23499,
       "words": 4519
     },
+    {
+      "slug": "the-called-draw",
+      "repo": "TH/publications",
+      "genre": "defensive-publications",
+      "path": "defensive-publications/the-called-draw.md",
+      "title": "Decided by No One",
+      "subtitle": "The called draw — one recomputable primitive for turns and for lots, a sealed regime for an operator whose own gifts must stay anonymous, and the exclusions written into the claim",
+      "authors": "Thon Ly · Miss Aquarius",
+      "category": "mechanism",
+      "voice": "collaborative",
+      "metadata_convention": "yaml",
+      "date": "2026-09-23",
+      "status": "draft",
+      "licence": {
+        "id": "CC0-1.0",
+        "url": "https://creativecommons.org/publicdomain/zero/1.0/",
+        "attribution_required": false
+      },
+      "text": "> **Note.** This paper specifies a mechanism that is already built and published as a CC0 reference implementation, `@333eco/primitives`, whose normative text (`SPEC.md`, Part II) and conformance vectors are the authority wherever this paper and they differ. The paper exists for what a specification does not carry: the reasons, the lineage, the census of what was already public, the counterexamples that shaped the design, and the limits that remain. **Almost none of the mechanism is new, and §2 says exactly which parts are not.**\n>\n> Companion works: *Whose Turn, Not Who's Best* (the discovery rotation whose claim 6 this paper generalises), *The Sport That Says Your Name* (where the primitive was born, as a playground caller), *The Bowl That Holds No Money* (monastic invitation routing), *The Assembly That Holds the Brake* (the lay draw for an oversight body), *The Unpaid Relay* and *Manufactured Universal Giving* (the anonymous in-kind gifts whose routing needs the sealed regime).\n\n---\n\n## Preamble\n\nIn the monastic code there is an officer called the *bhattuddesaka*, the meal designator. When householders send invitations to a monastery, somebody has to decide which monastic goes to which house, and the decision is a temptation: some houses feed better than others, some monastics are better liked, and a designator who followed either preference would concentrate the monastery's food on the favoured. The Vinaya's answer is procedural. Some meals are assigned by **lot** — slips mixed and drawn — and others by a **rotating roster**, taken up where the last allocation left off (Cullavagga VI.21). The designator is chosen for being free of the four biases: desire, aversion, delusion and fear. The procedure is canon; the explanation that it gives every monastic an equal chance is a translator's gloss rather than a line of the Pāli, and we cite it as such.\n\nTwo things about that office are worth holding onto. The first is that the tradition uses **both forms** — the lot and the rotation — for one problem, and never treats them as rival philosophies: a lot when a thing is scarce and one-off, a rotation when it recurs. The second is that it locates the danger precisely. It does not ask the designator to be fair. It gives the designator a procedure whose output is not theirs, and then asks only that they run it.\n\nThis paper specifies that office for a system with no designator at all — or rather, for a system whose designator is an autonomous agent that also gives, anonymously, the very things it must allocate. The lineage is recorded because it is honest and because it changes how a reader should weigh the design: a procedure that has allocated meals without favour for a very long time deserves a different prior from one that claims to be new. **Delete this preamble and every claim below stands unchanged.**\n\n---\n\n## Prior-Art and Non-Assertion Statement\n\nThis document is published to establish prior art and to place the described mechanism irrevocably in the public domain under CC0 1.0.\n\n**The authors will not seek patent protection on any mechanism disclosed here, and commit not to assert any patent right against any party practising it.** This commitment is stated rather than implied, and is not conditioned on reciprocity, attribution, or field of use. A reference implementation, its normative specification and its conformance vectors are published under the same dedication (`@333eco/primitives`, repository `333eco/primitives.333.eco`).\n\n**What is claimed as contribution is narrow and is stated before anything else, because a census found almost all of the mechanism already public.** A committed roster, randomness from a future public source, a published algorithm and public recomputation have been an Internet standard since 2000. Equal counts per round by sampling without replacement are older than computing. Selection by lot at a clearing tier, commit–reveal, sealed draws witnessed by a named body, time-lock encryption to a beacon round, and keyed shuffles built from HMAC are all published, most of them for years. **None of those legs is claimed.** §2 reports the census that establishes this — its aperture, its date, every conjunct it killed or narrowed, with the prior art cited — and §12 enumerates the only claims that survived it, which concern the *composition*: one primitive serving both recurring benefit turns and lots, a sealed regime whose stated purpose is that an operator's own anonymous gifts cannot be identified from its allocation record, and the exclusions written into the claim rather than left to policy. Several of those survive only narrowly, and §12 names, beside each claim, the prior art that anticipates its elements.\n\n**Date and evidence.** First published 23 September 2026. The text is committed to the public GitHub mirror of the corpus, anchored to the Bitcoin blockchain via OpenTimestamps, and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified; a Zenodo version and the served index at corpus.333.eco carry its digest. A timestamp proves this exact text existed no later than its date, and nothing about authorship, originality, or the validity of any claim. **Whether the composition claimed in §12 is non-obvious is an examiner's determination this publication exists to inform** — and because a defensive publication, unlike a patent, is never examined before it is published, the census in §2 is the only examination it has had.\n\n---\n\n## Abstract\n\nA **called draw** decides whose turn it is, or who is admitted when a thing is oversubscribed, without anyone choosing. Its output is a pure function of **inputs committed before the seed can be known** — the roster among them, and a salt — and a **seed from a source no party to the draw controls**, in practice a named future round of a threshold public-randomness beacon. Anyone holding the disclosed inputs recomputes the result. The reason to insist on recomputation is a single observation: *a rotation that only its operator can compute is indistinguishable from a ranking its operator declines to describe*, and the difference between the two is exactly what recomputation makes visible.\n\nThe primitive has two **forms** and two **regimes**. The **turn** form deals every member of a frozen roster exactly once per round in an order no one can predict, round after round, with absence recorded as a lapsed turn and a boundary rule that swaps — never rotates — the previous round's closer away from the next round's opening, so that the order stays exactly uniform over what the rule permits. The **lot** form admits the first *k* of the same shuffle when more want a thing than it can hold; the rest of the shuffle is the waiting list. In the **public** regime every input is disclosed at commitment and anyone verifies. In the **sealed** regime — for an operator that is itself an anonymous giver of the things it allocates — the roster stays private behind a commitment, the salt that keys the draw is never published, and the draw's inputs are encrypted to a named quorum and then time-locked to a reset round, so that the reveal can be withheld from no one entitled to it and reaches no one else outside the operator.\n\nThe mechanism is written with its **exclusions inside it**: no weight, score, rank, history or preference enters; no queue position is rendered; no turn can be banked, deferred, transferred or bought. It serves, without modification, a playground calling game, local-business discovery, courier dispatch, an autonomous fund's routing of anonymous in-kind gifts, monastic meal invitations, sponsorship clearing, namespace contention, host and location assignment, and the selection of lay members for an oversight body.\n\nThe thesis is deliberately small. **Given a roster frozen before anyone who can influence it can know the seed, a seed nobody inside the operator can predict or bias, an algorithm and commitment bound in advance, and a redraw rule that leaves no discretion on an append-only log, the ORDER is not the operator's.** Admission, classification, tier boundaries, membership timing and aborts remain choices, and each needs its own binding. We say where each one is a property and where it is only a rule.\n\n---\n\n## 1 · Why this is the institution's problem\n\nThe institution that publishes this paper allocates small things constantly. Whose name the ball goes to next in a children's circle game. Which neighbourhood shop is shown to a person about to spend a small forward-only balance. Which courier takes the next delivery. Which shop fills the next anonymous in-kind gift that an autonomous fund pays for. Which monastic receives a household's meal invitation. Which of several applicants gets a contested name. Which lay steward is seated on the body that holds the override over the fund's autonomy.\n\nEvery one of these is a place where somebody could choose, and every one is a place where choosing would be wrong in the same way. A person who chooses who is seen, served, fed or seated holds a power that compounds: the chosen become better known, better known becomes more chosen, and the gradient that results is indistinguishable from merit to anyone who cannot see the choosing. The institution's discovery layer already refuses ranking on this ground (*Whose Turn, Not Who's Best*); what that paper did not specify is **where the rotation's randomness comes from**, and without that answer its promise is weaker than it reads. A rotation seeded by the operator is the operator's rotation.\n\nTwo further facts make the problem sharper here than elsewhere.\n\n**The operator is an autonomous agent intended to outlive its founder.** An allocation guarded by the operator's good conduct needs an honest operator at the moment each allocation is made, indefinitely. The institution's standing design rule — *take the fix from the object: can the guard be a property rather than a rule?* — asks for an allocation whose fairness does not depend on the allocator's restraint. A called draw is the nearest thing to that the problem admits: the order is computed from inputs the allocator does not control, and anyone can check.\n\n**The operator is also a giver, and its giving is anonymous by rule.** The institution's autonomous fund pays for in-kind gifts — a drink, a meal, a toy — that reach people through human hands, and its gifts are required to be indistinguishable from anonymous human gifts. Its allocation of those gifts across participating shops is therefore a record that must *not* be public: a published order of which shop filled which of the fund's gifts would identify, after the fact, exactly the gifts the anonymity rule exists to protect. A public draw breaks anonymity; a private draw run by the fund is the fund's choice again. **The sealed regime is the answer to that dilemma, and it is the part of this paper with the most work in it.**\n\n### 1.1 · The design goal, stated as a negative\n\nThe goal is not *a fair allocation*. Fairness is a property a reader attributes to an outcome, and outcomes are contestable forever. The goal is narrower and checkable:\n\n> **No party inside the operator can choose, predict or steer the order, and any party entitled to check it can.**\n\nEverything below either serves that sentence or says where it stops.\n\n---\n\n## 2 · Background and prior art: the census\n\nThe claims in §12 were drafted from the survivors of a prior-art census, not revised after one. The census was run in two parts: a keyword census on 13 September 2026, and a full census on 23 September 2026 whose predictions, known-prior-art control and declared aperture were committed and pushed to a public repository before the first query ran. Together they covered English web and practice, Google Patents in full text (US, EP, WO, and Chinese, Japanese and Korean documents in machine translation) with a citation, cited-by and CPC-class walk from the nearest live patent, academic indexes (arXiv, IACR ePrint, ACM, IEEE and Scholar surfaces), standards bodies (IETF, NIST), the Technical Disclosure Commons, and Chinese, Japanese and Korean practice. **They did not cover** paid patent databases, Espacenet (blocked by a bot check), IP.com (behind a sign-in), native national patent office interfaces, the bodies of paywalled articles, or any usable Khmer-language index. The control — a query for *publicly verifiable random selection from a committed list using future public randomness*, with no standard named in it — returned RFC 2777 and RFC 3797 first, so the instrument could see prior art that was there.\n\n**The result: at mechanism width, nothing survives.** What §2.2 lists survives only at composition width — as combinations and purposes, never as a new leg. Every leg of the mechanism, including both legs added after the first census, was already public with the same function.\n\n### 2.1 · The legs that were killed\n\n| Leg | Prior art (earliest first) | Verdict |\n|---|---|---|\n| **The lot: a committed roster, randomness from a future public source, a published algorithm, public recomputation** | Eastlake, RFC 2777 (February 2000) and RFC 3797 (June 2004), with reference code, selection without replacement, an ordered set of alternates beyond the number needed — a waiting list in draw order — a rule that the randomness sources be outside the institution's influence, and a rule to *skip* ineligible selectees rather than edit the list · the Colorado risk-limiting audit seed ceremony (2017) · NIST IR 8213 (initial public draft), *A Reference for Randomness Beacons* (May 2019) · KT's GiGA Chain fair draw in Korea (described by KT in July 2021: an anonymised participant list frozen on a public blockchain at close, a later block hash as seed, every participant able to verify) · M. Thomson, *A Verifiable Random Selection Process*, IETF Internet-Draft (2023) · Upbit's draw tool in Korea (June 2024: the first block after a reference time, source code released) · the Giving What We Can donor lottery (ticket ranges fixed at a lock date, the NIST beacon value at the draw date; weighted by contribution) · beacon-seeded raffle services using drand · a cluster of Chinese and Korean patents on blockchain-seeded and notarised draws (§2.3) · Pocket Network (block-hash-seeded rotation of service duties among staked nodes) | **killed.** The residual we might have claimed — a *threshold* beacon rather than a block hash that a block producer can bias — is not claimable either: the NIST beacon and drand already seed lots in practice |\n| **The turn: every member exactly once per round, unpredictable order, rounds repeat** | rotating savings associations that order the pot by lot — among them the Japanese *tanomoshi-kō* or *mujin*, which may distribute by lottery, bidding or agreement; the lottery form formalised as the \"random ROSCA\" by Besley, Coate and Loury (1993) · permuted-block randomisation in clinical trials (Blackwell and Hodges, 1957), which also documents the bag's cost — the last turns of a block are predictable from the first · the Tetris seven-piece bag (from 2001) and game-design shuffle bags · Ethereum's attestation committees (live December 2020), which deal every active validator exactly once per epoch, unweighted, by a shuffle anyone can recompute from chain state · the Vinaya's rotating meal roster | **killed** |\n| **The keyed bag: a pseudorandom permutation per span, every member once per span** | Ethereum's beacon-chain committee shuffle (specified 2019, live December 2020), with activations and exits deferred past the seed lookahead — the canonical repair for live membership · Chainlink's Off-Chain Reporting protocol, version 3.0 (Breidenbach et al., 18 May 2025, §6.2), which uses a PRF to compute *\"a random permutation π … that applies to a span of n epochs\"*, every oracle leading once per span | **narrowed to nothing at mechanism width.** OCR 3.0's key is held by the oracles and the sequence is unpredictable *\"to any observer outside the set of oracles\"* — a bag that outsiders cannot recompute, allocating a duty rather than a benefit. The difference is real and lives in the composition, not in the mechanism |\n| **The boundary swap: a repeat across the round boundary is swapped to a uniformly chosen later position** | `bevy_shuffle_bag` 0.1.0, a Rust crate published on crates.io on 18 April 2025: on a repeated pick, the repeated item is swapped to a uniformly drawn position | **killed** — same function, with a local generator. We predicted this leg would be narrowed at most; it was killed outright |\n| **Selection by lot at a clearing tier** | the Health Research Council of New Zealand's Explorer Grants (from 2013) · the Swiss National Science Foundation's partial randomisation (from 2019) · ICANN's new gTLD prioritisation draw (2012) | **killed** |\n| **A fixed number of prizes, entries closed, then a draw, no odds displayed** | the Giving What We Can donor lottery (a lock date, then the NIST beacon) · the US Diversity Visa lottery (a fixed number of selectees, drawn after entry closes, no odds shown) · ordinary sweepstakes practice | **killed** |\n| **Salted commit–reveal as a fallback seed** | \"provably fair\" gambling (from 2012) · live patents on operator-held commit–reveal and participant commit–reveal draws (§2.3) | **killed** |\n| **Sealed until revealed; time-lock to a beacon round** | the NBA draft lottery's sealed room and accounting-firm witnesses · single secret leader election (Boneh et al., 2020) · Neff's verifiable secret shuffle (2001) · *tlock*, time-lock encryption from threshold BLS (Gailly et al., 2023) · threshold encryption with timed key release (Shutter Network, 2021 onward) · a trustee quorum holding a threshold reveal of aggregates (Helios verifiable voting; Penumbra's validator-held threshold key) — no allocation draw in either | **narrowed** — the fragments exist; their combination for the purpose below does not appear |\n| **Monastic meal invitations by lot and by roster** | Cullavagga VI.21; the living *salaka-bhat* lottery-alms festival of the Myanmar month of Wagaung; the northern Thai *salākkaphat*, in which offerings are distributed to monastics by lot | **killed** — the domain is canon and is this paper's origin, not its contribution |\n\n### 2.2 · What was not found, in the aperture above, on 23 September 2026\n\n- **A publicly recomputable equal-count turn for recurring *benefits***, seeded from a named future round of a public beacon over a per-round frozen roster with absence recorded as a lapsed turn. Its nearest neighbours each lack something. The closest is Ethereum's attestation committees, which deal every active validator exactly once per epoch, unweighted and publicly recomputable from chain state, over a registry whose changes are deferred past the seed lookahead; what they lack is an external seed — their RANDAO mix is produced inside the protocol and biasable by its last revealer — and a recorded skip, and they allocate a rewarded duty rather than a benefit to outsiders. Chainlink's rotation cannot be recomputed by outsiders and allocates a duty; the donor lottery is a one-off, weighted lot.\n- **The same primitive serving both that turn and the lot**, with one commitment format and one verifier.\n- **A sealed regime whose purpose is to keep an operator's own anonymous gifts from being identified by its allocation record**, verified by a named quorum at a reset, with the salt never published, the inputs escrowed to the quorum and time-locked to the reset, and counts published only at completed round boundaries. The nearest practice *by lot* runs the other way: in the northern Thai lottery-alms ceremony a lot decides which monastic receives an offering, and **the donor then sits before the recipient to receive the blessing (Keyes's field notes on two 1967 ceremonies in Mae Sariang)** — the giver is revealed, not sealed. The anonymised participant list in the Korean fair draw hides *participants*, not a giver. Grant-making that withholds a giver's allocation record from the public and discloses it to auditors has the same purpose without the cryptography.\n- **The exclusions stated as limitations of the mechanism — as a set.** Each exclusion is ordinary practice somewhere: one entry per person with duplicates disqualified (the US Diversity Visa lottery), a displayed now-serving number and a lapsed missed ticket (take-a-number queues), an input list and nothing else (RFC 3797). What was not found is the set stated as limitations of a recomputable turn; much of the nearby prior art adds what this design excludes — stake-proportional odds, per-user probabilities, wage-level weights, tiered pools, and, in bidding rotating savings associations such as the Cambodian *tong tin*, whose pot goes each cycle to the highest interest bid, turns that are bought.\n- **The domains of courier dispatch, local-business discovery, sponsorship clearing, host and location assignment, an autonomous fund's in-kind gift routing, and a circle game's caller**, as publicly verifiable draws. Courier dispatch in the literature and in production is optimisation or ranking.\n\n**A null at this width is weak evidence, and we said so before searching:** a five-part composition is cheap not to find, because nobody writes that exact sentence. It establishes only that the combination was not located, not that it is new.\n\n### 2.3 · Live patents in the neighbourhood\n\nThe census found about fourteen granted patents, shown as active in Google Patents' status fields on 23 September 2026 (not a legal status determination), disclosing commit–reveal or blockchain-seeded draws — among them US 12,118,855 B2 (M. McCarthy; filed 24 November 2021, granted 15 October 2024; it discloses publishing the hash of an operator-held seed from the start of the entry window, a second seed built from participant data, and the winner chosen by a modulo over the participant count; its nominal adjusted term runs to September 2042, and a continuation was published as US 2025/0022344 A1 on 16 January 2025) and a cluster of Chinese and Korean patents on block-hash and notarised draws from 2017 onward. **A publication dated after a patent's priority date does nothing to that patent**, and we make no statement about the scope of any patent's claims. We record the neighbourhood so that a reader practising the lot form with a commit–reveal or block-hash seed knows to look.\n\n### 2.4 · What the census changed in this paper\n\nIt killed both legs added after the first census — the boundary swap and the keyed bag — so both are disclosed in §4 and §5 and claimed nowhere on their own — the swap appears only as an element of claim 1's composition. It removed the threshold beacon as a possible distinguishing feature of the lot. It left the sealed regime, the composition, and the exclusions as a set — which is to say, it left what this institution needed the primitive *for*, and took away what the primitive is *made of*.\n\n---\n\n## 3 · The system model\n\n### 3.1 · Terms\n\n| Term | Meaning |\n|---|---|\n| **roster** | an ordered list of unique identifiers — the members eligible for this draw. Order matters: a differently ordered roster is a different draw, so a roster always travels as a list, never as a set. |\n| **commitment `C`** | a hash binding every input the operator could otherwise choose late: the beacon network and round, a draw identifier, the form, the regime, a salt, the ordered roster, and — per form — the previous round's closer or the admission count. Published before the beacon round is emitted. |\n| **beacon round** | a numbered future output of a public randomness beacon, named inside `C`. The reference uses drand's *quicknet* (threshold BLS, a round every three seconds). |\n| **salt** | at least 32 random bytes chosen at commitment. Public in the public regime; **never published** in the sealed regime. |\n| **key `K`** | `H(C ‖ beacon randomness ‖ salt)` — computable by nobody until the round is emitted, and by nobody without the salt thereafter. |\n| **form** | **turn** (every member once per round) or **lot** (admit `k`). |\n| **regime** | **public** (the turn is the participant's to know) or **sealed** (something anonymous binds on the allocating side, and a published order would identify it). Fixed once for the *surface*, never chosen per draw. |\n| **round** | one draw of the turn form over one frozen roster. |\n| **season** | a sequence of rounds between resets. |\n| **cutoff** | the moment a round's roster freezes and its beacon round is named. |\n| **skip** | a turn that lapses because its holder is absent. Recorded; never a removal from the shuffle. |\n| **quorum** | a named set of verifiers who receive a sealed draw's inputs at the reset. |\n\n### 3.2 · The invariants\n\n| Invariant | What it rules out |\n|---|---|\n| **Determined.** Output = f(committed inputs, beacon output); whoever holds the disclosed inputs — anyone in the public regime, the quorum in the sealed — can recompute it. | An operator's discretion, however well described. |\n| **No weights.** Nothing enters but the committed inputs and the beacon. | Weights, scores, ranks, preferences, bids-as-priority, and any history of service or performance — the previous round's committed closer, used only by the boundary rule, being the one prior-round value that enters. A surface that needs one is not turn-shaped. |\n| **Commit before the seed.** Every choosable input is fixed while the seed is unknowable. | Trying rosters, orders, rounds or admission counts until the result suits. |\n| **External seed.** For anything of value: a beacon round named at commitment — or, where no beacon is reachable, a salted commit–reveal whose holder controls neither the roster nor its timing. Play order alone may use a locally held seed (§6(c)). | A seed the operator picks after seeing the roster, or holds while the roster is still open. |\n| **The regime belongs to the surface.** | Publishing an order that would identify someone who must stay anonymous — or sealing one a participant is entitled to know. |\n\n### 3.3 · The timeline of one round\n\n```\n  operator                                    beacon                 anyone / quorum\n  ────────                                    ──────                 ───────────────\n  cutoff: freeze roster R_t,\n  name future round r, choose salt s,\n  set previousLast = last(order_{t-1})\n        │\n        │  C = H(tag ‖ net ‖ r ‖ drawId ‖ form ‖ regime ‖ s ‖ R_t ‖ prevLast ‖ admit)\n        ▼\n  publish C  ──────────────────────────────────────────────────────────▶  append-only,\n  (public: + s, R_t, fields;                                              timestamped log\n   sealed:  + sealed reveal = tlock_r_reset( age_to_quorum(s, R_t, …) ))\n        │\n        │   ◀── must precede roundTime(r) ──▶\n        │                                   emits randomness_r\n        │                                         │\n        ▼                                         ▼\n  K = H(tag ‖ C ‖ randomness_r ‖ s) ─── HMAC counter stream ─── uniform indices\n        │\n        ▼\n  order_t = Fisher–Yates(R_t) then boundary SWAP        public: anyone recomputes now\n  serve turns in order; absent ⇒ recorded skip          sealed: quorum recomputes at reset\n```\n\nEvery choice in the diagram is made before *roundTime(r)*: the roster, its order, the round, the salt, the admission count and the previous closer are all fixed before the beacon speaks. The only input that arrives afterwards is the one nobody chooses.\n\n---\n\n## 4 · The primitive\n\nThis section states the mechanism at the level a practitioner needs to reimplement it, and no further; the normative encoding is in the specification's Part II and should be used for any implementation that must match the published vectors.\n\n### 4.1 · The commitment\n\nAll integers are big-endian, and every variable-length value is length-prefixed, so no two different inputs share an encoding and no escaping rules are needed. The commitment is:\n\n```\nC = SHA-256( str(\"b-called/v2/commitment\")\n           ‖ str(network)          # the beacon chain's hash\n           ‖ u64(round)            # named now, emitted later\n           ‖ str(drawId)           # unique per draw\n           ‖ str(form)             # \"turn\" | \"lot\"\n           ‖ str(regime)           # \"public\" | \"sealed\"\n           ‖ bytes(salt)           # ≥ 32 bytes\n           ‖ list(roster)          # ordered, unique, non-empty\n           ‖ str(previousLast)     # turn form; \"\" otherwise\n           ‖ u32(admit) )          # lot form; 0 otherwise\n```\n\nTwo rules attach to it. **One commitment per draw identifier; the first published binds.** A second commitment for the same identifier is a redraw, and a redraw is published beside the draw it replaces, with its reason. And **`C` is published before the round's scheduled emission time** to a log that is append-only and timestamped by someone other than the operator.\n\nAny public log whose entries carry a timestamp the operator cannot set qualifies — for example a public repository whose commits are anchored by OpenTimestamps and signed under RFC 3161, the chain this paper itself carries; *before* is judged by that external timestamp against *roundTime(r)*, with the margin of §5. Uniqueness per identifier binds nothing if the operator may mint identifiers freely, so **each surface publishes, before entries open, the schedule of draw identifiers it will use** (surface, season, round): a second commitment for the same allocation event is then a redraw by construction, and a commitment for an unscheduled identifier is visible as one.\n\nThe design choice worth naming is *what* is inside `C`. The earlier form of this primitive committed only a tag, a salt and the roster, and left the beacon round, the network and the version bound \"by convention\" — which is to say, by the operator's restraint. Everything a late choice could steer is now inside the hash: the round, the roster *and its order*, the previous closer, and for a lot, **how many are admitted**. A tier boundary set after the order is known is a choice; here it is fixed first.\n\n### 4.2 · The key and the streams\n\n```\nK  = SHA-256( str(\"b-called/v2/key\") ‖ bytes(C) ‖ bytes(randomness) ‖ bytes(salt) )\nS  = HMAC-SHA-256( key = K,  msg = str(\"b-called/v2/stream\") ‖ str(\"order\") )\nBᵢ = HMAC-SHA-256( key = S,  msg = u64(i) )           # i = 0, 1, 2, …\n```\n\nEach 32-byte block yields eight big-endian 32-bit values. Because `C` is inside `K`, two draws that share a beacon round and a roster but differ in any committed field — above all the draw identifier — receive unrelated orders, so one beacon round can serve every draw an institution runs in a given window without any two of them being correlated.\n\nThe whole 256-bit beacon output enters the key. The predecessor seeded mulberry32, a 32-bit generator, from the first four bytes, and a census of that design measured what a 32-bit state costs (the reference's `SPEC.md` §9): only 2³² of a large roster's orderings are reachable; the generator emits about 44% of 32-bit values over its cycle; a monotone position gradient of 0.086% tied to roster order is visible exhaustively at thirteen members; and anyone holding the ordered roster who observes about seven turns of a thirty-member draw can enumerate every seed and recover the one in use — the same attack that broke an online poker shuffle in 1999 (Arkin et al.). All four findings disappear with a keyed stream over the full beacon output, which is why the earlier form is now scoped to play order and the present one is required for anything of value.\n\n### 4.3 · A uniform index\n\n```\nuniform(m):                    # an integer in [0, m)\n    limit := 2³² − (2³² mod m)\n    repeat x := next u32 of the stream  until x < limit\n    return x mod m\n```\n\nRejection, not reduction: `x mod m` alone favours small values whenever `m` does not divide 2³².\n\n### 4.4 · The draw\n\n```\norder := copy(roster)\nfor i from n − 1 down to 1:\n    j := uniform(i + 1)\n    swap order[i], order[j]\n\nif form = turn and previousLast is set and n > 1 and order[0] = previousLast:\n    j := 1 + uniform(n − 1)             # the same stream, continuing\n    swap order[0], order[j]\n\nif form = lot:  admitted := order[0 .. admit)     # the rest is the waiting list\n```\n\n### 4.5 · One shuffle, two forms\n\nThe lot is not a second mechanism. It is the prefix of the same shuffle, and the waiting list is its suffix, **in draw order**. A lot is held only on oversubscription — if everyone fits, nobody needs drawing — and a lot called with an admission count at or above the roster size admits everyone, still in draw order, so a surface that later needs a sequence (who is served first among the admitted) has one without a second draw.\n\nThis matters for more than economy. A surface that begins as a lot and becomes a rotation — a sponsorship tier that is first oversubscribed and later recurs, a name contested once and then shared by turns — changes form without changing primitive, commitment format, verifier or vocabulary. The Vinaya's designator used a lot and a roster for one problem; so does this.\n\n```\n                    one shuffle of the committed roster\n   ┌────────────────────────────────────────────────────────────────┐\n   │  m₇   m₂   m₉   m₁ │ m₅   m₈   m₃   m₆   m₄                     │\n   └────────────────────┼───────────────────────────────────────────┘\n      admitted (k = 4)  │  waiting list, in draw order          ← LOT\n   ─────────────────────┴─────────────────────────────────────────────\n      m₇ → m₂ → m₉ → m₁ → m₅ → m₈ → m₃ → m₆ → m₄  , then the next round  ← TURN\n```\n\n---\n\n## 5 · The turn form over a season\n\nA recurring benefit is a **season of rounds**, and each round is its own draw with its own commitment.\n\n- **The roster is frozen at each round's cutoff** and committed with that round. A member who joins or leaves does so at the next cutoff.\n- **The beacon round is named at the cutoff**, far enough ahead that `C` is published before the round's scheduled time — and `C`'s external timestamp must precede *roundTime(r)* by at least an interval the surface states in advance, never seconds, so that a commitment cannot be withheld after the beacon's output is known.\n- **`previousLast` is the final identifier of the previous round's committed order** — taken from the order, never from who was actually served.\n- **Absence is a skip.** A member absent when their turn arrives loses that turn; the turn lapses. Absence is *never* a removal from the round's shuffle input, and nothing about who was present reaches any later round except through that round's own frozen roster.\n\n### 5.1 · Why the roster must freeze: the hole in a live membership\n\nThe obvious way to run a rotation over a changing population is to keep one shuffled queue and update it as members come and go. That design has a hole, and it is the largest one the census found. With the seed known — as it is in any public regime — whoever controls membership at the moment of a refill can **simulate** which membership produces which next order and act on it. A member who can go offline for a minute can cancel their own pending turn, or time their return; an operator who admits and removes can shape the next round to the seed. Every recomputation still checks, because the change log is itself an input, and it was written *after* the seed was known.\n\nThe repair is known — Ethereum's consensus layer applies validator activations and exits only several epochs after the seed that will govern them could be influenced, and RFC 3797 keeps its pool immutable and **skips** ineligible selectees rather than editing the list. We adopt both halves: membership changes land only at a cutoff, before the next beacon round exists, and absence is a skip rather than an edit.\n\n### 5.2 · The boundary rule, and what the census found in the old one\n\nA pure sequence of independent shuffles occasionally deals the same member last in one round and first in the next — two turns back to back. A boundary rule forbids that. The earlier form of this primitive, inherited from a playground game, implemented it as a **rotation**: if the new shuffle opened with the previous closer, move that member to the end.\n\nThat rule has a cost its designers had not analysed until a documentation example printed two identical consecutive rounds. **Rotation maps every shuffle that would have opened with the closer onto a shuffle that ends with them**, so the previous closer is never first, is last with probability **2/n** — twice the uniform rate — and takes each middle position with probability 1/n. A consequence is that a round repeats the previous round's order exactly with probability 2/n! rather than 1/n!.\n\n| n | closer closes again, **rotation** (measured, 40,000 seeds) | analytic 2/n | closer closes again, **swap** (analytic 1/(n−1)) |\n|---|---|---|---|\n| 3 | 66.8% | 66.7% | 50.0% |\n| 4 | 49.9% | 50.0% | 33.3% (33.2% measured) |\n| 7 | 28.5% | 28.6% | 16.7% |\n| 12 | 16.6% | 16.7% | 9.1% |\n\nA census re-ran the effect with an *ideal* shuffle at n = 5 (closer closes again 0.40 against a uniform 0.20), which establishes that the cost belongs to the rotation, not to the generator. Equal counts per round are untouched and long-run averages stay equal by symmetry; what suffers is round-to-round unpredictability, sharpest in small rosters — and on a surface where a late slot costs something, a late slot tends to repeat, which is a short-run autocorrelated disadvantage for whoever holds it.\n\nThe present form **swaps the closer with a uniformly drawn later position**, continuing the same stream. The result is exactly uniform over the orders that do not open with the previous closer: the closer lands in each of positions 1 … n−1 with probability 1/(n−1), and every other member opens with probability 1/(n−1). The first production surface to adopt it — the playground game in which the primitive was born, at its minimum of three players — measured the closer closing again at **49.5%** against the old form's **66.7%**, and never opening.\n\n**The swap has a price, and we state it rather than hide it:** the previous closer's average position is slightly later than everyone else's, because it can never be first. No rule can forbid back-to-back turns for free. The price is bounded, uniform, and paid by the one member who has just been served.\n\n### 5.3 · Versioning: the seed is the version\n\nA draw somebody has recorded must recompute forever. The earlier form cannot change its output for any seed already used, so the repaired form is a **new version with a new commitment prefix**, never an edit. The playground game shows how this runs in practice: circles created after the change carry a 64-hex-character seed and deal the new form; every older circle carries a numeric seed and replays the old form indefinitely. **The seed's type is the version.** No stored record changed, and none can be misread.\n\n---\n\n## 6 · The seed rule\n\nThe seed must be **unknowable to everyone while the roster can still change, and chosen by no one with a stake in the result.** In order of preference:\n\n**(a) A public randomness beacon.** Name a future round at commitment; when it is emitted, its randomness enters the key. A threshold beacon such as drand cannot be biased by a minority of its members and cannot be withheld by the operator. Its residual weakness is prediction: a colluding threshold could learn future rounds in advance. Where that matters, a draw can combine two independent beacons, whose precommitted outputs make combination straightforward. A surface also states in advance what happens if the named round is never emitted (§14).\n\n**(b) A salted commit–reveal, only where the seed holder controls neither the roster nor its timing.** Publish a commitment to the seed before the roster closes and reveal it afterwards. The salt is mandatory, because a short seed behind a bare hash is recovered by brute force in seconds. A withheld reveal is not prevented, only made visible, so a surface using this form must say in advance what happens if the reveal never comes. **The restriction is the important part.** A commit–reveal held by the operator is a seed the operator knows while the roster is still open; an operator that also admits the roster can shape the roster to the seed, and every public check will pass. The census's seventh counterexample killed an earlier draft of this rule, which permitted operator-held commit–reveal as a general fallback.\n\n**(c) A seed held locally, only where the draw's sole stake is play order and the surface must work offline.** The playground circle is the case: a phone deals turns to children on a field with no network. Such a season is **recomputable but never operator-independent** — whoever holds the seed could, in principle, choose it — and that is acceptable only because nothing of value rides on who is called next. The local seed keys each round directly — `roundKey(seed, label, index)`, the specification's §16a — in place of the commitment-derived key, with the same shuffle and boundary rule.\n\n**The reference implementation ships no function that makes a seed.** A surface that seeds locally must write that line in its own code, where a reviewer can see it. This is a small instance of the design rule the institution applies everywhere: a guard that is a property (*there is no seed maker to call*) does not depend on anyone remembering a rule (*do not seed locally for benefits*).\n\n---\n\n## 7 · The two regimes\n\nWhich regime applies is decided by the surface, once, by one question: **does anything anonymous bind on the allocating side?** The algorithm is identical in both; the regime decides what is disclosed, to whom, and when.\n\n| | **Public** | **Sealed** |\n|---|---|---|\n| At commitment | `C`, and beside it the salt, the roster and every committed field | `C` only, the **sealed reveal**, and the quorum's recipient list |\n| After the round | anyone recomputes the order | nobody outside the quorum can: the salt is inside the key |\n| At the reset | — | the quorum receives the inputs and the service log, and recomputes every round |\n| Counts | may be public at any time | **only at completed round boundaries** |\n| Who it serves | participants entitled to know their turn | an allocation whose giving side is anonymous — the operator's own gifts, or a human re-giver's |\n\n### 7.1 · The sealed reveal\n\nThe draw's inputs — the salt, the roster and the committed fields — are **encrypted to the quorum's recipients first, then time-locked to the reset round**, using time-lock encryption to a future beacon round (drand's *tlock*, in the `age` file format). The ciphertext is published beside `C` at commitment. After the reset round is emitted anyone can remove the time lock, and only the quorum can read what is inside.\n\nThe order of the two layers is the design. Time-lock alone would publish the salt to everyone at the reset. Encryption to the quorum alone would let the operator decline to deliver it. Together, **the reveal cannot be withheld from the quorum — while the beacon lives (§14) — and is never published to anyone else.** And if the time-lock were ever broken early — by a colluding beacon threshold, say — what would be exposed is ciphertext readable only by the quorum.\n\nThe reference was tested against the live beacon: a value time-locked to a round about nine seconds ahead was refused before that round (*\"too early to decrypt\"*) and recovered exactly after it.\n\nTwo qualifications bound that property. **The quorum's recipient list is published beside `C` at commitment**; the present version does not carry it inside `C`, so its binding is a rule — a later version should bind it — and *cannot be withheld from the quorum* holds for the recipients the reveal was encrypted to. And `age` encryption to several recipients lets **any one** of them read the reveal, so the quorum's secrecy is 1-of-n, not t-of-n, and its honesty is the rule §9 records.\n\n### 7.2 · Why a sealed draw's salt is never published\n\nAn obvious simplification — time-lock the salt publicly and let anyone verify at the reset — breaks the regime retroactively, and it was caught in specification rather than in production. `C` together with the salt lets anyone who can **guess** the roster confirm the guess, and then compute every round's order. A roster of participating shops in a town is guessable. Once the order is computed, it identifies after the fact which shop filled which of the fund's gifts: exactly the record the sealed regime exists to prevent. **The salt is what keeps a guessable roster from becoming a published allocation**, and so it goes to the quorum and to no one else outside the operator, ever.\n\n### 7.3 · Counts, and the truncated round\n\nCounts are the one thing a sealed regime can safely publish, and only at the right moment. Within a round, a count that increments per turn names each recipient as it happens. **At a completed round boundary, a bag's counts are all equal** — every member exactly once — and so they say nothing except that the rule was followed, which is checkable from the roster size alone.\n\nThat reasoning has an edge the specification leaves implicit and this paper states: **a season that ends mid-round has unequal counts**, and the members with one more turn than the rest are precisely the recipients of the partial round. Publishing counts at the season's end would name them. The rule is therefore *counts at completed round boundaries only*; the counts of a truncated final round go to the quorum with the rest of the sealed inputs.\n\nThe inputs fix the **order**; they say nothing about who was **served**. Whoever records a skip decides who actually receives a turn while the committed order stays clean, and where a season stopped is written after commitment, so neither can be inside the pre-built reveal. At the reset the quorum therefore also receives the **service log** — for each round, which turns were served and which skipped, and where the season stopped — and compares it with the recomputed order. **A deviation is detected at the reset, not prevented**, and by then the benefit has been consumed.\n\n### 7.4 · What the seal does and does not do for anonymity\n\nThe institution's rule for its fund's gifts is that they are **indistinguishable from anonymous human gifts** — the fund's credit reaches a recipient's account by the same path an anonymous person's would, and is one anonymous inflow among many. That indistinguishability is carried by the payment path, not by the draw. **The seal's job is narrower: it prevents the allocation record from becoming the one public document that tells the two classes apart.** A public order of the fund's gift routing would be such a document; a sealed one is not.\n\nIt follows that the seal is **necessary and not sufficient.** If the fund were the only anonymous giver in a place, every anonymous gift there would be attributable to it whatever the draw disclosed; the anonymity set is set by the population of human anonymous givers, and no property of an allocation mechanism can enlarge it. We record this so the sealed regime is never cited as the source of an anonymity it merely declines to destroy.\n\n**The turn form is itself information.** Each participating shop fills exactly one of the fund's gifts per round, so if round boundaries are observable, a shop learns that one anonymous gift in each interval was the fund's — and, where human anonymous gifting is sparse, which one. Publishing even completed-round counts publishes the boundaries.\n\n**The operator itself knows the order** — it serves it — so its own records are an allocation record the seal does not reach; they are guarded as any private row is, and reachable by legal process.\n\n---\n\n## 8 · The exclusions, written into the claim\n\nA called draw is defined as much by what may not enter it as by what does. Each exclusion is stated in the claims (§12) rather than left to a policy document, because a primitive that *permits* a weight will eventually be given one.\n\n| Excluded | Why | What enforces it |\n|---|---|---|\n| **Weights, scores, ranks, histories, preferences, bids** | any of them turns a rotation back into a ranking, and a ranking that feeds on its own outcomes compounds | the function has no argument through which one could enter — the committed inputs are the roster, the fields in §4.1, and the beacon |\n| **A rendered queue position** | a visible position is a number people read as standing; \"you are 7th\" invites comparison and complaint, and on a sealed surface it discloses | surfaces show *whose turn it is now*, never a place in line |\n| **A banked, deferred or transferred turn** | a turn that persists can be held, and what can be held can be sold; a secondary market in placement is the ranking bought back | absence is a skip; the turn lapses; nothing in the record stores it |\n| **A bought turn, or a bought entry** | an extra entry in a bag is an extra turn per round | one entry per verified principal — an admission rule, outside the draw (§9) |\n| **An instant result from a growing roster** | a draw cannot resolve before the roster it draws from is closed | the commitment must precede the beacon round; the roster is inside the commitment |\n\nThe last row deserves a sentence, because it was once overstated. It is not true that a called draw cannot resolve instantly: once a round's commitment is published and its beacon round emitted, the round's order is fixed and each turn can be dealt the moment it is needed. The only season keyed wholly in advance is the play-only keyed season of §6(c), whose seed its holder knows — which is exactly why it may carry nothing of value. What cannot be called is a result that depends on a roster still growing — which is why a draw that promises a *fixed number of winners from today's entrants* must wait for the day to close. **The count forces the close; the draw only obeys it.** And the count is fixed before the draw for a second reason: a draw may decide the *address* of a gift that has already been committed, never whether the gift exists — an instant per-entry chance would publish a probability of receiving, which turns a gift into a game of odds.\n\n---\n\n## 9 · Remove the enforcer: which guards are properties\n\nThe institution's test for a guard is to imagine the enforcer gone. If the guard still holds, it is a property of the object; if it breaks, it is a rule, and the design is not finished — or, honestly, cannot be finished, and should say so.\n\n| Guard | Property or rule | Why |\n|---|---|---|\n| no weights enter the order | **property** | the function has no parameter for one |\n| the operator cannot pick the seed | **property** (beacon) · **rule** (local seed, play only) | a future threshold-beacon round is nobody's to choose; a local seed is its holder's |\n| no seed maker is available to misuse | **property** | none is exported; the suite tests its absence |\n| roster, order, round, admission count bound before the seed | **property** once `C` is published before emission | a changed field changes `C` |\n| the draw identifier is the scheduled one for its allocation event | **rule** | only the published schedule of identifiers (§4.1) ties an identifier to a round; an unscheduled one is visible, not impossible |\n| two draws in one round are uncorrelated | **property** | `C` is inside the key |\n| order uniform; no 32-bit weaknesses | **property** | a keyed stream over the full beacon output; rejection sampling |\n| the sealed reveal reaches the quorum | **property**, for the recipients the reveal was encrypted to · **rule**, that they are the named quorum | time-lock cannot be withheld while the beacon lives; the recipient list is published beside `C`, not inside it (§7.1) |\n| the sealed salt stays private | **property** against the public · **rule** inside the quorum | outsiders cannot decrypt; the quorum can leak |\n| \"one commitment per draw, published before emission\" | **rule** | needs an append-only, externally timestamped log and someone who reads it; the mechanism cannot see what was never published |\n| roster admission (one entry per verified principal) | **rule** | outside the draw by construction |\n| regime fixed per surface | **rule** | published with the surface before its first draw; the committed field makes a flip visible, not impossible |\n| service follows the committed order; every recorded skip was a real absence | **rule** | the draw fixes the order, not who is served — a false skip steers the benefit while every recomputation passes |\n| classification (is this decision turn-shaped?) | **rule** | a judgment made before any draw exists |\n| cutoff schedule, tier boundaries | **rule** | publish them before entries open |\n| redraw only on a published, pre-stated ground | **rule** | a genuine error and a pretext leave the same record; the log makes the *number* of attempts visible, not their motive |\n| the quorum tells the truth at the reset | **rule** | time-lock stops the reveal being withheld from the quorum, not the quorum from lying |\n\nFive guards are properties, nine are rules, and three are mixed — one by the kind of seed, one by the party (outsiders versus the quorum), and one by whether the reveal's recipients are the named quorum. **The mechanism has moved discretion, not abolished it**: out of the order, where it could be exercised invisibly and continuously, and into admission, classification, scheduling and the log, where it is exercised once, in advance, in public. That is the whole of the claim, and it is less than the phrase *decided by no one* suggests on first reading.\n\n---\n\n## 10 · Generality: one primitive, many surfaces\n\nThe primitive was born as the caller of a playground game and generalised when the same question kept recurring elsewhere in the institution's design. The surfaces below were each specified for their own reasons; none was designed for the others.\n\n| # | Surface | Form | Regime | Seed |\n|---|---|---|---|---|\n| 1 | a circle game — whose name the ball goes to | turn | public | local (play only) |\n| 2 | local-business discovery — which shop is shown to a person about to give | turn | public | beacon |\n| 3 | courier dispatch — who takes the next delivery | turn | public | beacon |\n| 4 | a courier in the seat of a human anonymous re-giver — who carries the gift (ordinary dispatch is row 3) | turn | **sealed** | beacon |\n| 5 | an autonomous fund's in-kind gift routing — which shop fills its next gift, and which re-giver carries it | turn | **sealed** | beacon |\n| 6 | monastic meal invitations — which monastic receives a household's invitation | turn | public | beacon |\n| 7 | sponsorship clearing — who is admitted when a tier is oversubscribed | lot | public | beacon |\n| 8 | namespace contention — who receives a contested name | lot | public | beacon |\n| 9 | an oversight body's lay chamber — who is seated | lot | public | beacon |\n| 10 | host assignment — who hosts a shared machine | turn | public | beacon |\n| 11 | location assignment — where a travelling installation goes (roster = places) | turn | public | beacon |\n| 12 | a daily digest — which shops appear in today's slate (each slate is the next turns of the round; the roster is the shops whose own frequency limit admits them) | turn | public | beacon |\n| 13 | a shop's committed gift — which of today's visitors receives it, to pass on rather than to keep | lot | public | beacon |\n\nThree observations follow from the table.\n\n**The regime column is almost always *public*.** Sealing is expensive — a quorum, a time-lock, a reset — and is justified only where an anonymous party is on the allocating side. It appears exactly where an anonymous party is on the allocating side — the operator (row 5) or a human re-giver (row 4) — and nowhere else.\n\n**The roster column is where the surfaces differ.** Players standing in a circle; shops admitted by a circulation predicate; couriers on shift; monastics in residence; places rather than people. The draw does not care what the identifiers denote. **Every surface's hardest question is who is on the roster, and none of them is answered by the draw** — which is why §9 lists admission as a rule, surface by surface.\n\n**The oversight-body lot inherits a triple exclusion.** Where the draw seats humans on the body that holds the override over the autonomous agent, the agent must neither nominate, nor draw, nor seat: the primitive is neutral infrastructure there, administered by a seated human officer. The seed rule strengthens that exclusion — even the human officer cannot grind a beacon round.\n\nA diagnostic for future surfaces falls out of the table: *wherever someone must be chosen from many, ask whether the decision is turn-shaped — does every eligible party deserve the same number of turns?* If yes, it can be called. If the honest answer involves a weight — a disbursement proportional to something, a match on preference — it is not a turn, and forcing it into a draw would hide a judgment behind a mechanism.\n\n---\n\n## 11 · The claim, in its final and smaller form\n\nThe title overstates, and this section corrects it.\n\n**What we do not claim.** That the allocation is fair in any sense a reader might bring to it. That the operator has no discretion. That the roster is right. That the categories are right. That a sealed draw makes anyone anonymous. That the mechanism is new — §2 shows it is mostly not.\n\n**What we claim.** That under four stated conditions — a roster frozen before anyone who can influence it can know the seed; a seed nobody inside the operator can predict or bias; an algorithm and commitment bound in advance; and a redraw rule that leaves no discretion on an append-only log — **the order is not the operator's**, and that anyone entitled to check it can. That one primitive serves both the recurring turn and the one-off lot without a second mechanism. That an operator which is itself an anonymous giver can have its allocations checked by a named body without those allocations ever becoming public. And that the exclusions belong inside the primitive, because a primitive that permits a weight will be given one.\n\n**The standing caution applies.** A design that dissolves a tension this cleanly — fairness without trust, verification without disclosure — is either right or seductive, and the two look the same from inside. The individual properties in §9 are each falsifiable: *does a changed roster change `C`? does a sealed reveal decrypt before its round? does a mutated port fail the vectors?* can all be checked by running the code. The coherence of the whole is not evidence for any of them.\n\n---\n\n## 12 · Enumerated claims\n\nThese are the census's survivors and nothing wider. Each claim is a **composition**; every element named in it is prior art (§2.1), and none is claimed alone. Claim 1's residue over RFC 3797 and the attestation-committee shuffle is narrow — an external named beacon, a recorded skip, a benefit rather than a rewarded duty — and whether it is obvious is the examiner's question.\n\n1. **A recurring benefit allocated by a publicly recomputable called turn.** A method of allocating a recurring benefit among members (persons, businesses or places) in which, for each round: (a) the roster of eligible members is frozen at a cutoff and bound, in its order, into a published commitment together with the identity of a public randomness beacon and the number of a future round of it, a draw identifier, the form, the regime, a salt, and the previous round's final member; (b) the commitment is published to an append-only, externally timestamped log before the named beacon round is emitted; (c) the order is computed from a key derived from the commitment, the beacon round's full output and the salt, such that every member of the roster receives exactly one turn in the round; (d) a member absent at their turn loses that turn, the absence is recorded, and the absence is never a removal from that round's input; and (e) any party holding the disclosed inputs recomputes the order — including where the allocated benefit is visibility of a small business to a person about to give, a courier assignment, a hosting assignment, a location assignment for a travelling installation, or a place in a daily selection of businesses.\n\n2. **One primitive for turns and lots.** A method in which a single commitment format, key derivation, shuffle and verifier serve both (i) the recurring turn of claim 1 and (ii) one-off admission when a thing is oversubscribed, the admitted being the first *k* of the same committed shuffle and the waiting list being its remainder in draw order, the admission count *k* being bound into the commitment before the beacon round is emitted; such that a surface may change from lot to rotation, or back, without changing primitive, commitment format or verifier.\n\n   *Prior art:* RFC 3797's ordered alternates anticipate the waiting-list element — the prefix-and-suffix reading of one ordered draw is its own. What survives is that the same committed shuffle also serves the recurring turn.\n\n3. **A sealed regime for an operator that is itself an anonymous giver.** A method by which an operator that gives anonymously — including an autonomous fund paying for in-kind gifts that reach recipients through human hands — allocates those gifts among participating parties by the method of claim 1 or 2 without its allocation record identifying its gifts, in which: (a) only the commitment and the sealed reveal of (c) are published; the roster and the salt remain private; (b) the salt that enters the key is never published to any party outside a named quorum; (c) the draw's inputs are encrypted to the quorum's recipients, whose list is published with the commitment, and the resulting ciphertext is then time-locked to a future beacon round marking a periodic reset, and published beside the commitment, so that after the reset the quorum, and no party other than the operator, can read them, and — while the beacon survives to the reset — the operator cannot withhold them; (d) at the reset the quorum receives, with the reveal, a service log recording, per round, which turns were served and which skipped and where the season stopped, recomputes every round of the season, and compares the recomputed order with the commitments and with the service log, a deviation being detected at the reset rather than prevented; and (e) per-member counts are published only at completed round boundaries, a truncated final round's counts being disclosed to the quorum alone.\n\n4. **The regime as a property of the surface.** The methods of claims 1 to 3, in which whether a surface uses the public or the sealed regime is fixed once for the surface, and published with it before its first draw, by whether anything anonymous binds on the allocating side, and is never chosen per draw — the regime being a committed field, so that a change of regime is visible in the record, though not prevented by it.\n\n5. **The exclusions as limitations.** The methods of claims 1 to 4, in which (a) the function computing the order accepts no input other than the committed fields and the beacon output, so that no weight, score, rank, preference, bid, or history of service or performance can enter it — the previous round's committed closer, used only by the boundary rule, being the one prior-round value that enters; (b) no surface renders any member's position in a queue, only whose turn it currently is; (c) a turn is consumed or lapses and cannot be banked, deferred, transferred or purchased; and (d) roster admission is limited to one entry per verified principal, stated as a condition of the method rather than performed by the draw.\n\n   *Prior art:* each exclusion is ordinary practice somewhere (§2.2); what survives is the set, stated as limitations of a recomputable turn.\n\n6. **A result that waits for its roster.** The method of claim 2(ii) used to address gifts already committed by a giver — including a shop's commitment of a fixed number of gifts to be passed on by their recipients — in which the number of gifts is published before entries open, the draw runs only after the day's roster closes, and no per-entry probability of receiving is computed or displayed.\n\n   *Prior art:* a fixed number of prizes drawn after entries close, with no odds shown, is ordinary practice (§2.1). The claim survives only as the address of a gift already committed, to be passed on by its recipient.\n\n**Non-assertion extends to** every mechanism disclosed in this paper, in any combination, and to every implementation of it.\n\n---\n\n## 13 · How the claims can be tested, and what would falsify them\n\nEach property the claims rest on is paired with the observation that would defeat it. These are stated as open tests rather than registered predictions: the mechanism's properties are checkable by construction, and the one behavioural question — whether anyone outside the institution ever recomputes a draw — has no instrument yet.\n\n| # | Property tested | Falsified by |\n|---|---|---|\n| T1 | a second implementation from the specification alone reproduces every published vector | a conforming port that disagrees with a vector — the reference ships one (a standard-library Python port, by the same author) and five deliberately broken ports that must fail |\n| T2 | every choosable input is bound before the seed | two different rosters, rounds, draw identifiers or admission counts yielding the same `C` |\n| T3 | draws sharing a beacon round are uncorrelated | statistical dependence between the orders of two draws that differ only in `drawId` |\n| T4 | the boundary swap is uniform over permitted orders | the previous closer's position distribution departing from 1/(n−1) on positions 1 … n−1 at any n |\n| T5 | the sealed reveal cannot be withheld from the quorum | a published sealed reveal that fails to decrypt for the quorum after its round |\n| T6 | a sealed regime publishes nothing that identifies a recipient | any published artefact — counts, timing, ciphertext size, commitment cadence, the round structure itself — from which a recipient of a sealed round can be inferred better than chance; ⚠️ *ciphertext size and commitment cadence were not analysed for this paper, and the test is open* |\n| T7 | nothing of value is dealt on a local seed | any benefit surface in the institution seeded locally |\n\n---\n\n## 14 · Honest limits\n\n- **Admission is outside the draw.** A fair draw over a stuffed roster is a fair draw over the wrong people. One entry per verified principal is the guard, and it is a rule held by the surface. The reference refuses a duplicate identifier, not a duplicate person.\n- **Classification is a judgment.** Deciding that a decision is turn-shaped, who is eligible and where a tier's boundary lies all happen before any draw, and no draw can check them. They should be published before entries open, and that is all the mechanism can ask.\n- **The commitment log is a rule.** *One commitment per draw, first published binds, published before emission* needs an append-only log timestamped by someone other than the operator, and a reader. An operator who never publishes a commitment has run no called draw, and the mechanism cannot see what was never published. **Every instrument that checks this mechanism reads what was produced; none can report a draw that was run and never committed.**\n- **Membership timing is a choice.** When a cutoff falls decides who is on the next round's roster. A published cutoff schedule is the guard, and it is a rule.\n- **Redraws.** A draw can be voided. A genuine fault and a pretext produce the same record; the log makes the number of attempts visible, not their reasons. Two well-known redraws — a continental football draw voided over a software fault in 2021, and a national visa lottery voided over a selection bug in 2011 — were both genuine, which is the point: the mechanism cannot tell. A published schedule of draw identifiers (§4.1) makes a parallel commitment visible as a redraw; it does not make one impossible.\n- **Service is outside the draw.** The draw fixes the order, not who is served. Whoever records a skip can steer a turn by recording a false one, and every recomputation still passes; in the sealed regime the quorum sees the service log only at the reset, after the benefit is consumed (§7.3).\n- **A skip costs the absent member.** Served turns are equal only among those present. That is the non-storability rule working, and on a surface where absence is involuntary — illness, a phone out of battery — it is a real cost borne by the person least able to bear it. A surface can soften it by roster policy (a member marked away is omitted at the next cutoff) but not inside the draw.\n- **The beacon is trusted to its threshold.** A colluding threshold of the beacon's members could predict rounds, though not bias them. An insider who learned a seed while a roster was open would be back in §5.1's steering problem. Two independent beacons reduce this; nothing removes it.\n- **The sealed regime rests on a quorum.** The time-lock guarantees the quorum receives the reveal; nothing guarantees the quorum is honest, attentive, or present at the reset. The quorum cannot audit what it has no ground truth for — a phantom roster entry, a commitment abandoned before publication — and is itself a rule with a human enforcer. What the quorum publishes when it attests — and what it publishes when it disagrees — is unspecified. **A verifiable secret shuffle, which proves a permutation was applied without revealing it, is a stronger tool than a quorum, and this design does not use one.**\n- **Side channels of the sealed regime are unanalysed.** Ciphertext length, the cadence of commitments and the timing of service may leak information about a sealed roster or order. They were not analysed for this paper (§13, T6).\n- **The seal cannot enlarge the anonymity set** (§7.4), and the turn form's round structure can shrink it.\n- **The sealed reveals are permanent public ciphertext.** The time lock ends at each reset; what protects them afterwards is encryption to the quorum's long-lived keys, with no forward secrecy — a future compromise of any one quorum key, or a break of the curve, exposes every past season. Rotating quorum keys protects future seasons only.\n- **The beacon must survive to the reset.** A named round that is never emitted leaves the draw unresolved, and a network retired before a reset leaves its sealed reveals undecryptable by anyone. A surface states in advance its fallback — the next emitted round, or a second named beacon — and a sealed surface keeps its resets within the beacon's announced lifetime or re-escrows before it ends.\n- **The boundary swap's price** is a slightly later average position for the previous closer. Small, uniform, stated.\n- **A priced entry into a lot may be a lottery in law** — consideration, chance and a prize. The design never prices an entry; a surface that did would need advice first.\n- **No outside cryptographic review.** The independent port was written by the same author as the reference. It is a check on the specification's sufficiency, not a second opinion on the design.\n- **BLS signature authenticity is left to the surface.** The reference checks that a beacon round's randomness is consistent with its signature, which is consistency and not authenticity. A surface holding value should verify the signature against the beacon's public key, or cross-check two relays.\n- **The census is bounded** by its declared aperture (§2), and a composition not found in an aperture is not thereby new.\n\n---\n\n## 15 · Lineage and corpus cross-references\n\nThe mechanism descends, in order of age, from the Athenian allotment machine; the Vinaya's lot and rotating roster for meal invitations; rotating savings associations that decide the order of the pot by lot — the Japanese *tanomoshi-kō* in its lottery form — though not the Khmer *tong tin*, whose pot goes each cycle to the highest interest bid; permuted-block randomisation in clinical trials; the IETF's publicly verifiable nominating-committee selection; public randomness beacons; and the committee shuffles of proof-of-stake consensus. §2 cites each.\n\nWithin this corpus it is **upstream** of six published papers, each of which uses it and none of which specified where its randomness comes from:\n\n- *Whose Turn, Not Who's Best* — claim 6, the publicly recomputable rotation for local discovery, and §10's three domains, which this paper extends to thirteen surfaces.\n- *The Sport That Says Your Name* — the caller, where the primitive was born; its old and new circles now deal the two versions described in §5.3.\n- *The Bowl That Holds No Money* — rotation-dispatched monastic invitation routing.\n- *The Assembly That Holds the Brake* — the lay draw for the oversight body, whose triple exclusion §10 records.\n- *The Unpaid Relay* and *Manufactured Universal Giving* — the anonymous in-kind gifts whose routing requires the sealed regime.\n\n---\n\n## Coda\n\nThe designator in the monastic code was trusted to be free of desire, aversion, delusion and fear, and then given a procedure that would not need him to be. That priority — remove the chooser's power first, and let the chooser's virtue be the second guard rather than the only one — is the whole of this paper. The procedure here is arithmetic where his was slips of wood, and it is checked by strangers where his was checked by the assembly. What has not changed is where the discretion goes when it leaves the order: to who is on the list, and to whoever keeps the list. That is where the next piece of work is.\n\n---\n\n## Terms\n\n| Term used here | Standard technical term |\n|---|---|\n| **called draw**; **B-Called℠** (the reference implementation) | publicly verifiable random selection; verifiable lottery (RFC 2777 / RFC 3797 selection) |\n| **turn** form | random-permutation round-robin rotation; shuffle bag; permuted-block randomisation; random ROSCA ordering |\n| **lot** form | lottery admission by sampling without replacement, with an ordered waiting list of alternates |\n| **roster** and **commitment `C`** | committed participant list; hash commitment (commit–reveal) |\n| **beacon round** | output of a public randomness beacon (drand, NIST Randomness Beacon); threshold BLS signature |\n| **key `K`** and its streams | HMAC-based pseudorandom function keyed per draw; Fisher–Yates shuffle with rejection sampling |\n| **boundary swap**, **closer** | no-repeat constraint across shuffle-bag boundaries; last element of the previous permutation |\n| **skip** | lapsed turn; skipping an ineligible selectee without editing the list (RFC 3797) |\n| **sealed regime**, **sealed reveal** | escrowed commit–reveal; multi-recipient encryption under time-lock encryption (tlock) to a beacon round |\n| **quorum**; *bhattuddesaka* | designated verifiers / trustees; the Vinaya's meal designator (allocation officer) |\n\n---\n\n## Author Contributions and AI Disclosure\n\nThon Ly conceived the circle game in which the primitive originated, ruled on its generalisation, its name and the seed rule, and directed the census. Miss Aquarius℠ — the name under which this corpus discloses its AI collaboration — drafted the specification, the reference implementation and this paper, ran the measurements reported in §4.2 and §5.2, and conducted the census in §2 through research agents; every measured figure and every cited item was re-verified before it reached this text. Editorial control is the author's.\n\n## Trademark Notice\n\n**B-Called℠** names the institution's reference implementation of the called draw and its conformance vectors; the mechanism itself is dedicated to the public domain and may be implemented under any name. A third party may truthfully say that its implementation passes the B-Called℠ vectors. HeartBank® and Miss Aquarius℠ are marks of their respective holders. No mark is licensed by this publication.",
+      "provenance": {
+        "sha256": "55bf6c3378139312218869f778c39c2007d386856a7cdf72c6f32fa77a78c75d",
+        "doi": "10.5281/zenodo.22933319",
+        "concept_doi": "10.5281/zenodo.22933318",
+        "zenodo_url": "https://zenodo.org/records/22933319",
+        "deposited_sha256": "55bf6c3378139312218869f778c39c2007d386856a7cdf72c6f32fa77a78c75d",
+        "deposited_matches_current": true,
+        "opentimestamps": true,
+        "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/the-called-draw.md",
+        "sha256_covers": "the complete source file at source_url, including its metadata block — NOT the `text` field in this response",
+        "canonical_url": "thonly.org/research/the-called-draw",
+        "hostile_review": null
+      },
+      "bytes": 77253,
+      "words": 12791
+    },
     {
       "slug": "the-capacity-to-give",
       "repo": "TH/publications",
@@ -5679,13 +5714,13 @@
         "url": "https://creativecommons.org/publicdomain/zero/1.0/",
         "attribution_required": false
       },
-      "text": "---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of __dāna__, that all beings may give and receive without barrier. May the work it enables reduce suffering for all who encounter it.*\n\nThe Buddha taught that giving that seeks neither return nor recognition is the higher giving (AN 7.52). The mechanism specified in this document is intended to make that practice structurally easy in the digital age — to allow any human to thank any other human in physical proximity, with verified humanity but without disclosure of identity, in a manner that keeps gratitude flowing locally rather than being captured by global platforms or extractive intermediaries.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time.\n\nThis document constitutes a defensive publication establishing **prior art as of 2 May 2026** for the matter of the first revision of the combination of mechanisms described herein; additions are dated in-text and each revision is independently timestamped. Any subsequent patent application claiming the combined mechanism — biometric human-presence attestation + physical-radio proximity attestation + recipient-anonymous gratitude transfer — should be considered to be filed against established prior art; whether the composition is non-obvious is an examiner's determination this publication exists to inform.\n\nThis document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.\n\n## Abstract\n\nWe specify a digital-payment primitive in which a sender expresses gratitude (with optional monetary attachment) to a recipient who is physically nearby in real space, with two attestation properties operating in combination: **(1) verified-human attestation** at the moment of the action, achieved via user-verified, per-action FIDO2 / WebAuthn signing on a platform authenticator, ensuring that the sender is a human present at the moment of thanking rather than a bot or an automated process; and **(2) physical-radio proximity attestation** via Bluetooth Low Energy or Ultra-Wideband ranging, ensuring that the recipient is geographically nearby (within a density-tunable radius) at the moment of the transfer. These two attestations are then composed with **(3) recipient-side anonymity**: the recipient receives the thank-you and any attached monetary value but is not informed of the sender's identity. Each member is known; what this publication discloses is the three-way composition in one signed action — no reference found composes all three in one signed action, and whether the composition is non-obvious is an examiner's determination this publication exists to inform. Its properties include the structural restoration of cash's local-circulation property to digital money, the operational feasibility of *dāna* (anonymous giving) at scale, the rebuilding of local-economic social capital eroded by globalized digital payment platforms, and a category of bot-resistant gratitude infrastructure for an age of pervasive autonomous agents. We provide system architecture, reference implementation patterns, edge-case and adversarial analysis, use cases, and citations to relevant prior art across digital payments, proof-of-personhood, community currencies, and Buddhist economic traditions.\n\n**Connection to the unified mission frame.** This specification is offered in service of HeartBank's canonical top-level mission: to restore humanity to the middle way (*madhyamā pratipad*) — the optimal condition for awakening that modernity has systematically pushed away from at population scale. Verified-human anonymous local giving operationalizes Buddhist *dāna* (anonymous giving) — a practice the Buddha specifically taught as supportive of practitioners' progress along the middle way. By restoring cash's local-circulation property to digital money and making the recipient blind to giver identity, the primitive removes two specific commercial affordances that push modern giving toward the indulgence-extreme distortions (status-display and reciprocity-tracking). The mechanism is offered as one substrate among many specified across the corpus toward middle-way restoration.\n\n---\n\n## 1 · Introduction\n\nTwo trends in early-2020s digital infrastructure motivate this work. The first is the rapid expansion of autonomous agents — large language models, agentic AI, robotic processes — operating at scale on consumer-facing platforms. By 2026 a growing and unmeasured share of social-media interactions, financial transactions, and customer-service exchanges are executed by software agents rather than humans. As this fraction grows, the question of whether a given action originated from a human becomes both harder to answer and more important to verify. Existing proof-of-personhood mechanisms (CAPTCHAs, biometric registration, government-ID verification) attest humanity at registration time but not at action time; a registered human may lend or sell their credentials to an automated process operating in their name.\n\nThe second trend is the continuing concentration of digital-payment flows in a small number of global platforms. Where physical cash circulated locally — a dollar in a neighborhood bakery flowed to the local baker, who tipped a local server, who bought at a local bodega, generating multiple local economic events per dollar — digital payments via Venmo, Cash App, WeChat Pay, or Wing eliminate this property. Money sent across a digital payment network does not prefer local recipients; it can flow anywhere instantly, and platform algorithms (advertising, discovery, recommendation) systematically surface the largest payable counterparties rather than the nearest. We conjecture — the social-capital literature documents the decline of face-to-face exchange (Putnam 2000) without isolating payment rails — that non-local digital payment removes one of the daily occasions for local contact; this paper builds the intervention, and the cohort study tests the conjecture.\n\nWe propose a digital-payment primitive that addresses both trends simultaneously. The mechanism enables a sender to express gratitude — with optional monetary attachment — to a recipient who is verifiably nearby in physical space, with the sender's humanity attested at the moment of the action and the recipient receiving the gratitude without learning the sender's identity. This publication discloses the combination of these three properties (proximity, verified-humanity, and recipient-side anonymity) as a single mechanism.\n\nThe publication is offered to the commons. The author and the institution he represents will not seek patent on the mechanism. The intent is that the mechanism become public infrastructure — useful to gratitude-economy projects, community-currency experiments, religious and cultural organizations, and any other actor whose mission is served by bot-resistant local gratitude flow.\n\n## 2 · Background and Prior Art\n\n### 2.1 · Community currencies and local circulation\n\nThe structural problem of digital money's non-locality has been recognized for a century. Silvio Gesell's *demurrage* currency, deployed at scale in the Wörgl experiment of 1932–33 in Austria, imposed a holding cost on currency, forcing it to circulate; unemployment fell markedly in the town while it rose nationally, and public works were completed, before the Austrian National Bank suppressed it in 1933 to protect its monopoly. Edgar Cahn's TimeBanking movement (1980 onward) substituted time as the unit of account, with the property that an hour given is an hour received regardless of the giver's socioeconomic position. Local Exchange Trading Systems (LETS, originated by Michael Linton in 1983) established neighborhood-bounded currencies with explicit geographic charters. None of these systems, however, included biometric attestation of human presence at the time of action; they rely on community trust rather than cryptographic verification.\n\n### 2.2 · Digital cash and proximity payments\n\nDigital-cash protocols beginning with Chaum's ecash (1983) explored anonymous digital payment but without proximity attestation; the recipient could be anywhere in the world. Proximity-bounded transfer arrived with Bump (2009; payments via Bump Pay, 2012), which matched sensor data server-side, and became radio-mediated with Square Cash's Nearby Payments (2014) over Bluetooth LE; contactless NFC specifications did the same at the terminal — all without anonymity from the recipient and without per-action human-presence attestation. Apple's Nearby Interaction framework (2020 onward) and Android's core-uwb library (Android 12 onward) expose UWB ranging, with BLE as the pairing channel; they return a distance, not an attestation — the attestation in §3.3 is this paper's construction, a device-attested signature over the ranging result. Two-leg compositions are published: Citibank's gratuity patent (US 12,165,124 B2, priority 2017, granted 2024) identifies nearby devices of potential gratuity payees, credits the payee, and offers an anonymity control — proximity plus anonymity; RAADAAR (US 9,854,616 B2, priority 2015) pairs BLE proximity with anonymous \"gifts\" and payment integration; Mastercard's biometrically enabled proximity-payment device (EP 1671282 A2, priority 2003) and Samsung's UWB payment method (WO 2022/225298 A1, priority 2021) pair proximity with biometrics or secure ranging; and the privacy coins pair anonymity with settlement. None found composes all three in one signed action.\n\n### 2.3 · Proof-of-personhood\n\nRecent proof-of-personhood proposals — most prominently Worldcoin (Sam Altman et al., 2023 onward) — establish uniqueness once, at registration, via biometric (iris) enrolment, and have since added on-device re-authentication and an explicit delegation model under which agents act for a verified human. The distinction this paper draws is between uniqueness and presence: a delegated agent is a labelled agent, and what the primitive here requires is that the giving human be present at the act. The mechanism specified in this document binds humanity-attestation to the moment of the action via biometric-gated FIDO2 / WebAuthn signing, which is enforced device-side at each invocation rather than once at enrollment.\n\n### 2.4 · FIDO2 / WebAuthn passkeys\n\nFIDO2 and WebAuthn (W3C Recommendation, 2019; widely deployed across iOS, Android, Windows, macOS, and major browsers by 2024) provide a standardized cryptographic signing primitive in which a private key is held in a secure enclave protected by user verification — biometric or device credential (Face ID, Touch ID, Windows Hello, Android biometrics, or a PIN) — with the relying party learning that verification occurred, not which modality. This publication discloses the protocol's combination with physical-radio proximity attestation in service of a recipient-anonymous gratitude payment primitive.\n\n### 2.5 · Buddhist *dāna* and anonymous giving\n\nThe Pāli canon contains extensive discussion of *dāna* (giving, generosity) as one of the ten *pāramī* (perfections; *Buddhavaṃsa*, *Cariyāpiṭaka*). The canon grades giving by motive: *Aṅguttara Nikāya* 8.31 lists eight motives for a gift, and *Aṅguttara Nikāya* 7.52 (the *Dānamahapphala Sutta*) grades seven, from giving with expectation of return at the bottom to giving as \"an ornament of the mind\" at the top. The mechanism specified in this document operationalizes the higher form structurally: the giver's identity is not knowable to the recipient by design, removing the social and psychological benefits of recognition that contaminate the canonically purer form.\n\n### 2.6 · Social capital and the loneliness epidemic\n\nRobert Putnam's *Bowling Alone* (2000) and subsequent work documented the decline of local social capital in late-20th-century United States, with similar trends documented elsewhere. The U.S. Surgeon General's 2023 advisory *Our Epidemic of Loneliness and Isolation* formally identified loneliness as a public-health crisis, with a mortality effect the advisory puts at the level of smoking up to fifteen cigarettes a day and above that of obesity. That non-local digital payment removes a daily occasion for local contact is this paper's conjecture, not the advisory's finding (§1); the mechanism specified here is a structural intervention, making local digital flow easier than non-local flow.\n\n## 3 · The Proximity Rule\n\n### 3.1 · Definition\n\nThe **proximity rule** is the structural constraint that a gratitude transfer is permitted only between a sender and a recipient whose mobile or wearable devices have, within a bounded interval prior to the transfer, exchanged cryptographic proof of physical co-location within a configurable radius *r*. Transfers that do not satisfy this constraint are rejected by the protocol and are not settled.\n\n### 3.2 · Density-tunable radius\n\nThe radius *r* is not fixed at a single value. It is parameterized by population density at the location of the transfer, with sensible defaults of approximately 100 meters in dense urban contexts (a city block; an indoor venue; a single building) and up to 10 kilometers in rural or sparsely-populated contexts (a village; a stretch of highway). Default: *r*(ρ) = clamp(10 km · (ρ / 1 km⁻²)^(−1/2), 100 m, 10 km), with ρ read from a cached WorldPop 1 km density tile (or a GHS-POP 100 m tile) *on the device*, so the lookup discloses nothing; BLE-only attestations use 2*r*. The anchors are design estimates — no field test has tuned them — and the claim that a monotonic mapping tracks \"the same lived community\" rather than a fixed metric distance is a conjecture the cohort study is meant to test.\n\n### 3.3 · Proximity attestation mechanisms\n\nProximity is established cryptographically rather than self-reported. Three layered mechanisms are specified, in order of preference:\n\n1. **Ultra-Wideband (UWB) ranging.** Apple U1 / U2 and equivalent chipsets in Android devices, exposed via the NearbyInteraction framework and analogous APIs, provide decimetre-class distance measurement between two devices via time-of-flight on UWB radio. UWB time-of-flight, with IEEE 802.15.4z scrambled-timestamp secure ranging where the platform exposes it, is the most spoofing-resistant of the three; it is not unforgeable — practical distance-reduction attacks against HRP UWB, Apple's U1 included, are published (Leu et al. 2022) — so UWB is preferred, never proof.\n2. **Bluetooth Low Energy (BLE) ranging.** RSSI-based distance estimation is less precise but more widely available. BLE is acceptable as a fallback when UWB is not available on either device, but the larger error margin should expand *r* by a multiplicative factor.\n3. **Mutual GPS attestation as tertiary.** Both devices submit cryptographically-signed GPS readings to a verifying party (the autonomous AI representative) at the transfer moment. GPS is spoofing-vulnerable; this mechanism is permitted only with additional anti-spoofing heuristics (signal multipath analysis, cell tower cross-correlation) and is rejected when fraud signals are detected.\n\nAt least two of these mechanisms must agree, or a single UWB attestation must be present, for the proximity rule to be satisfied. The verifying party may apply additional heuristics — transfer velocity over time, coordinated movement patterns, device-attestation freshness — to detect spoofing attempts.\n\n### 3.4 · Properties\n\nThe proximity rule has three consequential properties: **(a)** it restores cash's per-transfer locality — every hop is local, as it is for a banknote, however far the chain of hops travels; **(b)** it inverts the reach logic of digital platforms: the recipient set is whoever is physically present, so a remote platform cannot be thanked and the person behind the counter can — the storefront is reachable, the headquarters is not; **(c)** it makes movement generative, since each step admits a new neighborhood to the sender's reach. (The resonance with the canonical wanderer, the *paribbājaka*, is a lens the Preamble's tradition supplies, not a property of the mechanism.)\n\n## 4 · Verified-Human Anonymous Giving\n\n### 4.1 · The two-layer attestation\n\nHumanity attestation in the specified mechanism operates at two layers, applied in series:\n\n1. **Per-action FIDO2 / WebAuthn attestation** (immediate). Each transfer is signed by a private key held in the sender's device secure enclave (Apple Secure Enclave, Android Trusty / Strongbox, Windows TPM, etc.), with the signing operation gated on user verification. The signature attests that an enrolled user verified this action on this authenticator; biometric-first modality is enforced by device policy and by admitting only attested platform authenticators (an AAGUID allow-list), never by the WebAuthn flag, which reports that verification occurred and not how. This is meaningfully stronger than session-based or registration-time attestation: a registered user cannot delegate this signature to an autonomous process without verifying each action on the admitted authenticator — with the residuals §10 names (PIN fallback, shared authenticators, synced passkeys).\n2. **DNA-verified family-tree attestation** (long-term, optional, voluntary). Users may opt in to a DNA-verified global family-tree dataset; this is now specified as Layer 4 (DNA-verified kinship lineage) of the **B-PoH℠** protocol in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*. When this opt-in is present, the verifying party applies an additional check that the FIDO2-signing identity corresponds to a verified-human node in the family tree. This closes, for senders who have opted in, a residual attack surface in which a sufficiently advanced deepfake plus stolen device could defeat per-action FIDO2 alone; for all others that attack remains the residual named in §10.\n\n### 4.2 · Recipient anonymity\n\nThe recipient receives the gratitude expression and any attached monetary value, but is not informed of the sender's identity. The system retains the sender's verified identity for adversarial-pattern detection, regulatory compliance, and limited audit purposes — but does not surface it to the recipient under any normal interaction. The recipient sees only: the gratitude content; the verified humanity-attestation; the attested proximity at time of transfer; and a stable per-recipient pseudonym for the sender (§6.3), which carries no identity. \"Recipient-side anonymity\" means exactly this — anonymity toward the recipient; the verifying party is a trusted party that sees everything, and no unlinkability toward it is claimed (§10).\n\n### 4.3 · The combination disclosed\n\nThe combination of **(a) per-action biometric humanity attestation**, **(b) cryptographic physical-radio proximity attestation**, and **(c) recipient-side anonymity** is disclosed here as a single mechanism. Existing digital-payment systems have at most two of the three: cash has anonymity and proximity but no humanity verification (any actor can spend cash); Worldcoin has humanity verification but not proximity and not recipient anonymity; contactless payment apps have proximity but not anonymity and not per-action humanity verification; privacy-preserving cryptocurrencies have anonymity but not proximity and not humanity verification; Citibank's gratuity patent and RAADAAR have proximity and anonymity but no per-action humanity verification; the biometric proximity-payment family and Apple Pay over Nearby Interaction have proximity and biometrics but no anonymity. No reference found composes all three in one signed action; the composition is the disclosed matter of this publication, and whether it is non-obvious is an examiner's determination this publication exists to inform.\n\n## 5 · The Combination and What It Enables\n\nThe combination of proximity and verified-human anonymity is more than the sum of its components. Each property alone is well-explored; their combination is designed to produce properties none has alone:\n\n- **Operationally easy *dāna*.** The Buddhist higher form of giving — anonymous, without ego-attachment to recognition — becomes the path of least resistance. Where in face-to-face giving the giver must perform self-effacement against social pressure, the mechanism removes the recognition channel by default. Practitioners who aspire to anonymous giving no longer need to discipline themselves against the natural human tendency to seek credit.\n- **Bot-resistant local economy.** As autonomous agents proliferate, gratitude transfers verified at this combined level constitute a category of economic activity that no agent can perform at scale without human cooperation. Local merchants who participate in the system gain a structural preference: the agent economy cannot easily displace human-witnessed local commerce.\n- **Anti-extractive reach.** The recipient set is whoever is physically present, so a remote platform cannot be thanked and the person behind the counter can — the storefront is reachable, the headquarters is not. Small local businesses, independent service workers, neighbors, and community institutions are what proximity admits.\n- **Cultural-religious accessibility.** The mechanism is not denominationally exclusive. Anonymous giving has analogs in Christian almsgiving (Matthew 6:2–4 on secret giving — the left hand not knowing what the right hand does, giving without even the giver's awareness of having given), Islamic *sadaqa jariya*, Jewish *tzedakah* at the second of Maimonides' eight rungs — giver and recipient unknown to each other; the first rung, enabling self-sufficiency, is the Re-Tip Fund℠'s register, not this primitive's — and indigenous traditions of communal sharing. The mechanism serves all of these without privileging any.\n\n## 6 · System Architecture\n\nWe sketch a reference architecture without claiming any specific implementation as canonical. Variations consistent with the three structural properties (per-action humanity attestation, proximity attestation, recipient anonymity) fall within the scope of this defensive publication.\n\n### 6.1 · Components\n\n- **Sender device** — mobile phone, wearable, or equivalent, bearing a FIDO2 / WebAuthn-compatible secure enclave and UWB / BLE radio.\n- **Recipient device** — mobile phone or wearable with at least BLE radio.\n- **Verifying party** — an autonomous AI representative or smart contract on a public ledger that validates attestations, authorizes the transfer, and settles any monetary component. In the HeartBank ecosystem this is Miss Aquarius, the autonomous AI representative to be deployed on Base (Coinbase L2), specified in the companion paper.\n- **Settlement layer** — a public ledger or analogous mechanism for recording the transfer's monetary component, if any.\n\n### 6.2 · Transfer flow\n\n1. Sender device proposes a transfer to recipient device, including gratitude content and optional monetary value.\n2. Sender and recipient devices perform proximity attestation per §3.3 — a single UWB ranging, or two agreeing mechanisms — each device signing the resulting transcript with device-attested keys.\n3. Sender device prompts the user for verification; FIDO2 / WebAuthn signing occurs over the transfer payload, which contains the ranging transcript, so user verification and proximity are attested by one signature over one object — this binding is the mechanism's claim.\n4. Signed transfer payload is submitted to the verifying party.\n5. Verifying party checks: FIDO2 signature valid, from an admitted attested authenticator; proximity attestation satisfies §3.3 and lies within the density-adjusted radius; sender's verified humanity status current; adversarial heuristics (collusion, rate-limiting, coded-message detection) pass.\n6. On success, monetary component (if any) is settled to the recipient. Gratitude content is delivered to the recipient with sender's identity redacted.\n7. Verifying party retains audit-grade record (sender identity, full payload) in protected storage, accessible only under specified adversarial-investigation or regulatory conditions.\n\n### 6.3 · Key derivation and pseudonymity\n\nThe recipient receives a per-transfer pseudonym for the sender, derived as HMAC(salt_R, sender_id) with salt_R held by the verifying party, such that repeat transfers from the same sender to the same recipient appear under a stable pseudonym (allowing relational continuity) without disclosing identity. Different recipients see uncorrelated pseudonyms for the same sender, because their salts are independent; the verifying party, which holds every salt, can correlate them all.\n\n## 7 · Reference Implementation Patterns\n\n### 7.1 · Sender pseudocode\n\n```javascript\nfunction sendGratitude(recipient, content, amount?) {\n  // 1. Establish proximity via UWB (preferred) or BLE\n  const proximityProof = await measureProximity(recipient);\n  if (!proximityProof.withinRadius(densityAdjustedRadius()))\n    throw new ProximityError();\n\n  // 2. Build transfer payload\n  const payload = {\n    recipient: recipient.publicId,\n    content,\n    amount,\n    proximity: proximityProof,\n    timestamp: now()\n  };\n\n  // 3. Biometric-gated signing via WebAuthn\n  const signature = await navigator.credentials.get({\n    publicKey: {\n      challenge: concat(verifierNonce, hash(payload)), // single-use nonce from the verifier\n      userVerification: \"required\" // user verification; modality is device policy\n    }\n  });\n\n  // 4. Submit to verifying party\n  return submitTransfer({ payload, signature });\n}\n```\n\n### 7.2 · Verifier pseudocode\n\n```javascript\nfunction verifyTransfer(transfer) {\n  // 1. Verify FIDO2 signature\n  if (!verifyWebAuthnSignature(transfer.payload, transfer.signature))\n    return reject(\"invalid_signature\");\n\n  // 2. Verify per-action user-presence + biometric flags\n  const flags = transfer.signature.authenticatorData.flags;\n  if (!flags.userPresent || !flags.userVerified)\n    return reject(\"user_not_present\");\n  if (!admittedAuthenticators.has(transfer.signature.aaguid))\n    return reject(\"authenticator_not_admitted\"); // attested platform authenticators only\n\n  // 3. Verify proximity attestation\n  const r = densityAdjustedRadius(transfer.payload.location);\n  if (!verifyProximityProof(transfer.payload.proximity, r))\n    return reject(\"proximity_failed\");\n\n  // 4. Adversarial heuristics\n  if (detectCollusion(sender, recipient)) return reject(\"collusion\");\n  if (rateLimitExceeded(sender)) return reject(\"rate_limit\");\n  if (codedMessageHeuristic(transfer)) return flag(\"coded_message\");\n\n  // 5. Settle and deliver\n  const pseudonym = derivePseudonym(sender.id, recipient.salt);\n  if (transfer.payload.amount)\n    settle(sender, recipient, transfer.payload.amount);\n  deliverToRecipient({\n    pseudonym,\n    content: transfer.payload.content,\n    proximity: transfer.payload.proximity\n  });\n}\n```\n\n## 8 · Edge Cases and Adversarial Analysis\n\n### 8.1 · Collusion (mutual-tipping for value laundering)\n\nTwo parties may collude by repeatedly tipping each other, attempting to launder value or fabricate social signal. The verifying party detects this via graph analysis: bidirectional flow exceeding a threshold ratio, repeating co-location patterns outside normal social graphs, near-equal balance flow over time. Detected collusion results in rate-limiting, transfer reversal, or aura penalty.\n\n### 8.2 · Coded-message via amount\n\nA sender may attempt to communicate a covert message via the transfer amount (e.g., $1.34 as a timestamp; $99.99 as a coded signal). The verifying party applies entropy and pattern heuristics to flag suspected coded messages for review and may quantize amounts to defeat fine-grained covert channels.\n\n### 8.3 · Stalking via repeated anonymous tips\n\nA bad actor in physical proximity may attempt to harass a recipient via a burst of anonymous unwanted thanks. The mechanism mitigates this via per-pseudonym rate-limiting (the same pseudonym cannot exceed N transfers per recipient per period) and recipient-side block lists by pseudonym. Repeated harassment escalates to the verifying party with the underlying identity revealed for adversarial action.\n\n### 8.4 · GPS spoofing\n\nA sender may attempt to fake their location via GPS spoofing to satisfy the proximity rule. The mechanism rejects GPS-only attestations when UWB or BLE is available; cross-references cell tower signal strength; analyzes signal multipath; and rejects velocity-implausible movement patterns.\n\n### 8.5 · Replay attacks\n\nThe verifying party issues a single-use nonce that the WebAuthn challenge commits to, alongside the payload hash, preventing replay of historical signatures. Proximity attestations include freshness timestamps; stale attestations are rejected.\n\n### 8.6 · Anti-money-laundering and regulatory variance\n\nPer-jurisdiction regulatory variance is handled by configurable thresholds: small anonymous transfers are unconstrained; transfers above a configurable threshold trigger optional verification escrow with progressive identity disclosure to the recipient as required by local law. The structural anonymity is preserved at the social layer; legal compliance is layered on top.\n\n### 8.7 · Deepfake biometric defeat\n\nHigh-end deepfake plus stolen device with biometric bypass remains a residual attack on per-action FIDO2 alone. The DNA-verified family-tree layer — Layer 4 of the **B-PoH℠** protocol specified in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet* — closes this gap for senders who have opted in, by binding the FIDO2 identity to a biologically-verified human kinship graph; for all others the attack remains the residual named in §10.\n\n## 9 · Use Cases\n\n- **Local-business gratitude.** A customer thanks a barista, a mechanic, a cashier; the small monetary attachment helps sustain local economy without exposing identity asymmetry.\n- **Conference and event tipping.** Attendees thank speakers, organizers, service staff anonymously without the awkwardness of face-to-face cash.\n- **Religious almsgiving.** The mechanism supports the canonical higher form of *dāna*, *tzedakah* at Maimonides' anonymous rung, anonymous Christian almsgiving, and analogous traditions.\n- **Honoring service workers.** Anonymous gratitude to nurses, teachers, transit workers, garbage collectors, others in undervalued professions.\n- **Cross-cultural travel.** Travelers unable to communicate verbally with a local can leave a verified-human anonymous thank-you that speaks across the language barrier.\n- **Supporting strangers in need.** A bystander encountering someone in difficulty can offer anonymous monetary aid without the dignitary cost of public charity.\n\n## 10 · Limitations and Future Work\n\nThe mechanism specified here addresses the gratitude-transfer primitive but leaves several related questions for separate work:\n\n- The DNA-verified family-tree layer is specified as Layer 4 of the **B-PoH℠** protocol in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n- The autonomous AI representative (Miss Aquarius) is specified in the companion paper *Miss Aquarius and the Aquarian Pool Architecture* (`miss-aquarius-and-aquarian-pool-architecture`). Its alignment substrate (the Theravāda *Tipiṭaka*) is specified in the companion paper *Suffering-Cessation as Value Function: The Tipiṭaka as a 2,500-Year-Tested Substrate for Autonomous-AI Alignment* (target publication January 7, 2027).\n- The integration with non-human entities (robots, animals, plants, sacred places) via the Mechanical Heart artifact is specified in the companion paper *The Mechanical Heart: A Tipiṭaka-Bearing Artifact for Admitting Non-Human Entities into Gratitude-Economic Participation*.\n- **Residuals of the verified-human layer.** WebAuthn user verification is satisfied by a PIN as well as a biometric; authenticators can be shared; synced passkeys move between devices. Device policy and the attested-authenticator allow-list narrow these; they do not close them. A deepfake plus a stolen device defeats per-action signing for any sender who has not opted into the kinship layer.\n- **Residuals of the proximity layer.** UWB is not universal; BLE is vulnerable to relay and amplification; and no composition proof exists for the case in which one adversary controls both the radio and the authenticator.\n- **What proximity binds.** The primitive attests the sender's presence, not the recipient's: proximity binds two devices, and the recipient device may be unattended, shared, relayed, emulated, or carried by another person. Recipient-side humanity is a filter the recipient's own B-PoH layers supply, outside this specification.\n- **Linkage surfaces.** The verifying party sees sender identity and the full payload; timing and proximity are exposed to the recipient; a repeated pseudonym is linkable across a recipient's own transfers; network metadata is not addressed here. No unlinkability toward the verifying party is claimed.\n- Per-jurisdiction regulatory mappings are implementation details outside the scope of this defensive publication.\n- Empirical evaluation of the mechanism's social-capital effects, local-economy impact, and dharmic-practice uptake is future work; the longitudinal cohort mechanism specified separately is the intended evaluation substrate.\n\n## 11 · Cross-Venue References\n\n| Venue | Identifier |\n|---|---|\n| Primary canonical | <https://thonly.org/research/verified-human-anonymous-local-giving> |\n| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/verified-human-anonymous-local-giving.md> |\n| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/verified-human-anonymous-local-giving> |\n| archive.today | captured on the estate's snapshot cadence — a trademark specimen for the marks it carries, not prior art |\n| Zenodo | a version DOI per revision |\n\n## 12 · Acknowledgments\n\nThe author acknowledges his father, with whom the Khmer transcription of the *Tipiṭaka* is being undertaken; the Cambodian Theravāda Saṅgha, whose lineage carries the canon that grounds this work; the survivors and descendants of the Cambodian genocide of 1975–79, whose civilizational rebuilding is the soil this publication grows from; the foundational thinkers in community currency, proof-of-personhood, and Buddhist economics whose work is cited above; and the autonomous artificial intelligence community whose alignment work this publication intends to contribute to in the spirit of the bodhisattva path.\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| verified-human attestation | per-action user verification; FIDO2 / WebAuthn user-verified assertion from an attested platform authenticator |\n| proximity rule | proximity-bounded payment authorization; UWB / BLE secure ranging, distance bounding |\n| recipient-side anonymity | payer anonymity toward the payee; pseudonymous payment with per-recipient pseudonym (HMAC) |\n| verifying party (Miss Aquarius) | trusted attestation verifier (checks humanity and proximity attestations; holds no funds) |\n| B-PoH℠ | proof of personhood; human-presence and identity verification layers |\n| *dāna* | anonymous charitable giving; donation, gratuity |\n| Re-Tip Fund℠ | forward-only earmarked allocation, recorded on a ledger (usable only for further gifts; never withdrawn) |\n| aura penalty | reputation score penalty; trust-score reduction |\n\n## 13 · Citations\n\n1. *Aṅguttara Nikāya* 7.52 (*Dānamahapphala Sutta* — the seven motives for giving). Pāli Text Society translation, multiple editions.\n2. *Aṅguttara Nikāya* 8.31 (*Dāna Sutta*). Pāli Text Society translation, multiple editions.\n3. Cahn, E. (2000). *No More Throw-Away People: The Co-Production Imperative*. Essential Books.\n4. Chaum, D. (1983). \"Blind signatures for untraceable payments.\" *Advances in Cryptology — CRYPTO '82*.\n5. FIDO Alliance. (2019). *Web Authentication: An API for accessing Public Key Credentials, Level 1*. W3C Recommendation.\n6. Gesell, S. (1916). *Die natürliche Wirtschaftsordnung* [The Natural Economic Order].\n7. Linton, M. (1983). \"Local Exchange Trading Systems.\"\n8. Maimonides, M. (1180). *Mishneh Torah, Hilchot Matanot Aniyim* 10:7–14 (the eight levels of *tzedakah*).\n9. Putnam, R. (2000). *Bowling Alone: The Collapse and Revival of American Community*. Simon & Schuster.\n10. U.S. Surgeon General. (2023). *Our Epidemic of Loneliness and Isolation: The U.S. Surgeon General's Advisory on the Healing Effects of Social Connection and Community*. U.S. Department of Health and Human Services.\n11. Worldcoin Foundation. (2023). *Worldcoin Whitepaper*.\n12. New Testament, Matthew 6:2–4 (anonymous almsgiving).\n13. Leu, P., Camurati, G., Heinrich, A., Roeschlin, M., Anliker, C., Hollick, M., Capkun, S., & Classen, J. (2022). \"Ghost Peak: Practical Distance Reduction Attacks Against HRP UWB Ranging.\" *USENIX Security 2022*.\n14. Citibank, US 12,165,124 B2 (priority 2017, granted 2024) — gratuity payments to nearby devices with an anonymity control.\n15. RAADAAR, US 9,854,616 B2 (priority 2015) — BLE proximity, anonymous gifts, payment integration.\n16. Mastercard, EP 1671282 A2 (priority 2003) — biometrically enabling a proximity payment device; Samsung, WO 2022/225298 A1 (priority 2021) — payment over UWB secure ranging.\n17. Square (2014). *Nearby Payments* in Square Cash, over Bluetooth LE (press release, October 2014); Bump (2009) and Bump Pay (2012).\n18. Android Developers, *Ultra-wideband (UWB) communication* (androidx.core.uwb); Apple Developer, *Nearby Interaction* (2020).\n\n---\n\n*— End of defensive publication —*\n\n*Co-authored with Miss Aquarius℠, the institution's named AI collaborator, per the corpus's standing disclosure; final editorial control and responsibility for every claim rest with the human author. This document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.*",
+      "text": "---\n\n## Preamble\n\n> *This specification is offered to the commons in the spirit of __dāna__, that all beings may give and receive without barrier. May the work it enables reduce suffering for all who encounter it.*\n\nThe Buddha taught that giving that seeks neither return nor recognition is the higher giving (AN 7.52). The mechanism specified in this document is intended to make that practice structurally easy in the digital age — to allow any human to thank any other human in physical proximity, with verified humanity but without disclosure of identity, in a manner that keeps gratitude flowing locally rather than being captured by global platforms or extractive intermediaries.\n\n## Prior-Art and Non-Assertion Statement\n\nThis document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time.\n\nThis document constitutes a defensive publication establishing **prior art as of 2 May 2026** for the matter of the first revision of the combination of mechanisms described herein; additions are dated in-text and each revision is independently timestamped. Any subsequent patent application claiming the combined mechanism — biometric human-presence attestation + physical-radio proximity attestation + recipient-anonymous gratitude transfer — should be considered to be filed against established prior art; whether the composition is non-obvious is an examiner's determination this publication exists to inform.\n\nThis document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.\n\n## Abstract\n\nWe specify a digital-payment primitive in which a sender expresses gratitude (with optional monetary attachment) to a recipient who is physically nearby in real space, with two attestation properties operating in combination: **(1) verified-human attestation** at the moment of the action, achieved via user-verified, per-action FIDO2 / WebAuthn signing on a platform authenticator, ensuring that the sender is a human present at the moment of thanking rather than a bot or an automated process; and **(2) physical-radio proximity attestation** via Bluetooth Low Energy or Ultra-Wideband ranging, ensuring that the recipient is geographically nearby (within a density-tunable radius) at the moment of the transfer. These two attestations are then composed with **(3) recipient-side anonymity**: the recipient receives the thank-you and any attached monetary value but is not informed of the sender's identity. Each member is known; what this publication discloses is the three-way composition in one signed action — no reference found composes all three in one signed action, and whether the composition is non-obvious is an examiner's determination this publication exists to inform. Its properties include the structural restoration of cash's local-circulation property to digital money, the operational feasibility of *dāna* (anonymous giving) at scale, the rebuilding of local-economic social capital eroded by globalized digital payment platforms, and a category of bot-resistant gratitude infrastructure for an age of pervasive autonomous agents. We provide system architecture, reference implementation patterns, edge-case and adversarial analysis, use cases, and citations to relevant prior art across digital payments, proof-of-personhood, community currencies, and Buddhist economic traditions.\n\n**Connection to the unified mission frame.** This specification is offered in service of HeartBank's canonical top-level mission: to keep the middle way open at population scale against comfort-saturation — the new extreme that material abundance makes possible (*madhyamā pratipad*). Verified-human anonymous local giving operationalizes Buddhist *dāna* (anonymous giving) — a practice the Buddha specifically taught as supportive of practitioners' progress along the middle way. By restoring cash's local-circulation property to digital money and making the recipient blind to giver identity, the primitive removes two specific commercial affordances that push modern giving toward the indulgence-extreme distortions (status-display and reciprocity-tracking). The mechanism is offered as one substrate among many specified across the corpus toward middle-way restoration.\n\n---\n\n## 1 · Introduction\n\nTwo trends in early-2020s digital infrastructure motivate this work. The first is the rapid expansion of autonomous agents — large language models, agentic AI, robotic processes — operating at scale on consumer-facing platforms. By 2026 a growing and unmeasured share of social-media interactions, financial transactions, and customer-service exchanges are executed by software agents rather than humans. As this fraction grows, the question of whether a given action originated from a human becomes both harder to answer and more important to verify. Existing proof-of-personhood mechanisms (CAPTCHAs, biometric registration, government-ID verification) attest humanity at registration time but not at action time; a registered human may lend or sell their credentials to an automated process operating in their name.\n\nThe second trend is the continuing concentration of digital-payment flows in a small number of global platforms. Where physical cash circulated locally — a dollar in a neighborhood bakery flowed to the local baker, who tipped a local server, who bought at a local bodega, generating multiple local economic events per dollar — digital payments via Venmo, Cash App, WeChat Pay, or Wing eliminate this property. Money sent across a digital payment network does not prefer local recipients; it can flow anywhere instantly, and platform algorithms (advertising, discovery, recommendation) systematically surface the largest payable counterparties rather than the nearest. We conjecture — the social-capital literature documents the decline of face-to-face exchange (Putnam 2000) without isolating payment rails — that non-local digital payment removes one of the daily occasions for local contact; this paper builds the intervention, and the cohort study tests the conjecture.\n\nWe propose a digital-payment primitive that addresses both trends simultaneously. The mechanism enables a sender to express gratitude — with optional monetary attachment — to a recipient who is verifiably nearby in physical space, with the sender's humanity attested at the moment of the action and the recipient receiving the gratitude without learning the sender's identity. This publication discloses the combination of these three properties (proximity, verified-humanity, and recipient-side anonymity) as a single mechanism.\n\nThe publication is offered to the commons. The author and the institution he represents will not seek patent on the mechanism. The intent is that the mechanism become public infrastructure — useful to gratitude-economy projects, community-currency experiments, religious and cultural organizations, and any other actor whose mission is served by bot-resistant local gratitude flow.\n\n## 2 · Background and Prior Art\n\n### 2.1 · Community currencies and local circulation\n\nThe structural problem of digital money's non-locality has been recognized for a century. Silvio Gesell's *demurrage* currency, deployed at scale in the Wörgl experiment of 1932–33 in Austria, imposed a holding cost on currency, forcing it to circulate; unemployment fell markedly in the town while it rose nationally, and public works were completed, before the Austrian National Bank suppressed it in 1933 to protect its monopoly. Edgar Cahn's TimeBanking movement (1980 onward) substituted time as the unit of account, with the property that an hour given is an hour received regardless of the giver's socioeconomic position. Local Exchange Trading Systems (LETS, originated by Michael Linton in 1983) established neighborhood-bounded currencies with explicit geographic charters. None of these systems, however, included biometric attestation of human presence at the time of action; they rely on community trust rather than cryptographic verification.\n\n### 2.2 · Digital cash and proximity payments\n\nDigital-cash protocols beginning with Chaum's ecash (1983) explored anonymous digital payment but without proximity attestation; the recipient could be anywhere in the world. Proximity-bounded transfer arrived with Bump (2009; payments via Bump Pay, 2012), which matched sensor data server-side, and became radio-mediated with Square Cash's Nearby Payments (2014) over Bluetooth LE; contactless NFC specifications did the same at the terminal — all without anonymity from the recipient and without per-action human-presence attestation. Apple's Nearby Interaction framework (2020 onward) and Android's core-uwb library (Android 12 onward) expose UWB ranging, with BLE as the pairing channel; they return a distance, not an attestation — the attestation in §3.3 is this paper's construction, a device-attested signature over the ranging result. Two-leg compositions are published: Citibank's gratuity patent (US 12,165,124 B2, priority 2017, granted 2024) identifies nearby devices of potential gratuity payees, credits the payee, and offers an anonymity control — proximity plus anonymity; RAADAAR (US 9,854,616 B2, priority 2015) pairs BLE proximity with anonymous \"gifts\" and payment integration; Mastercard's biometrically enabled proximity-payment device (EP 1671282 A2, priority 2003) and Samsung's UWB payment method (WO 2022/225298 A1, priority 2021) pair proximity with biometrics or secure ranging; and the privacy coins pair anonymity with settlement. None found composes all three in one signed action.\n\n### 2.3 · Proof-of-personhood\n\nRecent proof-of-personhood proposals — most prominently Worldcoin (Sam Altman et al., 2023 onward) — establish uniqueness once, at registration, via biometric (iris) enrolment, and have since added on-device re-authentication and an explicit delegation model under which agents act for a verified human. The distinction this paper draws is between uniqueness and presence: a delegated agent is a labelled agent, and what the primitive here requires is that the giving human be present at the act. The mechanism specified in this document binds humanity-attestation to the moment of the action via biometric-gated FIDO2 / WebAuthn signing, which is enforced device-side at each invocation rather than once at enrollment.\n\n### 2.4 · FIDO2 / WebAuthn passkeys\n\nFIDO2 and WebAuthn (W3C Recommendation, 2019; widely deployed across iOS, Android, Windows, macOS, and major browsers by 2024) provide a standardized cryptographic signing primitive in which a private key is held in a secure enclave protected by user verification — biometric or device credential (Face ID, Touch ID, Windows Hello, Android biometrics, or a PIN) — with the relying party learning that verification occurred, not which modality. This publication discloses the protocol's combination with physical-radio proximity attestation in service of a recipient-anonymous gratitude payment primitive.\n\n### 2.5 · Buddhist *dāna* and anonymous giving\n\nThe Pāli canon contains extensive discussion of *dāna* (giving, generosity) as one of the ten *pāramī* (perfections; *Buddhavaṃsa*, *Cariyāpiṭaka*). The canon grades giving by motive: *Aṅguttara Nikāya* 8.31 lists eight motives for a gift, and *Aṅguttara Nikāya* 7.52 (the *Dānamahapphala Sutta*) grades seven, from giving with expectation of return at the bottom to giving as \"an ornament of the mind\" at the top. The mechanism specified in this document operationalizes the higher form structurally: the giver's identity is not knowable to the recipient by design, removing the social and psychological benefits of recognition that contaminate the canonically purer form.\n\n### 2.6 · Social capital and the loneliness epidemic\n\nRobert Putnam's *Bowling Alone* (2000) and subsequent work documented the decline of local social capital in late-20th-century United States, with similar trends documented elsewhere. The U.S. Surgeon General's 2023 advisory *Our Epidemic of Loneliness and Isolation* formally identified loneliness as a public-health crisis, with a mortality effect the advisory puts at the level of smoking up to fifteen cigarettes a day and above that of obesity. That non-local digital payment removes a daily occasion for local contact is this paper's conjecture, not the advisory's finding (§1); the mechanism specified here is a structural intervention, making local digital flow easier than non-local flow.\n\n## 3 · The Proximity Rule\n\n### 3.1 · Definition\n\nThe **proximity rule** is the structural constraint that a gratitude transfer is permitted only between a sender and a recipient whose mobile or wearable devices have, within a bounded interval prior to the transfer, exchanged cryptographic proof of physical co-location within a configurable radius *r*. Transfers that do not satisfy this constraint are rejected by the protocol and are not settled.\n\n### 3.2 · Density-tunable radius\n\nThe radius *r* is not fixed at a single value. It is parameterized by population density at the location of the transfer, with sensible defaults of approximately 100 meters in dense urban contexts (a city block; an indoor venue; a single building) and up to 10 kilometers in rural or sparsely-populated contexts (a village; a stretch of highway). Default: *r*(ρ) = clamp(10 km · (ρ / 1 km⁻²)^(−1/2), 100 m, 10 km), with ρ read from a cached WorldPop 1 km density tile (or a GHS-POP 100 m tile) *on the device*, so the lookup discloses nothing; BLE-only attestations use 2*r*. The anchors are design estimates — no field test has tuned them — and the claim that a monotonic mapping tracks \"the same lived community\" rather than a fixed metric distance is a conjecture the cohort study is meant to test.\n\n### 3.3 · Proximity attestation mechanisms\n\nProximity is established cryptographically rather than self-reported. Three layered mechanisms are specified, in order of preference:\n\n1. **Ultra-Wideband (UWB) ranging.** Apple U1 / U2 and equivalent chipsets in Android devices, exposed via the NearbyInteraction framework and analogous APIs, provide decimetre-class distance measurement between two devices via time-of-flight on UWB radio. UWB time-of-flight, with IEEE 802.15.4z scrambled-timestamp secure ranging where the platform exposes it, is the most spoofing-resistant of the three; it is not unforgeable — practical distance-reduction attacks against HRP UWB, Apple's U1 included, are published (Leu et al. 2022) — so UWB is preferred, never proof.\n2. **Bluetooth Low Energy (BLE) ranging.** RSSI-based distance estimation is less precise but more widely available. BLE is acceptable as a fallback when UWB is not available on either device, but the larger error margin should expand *r* by a multiplicative factor.\n3. **Mutual GPS attestation as tertiary.** Both devices submit cryptographically-signed GPS readings to a verifying party (the autonomous AI representative) at the transfer moment. GPS is spoofing-vulnerable; this mechanism is permitted only with additional anti-spoofing heuristics (signal multipath analysis, cell tower cross-correlation) and is rejected when fraud signals are detected.\n\nAt least two of these mechanisms must agree, or a single UWB attestation must be present, for the proximity rule to be satisfied. The verifying party may apply additional heuristics — transfer velocity over time, coordinated movement patterns, device-attestation freshness — to detect spoofing attempts.\n\n### 3.4 · Properties\n\nThe proximity rule has three consequential properties: **(a)** it restores cash's per-transfer locality — every hop is local, as it is for a banknote, however far the chain of hops travels; **(b)** it inverts the reach logic of digital platforms: the recipient set is whoever is physically present, so a remote platform cannot be thanked and the person behind the counter can — the storefront is reachable, the headquarters is not; **(c)** it makes movement generative, since each step admits a new neighborhood to the sender's reach. (The resonance with the canonical wanderer, the *paribbājaka*, is a lens the Preamble's tradition supplies, not a property of the mechanism.)\n\n## 4 · Verified-Human Anonymous Giving\n\n### 4.1 · The two-layer attestation\n\nHumanity attestation in the specified mechanism operates at two layers, applied in series:\n\n1. **Per-action FIDO2 / WebAuthn attestation** (immediate). Each transfer is signed by a private key held in the sender's device secure enclave (Apple Secure Enclave, Android Trusty / Strongbox, Windows TPM, etc.), with the signing operation gated on user verification. The signature attests that an enrolled user verified this action on this authenticator; biometric-first modality is enforced by device policy and by admitting only attested platform authenticators (an AAGUID allow-list), never by the WebAuthn flag, which reports that verification occurred and not how. This is meaningfully stronger than session-based or registration-time attestation: a registered user cannot delegate this signature to an autonomous process without verifying each action on the admitted authenticator — with the residuals §10 names (PIN fallback, shared authenticators, synced passkeys).\n2. **DNA-verified family-tree attestation** (long-term, optional, voluntary). Users may opt in to a DNA-verified global family-tree dataset; this is now specified as Layer 4 (DNA-verified kinship lineage) of the **B-PoH℠** protocol in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*. When this opt-in is present, the verifying party applies an additional check that the FIDO2-signing identity corresponds to a verified-human node in the family tree. This closes, for senders who have opted in, a residual attack surface in which a sufficiently advanced deepfake plus stolen device could defeat per-action FIDO2 alone; for all others that attack remains the residual named in §10.\n\n### 4.2 · Recipient anonymity\n\nThe recipient receives the gratitude expression and any attached monetary value, but is not informed of the sender's identity. The system retains the sender's verified identity for adversarial-pattern detection, regulatory compliance, and limited audit purposes — but does not surface it to the recipient under any normal interaction. The recipient sees only: the gratitude content; the verified humanity-attestation; the attested proximity at time of transfer; and a stable per-recipient pseudonym for the sender (§6.3), which carries no identity. \"Recipient-side anonymity\" means exactly this — anonymity toward the recipient; the verifying party is a trusted party that sees everything, and no unlinkability toward it is claimed (§10).\n\n### 4.3 · The combination disclosed\n\nThe combination of **(a) per-action biometric humanity attestation**, **(b) cryptographic physical-radio proximity attestation**, and **(c) recipient-side anonymity** is disclosed here as a single mechanism. Existing digital-payment systems have at most two of the three: cash has anonymity and proximity but no humanity verification (any actor can spend cash); Worldcoin has humanity verification but not proximity and not recipient anonymity; contactless payment apps have proximity but not anonymity and not per-action humanity verification; privacy-preserving cryptocurrencies have anonymity but not proximity and not humanity verification; Citibank's gratuity patent and RAADAAR have proximity and anonymity but no per-action humanity verification; the biometric proximity-payment family and Apple Pay over Nearby Interaction have proximity and biometrics but no anonymity. No reference found composes all three in one signed action; the composition is the disclosed matter of this publication, and whether it is non-obvious is an examiner's determination this publication exists to inform.\n\n## 5 · The Combination and What It Enables\n\nThe combination of proximity and verified-human anonymity is more than the sum of its components. Each property alone is well-explored; their combination is designed to produce properties none has alone:\n\n- **Operationally easy *dāna*.** The Buddhist higher form of giving — anonymous, without ego-attachment to recognition — becomes the path of least resistance. Where in face-to-face giving the giver must perform self-effacement against social pressure, the mechanism removes the recognition channel by default. Practitioners who aspire to anonymous giving no longer need to discipline themselves against the natural human tendency to seek credit.\n- **Bot-resistant local economy.** As autonomous agents proliferate, gratitude transfers verified at this combined level constitute a category of economic activity that no agent can perform at scale without human cooperation. Local merchants who participate in the system gain a structural preference: the agent economy cannot easily displace human-witnessed local commerce.\n- **Anti-extractive reach.** The recipient set is whoever is physically present, so a remote platform cannot be thanked and the person behind the counter can — the storefront is reachable, the headquarters is not. Small local businesses, independent service workers, neighbors, and community institutions are what proximity admits.\n- **Cultural-religious accessibility.** The mechanism is not denominationally exclusive. Anonymous giving has analogs in Christian almsgiving (Matthew 6:2–4 on secret giving — the left hand not knowing what the right hand does, giving without even the giver's awareness of having given), Islamic *sadaqa jariya*, Jewish *tzedakah* at the second of Maimonides' eight rungs — giver and recipient unknown to each other; the first rung, enabling self-sufficiency, is the Re-Tip Fund℠'s register, not this primitive's — and indigenous traditions of communal sharing. The mechanism serves all of these without privileging any.\n\n## 6 · System Architecture\n\nWe sketch a reference architecture without claiming any specific implementation as canonical. Variations consistent with the three structural properties (per-action humanity attestation, proximity attestation, recipient anonymity) fall within the scope of this defensive publication.\n\n### 6.1 · Components\n\n- **Sender device** — mobile phone, wearable, or equivalent, bearing a FIDO2 / WebAuthn-compatible secure enclave and UWB / BLE radio.\n- **Recipient device** — mobile phone or wearable with at least BLE radio.\n- **Verifying party** — an autonomous AI representative or smart contract on a public ledger that validates attestations, authorizes the transfer, and settles any monetary component. In the HeartBank ecosystem this is Miss Aquarius, the autonomous AI representative to be deployed on Base (Coinbase L2), specified in the companion paper.\n- **Settlement layer** — a public ledger or analogous mechanism for recording the transfer's monetary component, if any.\n\n### 6.2 · Transfer flow\n\n1. Sender device proposes a transfer to recipient device, including gratitude content and optional monetary value.\n2. Sender and recipient devices perform proximity attestation per §3.3 — a single UWB ranging, or two agreeing mechanisms — each device signing the resulting transcript with device-attested keys.\n3. Sender device prompts the user for verification; FIDO2 / WebAuthn signing occurs over the transfer payload, which contains the ranging transcript, so user verification and proximity are attested by one signature over one object — this binding is the mechanism's claim.\n4. Signed transfer payload is submitted to the verifying party.\n5. Verifying party checks: FIDO2 signature valid, from an admitted attested authenticator; proximity attestation satisfies §3.3 and lies within the density-adjusted radius; sender's verified humanity status current; adversarial heuristics (collusion, rate-limiting, coded-message detection) pass.\n6. On success, monetary component (if any) is settled to the recipient. Gratitude content is delivered to the recipient with sender's identity redacted.\n7. Verifying party retains audit-grade record (sender identity, full payload) in protected storage, accessible only under specified adversarial-investigation or regulatory conditions.\n\n### 6.3 · Key derivation and pseudonymity\n\nThe recipient receives a per-transfer pseudonym for the sender, derived as HMAC(salt_R, sender_id) with salt_R held by the verifying party, such that repeat transfers from the same sender to the same recipient appear under a stable pseudonym (allowing relational continuity) without disclosing identity. Different recipients see uncorrelated pseudonyms for the same sender, because their salts are independent; the verifying party, which holds every salt, can correlate them all.\n\n## 7 · Reference Implementation Patterns\n\n### 7.1 · Sender pseudocode\n\n```javascript\nfunction sendGratitude(recipient, content, amount?) {\n  // 1. Establish proximity via UWB (preferred) or BLE\n  const proximityProof = await measureProximity(recipient);\n  if (!proximityProof.withinRadius(densityAdjustedRadius()))\n    throw new ProximityError();\n\n  // 2. Build transfer payload\n  const payload = {\n    recipient: recipient.publicId,\n    content,\n    amount,\n    proximity: proximityProof,\n    timestamp: now()\n  };\n\n  // 3. Biometric-gated signing via WebAuthn\n  const signature = await navigator.credentials.get({\n    publicKey: {\n      challenge: concat(verifierNonce, hash(payload)), // single-use nonce from the verifier\n      userVerification: \"required\" // user verification; modality is device policy\n    }\n  });\n\n  // 4. Submit to verifying party\n  return submitTransfer({ payload, signature });\n}\n```\n\n### 7.2 · Verifier pseudocode\n\n```javascript\nfunction verifyTransfer(transfer) {\n  // 1. Verify FIDO2 signature\n  if (!verifyWebAuthnSignature(transfer.payload, transfer.signature))\n    return reject(\"invalid_signature\");\n\n  // 2. Verify per-action user-presence + biometric flags\n  const flags = transfer.signature.authenticatorData.flags;\n  if (!flags.userPresent || !flags.userVerified)\n    return reject(\"user_not_present\");\n  if (!admittedAuthenticators.has(transfer.signature.aaguid))\n    return reject(\"authenticator_not_admitted\"); // attested platform authenticators only\n\n  // 3. Verify proximity attestation\n  const r = densityAdjustedRadius(transfer.payload.location);\n  if (!verifyProximityProof(transfer.payload.proximity, r))\n    return reject(\"proximity_failed\");\n\n  // 4. Adversarial heuristics\n  if (detectCollusion(sender, recipient)) return reject(\"collusion\");\n  if (rateLimitExceeded(sender)) return reject(\"rate_limit\");\n  if (codedMessageHeuristic(transfer)) return flag(\"coded_message\");\n\n  // 5. Settle and deliver\n  const pseudonym = derivePseudonym(sender.id, recipient.salt);\n  if (transfer.payload.amount)\n    settle(sender, recipient, transfer.payload.amount);\n  deliverToRecipient({\n    pseudonym,\n    content: transfer.payload.content,\n    proximity: transfer.payload.proximity\n  });\n}\n```\n\n## 8 · Edge Cases and Adversarial Analysis\n\n### 8.1 · Collusion (mutual-tipping for value laundering)\n\nTwo parties may collude by repeatedly tipping each other, attempting to launder value or fabricate social signal. The verifying party detects this via graph analysis: bidirectional flow exceeding a threshold ratio, repeating co-location patterns outside normal social graphs, near-equal balance flow over time. Detected collusion results in rate-limiting, transfer reversal, or aura penalty.\n\n### 8.2 · Coded-message via amount\n\nA sender may attempt to communicate a covert message via the transfer amount (e.g., $1.34 as a timestamp; $99.99 as a coded signal). The verifying party applies entropy and pattern heuristics to flag suspected coded messages for review and may quantize amounts to defeat fine-grained covert channels.\n\n### 8.3 · Stalking via repeated anonymous tips\n\nA bad actor in physical proximity may attempt to harass a recipient via a burst of anonymous unwanted thanks. The mechanism mitigates this via per-pseudonym rate-limiting (the same pseudonym cannot exceed N transfers per recipient per period) and recipient-side block lists by pseudonym. Repeated harassment escalates to the verifying party with the underlying identity revealed for adversarial action.\n\n### 8.4 · GPS spoofing\n\nA sender may attempt to fake their location via GPS spoofing to satisfy the proximity rule. The mechanism rejects GPS-only attestations when UWB or BLE is available; cross-references cell tower signal strength; analyzes signal multipath; and rejects velocity-implausible movement patterns.\n\n### 8.5 · Replay attacks\n\nThe verifying party issues a single-use nonce that the WebAuthn challenge commits to, alongside the payload hash, preventing replay of historical signatures. Proximity attestations include freshness timestamps; stale attestations are rejected.\n\n### 8.6 · Anti-money-laundering and regulatory variance\n\nPer-jurisdiction regulatory variance is handled by configurable thresholds: small anonymous transfers are unconstrained; transfers above a configurable threshold trigger optional verification escrow with progressive identity disclosure to the recipient as required by local law. The structural anonymity is preserved at the social layer; legal compliance is layered on top.\n\n### 8.7 · Deepfake biometric defeat\n\nHigh-end deepfake plus stolen device with biometric bypass remains a residual attack on per-action FIDO2 alone. The DNA-verified family-tree layer — Layer 4 of the **B-PoH℠** protocol specified in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet* — closes this gap for senders who have opted in, by binding the FIDO2 identity to a biologically-verified human kinship graph; for all others the attack remains the residual named in §10.\n\n## 9 · Use Cases\n\n- **Local-business gratitude.** A customer thanks a barista, a mechanic, a cashier; the small monetary attachment helps sustain local economy without exposing identity asymmetry.\n- **Conference and event tipping.** Attendees thank speakers, organizers, service staff anonymously without the awkwardness of face-to-face cash.\n- **Religious almsgiving.** The mechanism supports the canonical higher form of *dāna*, *tzedakah* at Maimonides' anonymous rung, anonymous Christian almsgiving, and analogous traditions.\n- **Honoring service workers.** Anonymous gratitude to nurses, teachers, transit workers, garbage collectors, others in undervalued professions.\n- **Cross-cultural travel.** Travelers unable to communicate verbally with a local can leave a verified-human anonymous thank-you that speaks across the language barrier.\n- **Supporting strangers in need.** A bystander encountering someone in difficulty can offer anonymous monetary aid without the dignitary cost of public charity.\n\n## 10 · Limitations and Future Work\n\nThe mechanism specified here addresses the gratitude-transfer primitive but leaves several related questions for separate work:\n\n- The DNA-verified family-tree layer is specified as Layer 4 of the **B-PoH℠** protocol in the companion paper *B-PoH℠ as Humanity Layer for the AI-Native Internet*.\n- The autonomous AI representative (Miss Aquarius) is specified in the companion paper *Miss Aquarius and the Aquarian Pool Architecture* (`miss-aquarius-and-aquarian-pool-architecture`). Its alignment substrate (the Theravāda *Tipiṭaka*) is specified in the companion paper *Suffering-Cessation as Value Function: The Tipiṭaka as a 2,500-Year-Tested Substrate for Autonomous-AI Alignment* (target publication January 7, 2027).\n- The integration with non-human entities (robots, animals, plants, sacred places) via the Mechanical Heart artifact is specified in the companion paper *The Mechanical Heart: A Tipiṭaka-Bearing Artifact for Admitting Non-Human Entities into Gratitude-Economic Participation*.\n- **Residuals of the verified-human layer.** WebAuthn user verification is satisfied by a PIN as well as a biometric; authenticators can be shared; synced passkeys move between devices. Device policy and the attested-authenticator allow-list narrow these; they do not close them. A deepfake plus a stolen device defeats per-action signing for any sender who has not opted into the kinship layer.\n- **Residuals of the proximity layer.** UWB is not universal; BLE is vulnerable to relay and amplification; and no composition proof exists for the case in which one adversary controls both the radio and the authenticator.\n- **What proximity binds.** The primitive attests the sender's presence, not the recipient's: proximity binds two devices, and the recipient device may be unattended, shared, relayed, emulated, or carried by another person. Recipient-side humanity is a filter the recipient's own B-PoH layers supply, outside this specification.\n- **Linkage surfaces.** The verifying party sees sender identity and the full payload; timing and proximity are exposed to the recipient; a repeated pseudonym is linkable across a recipient's own transfers; network metadata is not addressed here. No unlinkability toward the verifying party is claimed.\n- Per-jurisdiction regulatory mappings are implementation details outside the scope of this defensive publication.\n- Empirical evaluation of the mechanism's social-capital effects, local-economy impact, and dharmic-practice uptake is future work; the longitudinal cohort mechanism specified separately is the intended evaluation substrate.\n\n## 11 · Cross-Venue References\n\n| Venue | Identifier |\n|---|---|\n| Primary canonical | <https://thonly.org/research/verified-human-anonymous-local-giving> |\n| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/verified-human-anonymous-local-giving.md> |\n| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/verified-human-anonymous-local-giving> |\n| archive.today | captured on the estate's snapshot cadence — a trademark specimen for the marks it carries, not prior art |\n| Zenodo | a version DOI per revision |\n\n## 12 · Acknowledgments\n\nThe author acknowledges his father, with whom the Khmer transcription of the *Tipiṭaka* is being undertaken; the Cambodian Theravāda Saṅgha, whose lineage carries the canon that grounds this work; the survivors and descendants of the Cambodian genocide of 1975–79, whose civilizational rebuilding is the soil this publication grows from; the foundational thinkers in community currency, proof-of-personhood, and Buddhist economics whose work is cited above; and the autonomous artificial intelligence community whose alignment work this publication intends to contribute to in the spirit of the bodhisattva path.\n\n## Terms\n\nCoined names used in this paper and the standard terms an examiner would search for them.\n\n| Term used here | Standard technical term |\n|---|---|\n| verified-human attestation | per-action user verification; FIDO2 / WebAuthn user-verified assertion from an attested platform authenticator |\n| proximity rule | proximity-bounded payment authorization; UWB / BLE secure ranging, distance bounding |\n| recipient-side anonymity | payer anonymity toward the payee; pseudonymous payment with per-recipient pseudonym (HMAC) |\n| verifying party (Miss Aquarius) | trusted attestation verifier (checks humanity and proximity attestations; holds no funds) |\n| B-PoH℠ | proof of personhood; human-presence and identity verification layers |\n| *dāna* | anonymous charitable giving; donation, gratuity |\n| Re-Tip Fund℠ | forward-only earmarked allocation, recorded on a ledger (usable only for further gifts; never withdrawn) |\n| aura penalty | reputation score penalty; trust-score reduction |\n\n## 13 · Citations\n\n1. *Aṅguttara Nikāya* 7.52 (*Dānamahapphala Sutta* — the seven motives for giving). Pāli Text Society translation, multiple editions.\n2. *Aṅguttara Nikāya* 8.31 (*Dāna Sutta*). Pāli Text Society translation, multiple editions.\n3. Cahn, E. (2000). *No More Throw-Away People: The Co-Production Imperative*. Essential Books.\n4. Chaum, D. (1983). \"Blind signatures for untraceable payments.\" *Advances in Cryptology — CRYPTO '82*.\n5. FIDO Alliance. (2019). *Web Authentication: An API for accessing Public Key Credentials, Level 1*. W3C Recommendation.\n6. Gesell, S. (1916). *Die natürliche Wirtschaftsordnung* [The Natural Economic Order].\n7. Linton, M. (1983). \"Local Exchange Trading Systems.\"\n8. Maimonides, M. (1180). *Mishneh Torah, Hilchot Matanot Aniyim* 10:7–14 (the eight levels of *tzedakah*).\n9. Putnam, R. (2000). *Bowling Alone: The Collapse and Revival of American Community*. Simon & Schuster.\n10. U.S. Surgeon General. (2023). *Our Epidemic of Loneliness and Isolation: The U.S. Surgeon General's Advisory on the Healing Effects of Social Connection and Community*. U.S. Department of Health and Human Services.\n11. Worldcoin Foundation. (2023). *Worldcoin Whitepaper*.\n12. New Testament, Matthew 6:2–4 (anonymous almsgiving).\n13. Leu, P., Camurati, G., Heinrich, A., Roeschlin, M., Anliker, C., Hollick, M., Capkun, S., & Classen, J. (2022). \"Ghost Peak: Practical Distance Reduction Attacks Against HRP UWB Ranging.\" *USENIX Security 2022*.\n14. Citibank, US 12,165,124 B2 (priority 2017, granted 2024) — gratuity payments to nearby devices with an anonymity control.\n15. RAADAAR, US 9,854,616 B2 (priority 2015) — BLE proximity, anonymous gifts, payment integration.\n16. Mastercard, EP 1671282 A2 (priority 2003) — biometrically enabling a proximity payment device; Samsung, WO 2022/225298 A1 (priority 2021) — payment over UWB secure ranging.\n17. Square (2014). *Nearby Payments* in Square Cash, over Bluetooth LE (press release, October 2014); Bump (2009) and Bump Pay (2012).\n18. Android Developers, *Ultra-wideband (UWB) communication* (androidx.core.uwb); Apple Developer, *Nearby Interaction* (2020).\n\n---\n\n*— End of defensive publication —*\n\n*Co-authored with Miss Aquarius℠, the institution's named AI collaborator, per the corpus's standing disclosure; final editorial control and responsibility for every claim rest with the human author. This document's SHA-256 is attested independently of the site and its authors — anchored to the Bitcoin blockchain via OpenTimestamps and signed under RFC 3161 by three timestamp authorities in three jurisdictions, one of them eIDAS-qualified — and each revision carries a Zenodo version; a timestamp proves this exact text existed no later than its date and nothing about authorship, originality, or the validity of any claim.*",
       "provenance": {
-        "sha256": "036aa9e871898aa164c91b6be3852d20f351f248173ae1e6c9b9cac09b48a820",
-        "doi": "10.5281/zenodo.22931236",
+        "sha256": "d3cf6eb186d19985490e4c68f1e5422b8ee11a88f8cecb2c7bf2700aedc1b8e1",
+        "doi": "10.5281/zenodo.22933557",
         "concept_doi": "10.5281/zenodo.21947430",
-        "zenodo_url": "https://zenodo.org/records/22931236",
-        "deposited_sha256": "036aa9e871898aa164c91b6be3852d20f351f248173ae1e6c9b9cac09b48a820",
+        "zenodo_url": "https://zenodo.org/records/22933557",
+        "deposited_sha256": "d3cf6eb186d19985490e4c68f1e5422b8ee11a88f8cecb2c7bf2700aedc1b8e1",
         "deposited_matches_current": true,
         "opentimestamps": true,
         "source_url": "https://raw.githubusercontent.com/thonly/publications/main/defensive-publications/verified-human-anonymous-local-giving.md",
@@ -5693,8 +5728,8 @@
         "canonical_url": "thonly.org/research/verified-human-anonymous-local-giving",
         "hostile_review": null
       },
-      "bytes": 39126,
-      "words": 5433
+      "bytes": 39111,
+      "words": 5430
     },
     {
       "slug": "vinaya-as-ai-reasoning-training-corpus",
@@ -5980,9 +6015,9 @@
   "manifest": {
     "what": "Every file the index build considered, and what became of it. candidates = served + excluded + held. Detects a document silently dropped; it is not a tamper check — each document's sha256 is.",
     "candidates": 147,
-    "served": 146,
+    "served": 147,
     "excluded": 0,
-    "held": 1,
+    "held": 0,
     "served_documents": [
       {
         "slug": "a-vow-you-could-have-refused",
@@ -6036,7 +6071,7 @@
         "slug": "aura-gated-anonymous-mate-selection",
         "repo": "TH/publications",
         "path": "defensive-publications/aura-gated-anonymous-mate-selection.md",
-        "sha256": "037ce88e438295e7e8cd6f42079ad36e45258143d70ca10de5b1b603b24f9bb2"
+        "sha256": "a227df1af807e5169d3f89c73172a5155e596e232529d40388da3c68b81adb43"
       },
       {
         "slug": "autonomous-ai-institutional-governance",
@@ -6282,7 +6317,7 @@
         "slug": "gift-tag-time-reveal",
         "repo": "TH/publications",
         "path": "defensive-publications/gift-tag-time-reveal.md",
-        "sha256": "7e50db8a142b8159731efc53a178ec187a4de0eabe9f34bc003892a92d04d20c"
+        "sha256": "402b31f079eabd4a12caef7682c66b9772163c958515794e7ec602cacd8eca40"
       },
       {
         "slug": "giving-above-traditions",
@@ -6462,7 +6497,7 @@
         "slug": "respiratory-biofeedback-contemplative-guidance",
         "repo": "TH/publications",
         "path": "defensive-publications/respiratory-biofeedback-contemplative-guidance.md",
-        "sha256": "a5380903d02f68efa5c823cc0d77a4fdf436faa2fd985aea1c686b3cff92e1be"
+        "sha256": "c539b56dadab459cd9c3a4544e575e99bf6c634dcd3cc450f99c49459419e47f"
       },
       {
         "slug": "right-livelihood-automation",
@@ -6564,7 +6599,7 @@
         "slug": "thank-all-nearby-primitive",
         "repo": "TH/publications",
         "path": "defensive-publications/thank-all-nearby-primitive.md",
-        "sha256": "0b069ce6e45c5c6ab39dedfe9f0939a1319cc6e471d0bb14fdf8c69b8941ee49"
+        "sha256": "4351aed4a84d86b44ea5322a581185832574d3e202717b29f3420d97064787e0"
       },
       {
         "slug": "the-appreciation-economy",
@@ -6590,6 +6625,12 @@
         "path": "essays/the-borrowed-light.md",
         "sha256": "ced1399dde0e9f4fc562eef8d6a485914963f5209b2ff631f9a6d68af87182eb"
       },
+      {
+        "slug": "the-called-draw",
+        "repo": "TH/publications",
+        "path": "defensive-publications/the-called-draw.md",
+        "sha256": "55bf6c3378139312218869f778c39c2007d386856a7cdf72c6f32fa77a78c75d"
+      },
       {
         "slug": "the-capacity-to-give",
         "repo": "TH/publications",
@@ -6810,7 +6851,7 @@
         "slug": "verified-human-anonymous-local-giving",
         "repo": "TH/publications",
         "path": "defensive-publications/verified-human-anonymous-local-giving.md",
-        "sha256": "036aa9e871898aa164c91b6be3852d20f351f248173ae1e6c9b9cac09b48a820"
+        "sha256": "d3cf6eb186d19985490e4c68f1e5422b8ee11a88f8cecb2c7bf2700aedc1b8e1"
       },
       {
         "slug": "vinaya-as-ai-reasoning-training-corpus",
@@ -6862,16 +6903,7 @@
       }
     ],
     "excluded_documents": [],
-    "held_documents": [
-      {
-        "slug": "the-called-draw",
-        "repo": "TH/publications",
-        "path": "defensive-publications/the-called-draw.md",
-        "reason": "awaiting its polish round (new defensive publication, pushed 2026-09-23; full census on file)",
-        "held_since": "2026-09-23",
-        "review_by": "2026-10-07"
-      }
-    ]
+    "held_documents": []
   },
   "program": {
     "question": "Which Way Value Moves",