From e44e7a8fa91b6b8c25d33f8a9d83f8dd40c97a88 Mon Sep 17 00:00:00 2001 From: Sczitzo <46541128+Sczitzo@users.noreply.github.com> Date: Sat, 13 Jun 2026 22:58:53 -0700 Subject: [PATCH] consolidate: close the four data-retention gaps (G-1..G-4, P-078) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes the four 'unspecified — gap' retention/stripping cells the P-075 data-stewardship consolidation confessed (the Christ-centered reviewer called them 'confession without repentance'). Owner-approved Balanced posture: bypass-detection data earns the longest band, the vulnerable- person datasets (hardship support-network graph; household-linkable assessment data) retain the least. New parameters FC-211..214, retention tied to the appeal-spine window close + the corpus 30/90/180/365-day grid + protective hard caps + pre-activation binding gates (RESERVED — not final binds; calibration of the data doctrine's already-required deletion schedule, not a new mechanism; P-073-conformant). - FC-211 bypass-detection: 90d post enforcement-matter finality, 180d open-build ceiling, 365d hard cap (per-record, never reset; 365d cap governs over finality+90d on slow cases). - FC-212 attestation graph: appeal-close + 30d, 180d ceiling, case- pseudonym at intake. - FC-213 Commons Return assessment: appeal-close + 30d strip, 18-month cap, household-linkable records stripped first. - FC-214 person-flags: resolution + 30d, 180d max age, irreversible unlink (an expired flag is gone, not archived). Panel: four parallel single-role reviewers. Adversarial found four load-bearing holes — all fixed: the deletion clock now reliably starts when no appeal is filed (deemed-close rule); the open-build ceiling can't be reset by re-derivation; the 'draft anchor finality' term- collision is removed; the clock-vs-cap conflict resolved (365d cap wins). Christ-centered (the gap's original accuser) APPROVE WITH the 'CLOSED'→'SPECIFIED' wording fix. Corpus-fit APPROVE. Minimalist confirmed four distinct parameters (not collapsible) + trimmed the Patch_Log restatement. Validators green (114 docs). Co-Authored-By: Claude Fable 5 --- app/public/generated/corpus.json | 47 ++++++++++--------- docs/annexes/ANNEX_AF.md | 2 +- docs/annexes/ANNEX_AJ.md | 2 +- docs/annexes/ANNEX_C.md | 2 +- docs/annexes/ANNEX_D.md | 2 +- ...Monitoring_Administrative_Safety_Packet.md | 14 +++--- .../Parameter_Calibration_Register.md | 4 ++ docs/governance/Patch_Log.md | 26 ++++++++-- founding/commitments.md | 4 ++ 9 files changed, 66 insertions(+), 37 deletions(-) diff --git a/app/public/generated/corpus.json b/app/public/generated/corpus.json index aa7bac4..f5b0b41 100644 --- a/app/public/generated/corpus.json +++ b/app/public/generated/corpus.json @@ -7,12 +7,12 @@ "activeAnnexCount": 15, "proposedAnnexCount": 1, "referenceAnnexCount": 29, - "commitmentCount": 106, - "reservedCommitmentCount": 56, + "commitmentCount": 110, + "reservedCommitmentCount": 60, "threatCount": 33, - "patchCount": 77, + "patchCount": 78, "validatorStatus": "pass", - "buildStamp": "corpus-fc452a84a412" + "buildStamp": "corpus-77094cfa21f1" }, "docs": [ { @@ -1493,7 +1493,7 @@ "status": "", "statusBucket": "reference", "summary": "Rule. The patch log is not a substitute for the constitution. The Humane Constitution holds the law-like text; the patch log explains how and why the hardening evolved.", - "content": "# Patch Log\n\n**Running change ledger aligned to the Humane Constitution \u00b7 Current through P-077 (P-071 reserved)**\n\n---\n\n**Purpose.** This log records the hardening changes introduced during the current cycle and keeps a traceable link between threats, mitigations, introduced risks, and remaining open questions.\n\n**Rule.** The patch log is not a substitute for the constitution. The Humane Constitution holds the law-like text; the patch log explains how and why the hardening evolved.\n\n**Patch status convention:** \n- **ACTIVE** = adopted into the document set and awaiting simulation/tuning; not evidence-backed proof. \n- **SUPERSEDED** = replaced by a later patch. \n- **PROPOSED** = designed but not yet accepted into the Humane Constitution.\n- **RETIRED** = intentionally removed.\n\n**Evidence discipline.** A patch can be well designed and still fail in contact with identity errors, measurement lag, legal wrappers, institutional self-protection, or founding politics. Do not treat `ACTIVE` or `PROPOSED` as `RESOLVED`; evidence-backed resolution belongs in the Claims and Evidence Register and the relevant Threat Register residual-risk update.\n\n---\n\n## Patch Inventory\n\n| Patch ID | Related Threat | Status | Priority | Core Change |\n| :--- | :--- | :--- | :--- | :--- |\n| P-001 | T-001 | **ACTIVE** | Critical | Contain shadow convertibility through friction, detection, and broker-focused enforcement. |\n| P-002 | T-004 | **ACTIVE** | Critical | Stabilize incentives with nonlinear reward architecture and anti-gaming design. |\n| P-003 | T-002 | **ACTIVE** | Critical | Replace single-gate identity with differential assurance and recovery-safe continuity. |\n| P-004 | T-007 | **ACTIVE** | Critical | Stop semantic capture through definition governance and anti-laundering rules. |\n| P-005 | T-005 | **ACTIVE** | Critical | Governance throughput: tiered CRP queues, throughput floor, emergency re-declaration. |\n| P-006 | T-006 | **ACTIVE** | Critical | Measurement lag: sentinel mandate, PCRP first-responder authority, Shared Storehouse unwind symmetry. |\n| P-008 | T-008 | **PROPOSED** | High | Elite formation: legibility audit, diversity mandates, verification independence, cohort cooling. PROPOSED and superseded for operative authority by P-025 (Federated Ombuds constitution); P-025 is the live ACTIVE control for T-008. |\n| P-009 | T-009 | **ACTIVE** | Med-High | Grace exploitation: graduated renewal, cross-quarter history, collusion detection, Service Record slow-decay. |\n| P-011 | T-011 | **ACTIVE** | Critical | Narrative hardening: RPCP, pre-committed failure doctrine, CFRL, adversarial narrative simulation. |\n| P-012 | T-012\u2013T-015 | **ACTIVE** | Critical | Interface hardening: oracle independence, categorical throughput floors, deadlock protocol, demand-context flag. |\n| P-013 | T-016 | **ACTIVE** | Critical | FAP integrity: representativeness standard, deadlock timeline, audit epistemic independence, anti-gaming Tier 2. |\n| P-014 | T-017 | **ACTIVE** | Critical | Bootstrap activation: one-time founding instrument for P-013 activation only. |\n| P-015 | T-018 / T-019 | **ACTIVE** | High | PCRP attack surface: false-trigger escalation path, exhaustion alert, manufactured flag assessment. |\n| P-016 | T-002 | **PROPOSED** | Critical | Identity asymmetric error doctrine: quantified fraud/exclusion rate targets, Tier 2 founding commitment. Remains PROPOSED / pre-ratification until founding adoption and pilot-calibrated rate confirmation; FC-140 through FC-145 have bound starting values, while FC-146 through FC-150 remain pre-launch commitments. |\n| P-017 | T-020 / T-021 | **ACTIVE** | Critical | Oracle epistemological and algorithmic independence: methodology-class diversity, AI supply chain transparency, physical ground-truth requirement. Numerical floors (N\u22655, \u22653 classes, \u22640.30 pairwise correlation, \u22651 adversarial seat) bound in `/founding/commitments.md` FC-030/FC-031/FC-032/FC-033. |\n| P-018 | T-022 | **PROPOSED** | Critical | Electoral cycle resilience: entrenchment ladder, Essential Access floor minimum persistence, administrative hollowing triggers, transition continuity protocol. |\n| P-019 | T-023 | **ACTIVE** | Med-High | Pilot external validity gate: stress-condition pilot requirement, red-team challenge window, crisis simulation mandate. |\n| P-020 | T-017 | **ACTIVE** | Critical | Founding window extension: 60-day pre-activation disclosure, oppose-coalition adversarial member nomination. |\n| P-021 | \u2014 | **ACTIVE** | High | Register disclosure protocol: bifurcation into public and restricted versions; operational security for detection thresholds. |\n| P-022 | T-024 | **ACTIVE** | Critical | Shared Storehouse oracle-failure fallback: conservative hold, 48h REB first-responder window, 72h governance handoff, FC-100 14-day restoration verification, reconciliation review. Annex AQ ACTIVE. |\n| P-023 | T-025 | **ACTIVE** | High | Capital-deployment shelter capture: contract-commitment architecture, milestone escrow, verified physical deliverables, and no protected-capital label without deployment. |\n| P-024 | T-009 / TR-07 / T-018 | **ACTIVE** | Critical | Attestation-at-risk stake mechanism: FC-080 stake ratio, FC-081 audit window, FC-082 graph density threshold, slashed-stake redistribution, graph-density safe harbor for legitimate close-knit communities. Annex AS. |\n| P-025 | T-008 | **ACTIVE** | Critical | Federated Ombuds constitution: 5 sub-Ombuds (FC-090), 4-of-5 Plenum supermajority (FC-091), 730-day staggered terms (FC-092), Oversight Assembly (7 members, 5-of-7), structural-dispersal criteria, Concentration Response. Annex AI rewritten. Supersedes single-commissioner draft. |\n| P-026 | T-026 / T-027 | **ACTIVE** | Critical | Founding Order \u2014 Subsidiarity, Consent & Exit: smallest-scale default with three-prong competence test; affirmative consent events at 2/3 supermajority (FC-120); 730-day graceful exit unwind (FC-121) with Essential Access continuity preserved; five-scale hierarchy (FC-122: household/neighborhood \u2264500/locality \u22645,000/region \u2264500,000/federation); re-entry symmetric, no penalty. `/founding/order/` directory. |\n| P-027 | T-005 / T-008 | **ACTIVE** | Critical | Structural consolidation into one Founding Order and seven Articles of Constitutional Order. Rights and execution unified under Article I; Essential Access and delivery unified under Article IV; markets, housing, enterprise, and PFCR unified under Article V; Voice, Service Record, and deliberation unified under Article VI; transparency and environmental scanning unified under Article VII. |\n| P-029 | T-016 | **ACTIVE** | Critical | Public Finance & Commons Revenue (PFCR): structural non-tax public funding, Commons Return source-base receipts, public banking rails as infrastructure, and anti-hidden-debt discipline. |\n| P-030 | PRD-004 | **ACTIVE** | Critical | Protocol-only money creation + household finance boundaries: no private Flow creation, no compounding household ordinary-life debt, no survival-floor securitization. |\n| P-031 | PRD-009 | **ACTIVE** | Critical | Anti-dynasty ownership: count-through beneficial ownership, trust prohibition for extractive continuity, succession limited to continuity and stewardship. |\n| P-032 | PRD-009 | **ACTIVE** | High | Stewardship ownership rule: land, housing, and enterprise rights may not become perpetual passive extraction claims. |\n| P-033 | PRD-008 | **ACTIVE** | High | Worker-owned and mission-locked enterprise preference: financing, procurement, and succession pathways structurally favor stewardship forms over absentee control. |\n| P-034 | T-016 / INV-007 | **ACTIVE** | Critical | Two-key architectural precondition for Tier-1-touching patches: adversarial panel attestation required before FAP intake; FAP reviewer cannot override absence; Beer S3* independence enforced; Buterin defection penalty specified. Annex AV. |\n| P-035 | \u2014 | **ACTIVE** | High | Founding group corrigibility clause + epistemic humility statement in Preamble and \u00a70A. |\n| P-036 | \u2014 | **ACTIVE** | High | Keyholder servanthood duty + replacement mechanism for self-interested keyholders (Article I). |\n| P-037 | \u2014 | **ACTIVE** | High | Identity-serves-person clause with triennial review and sunset requirement on secondary data use (Article II). |\n| P-038 | T-006 | **ACTIVE** | High | Community challenge path for capacity measurement figures with 14-day published response (Article III). |\n| P-039 | \u2014 | **ACTIVE** | High | Explicit protection for pre-existing mutual aid, family, and religious care networks; Article IV as floor not monopoly (Article IV). |\n| P-040 | \u2014 | **ACTIVE** | High | Housing cap pastoral revision (remove cold \"regardless\" language); structural humility closing clause added to Article V. |\n| P-041 | T-008 | **ACTIVE** | High | Biennial recognized-contribution audit to include invisible and pastoral work; 180-day correction requirement (Article VI). |\n| P-042 | \u2014 | **ACTIVE** | High | Low-barrier community alert pathway with 30-day acknowledgment and 90-day review trigger (Article VII). |\n| P-043 | Multiple | ACTIVE | High | Logical-analysis corpus corrections \u2014 documentary, amendment architecture, definitions, placeholder fill |\n| P-044 | Multiple | ACTIVE | High | Threat-strengthening batch \u2014 T-001/T-002/T-004/T-005/T-007/T-018/T-019 mitigation gaps closed |\n| P-045 | T-001 / T-002 / T-004 / T-007 / IC-004 | **ACTIVE** | Critical | Threat-mitigation batch \u2014 threshold derivation, asymmetric exclusion review, contribution floor, protected-term seed list, dignity-only continuity mode (threats remain Active \u2014 unproven; nothing marked Resolved) |\n| P-046 | Multiple | **ACTIVE** | Critical | Evidence and capture hardening \u2014 seven proof artifacts, drift audit, parameter calibration, abuse cases, evidence ladder, founding dossier, and capture dashboard |\n| P-047 | T-025 / T-026 / T-027 / external dependency capture | **ACTIVE** | Critical | Essential-sector conglomerate transition \u2014 profitable compliant path, refusal survivability tests, public fallback capacity, and numeric evidence anchors |\n| P-048 | T-025 / T-026 / T-027 / external dependency capture | **ACTIVE** | Critical | Essential-sector refusal test package \u2014 sector drills, FC-194 through FC-201 calibration rows, Annex AT receiver/licensing triggers, public explainer, and evidence-source expansion |\n| P-049 | Multiple evidence-gap bridges | **ACTIVE** | High | Cross-register bridge pass \u2014 aligns Hardening Queue, Open Problems, Pilot Roadmap, Public Readiness, README, and evidence-gap language with founding artifact status and essential-sector refusal testing |\n| P-050 | T-028 | **ACTIVE** | Critical | Compliant Alternative Supplier Pre-Registration (CASP): mandatory pre-registration of backup suppliers with automatic-activation contracts before essential-sector procurement renewal; gap-window calculation requirement; adversarial observation requirement for drill-secure classification. ANNEX_AT \u00a7AT6.6. |\n| P-051 | T-022 | **ACTIVE** | Critical | Constitutional Integrity Panel (CIP): 7-member independent body with staggered terms, constitutionally fixed funding (0.01% of annual Flow issuance), multi-body appointment preventing governing-coalition control, 5-of-7 quorum for Tier 1 ratification, automatic review triggers for institutional vacancy or publication lapses. ANNEX_AM \u00a7AM8. |\n| P-052 | T-019 | **ACTIVE** | High | Federated Ombuds deliberate-manufacture standard: pre-committed 4-criterion assessment (timing, proportionality, prior-basis, knowledge), 24-hour Plenum decision window, asymmetric default favoring PCRP activation when evidence is inconclusive, manufactured-flag referral to Enforcement Panel. ANNEX_AI \u00a74.12. |\n| P-053 | Insider retaliation / reporter protection | **ACTIVE** | Critical | Whistleblower Protection and Anti-Retaliation Protocol: administrative freeze on respondent write-access from filing; automatic escalation of retaliatory modifications; 45-day \"under review\" cap; restoration on exoneration. ANNEX_AW; Article VII reporter-protection clause. |\n| P-054 | Identity disclosure as safety vector | **ACTIVE** | Critical | Confidential Enrollment and Safety-Identity Protocol: cryptographically sealed identity for safety-compromised persons; address-blind delivery; 30-day emergency enrollment; 72-hour token for undocumented persons; sealed-record governance. ANNEX_AX; Article II safety-shielded enrollment clause. |\n| P-055 | Delivery gap between guarantee and operation | **ACTIVE** | Critical | Delivery Sufficiency Standard: four operational conditions (path exists, accessible, monitored, accountable party); Delivery Sufficiency Register published quarterly; seven founding-population entries; cross-boundary delivery accounting. ANNEX_AY; Article IV delivery-sufficiency obligation. |\n| P-056 | T-002 / INV-001 | **PROPOSED** | Critical | Open-Access Survival Floor (Two-Tier Identity Model): separates non-duplication (required for CSM) from identity verification (required only for above-floor services and civic instruments). Defines Tier 0 (open-access/pseudonymous survival floor) and Tier 1 (identity-gated services). Establishes civic accountability norm: the system trusts citizens because there is enough for everyone. Aggregate anomaly detection replaces individual surveillance at the survival tier. Token mechanism specification delegated to ANNEX_AZ \u00a7AZ2 as a pre-operational prerequisite. ANNEX_AK \u00a7AK8. |\n| P-057 | ACL-011 / ACL-010 | **PROPOSED** | High | Pilot Site Selection Criteria: required, disqualifying, and preferred characteristics for pilot town site selection; Phase 1 capital reference ranges ($15\u201322M); site selection process with adversarial panel member approval requirement. |\n| P-058 | T-016 / constitutional void | **PROPOSED** | High | Jurisdiction Interface Clause: three-layer jurisdiction interface (RAC mediation \u2192 external courts \u2192 federal floor); matters governed by external law enumerated; pre-enrollment 7-day grace window; retaliation prohibition; filing assistance obligation. |\n| P-059 | ACL-010 / dignity-floor leverage | **PROPOSED** | Critical | Vulnerable Population Consent Protocol (VPCP): ICA structure (civil-society nominated, 50% peer specialists, adverse-finding authority); VPCP-001 through VPCP-008 rules; 30-day cooling-off; teach-back verification as founding team obligation; non-waivable exit rights (60-day housing, 90-day healthcare, no clawback); pre-recruitment prerequisites gate. |\n| P-060 | ACL-005 / founding keyholder capture | **PROPOSED** | Critical | Founding Team Composition Standard: composition floor (FT-1 through FT-4); 9-seat keyholder allocation with distributed nomination (Seats 3\u20138 via civil-society organizations approved by adversarial panel member); founder sunset rules (FS-1 through FS-7); Perpetual Humility Review with Humility Declaration. |\n| P-061 | ACL-007 / Power-Wealth Convergence | **PROPOSED** | Critical | Founding Capital Framework: phase targets ($15\u201322M / $35\u201355M / $60\u201390M); 20%/30% funder concentration limits; Capital Steward independent fiduciary; constitutional primacy clause (non-negotiable in all funding agreements); government walk-away rule (4 trigger conditions); CLT land structure; wind-down reserve (6 months EA pre-funded). |\n| P-062 | ACL-011 / ACL-010 | **PROPOSED** | High | Pilot Timeline Framework: five-track parallel structure (Founding Legitimacy, Site Acquisition, Design/Permitting, Construction, Recruitment); three enrollment windows with hard prerequisites; critical-path gates (A2 at Month 8, D2 at Month 26\u201330, INV-LAUNCH-1 clearance); failure contingency requiring Resident Transition Protocol before Cohort 1 occupancy. |\n| P-064 | T-028 | **ACTIVE** | Critical | Compliance-Masked Refusal Hardening: treats lawful-looking obstruction as refusal when formal compliance hides CSM delivery degradation, patient-continuity failure, data/control-system lockout, PBM access friction, standards delay, affiliate fallback capture, workforce poaching, legal delay, or concession pressure. |\n| P-065 | T-022 | **ACTIVE** | Critical | CIP Vacancy-Starvation Hardening: appointment deadlines, fallback nomination, void mass appointments, below-quorum self-repair limits, publication-channel fallback, missed Ombuds-report suspension, conduct-only hollowing triggers, servant-authority and relief-first limits. |\n| P-066 | T-029 | **ACTIVE** | Critical | Commons Return and Universal Stake Fiscal Sustainability Gate: replaces routine progressive net-worth demurrage as active wealth spine, registers fiscal/debasement risk, requires costed public-finance model, source-base revenue testing, remaining-tax disclosure, incidence review, lockbox sufficiency, and scale-blocking fiscal adequacy gate. |\n| P-067 | T-030 | **ACTIVE** | Critical | Cyber Resilience and Availability Gate: registers ransomware, key-compromise, regional-outage, offline-continuity, supply-chain, and public-status failure as a distinct threat to survival-floor delivery. |\n| P-068 | T-031 | **ACTIVE** | Critical | Last-Resort Unenrolled Access Gate: registers the risk that a person who cannot enroll, hold a wallet, or use digital credentials still cannot reach the survival floor; requires no-credential, trusted-intermediary, analog-reconciliation, abuse/diversion, and dignity-interview tests before universality claims. |\n| P-069 | T-032 | **ACTIVE** | Critical | Monitoring Repurposing Gate: registers the risk that protective monitoring becomes surveillance or coercive control; requires purpose register, purpose-creep red team, linkability test, office-separation drill, individual-flag appeal drill, retention audit, and coercive-use scenario. |\n| P-070 | T-033 | **ACTIVE** | Critical | Founding Legitimacy Prerequisite Definition Gate: reconciles consent thresholds, defines admissible non-coercive consent evidence, defines independent civil-society reviewer qualification, and blocks Gate A until consent and review are independently evidenced. |\n| P-072 | T-025 | **PROPOSED** | High | Productive Status Register: one canonical \"productive\" determination shared by Flow issuance (ANNEX_X) and the Commons Return exemption (ANNEX_D \u00a7D3), with settle-forward escrow closing the temporal double-dip. Remains PROPOSED / pilot-gated until its evidence test passes; binds nothing until then. |\n| P-073 | structural \u2014 no threat row | **ACTIVE** | High | Framework-first intake (anti-accretion rule): FAP intake gate requiring any new mechanism to extend the most general existing instrument for its protective function or carry a published justification; published return record with adversarial-panel escalation; simplicity presumption bounded by independence count and protected-person path equivalence. Amends Acceptance_Protocol.md. |\n| P-074 | structural \u2014 no threat row | **ACTIVE** | High | Appeal Spine consolidation: ANNEX_L \u00a7L7 becomes the single canonical appeal procedure (one filing rule, floor + status-quo-ante continue during appeal, one ladder with the Ombuds Plenum kept separate for independence); seven scattered appeal procedures become spine pointers (with ANNEX_I's duplicate clocks and ANNEX_AI \u00a74.8's duplicate window deleted); the ANNEX_AW \u00a7AW3.3 orphan appeal window (RRE-011) is a named follow-up, not yet absorbed. First P-073-mandated consolidation of an entire mechanism family. |\n| P-075 | structural \u2014 no threat row | **ACTIVE** | High | Evidence-test framework + data stewardship standard: Evidence Ladder gains the canonical Test Package Template (drift rule; four package follow-ups named); the Monitoring Administrative Safety Packet gains the master Minimization and Purpose-Limitation Doctrine, a quote-sourced per-domain calibration table (open gaps marked honestly), a cross-domain linkage rule generalizing ANNEX_D \u00a7D6.5, and a drift rule; the Monitoring Repurposing ETP's duplicated six-condition baseline becomes a pointer. |\n| P-076 | structural \u2014 no threat row | **ACTIVE** | Medium | Institution merger audit: Conservative Hold declaring authority bound to the existing RCS accreditation body (dangling ANNEX_AL \u00a73 pointer resolved); phantom \"Measurement Oversight Body\" deleted, escalation bound to the ANNEX_AL \u00a74.1 methodology-review panel; \"oracle council\" unified to \"oracle cohort\" (FC-033's own unit). Two proposed mergers examined and REJECTED with reasons: register-adjudicator vs contribution verification are different functions protecting different people (merging would weaken INV-006), and the \"Temporal Continuity Review Panel\" exists nowhere in the corpus. No operating institution merged; no check removed. |\n| P-077 | structural \u2014 no threat row | **ACTIVE** | Medium | Canonical-home (anti-drift) discipline: the four near-identical drift rules (status spine, appeal spine, evidence template, data doctrine) collapse into one doctrine in the P-073 gate (Acceptance_Protocol) \u2014 domains cite their canonical home and keep only domain substance; a divergent restatement yields to the home, except where domain text is strictly more protective of the person (never for uniform procedural rules). The four local rules shrink to home-declaration + specific enforcement + citation. Constitution change; Christ-centered Session 27. |\n\n---\n\n## Reserved / Never-Assigned Patch IDs\n\nThese IDs do not appear in the inventory above. They are recorded here so a reader can distinguish a deliberately skipped number from a lost or missing patch. Mirrors the \"Retired and Reserved IDs\" table in the Threat Register.\n\n| Patch ID | Status | Reason |\n| :--- | :--- | :--- |\n| P-007 | **RESERVED** | Reserved at numbering; never assigned a patch. The threat work that would have occupied this slot was absorbed into adjacent patches before formal sequencing. No design exists under this ID. |\n| P-010 | **RESERVED** | Reserved at numbering; never assigned a patch. No design exists under this ID. |\n| P-028 | **RESERVED** | Reserved at numbering; never assigned a patch. The economic-governance integration that would have followed P-027 was consolidated into the P-029 through P-033 batch. No standalone design exists under this ID. |\n| P-063 | **DRAFT-ONLY** | Reserved for the P-063 v15 review packet. It is explicitly not corpus-registered, not adopted into Annex D, and not part of the active Patch Log inventory. |\n| P-071 | **RESERVED** | Reserved for the Harberger/COST shadow-assessment proposal (`docs/superpowers/specs/2026-06-09-commons-return-should-fixes-redline.md`), which is held as a proposal and not incorporated. The number is reserved so cross-references in the pending-proposal redlines stay stable; no design is incorporated under this ID. |\n\n---\n\n## P-029 through P-033 \u2014 Economic Governance Integration\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-029 | T-016 / public-funding architecture | **ACTIVE** | Critical | constitutional fiscal redesign |\n| P-030 | PRD-004 | **ACTIVE** | Critical | monetary + retail-finance boundary |\n| P-031 | PRD-009 | **ACTIVE** | Critical | ownership + succession + anti-circumvention |\n| P-032 | PRD-009 | **ACTIVE** | High | constitutional ownership standard |\n| P-033 | PRD-008 | **ACTIVE** | High | enterprise-preference and succession design |\n\n### P-029 \u2014 Public Finance & Commons Revenue (PFCR)\n\n**Constitutional text:** [ANNEX_X.md \u00a7 X8](../annexes/ANNEX_X.md)\n\n- **Introduced design:** replaces the former catch-all resilience funding model with a dedicated public-funding function. PFCR funds public operations through Commons Return source-base receipts, commons and land-use charges, scarce-license and gateway fees, and bounded public issuance tied to real public production.\n- **Clauses integrated:** no taxes on survival access, ordinary labor, or basic household exchange; public banking rails funded as infrastructure; postal-bank/public-bank option; anti-hidden-debt rules; source-by-source public reporting.\n- **Dependencies:** Commons Return source-base methodology, asset-equivalence review, gateway registry, and budget transparency stack.\n- **New risks introduced:** fiscal dependence on poorly calibrated Commons Return, source-base valuation, or gateway flows; naming disputes over what counts as a prohibited tax. Mitigated by judicial review trigger, source registry, and P-066 fiscal adequacy gate.\n\n### P-030 \u2014 Protocol-Only Money Creation and Household Finance Boundaries\n\n**Constitutional text:** [ANNEX_X.md](../annexes/ANNEX_X.md)\n\n- **Introduced design:** only protocol-authorized issuance bodies may create Flow or Flow-equivalent purchasing power. Private institutions may lend existing Flow, but may not create new Flow, deposit substitutes, or debt-expanded currency-like claims.\n- **Clauses integrated:** compounding interest prohibited on household ordinary-life debt; no securitization of survival-linked household claims; no revolving survival traps; public retail banking floor on the common rail.\n- **Dependencies:** retail-rail charter, prudential supervision of licensed providers, and public option continuity.\n- **New risks introduced:** shadow-credit attempts outside the chartered rail, and pressure to relabel hidden fees as service charges. Mitigated by common-rail enforcement and anti-equivalence review.\n\n### P-031 \u2014 Anti-Dynasty Ownership\n\n**Constitutional text:** [ANNEX_J.md \u00a7 R1\u2013R2](../annexes/ANNEX_J.md)\n\n- **Introduced design:** beneficial ownership always counts through to natural persons or mission-locked/community bodies. Perpetual trusts, shell chains, and equivalent structures may not preserve extractive control across generations.\n- **Clauses integrated:** family continuity protected in modest form, but dynastic landlordism, absentee succession structures, and perpetual extractive wrappers are prohibited.\n- **Dependencies:** beneficial-ownership registry, succession review rules, and housing / enterprise stewardship standards.\n- **New risks introduced:** harder succession planning for legitimate family continuity cases. Mitigated by explicit continuity allowances for homes, tools, dependents, and mission-locked stewardship bodies.\n\n### P-032 \u2014 Stewardship Ownership Standard\n\n**Constitutional text:** [ANNEX_J.md \u00a7 R1\u2013R2](../annexes/ANNEX_J.md)\n\n- **Introduced design:** ownership across land, housing, and enterprise is reframed as stewardship rather than a perpetual tribute right. Capital may be rewarded for risk and contribution, but not for endless passive extraction from necessity or labor.\n- **Clauses integrated:** bounded capital claims, anti-rent use-right logic, and judicially reviewable passive-extraction prohibitions.\n- **Dependencies:** housing and commons use-right enforcement, capital-instrument redesign, and ACC / anti-monopoly enforcement.\n- **New risks introduced:** valuation disputes around what counts as productive stewardship. Mitigated by published criteria, appeal paths, and mission-lock documentation.\n\n### P-033 \u2014 Worker-Owned and Mission-Locked Enterprise Preference\n\n**Constitutional text:** [ANNEX_J.md \u00a7 R1](../annexes/ANNEX_J.md)\n\n- **Introduced design:** worker-owned, cooperative, and mission-locked firms receive structural preference in PFCR-backed finance, procurement, retained-earnings treatment, worker buyout pathways, and founder-exit conversion rules.\n- **Clauses integrated:** natural monopolies moved to a separate regulated-utility track; outside capital claims must be capped, redeemable, sunset, or otherwise bounded.\n- **Dependencies:** procurement rules, cooperative finance tools, public venture / buyout facilities, and utility-governance charter.\n- **New risks introduced:** preferential treatment could be gamed by sham cooperatives. Mitigated by governance-proof requirements, payout constraints, and beneficial-ownership transparency.\n\n---\n\n### P-034 \u2014 Two-Key Architectural Precondition for Tier-1 Invariant Enforcement\n\n**Threat addressed:** T-016 / INV-007 \n**Audit finding:** PRD-001 / Phase 1 Article I adversarial audit; confirmed still open in Phase 4 follow-up check \n**Status:** ACTIVE | **Priority:** Critical | **Annex:** AV (Acceptance_Protocol.md \u00a7Structural Precondition Gate)\n\n**Constitutional text:** [ANNEX_AV.md](../annexes/ANNEX_AV.md)\n\n**Problem diagnosed:** \nThe prior INV-007 enforcement relied on a single FAP reviewer checking patch proposals against INVARIANTS.md before intake. This is a single point of failure: a captured, compromised, or mistaken reviewer can admit a Tier-1-touching proposal simply by not flagging the violation. The Beer VSM logic gate test (Phase 1) confirmed this: the normative model collapses to `defect \u2192 bypass` because the reviewer is both S3 (operational control) and the entire S3* (audit channel). A single captured actor voids all seven invariants simultaneously.\n\n**Introduced design \u2014 two-key architectural precondition (Annex AV):**\n- Any patch tagged `modifies_tier1=True` must carry cryptographic attestation from the standing adversarial panel member before FAP intake opens.\n- The FAP reviewer's authority is explicitly scoped to exclude the ability to waive or override the absence of attestation.\n- The adversarial panel member is nominated by the oppose-coalition body (AH2.3), not the founding coalition \u2014 structurally independent of FAP administration.\n- Defection penalty: improper admission attestation \u2192 permanent removal + forfeiture of seat to oppose-coalition nominating body + public defection finding. Honest attestation (including rejections) carries no penalty. The payoff matrix favors honest behavior.\n\n**Beer VSM fix:** S3* (adversarial panel attestation) is now structurally independent of S3 (FAP reviewer). Collapsing S3* into S3 is architecturally impossible \u2014 the adversarial panel member holds a key the FAP reviewer does not control.\n\n**Buterin incentive alignment fix:** Defection (improper admission) is costly (removal + public record). Honesty is safe. The reviewer incentive is also corrected: a reviewer who admits a proposal that lacks attestation has acted outside their authority \u2014 no benefit accrues, only liability.\n\n**Clauses integrated:** INV-007 mechanical boundary (amended), INVARIANTS.md \u00a7Invariant Violation Detection (precondition block added), Acceptance_Protocol.md \u00a7AV1\u2013AV6, Annex AV \u00a7AV7\u2013AV10 operational procedure.\n\n**Dependencies:** Adversarial panel member must be seated (per AH2.3) before any `modifies_tier1=True` proposal may be submitted. P-034 becomes operational the moment the adversarial panel member's key is registered.\n\n**New risks introduced:**\n- If the adversarial panel member seat goes vacant, no Tier-1-touching proposals can advance. Mitigated: vacancy is observable and not covert; it is a conservative failure mode (proposals stall, not wrongly admitted).\n- Oppose-coalition nominating body could itself be captured. Mitigated: AH2.3 qualifications exclude organizations with funding relationships with the founding coalition; three-year lookback applies.\n\n**Residual risk (acknowledged):** The adversarial panel member can be defected through external pressure not covered by the internal penalty structure (coercion, external blackmail). This is documented as a known residual rather than a resolved problem. Physical-world coercion cannot be fully eliminated by protocol design; conservative failure mode (panel member refuses to attest rather than attesting fraudulently) is the design target.\n\n## P-001 through P-004 \u2014 Core Convertibility Controls\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-001 | T-001 | **ACTIVE** | Critical | structural + behavioral detection + targeted enforcement. |\n\n### P-001 \u2014 Shadow Convertibility Containment\n\n**Constitutional text:** [ANNEX_AB.md \u00a7 AB2](../annexes/ANNEX_AB.md)\n\n- **Introduced design:** Essential Access-only channels, non-delegable redemption, context-locking where proportionate, anomaly detection, broker targeting, and an explicit leakage-tolerance concept.\n- **Clauses to integrate:** Essential Access Exclusivity, Non-Delegable Consumption, Leakage Tolerance, Broker-Focused Enforcement.\n- **Dependencies:** identity assurance, coercion reporting pathways, and sufficiently accurate essential-supply management.\n- **New risks introduced:** over-surveillance, false positives, user friction, and migration of abuse into proxy-identity channels.\n- **Residual risk:** small-scale favors and informal pooling remain acceptable if they do not scale into arbitrage infrastructure.\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-002 | T-004 | **ACTIVE** | Critical | economic + behavioral + contribution architecture. |\n\n### P-002 \u2014 Incentive System Stabilization\n\n**Constitutional text:** [ANNEX_AB.md \u00a7 AB3](../annexes/ANNEX_AB.md)\n\n- **Evidence package:** [Service Record Misuse Evidence Test Package](./Service_Record_Misuse_Evidence_Test_Package.md)\n- **Introduced design:** nonlinear reward curves, multi-channel rewards (Flow, civic standing, status/recognition), opportunity access, time/flexibility rewards, and anti-gaming contribution assessment.\n- **Clauses to integrate:** Incentive Nonlinearity, Multi-Channel Reward, Outcome-Based Contribution, Anti-Gaming Contribution.\n- **Dependencies:** identity attribution, contribution verification, and governance rules for how civic standing can matter without becoming coercive privilege.\n- **New risks introduced:** status hierarchy, burnout optimization, and domain bias toward easier-to-measure work.\n- **Residual risk:** optimization behavior remains, but the design goal is to align it with contribution rather than suppress it.\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-003 | T-002 | **ACTIVE** | Critical | structural + security + continuity protection. |\n\n### P-003 \u2014 Identity System Hardening\n\n**Constitutional text:** [ANNEX_AB.md \u00a7 AB4](../annexes/ANNEX_AB.md)\n\n- **Evidence package:** [Identity and Recovery Evidence Test Package](./Identity_Recovery_Evidence_Test_Package.md)\n- **Introduced design:** four assurance tiers (survival floor, provisional, core, civic activation), multi-evidence thresholding, no single universal credential, hardened recovery, anti-Sybil controls, and no-survival-lockout under uncertainty.\n- **Clauses to integrate:** Identity Adversarial Reality, Differential Assurance, Recovery Safety, No Master Credential, Identity Failure Continuity.\n- **Dependencies:** appeals architecture, ombuds/advocate pathways, and clear separation between verification and monitoring.\n- **New risks introduced:** complexity, onboarding friction, and slower recovery for legitimate edge cases if poorly implemented.\n- **Residual risk:** low-level fraud remains possible and should be contained rather than denied in theory.\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-004 | T-007 | **ACTIVE** | Critical | governance + constitutional anti-capture control. |\n\n### P-004 \u2014 Definition Drift Protection\n\n**Constitutional text:** [ANNEX_AB.md \u00a7 AB5](../annexes/ANNEX_AB.md)\n\n- **Introduced design:** protected term classes, semantic effect test, worked-example requirement, public definition registry, upward classification default, and anti-laundering control across code, vendor, and standards layers.\n- **Clauses to integrate:** Definition Integrity, Semantic Effect, Upward Classification Default, Worked Example Requirement, Definition Registry, Anti-Laundering.\n- **Dependencies:** classification authority, change-control process, and review capacity.\n- **New risks introduced:** process friction, slower iteration, and semantic bureaucracy if overbuilt.\n- **Residual risk:** subtle drift can still occur unless registry, examples, and challenge windows are actually used.\n\n---\n\n## P-005 through P-012 \u2014 Governance and Operational Resilience\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-005 | T-005 | **ACTIVE** | Critical | structural + procedural + monitoring |\n\n### P-005 \u2014 Governance Throughput Hardening\n\n**Constitutional text:** [ANNEX_AC.md \u00a7 AC1](../annexes/ANNEX_AC.md)\n\n- **Change type:** structural + procedural + monitoring.\n- **Introduced design:** CRP dual-queue separation (constitutional vs. operational); minimum operational throughput floor (5 priority decisions per quarter, non-blockable by constitutional challenges); sequential emergency re-declaration cap (2 consecutive quarters max, requires independent audit and public justification to extend); intake throttle with priority scoring (impact \u00d7 urgency \u00d7 reversibility; Voice-signal for urgency; overflow is public); cross-quarter interim authorization bridge (Ombuds + 1 rotating CRP member + regional exec; scope-locked to emergency declaration; provisional only; cannot narrow Essential Access access or touch constitutional matters); decision quality audit metrics (alternatives-presented ratio, reversal rate, minority dissent rate); [Ambitious] real-time throughput dashboard with auto-escalation trigger.\n- **Clauses to integrate:** CRP Dual-Queue Separation; Minimum Throughput Floor; Sequential Emergency Cap; Intake Throttle and Priority Scoring; Cross-Quarter Interim Bridge; Decision Quality Metrics. See Annex AC1.\n- **Dependencies:** Annex L (CRP sub-panel composition); Annex T (simulation mandate extension); Article V compliance matrix; Level 3\u20134 emergency cascade table.\n- **New risks introduced:** Operational sub-panel capture if composition predictable; interim bridge scope creep; priority scoring gaming; [ambitious] throughput dashboard exposure of vulnerability windows (mitigated by 48-hour publication lag).\n- **Residual risk:** Throughput theater remains hard to detect. Patient actor can operate within throughput floors while maintaining effective paralysis through distributed delay across proposals.\n- **Compound linkages:** T-005 \u00d7 T-006 (PCRP window synchronization); T-005 \u00d7 T-008 (PCRP authority as new power locus); T-005 \u00d7 T-001 (paralysis extends cadence exploit windows).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-006 | T-006 | **ACTIVE** | Critical | structural + authority definition + measurement architecture |\n\n### P-006 \u2014 Measurement Lag and Supply Shock Hardening\n\n**Constitutional text:** [ANNEX_AC.md \u00a7 AC2](../annexes/ANNEX_AC.md)\n\n- **Change type:** structural + authority definition + measurement architecture.\n- **Introduced design:** Sentinel indicator mandate \u2014 every slow-audit essential category requires a faster low-fidelity signal; max lag by volatility class (48h high / 7d medium / 30d low). Pre-Confirmation Response Protocol (PCRP) \u2014 defined first-responder authority (Regional Executive Body, joint activation); permitted: 70% above-baseline issuance reduction, reserve release, expedited oracle review (survival floor issuance stays 100%); prohibited: full Shared Storehouse, survival floor narrowing, other categories, beyond 72h without oracle confirmation; false-trigger tracking \u2014 3 false activations per 4 quarters triggers mandatory independent audit. Shared Storehouse unwind symmetry \u2014 recovery fast-track mirrors PCRP; conservative bias applies to activation, not prolonged restriction after recovery. Cadence-adjusted U8 bridge \u2014 48-hour trigger for high-volatility categories; 7-day retained for medium-volatility. [Ambitious] Essential Access redemption velocity as native sentinel (150% spike threshold). [Ambitious] Cross-category demand surge detector.\n- **Clauses to integrate:** Sentinel Indicator Mandate; PCRP; PCRP Scope Definition (protected term under P-004); Shared Storehouse Unwind Symmetry; Cadence-Adjusted U8 Bridge. See Annex AC2.\n- **Dependencies:** Regional Executive Body formally constituted with joint-activation rules. Essential Access ledger redemption velocity in privacy-preserving aggregate form. Annex M extended with cadence floors. Annex U8 modified.\n- **New risks introduced:** PCRP soft-power weaponization; two-source corroboration gaming; recovery fast-track exploit via manufactured sentinel signals; [ambitious] Essential Access velocity oracle suppression gaming (mitigated by anomaly detection on suppression patterns).\n- **Residual risk:** Inter-cycle gap is compressed not eliminated. 'Supply shock' must be a protected term under P-004 with worked examples to prevent scope creep.\n- **Compound linkages:** T-006 \u00d7 T-001 (cadence windows = black market opportunity); T-006 \u00d7 T-005 (PCRP window synchronization); T-006 \u00d7 T-008 (PCRP authority at REB = elite formation risk).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-008 | T-008 | **PROPOSED** | High | structural + measurement + institutional design |\n\n### P-008 \u2014 Bureaucratic Elite Formation Hardening\n\n**Constitutional text:** [ANNEX_AC.md \u00a7 AC3](../annexes/ANNEX_AC.md)\n\n- **Status basis:** **PROPOSED.** P-008 is designed but was not accepted as the operative authority for T-008. P-025 (Federated Ombuds constitution) supersedes it and is the live ACTIVE control \u2014 see SPECIFICATIONS.md \u00a74.3, which records that P-008 is PROPOSED and P-025 is the operative ACTIVE authority for the 20% sector ceiling. The legibility-audit, diversity, verification-independence, and cohort-cooling designs below are retained as design reference; their operative enforcement runs through P-025.\n- **Evidence package:** [Service Record Misuse Evidence Test Package](./Service_Record_Misuse_Evidence_Test_Package.md)\n- **Change type:** structural + measurement + institutional design.\n- **Introduced design:** Legibility gap audit \u2014 quarterly Article VI reporting tracks verification approval rate, evidence burden, appeals rate, and abandonment rate by contribution category; 20-point disparity triggers independent process audit (not by incumbent verifier pool). Service Record sector ceiling specification mandate \u2014 max 25% per sector, max 35% per identifiable institutional-origin cluster in any Service Record-governed service pool; specified at founding as precondition under Annex N. Epistemic diversity requirement \u2014 three-axis standard (institutional origin \u226430%, contribution-type diversity \u226530% informal/care, geography \u226525% non-urban-dense) for all oversight bodies >5 members; pool design requirement. Verification independence rule \u2014 verifiers cannot review claims in own primary contribution category; applies to mid-range and above claims. Cooling-off cohort rule \u2014 cohort tracking by Ombuds Office; max 2 cohort members sharing review authority over same subject simultaneously. [Ambitious] Qualification standard governance \u2014 competence criteria added to P-004 protected terms registry; standard-setting body must include \u226540% from non-qualifying backgrounds. [Ambitious] Real-time concentration dashboard.\n- **Clauses to integrate:** Legibility Gap Audit; Service Record Sector Ceiling Specification (founding precondition Annex N); Epistemic Diversity Requirement; Verification Independence Rule; Cooling-Off Cohort Rule; Qualification Standard Governance (P-004 extension); Concentration Dashboard. See Annex AC3.\n- **Dependencies:** Service Record sector ceilings specified at founding (pre-CRP constitution). Article VI U7 extended for verifier category independence. P-004 protected terms registry extended. Pool-depth health metrics added to Article VII.\n- **New risks introduced:** Epistemic diversity pool-depth constraint interacts with P-005 throughput vulnerability. Verification independence adds legitimate friction to high-impact claims. Cohort tracking system is a power locus if Ombuds Office itself captured. [Ambitious] concentration dashboard gaming below thresholds (mitigated by 30-day data lag).\n- **Residual risk:** Class formation through informal social networks has no hard control. Open question: Ombuds Office carries three load-bearing functions (cohort tracking, legibility audit, diversity certification) \u2014 if Ombuds becomes an elite formation site all three are compromised. Who audits the auditors of elite formation?\n- **Compound linkages:** T-008 \u00d7 T-011 (elite formation creates narrative attack surface; P-008 dashboard provides defense evidence base); T-008 \u00d7 T-005 (PCRP authority concentration); T-008 \u00d7 T-006 (PCRP regional bodies subject to elite formation).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-011 | T-011 | **ACTIVE** | Critical | communication architecture + transparency + pre-commitment |\n\n### P-011 \u2014 Narrative Attack Surface Hardening\n\n**Constitutional text:** [ANNEX_AD.md](../annexes/ANNEX_AD.md)\n\n- **Change type:** communication architecture + transparency + pre-commitment doctrine.\n- **Introduced design:** Rapid Public Communication Protocol (RPCP) \u2014 4-hour structured template for any public-visibility operational event; covers what happened, system response, access status, next steps; does not replace 7-day post-mortem; pre-authorized publication authority required. Pre-committed failure communication doctrine \u2014 published pre-launch document acknowledging expected failures (PCRP false triggers, oracle disputes, Shared Storehouse activations, enforcement errors, measurement uncertainty) with containment mechanisms; converts failures from surprises to acknowledged expected events. Citizen-Facing Rights Layer (CFRL) \u2014 one page, 8th-grade level, pre-launch, translated; governed as P-004 protected specification. Adversarial Narrative Simulation \u2014 added to Annex T annual mandate; hostile framing team publishes simulated attack; system responds within 4 hours; report published. Hostile Frame Pre-emption Registry \u2014 top 10 mischaracterizations with accurate rebuttals and Article VII evidence; updated quarterly; published as 'Common Misunderstandings.' [Ambitious] Narrative Health Dashboard \u2014 public understanding accuracy surveys, hostile framing prevalence index, RPCP response time metric; Level 1 watch auto-trigger. [Ambitious] Pre-Launch Narrative Audit \u2014 independent adversarial audit by communications professionals; findings and mitigations published simultaneously.\n- **Clauses to integrate:** RPCP; Pre-Committed Failure Doctrine; CFRL (P-004 protected spec); Adversarial Narrative Simulation (Annex T extension); Hostile Frame Registry. See Annex AD.\n- **Dependencies:** Operative elite-formation controls are prerequisite for elite formation narrative rebuttal \u2014 these run through P-025 (ACTIVE), the operative authority for T-008, since P-008 is PROPOSED. Article VII infrastructure must support 4-hour publication SLA. White Paper sync required before launch (AD6). CFRL added to P-004 protected terms registry.\n- **New risks introduced:** Pre-committed failure document weaponized to prime failure expectation \u2014 mitigated by simultaneous publication of containment mechanisms. CFRL creates false certainty \u2014 mitigated by 'Humane Constitution governs' disclaimer. ANS report as hostile playbook \u2014 mitigated by publishing after exercise completion. Hostile frame registry amplifies framings \u2014 mitigated by 'common misunderstandings' framing.\n- **Residual risk:** Narrative defense is bounded by actual system performance. No communication architecture survives sustained failure. Pre-launch framing window (18+ months before launch) cannot be closed by protocol \u2014 only by early CFRL and pre-commitment doctrine deployment.\n- **Compound linkages:** T-011 \u00d7 T-008 (elite formation is factual hook for 'captured by professionals' narrative; P-008 concentration dashboard is the counter-narrative evidence base). T-011 \u00d7 T-006 (PCRP false triggers are the highest-visibility predictable failure). T-011 \u00d7 T-005 (governance paralysis generates narrative events).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-012 | T-012/013/014/015 | **ACTIVE** | Critical | structural + protocol + measurement |\n\n### P-012 \u2014 Interface Hardening and Deadlock Prevention\n\n**Constitutional text:** [ANNEX_AE.md \u00a7 AE2.1\u2013AE2.4](../annexes/ANNEX_AE.md)\n\n- **Change type:** structural + protocol + measurement architecture.\n- **Introduced design:** PCRP oracle independence requirement \u2014 two-source corroboration must use structurally independent measurement systems; manipulated oracle counts as one source regardless of downstream channels; single-source PCRP activates at reduced scope with Ombuds co-certification. Categorical throughput minimums \u2014 P-005 floor amended from single aggregate to 5 categorical minimums (identity, supply, enforcement, governance, unreserved); single category capped at 3 of 5 slots. Emergency deadlock resolution protocol \u2014 auto-declaration when mandatory decision is blocked by 2+ valid processes; 3-member arbitration panel within 6 hours; survival floor bridge unconditional; scope freeze; mandatory root-cause review. Demand-context flag for Essential Access velocity oracle \u2014 discount applied during Flow enforcement actions, mass re-verification campaigns, or regional defection; Ombuds co-certification required for PCRP. RPCP contested-status template \u2014 separates physical event from legal characterization during active CRP review. Cumulative procedural drift trigger \u2014 extends P-004 to 20 Tier 3 decisions in 8 quarters reducing Tier 2/1 decision space; triggers mandatory CRP cumulative review.\n- **Clauses to integrate:** AE2.1\u2013AE2.6. Amends AC1.2 (throughput floor), AC2.2 (PCRP), AD1 (RPCP), AB5 (P-004 drift).\n- **Dependencies:** operational demand-context register (new data feed); RPCP contested-status template library extension; CRP cumulative review procedure.\n- **New risks introduced:** Deadlock panel engineered as bypass route \u2014 bad actors deliberately trigger triple-block to force panel arbitration. Demand-context flag delays legitimate PCRP during enforcement periods. Categorical floor gaming \u2014 proposals reframed to occupy minimum category slots. Cumulative drift review weaponized against legitimate operational evolution.\n- **Residual risk:** Second-generation deadlock has no defined resolution beyond Level 5 structural review. T-009 (Grace Exploitation Loop) remains OPEN and is the next hardening target.\n- **Compound linkages:** All of T-012/013/014/015 inter-linked through PCRP, throughput floor, and deadlock protocol.\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-009 | T-009 | **ACTIVE** | Med-High | behavioral + verification + structural |\n\n### P-009 \u2014 Grace Exploitation Loop Hardening\n\n**Constitutional text:** [ANNEX_AF.md](../annexes/ANNEX_AF.md)\n\n- **Evidence package:** [Service Record Misuse Evidence Test Package](./Service_Record_Misuse_Evidence_Test_Package.md)\n- **Change type:** behavioral + verification architecture + structural.\n- **Introduced design:** Graduated renewal intensity \u2014 first activation lightweight; first renewal structured; second renewal mid-intensity with support service confirmation; third+ renewal high-intensity independent panel. All qualifying hardship approved under any standard. Cross-quarter history review \u2014 full pause history assessed at every renewal; category switching flagged for elevated scrutiny at next renewal. Hardship attestation collusion detection \u2014 P-002 analytics extended to hardship networks; detects mutual pairs, star clusters, temporal clustering; community-disaster safe harbor for 2 quarters on oracle-verified regional emergency. Service Record slow-decay at 20% of normal rate during pause \u2014 Voice freeze unchanged; 4-quarter pause produces ~8% Service Record loss (negligible); 12-quarter rotation produces ~22% loss (drains high-impact threshold). Service pool pause-saturation monitoring \u2014 >20% simultaneous pause triggers pool-health alert and review; never bars individual activation. [Ambitious] Capability development pathway \u2014 up to 15% quarterly Service Record earnable through pause-appropriate stewardship during pause. [Ambitious] T-009 \u00d7 P-008 explicit closure \u2014 paused cohort members count toward P-008 cohort cooling concurrent maximum; active members accommodate, not paused person.\n- **Clauses to integrate:** AF1\u2013AF7. Annex K4 amended (graduated renewal; Service Record slow-decay). P-002 analytics extended (AF3). AC3.5 amended (AF7). Article VII dashboard extended (AF5).\n- **Dependencies:** P-002 collusion analytics infrastructure extended to hardship attestation graph. Service Record slow-decay rate requires Article VI / Annex K4 protocol-level calibration. P-011 CFRL must communicate graduated renewal clearly before launch. [Ambitious] P-004 registry: 'pause-appropriate stewardship' as protected term. [Ambitious] P-008 AC3.5 amended per AF7.\n- **New risks introduced:** Graduated renewal deters genuine long-term hardship if perceived as punitive \u2014 mitigated by CFRL communication and calibration. Service Record slow-decay may deter activation \u2014 mitigated by clear communication and negligible 4-quarter loss. Community-disaster safe harbor exploitable by manufactured disaster claims \u2014 mitigated by oracle verification requirement. Pool saturation monitoring creates perverse incentive against legitimate pause at bad timing \u2014 mitigated by review-only trigger.\n- **Residual risk:** Involuntary unemployment category remains most exploitable \u2014 disproof requires intrusive investigation incompatible with non-surveillance commitment. Accept as contained leakage: graduate renewal intensity is the best available control. Low-level 1-2 quarter grace exploitation is acceptable system leakage \u2014 the cost of genuinely frictionless access for legitimate hardship.\n- **Compound linkages:** T-009 \u00d7 T-008 (primary bypass route for P-008 controls \u2014 AF7 addresses it at design level; evidence remains pending); T-009 \u00d7 T-011 (graduated renewal must be communicated through CFRL or becomes narrative attack surface).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-013 | T-016 | **ACTIVE** | Critical | structural + governance + audit architecture |\n\n### P-013 \u2014 Formal Acceptance Process Integrity\n\n**Constitutional text:** [ANNEX_AG.md](../annexes/ANNEX_AG.md)\n\n- **Change type:** structural + governance + audit architecture.\n- **Introduced design:** Pilot representativeness standard \u2014 pilot region requires published 4-dimension assessment; >1 favorable dimension requires second stress-tested region; single favorable region = PILOT only, not ACTIVE. Deadlock resolution timeline \u2014 30d negotiation, 60d published mediation, day 61 CRP binding ruling (14-day SLA); substitute review if CRP is party. Audit epistemic independence \u2014 4-year institutional affiliation bar; domain-diversity requirement; adversarial audit member for I=5 patches (multi-member team, no veto). Anti-gaming constitutional upgrade \u2014 evidence waiver prohibition reclassified Tier 2; urgency bypass now requires H-2 amendment process. Stagnation documentation quality \u2014 3-question review (accurate? progress? resolvable?); structural obstacles trigger bootstrap review not continued documentation. [Ambitious] Bootstrap Resolution Protocol \u2014 minimum viable bootstrap micro-patch for circular dependencies; 2-authority expedited sign-off; auto-sunset; P-008 legibility gap audit as first bootstrap candidate. [Ambitious] FAP concentration controls \u2014 cohort cooling on sign-off cluster; audit body meets AC3.3 diversity standard; independent Article VII monitoring (not Ombuds-managed).\n- **Clauses to integrate:** AG1\u2013AG7. FAP document amended directly. Anti-gaming rules reclassified Tier 2 (H-2 required for amendment). Representativeness criteria added to P-004 protected terms registry.\n- **Dependencies:** P-005 categorical floor extended to include FAP deadlock resolution slot. P-004 protected terms registry extended for representativeness criteria. P-008 AC3.3 epistemic diversity standard referenced for audit body. Article VII AC3.7 concentration dashboard extended for FAP sign-off cluster. Independent concentration monitoring (not Ombuds) required before FAP becomes operative.\n- **New risks introduced:** Two-region pilot requirement increases cost and time; 'close enough' stress-tested region designation risk (mitigated by published representativeness assessment). 60-day deadlock window creates operational gap (mitigated by Annex C-6 emergency patching remaining available as separate pathway). Adversarial auditor produces hostile reports (mitigated by multi-member team). [Ambitious] Bootstrap micro-patch normalized as general bypass channel (mitigated by 2-authority sign-off, survival floor requirement, auto-sunset). [Ambitious] FAP concentration controls risk infinite regress (mitigated by self-executing Article VII publication).\n- **Residual risk:** Evidence farming in stress-tested pilot region remains possible if representativeness assessment criteria are gamed at the definition stage \u2014 criteria require P-004 protection. Deadlock resolution creates new CRP workload at day 61; if CRP is congested (T-005 risk), the deadline may not be met \u2014 P-005 categorical floor must include FAP deadlock as a guaranteed slot. At root: the FAP cannot be made exploitation-proof without being made unusable. P-013 accepts this and chooses calibrated friction over either extreme.\n- **Compound linkages:** T-016 \u00d7 T-005 (deadlock resolution congests CRP; P-005 floor must accommodate). T-016 \u00d7 T-008 (audit capture via intellectual-cousin exploit \u2014 mitigated by AG3). T-016 \u00d7 T-011 (stagnation of critical patches is narrative attack: 'the system cannot fix itself').\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-014 | T-017 | **ACTIVE** | Critical | founding governance + one-time exception |\n\n### P-014 \u2014 P-013 Bootstrap Activation (One-Time Founding Instrument)\n\n**Constitutional text:** [ANNEX_AH.md \u00a7 AH1\u2013AH7](../annexes/ANNEX_AH.md)\n\n**Special status.** P-014 is not a standing patch. It is a one-time founding instrument. It has no standing effect after P-013 reaches ACTIVE. It closes permanently upon P-013 activation.\n\n- **Nature:** One-time founding instrument, not a standing patch. Closes permanently upon P-013 ACTIVE.\n- **Change type:** founding governance + constitutional one-time exception.\n- **Introduced design:** 5-stage process: (1) Pre-activation disclosure \u2014 60-day minimum public challenge window (extended by P-020; see ANNEX_AH.md \u00a7AH2); circular dependency analysis published; founding exception statement from Threat Register Owner; panel composition disclosed before sign-off. (2) Heightened 5-member panel \u2014 Threat Register Owner, 1 CRP reserve member (lot-drawn, not involved in P-013 design), 1 external systems reviewer from outside design-team domain, 1 Ombuds officer, 1 public-interest advocate (lot-drawn). All attest no 5-year affiliation with design team (externally verified). Adversarial member required; dissent published. 4/5 votes required. (3) Substitute evidence \u2014 desk review of 3+ real-world analogue cases; adversarial red-team analysis; scope-limitation certification; sunset compatibility check. (4) Activation and permanent sealing \u2014 P-013 ACTIVE; P-014 closes permanently; full activation record published; non-precedent statement embedded with Tier 2 protection; P-006 and P-009 immediately enter the Formal Acceptance Protocol pilot stage. (5) Post-activation audit within 90 days \u2014 using P-013's own now-operative standards; adversarial member required; if compromised \u2192 P-013 suspended and re-submitted through the now-operative Formal Acceptance Protocol.\n- **Non-precedent statement (Tier 2 protected):** 'P-014 was invoked once, for P-013 only, because no other process was available. It may not be cited as authority for any future activation, exception, or urgency bypass. Any invocation of P-014 logic for any purpose requires H-2 amendment process.'\n- **Clauses to integrate:** AH1\u2013AH7. Annex N/U2 as constitutional anchor.\n- **New risks introduced:** Founding panel subject to capture during pre-activation window (mitigated by 60-day minimum disclosure, lot-drawing, external conflict verification, adversarial member, and the Founding Legitimacy Dossier). Post-activation audit finding of compromise suspends P-013 \u2014 creates a window where the Formal Acceptance Protocol is operative but its governing patch is suspended (mitigated by the prior Formal Acceptance Protocol fallback during suspension; suspension published immediately). Pre-activation disclosure creates a hostile narrative window (mitigated by framing as transparency demonstration).\n- **Residual risk:** Desk review cases may be selected to confirm rather than challenge P-013 \u2014 adversarial member's case selection is the primary control; cases published for independent scrutiny. Second-order self-reference if post-activation audit finds compromise \u2014 accepted as less circular than the original bootstrap problem.\n- **Auto-close clause:** P-014 closes permanently upon P-013 ACTIVE status. No re-opening, no emergency extension, no analogical application. This clause is Tier 2 protected.\n- **Compound linkages:** T-017 \u00d7 T-016 (bootstrap paradox is the exploit surface T-016 bad actors use for indefinite delay of P-013). T-017 \u00d7 T-011 (bootstrap paradox is a narrative attack surface \u2014 P-014 pre-activation disclosure converts it into a transparency demonstration).\n\n---\n\n## P-013 through P-025 \u2014 Founding Mechanics and Attack Surface Closure\n\n*Red-team hardening cycle. Addresses T-018 through T-023 and closes residual risks identified in T-001, T-002, T-017, and the register's own operational security posture.*\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-015 | T-018 / T-019 | **ACTIVE** | High | structural + protocol + escalation path |\n\n### P-015 \u2014 PCRP Attack Surface Hardening\n\n**Constitutional text:** [ANNEX_AP.md](../annexes/ANNEX_AP.md)\n\n- **Change type:** structural + protocol + escalation path.\n- **Addresses:** T-018 (False-Trigger Exhaustion Attack), T-019 (Demand-Context Flag Suppression Attack).\n- **Introduced design:**\n - *False-trigger escalation path (T-018):* False PCRP triggers accompanied by oracle manipulation evidence or coordination timing signatures do not count toward the 3-trigger audit cap \u2014 they escalate immediately to the enforcement track with formal investigation. Cap reset is available via independent audit finding of deliberate manipulation. A \"trigger exhaustion alert\" fires when 2 of 3 cap slots are consumed within a single quarter, prompting pre-emptive review before the third activation.\n - *Demand-context manufactured flag assessment (T-019):* Ombuds co-certification during demand-context periods must include an explicit assessment of whether the triggering enforcement action was manufactured or strategically timed; this assessment is a required step with a defined 4-hour timeline, not an optional judgment. A cross-register timing monitor flags any enforcement action initiated within 48 hours of sentinel indicator movement \u2014 this does not block the enforcement action but elevates scrutiny on any resulting demand-context flag. If Ombuds finds deliberate flag manufacture, the demand-context designation is lifted and PCRP activation proceeds at standard scope.\n - *Ombuds constitution pre-condition:* Annex AI (Federated Ombuds constitution) specifies explicit authority, decision criteria, and the 4-hour determination timeline for manufactured-flag assessments. **Annex AI is a pre-launch blocking gate \u2014 P-015 is not operative until at least four of five sub-Ombuds are appointed, challenged, and seated, and the Ombuds Oversight Assembly is seated.**\n- **Clauses to integrate:** AP1\u2013AP4. Amends AC2.3 (false-trigger cap rules). Amends AE2.4 (demand-context Ombuds certification procedure). See Annex AI for full Ombuds mandate and independence requirements.\n- **Dependencies:** Federated Ombuds formally constituted per Annex AI (at least four of five sub-Ombuds seated, Oversight Assembly seated, manufactured-flag criteria published). P-006 PCRP false-trigger tracking infrastructure operative. P-012 demand-context flag register operative. Cross-register timing monitor (Annex AI Section 3.3) technically implemented and tested.\n- **New risks introduced:** False-trigger escalation path can be weaponized in reverse \u2014 a genuine false trigger attributed to manipulation to avoid the audit cap. Mitigated by: escalation requires two independent evidence types (oracle manipulation evidence AND timing cluster), not a single officer judgment. Manufactured-flag assessment timeline (4 hours) creates pressure that could produce errors; mitigated by conservative default (maintain demand-context designation while assessment runs, but PCRP can activate at reduced scope with single-source authorization).\n- **Residual risk:** Real-time distinction between genuine oracle failure and engineered false trigger remains unreliable; escalation path applies retroactively. Low-level demand-context flag suppression using a genuinely valid enforcement action remains possible \u2014 accepted as operational leakage below detection threshold.\n- **Compound linkages:** T-018 \u00d7 T-019 (compound PCRP attack \u2014 both simultaneously executed is highest-risk scenario; P-015 must address the compound case explicitly). T-018 \u00d7 T-013 (audit load from false-trigger investigation consumes CRP capacity).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-016 | T-002 | **PROPOSED** | Critical | constitutional commitment + quantified doctrine |\n\n### P-016 \u2014 Identity Asymmetric Error Doctrine\n\n**Constitutional text:** [ANNEX_AK.md](../annexes/ANNEX_AK.md)\n\n- **Change type:** constitutional commitment + quantified doctrine.\n- **Status basis:** **PROPOSED / pre-ratification** for deploy-state; **designed, needs evidence** for maturity. Annex AK is incorporated as the live design candidate, but P-016 is not evidence-backed and not ratified into a founding until the founding coalition adopts the doctrine, confirms pilot-calibrated rates, and binds remaining FC values.\n- **Addresses:** T-002 \u2014 calibrating fraud tolerance without making the system unusable for vulnerable populations. Extends P-003.\n- **Introduced design:** The founding coalition must publish and formally adopt an **Asymmetric Error Doctrine** (AED) as a Tier 2 founding commitment before deployment. The AED must specify:\n - (a) Maximum acceptable fraud rate per instrument tier (Essential Access, Voice, Service Record) \u2014 expressed as a percentage of enrolled population per quarter, with confidence interval.\n - (b) Maximum acceptable exclusion rate for vulnerable populations (displaced, undocumented, digitally fragile persons) per tier \u2014 expressed as a percentage of estimated vulnerable population.\n - (c) The review trigger when either rate is exceeded \u2014 automatic publication and independent audit within 30 days.\n - (d) The decision rule when the two error types trade off: when reducing fraud exclusion would increase vulnerable-population exclusion by more than a specified ratio, the exclusion reduction takes priority unless the fraud rate exceeds a specified ceiling.\n - (e) Annual recalibration review by an independent panel with at least one member from a vulnerable-population advocacy organization.\n- **Clauses to integrate:** AK1\u2013AK5. Annex B (identity architecture) extended. AED added to P-004 protected terms registry. Founding preconditions checklist extended (Annex N).\n- **Dependencies:** Identity system operational data required for calibration. AED is therefore a Tier 2 design commitment at founding: FC-140 through FC-145 have bound starting values, FC-146 through FC-150 remain pre-launch commitments, and all values must be tested before scale-up. The commitment to publish and honor the doctrine is the founding obligation; passing the evidence gates is the scale-up obligation.\n- **New risks introduced:** Quantified targets create goodhart's-law gaming \u2014 operators optimize to the metric rather than the underlying goal. Mitigated by: AED specifies both rates and requires independent measurement (not self-reported). Published targets also create narrative attack surface (\"the system allows X% fraud\"). Mitigated by: pre-committed publication converts this from a vulnerability into a transparency demonstration consistent with P-011.\n- **Residual risk:** Some exclusion is structurally unavoidable with any identity system. The AED does not solve this; it makes the trade-off explicit and governable rather than implicit and subject to political manipulation.\n- **Compound linkages:** T-002 \u00d7 T-011 (AED publication is a narrative attack surface \u2014 simultaneously the correct response). T-002 \u00d7 T-008 (vulnerable population exclusion rates must be tracked independently from the same bodies that operate the identity system \u2014 Ombuds Office or equivalent).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-017 | T-020 / T-021 | **ACTIVE** | Critical | measurement architecture + accreditation + supply-chain transparency |\n\n### P-017 \u2014 Oracle Epistemological and Algorithmic Independence\n\n**Status: ACTIVE (promoted 2026-04-18 via Proposal 3 close-out).** Numerical floors bound in `/founding/commitments.md` FC-030 (N\u22655), FC-031 (\u22653 methodology classes), FC-032 (pairwise correlation \u22640.30), FC-033 (\u22651 adversarial seat), FC-100 (14-day quorum-loss restoration window). Annex AL promoted to ACTIVE with its former founding-parameter slots fully bound.\n\n**Constitutional text:** [ANNEX_AL.md](../annexes/ANNEX_AL.md)\n\n- **Change type:** measurement architecture + accreditation standards + supply-chain transparency.\n- **Addresses:** T-020 (Epistemological Oracle Capture), T-021 (Algorithmic Oracle Capture).\n- **Introduced design:**\n - *Methodology-class diversity mandate (T-020):* RCS accreditation must include at least one measurement node per high-volatility essential category using a fundamentally different methodology class (e.g., community-based participatory research vs. institutional statistical modeling vs. independent physical sampling). The specific methodology classes are defined as a P-004 protected term (Annex AL \u2014 \"methodology class\" definition with worked examples).\n - *Methodological divergence signal (T-020):* Systematic divergence between methodology classes is a first-order sentinel indicator requiring investigation, not an anomaly requiring suppression. A divergence above a defined threshold triggers an independent methodological review before that category can be used for Shared Storehouse activation.\n - *Standards-funding transparency (T-020):* Any RCS-accredited node must disclose funding sources for the methodological standards it relies on, with a three-year lookback. Funding from parties with material interest in oracle outputs triggers additional scrutiny.\n - *Anti-monoculture review trigger (T-020):* If three or more oracle nodes rely on the same standards body for a given category, an independent methodological review is required before that category can be used for Shared Storehouse activation.\n - *AI supply chain transparency (T-021):* Any oracle node using ML or AI components must disclose model provenance, training data sources, and any shared upstream dependencies with other oracle nodes. This disclosure is published and part of the independence certification.\n - *Algorithmic independence certification (T-021):* Oracle independence audit must include explicit verification that no two corroborating oracle nodes share a common upstream AI model, training dataset, or fine-tuning pipeline, and that formally independent nodes are not producing same-direction material errors that evade FC-032 pairwise-correlation checks.\n - *Physical ground-truth requirement (T-021):* At least one measurement node per high-volatility category must use direct physical sampling (not model-derived estimates) as its primary measurement method.\n- **Clauses to integrate:** AL1\u2013AL7. Annex M (oracle architecture) extended. \"Methodology class\" and \"algorithmic independence\" added to P-004 protected terms registry per Annex AL. RCS accreditation standards document updated.\n- **Dependencies:** Annex AL (methodology-class definitions) published and initial methodology-class registry populated before first oracle set is accredited. **Annex AL is a pre-launch blocking gate \u2014 P-017 is not operative until the methodology-class registry is published and the standards-body concentration tracking system is built.** P-004 protected terms registry must be operative. Oracle independence audit capacity must include algorithmic supply chain review \u2014 new capability requirement. Physical sampling for high-volatility categories requires resource commitment from founding coalition.\n- **New risks introduced:** Methodology-class diversity requirement increases oracle system cost and coordination complexity. Physical sampling is expensive; cost pressure may produce under-investment that weakens the ground-truth requirement over time \u2014 addressed by Article VII publication of sampling frequency and method per category. AI supply chain disclosure creates competitive sensitivity concerns for oracle node operators \u2014 mitigated by: disclosure is to auditors, not publicly; methodology-level information is published but not proprietary implementation details.\n- **Residual risk:** Defining \"fundamentally different methodology class\" is subject to T-007 definition drift. Pairwise correlation alone can miss directional bias, so Annex AL now requires direction-of-error review and adversarial-seat certification before activation votes. Small pilot populations can also overclaim independence; Cohort 1 requires a small-population oracle plan if below 500 persons. Annex AL Sections 1 and 2 are P-004 protected; Sections 3 and 4 are updated through annual audit (Annex AL Section 5). The annual review panel must include an adversarial methodologist whose role is to find exploitation paths in the current definitions.\n- **Compound linkages:** T-020 \u00d7 T-021 (both target oracle epistemological foundations; P-017 addresses both). T-020 \u00d7 T-012 (structural oracle independence is necessary but not sufficient; P-017 adds the epistemological layer). T-020 \u00d7 T-008 (epistemic monoculture in oracle methodology parallels elite formation in oversight \u2014 P-008 and P-017 share the diversity-mandate logic).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-018 | T-022 | **PROPOSED** | Critical | constitutional architecture + political durability |\n\n### P-018 \u2014 Electoral Cycle Resilience\n\n**Constitutional text:** [ANNEX_AM.md](../annexes/ANNEX_AM.md)\n\n- **Change type:** constitutional architecture + political durability + transition protocol.\n- **Addresses:** T-022 (Electoral Cycle Capture).\n- **Introduced design:**\n - *Entrenchment ladder (direct repeal route):* Tier 1 invariants require not just a legislative supermajority but concurrent ratification by an independent constitutional body. The constitutional body's composition must be specified at founding such that it cannot be reconstituted entirely by the governing coalition within a single electoral term.\n - *Essential Access floor minimum persistence (administrative hollowing route):* A minimum Essential Access floor \u2014 defined at founding as 70% of the founding basket \u2014 is constitutionally self-executing: it does not require legislative appropriation and cannot be suspended by executive action. This floor persists through any governing coalition transition unless repealed via the full Tier 1 amendment process.\n - *Administrative hollowing triggers:* If a founding institution is unfilled for more than 90 days, or post-mortem publication lapses for more than 30 days, or oracle accreditation count drops below a specified minimum, an automatic constitutional review is triggered that does not require the governing coalition's initiation. The review is initiated by the constitutional body and is self-executing.\n - *Transition continuity protocol:* When a new governing coalition takes office, a mandatory 180-day transition audit is required before any changes to Tier 2 or Tier 1 provisions. The audit is conducted by the constitutional body, not the incoming government. During the 180-day window, no Tier 2 or higher changes may be made except through emergency deadlock resolution (P-012 AE2.3).\n - *Treaty override protection (jurisdictional fragmentation route):* International agreements that require modification to the non-convertibility architecture trigger a mandatory Tier 2 impact assessment before ratification. An agreement that would produce cumulative Tier 2 impact (by T-007/P-012 cumulative drift trigger standards) requires the full Tier 2 amendment process for each applicable provision.\n- **Clauses to integrate:** AM1\u2013AM6. Tier 1 amendment process modified (Annex A). Essential Access floor persistence clause added to Article IV. Administrative hollowing triggers added to the Article VII dashboard as auto-publication requirements. Transition continuity protocol added to the operational layer.\n- **Dependencies:** Independent constitutional body formally constituted at founding with staggered terms and confirmed independence from governing coalition appointment. Essential Access floor minimum definition requires RCS capacity confirmation.\n- **New risks introduced:** Self-executing Essential Access floor minimum requires RCS capacity to be maintained regardless of political will \u2014 if oracle system degrades, the self-executing floor has no measurement basis. Mitigated by: oracle degradation itself triggers an administrative hollowing review. Transition continuity audit creates 180-day governance window \u2014 addressed by: audit has a defined 30-day maximum scope for routine transitions; extensions require independent authorization.\n- **Residual risk:** A government with sufficient political will and supermajority can repeal constitutional entrenchment. The designed defense buys time and raises political cost; it cannot prevent determined repeal. Ultimate residual risk: protocol durability depends on political culture. No design can substitute for a political culture that values the commitments.\n- **Compound linkages:** T-022 \u00d7 T-011 (hostile electoral success often follows narrative attack \u2014 P-011 and P-018 are jointly necessary). T-022 \u00d7 T-008 (elite formation inside institutions may assist administrative hollowing by a hostile government). T-022 \u00d7 T-017 (T-022 success produces a new bootstrap problem \u2014 recursive T-017). T-022 \u00d7 T-016 (hostile government can capture FAP sign-off authorities).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-019 | T-023 | **ACTIVE** | Med-High | evidence architecture + scale-up gating |\n\n### P-019 \u2014 Pilot External Validity Gate\n\n**Constitutional text:** [ANNEX_AN.md](../annexes/ANNEX_AN.md)\n\n- **Change type:** evidence architecture + scale-up gating + simulation mandate.\n- **Addresses:** T-023 (Pilot External Validity Collapse).\n- **Introduced design:**\n - *Stress-condition pilot gate:* Scale-up approval requires the pilot evidence record to include at least one each of: an economic stress event (recession, significant unemployment spike, or supply price shock affecting the pilot region); a compound supply disruption (two or more essential categories simultaneously below adequate levels); and documented operation during a formal political opposition campaign against the system. Where a condition could not be tested in the pilot, the evidence record must include: (a) explicit documentation of why it could not be tested; (b) a designated substitute evidence source (e.g., analogous case from another jurisdiction, red-team analysis); (c) a residual-risk statement acknowledging the gap; and (d) a post-scale monitoring commitment specific to the untested condition.\n - *Red-team challenge window (T-016 companion):* Before any scale-up vote, a mandatory 30-day adversarial challenge window allows independent reviewers to contest the external validity of the evidence base. Challengers must have access to the full evidence record, not just the summary. Responses to challenges are published before the vote.\n - *Crisis simulation mandate:* The Annual Compound Simulation must include at least one compound-crisis scenario not previously simulated before each scale-up gate. The talent drain scenario and civic legibility scenario fulfill this requirement for the first scale-up gate only.\n- **Clauses to integrate:** AN1\u2013AN5. FAP (Formal Acceptance Protocol) extended \u2014 scale-up gate conditions added to evidence requirements. Annex T (simulation mandate) extended. P-013 representativeness standard cross-referenced (stress-condition pilot is a representativeness requirement).\n- **Dependencies:** Annual Compound Simulation must be updated to include new scenarios before each scale-up gate. Red-team challenge window requires independent reviewer access infrastructure.\n- **New risks introduced:** Stress-condition requirement may delay scale-up indefinitely if adverse conditions do not occur in the pilot region within a reasonable window. Mitigated by: substitute evidence pathway is explicitly available; the requirement is for good-faith engagement with external validity, not for a manufactured crisis. Red-team challenge window creates a blocking mechanism \u2014 mitigated by: challengers must propose specific residual-risk mitigations, not merely object.\n- **Residual risk:** Some external validity gaps cannot be filled by any pilot. A deliberately engineered crisis to satisfy the stress-condition requirement would satisfy the letter but not the spirit of P-019. Ultimate residual risk: the evidence base for a system of this scale will always be incomplete.\n- **Compound linkages:** T-023 \u00d7 T-016 (honest insufficient pilot is the complement to dishonest evidence farming \u2014 both require evidence quality controls). T-023 \u00d7 T-011 (scale-up failure after smooth pilot is a maximum-impact narrative attack). T-023 \u00d7 T-022 (hostile electoral challenge is one of the hardest conditions to include in a controlled pilot; substitute evidence pathway must address this explicitly).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-020 | T-017 | **ACTIVE** | Critical | founding governance + window extension |\n\n### P-020 \u2014 Founding Window Extension\n\n**Constitutional text:** [ANNEX_AH.md \u00a7 AH2.1\u2013AH2.4](../annexes/ANNEX_AH.md)\n\n- **Change type:** founding governance amendment \u2014 extends P-014 Annex AH.\n- **Addresses:** T-017 residual risk \u2014 14-day pre-activation disclosure window is insufficient for independent critique to organize against a coordinated founding capture attempt.\n- **Introduced design (Annex AH2, amending AH1):**\n - *60-day pre-activation disclosure (replacing 14-day):* The P-014 pre-activation challenge window is extended from 14 days to 60 days minimum. The 60-day clock begins when the circular dependency analysis, founding exception statement, and panel composition are simultaneously published. No stage of P-014 may proceed until the 60-day window closes with no unresolved structural objections requiring response.\n - *Oppose-coalition adversarial member nomination:* The adversarial panel member required by P-014 may not be appointed by the same nominating process as the other four panel members. The adversarial member must be nominated by a body that is structurally opposed to or independent from the founding coalition's interests \u2014 specifically: (a) a civil liberties or human rights organization not affiliated with the founding coalition; (b) a registered opposition political party or civic organization; or (c) an independent academic institution with no material funding relationship with founding coalition members. The nominating body's selection rationale must be published as part of the founding record.\n - *Objection response requirement:* Any structural objection submitted during the 60-day window that identifies a specific P-013 standard not met by the P-014 process must receive a written response from the founding panel before the window closes. Unresponded objections extend the window by 14 days, non-cumulatively.\n- **Non-precedent statement (extends AH1 Tier 2 protection):** 'P-020 amends P-014. The 60-day window and oppose-coalition nomination are P-014 requirements only. They do not set a precedent for other patch activations, emergency processes, or governance decisions. Any invocation of P-020 logic for any other purpose requires H-2 amendment process.'\n- **Clauses to integrate:** AH2.1\u2013AH2.4. P-014 founding checklist extended. Annex N founding preconditions updated.\n- **Dependencies:** Oppose-coalition nominating body must be identified before P-014 stage 1 begins. 60-day window requires that the founding timeline allow for this \u2014 founding planning should budget 90 days for the P-014 process from first public disclosure to panel sign-off.\n- **New risks introduced:** 60-day window provides more time for coordinated opposition to manufacture procedural objections that are technically valid but strategically motivated. Mitigated by: objection response requirement specifies that only structural objections (identifying a specific P-013 standard not met) require response; procedural objections without structural grounding do not extend the window. Oppose-coalition nomination process requires identifying a legitimate opposition body \u2014 in contexts without organized opposition, this may be difficult. Mitigated by: the three pathways (civil liberties org, opposition party, academic institution) provide alternatives.\n- **Residual risk:** A 60-day window with published panel composition still allows founding panel capture if the oppose-coalition nomination process is itself captured. Ultimate residual: founding legitimacy depends on the quality of the political culture and civil society present at the founding moment. No procedural design fully compensates for absent civil society.\n- **Compound linkages:** T-017 \u00d7 T-022 (T-022 attack recurs as T-017 after a successful dismantling \u2014 P-020 hardened founding reduces risk of both initial capture and post-T-022 refounding capture). T-017 \u00d7 T-011 (60-day public window converts founding moment into sustained transparency demonstration).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-021 | \u2014 | **ACTIVE** | High | register architecture + disclosure policy |\n\n### P-021 \u2014 Register Disclosure Protocol\n\n**Constitutional text:** [ANNEX_AO.md](../annexes/ANNEX_AO.md)\n\n- **Change type:** register architecture + operational security + transparency calibration.\n- **Addresses:** Open threat register as attack surface \u2014 the current register publishes specific detection thresholds, timing windows, and exploit paths that constitute an operational manual for sophisticated attackers. This is not a new threat ID (the vulnerability is architectural, not a distinct attack class); it is a structural change to how the register is maintained.\n- **Introduced design:** The register is bifurcated into:\n - *Public Register:* Threat categories, mechanisms (described at class level, not with specific thresholds), mitigation approaches, residual risks, risk scores, and compound linkages. The public register is published in the open GitHub repository and is the primary accountability and transparency artifact. The current `Threat_Register.md` is the public register.\n - *Restricted Register Annex:* Specific detection thresholds (e.g., exact trigger counts and time windows), precise timing windows for exploitation, operational detection patterns and signatures, and calibration data used to set automated alerts. The Restricted Annex is available to: credentialed auditors under NDA; adversarial panel members in the P-013/P-014 acceptance process; the constitutional review body; and Ombuds Office staff. It is not published publicly. It is version-controlled privately with access logs.\n - *Consistency requirement:* Both versions must be updated simultaneously. Any discrepancy between the public and restricted versions triggers a T-007 definition-drift review. The restricted version is the authoritative operational document; the public version is the transparency artifact.\n - *Reclassification review:* Annually, the Threat Register Owner reviews whether any restricted-version content can be declassified to the public version (because the window of operational sensitivity has passed) or whether any public-version content should be reclassified to restricted (because specific operational details have been added).\n- **Clauses to integrate:** AO1\u2013AO5. Annex AO (Register Disclosure Protocol) \u2014 see `docs/annexes/ANNEX_AO.md`. P-004 protected terms registry: 'restricted annex' and 'public register' defined.\n- **Dependencies:** Restricted Annex infrastructure (private version-controlled repository with access controls) must be established before P-021 is operative. Threat Register Owner role must be formally constituted with authority to manage both versions.\n- **New risks introduced:** Bifurcation creates an accountability gap \u2014 the public cannot verify that the restricted version is consistent with stated mitigations. Mitigated by: credentialed auditors can access restricted version and publish a consistency attestation (not the content) annually. Restricted version existence itself creates an information asymmetry that could be used to claim mitigations are more robust than they are. Mitigated by: consistency attestation is published; any disclosed gap between public claims and restricted reality is a T-007 event.\n- **Residual risk:** The bifurcation design assumes that restricted content stays restricted. Leaks are possible. The design accepts this and treats the restricted version as reducing adversarial advantage, not eliminating it \u2014 full security through obscurity is not the goal.\n- **Compound linkages:** P-021 \u00d7 T-011 (restricted register removes some transparency \u2014 P-021 must be communicated publicly as a deliberate operational security choice, not a transparency failure, or it becomes a narrative attack surface).\n\n---\n\n## P-022 through P-023 \u2014 Operational Gap Closure\n\n*Operational gap closure (P-022) and design-discussion registration (P-023).*\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-022 | T-024 | **ACTIVE** | Critical | protocol + authority definition + FC-100 restoration verification + reconciliation |\n\n### P-022 \u2014 Shared Storehouse Oracle-Failure Fallback Protocol\n\n**Status: ACTIVE (promoted 2026-04-18 via Proposal 6 close-out).** FC-100 `ORACLE_QUORUM_LOSS_RESTORATION_WINDOW` = 14 days bound in `/founding/commitments.md`. Annex AQ promoted to ACTIVE with full protocol detail, survival floor unconditionality confirmed, Reconciliation Review specified.\n\n**Constitutional text:** [ANNEX_AQ.md](../annexes/ANNEX_AQ.md)\n\n- **Change type:** protocol + authority definition + oracle reconciliation procedure.\n- **Addresses:** T-024 (Shared Storehouse Oracle-Failure During Active Rationing) \u2014 the operational void where Shared Storehouse is active and the oracle system fails, loses quorum, or enters an unresolvable dispute with no defined decision path.\n- **Introduced design:**\n - *Conservative hold default:* When the oracle system loses quorum or enters an unresolvable dispute while Shared Storehouse is active, Shared Storehouse holds at its current activation level. No escalation. No expansion to new categories. No automatic lapse. The conservative hold is the designed default \u2014 not doing nothing, but doing the least-harm thing until authority is restored.\n - *48-hour REB first-responder window:* The Regional Executive Body (REB), using its existing P-006 first-responder authority, may issue a provisional continuation or provisional lapse within 48 hours of oracle failure based on non-oracle physical indicators: distribution fill rates, vendor inventory reports, and logistics data. The REB decision is published immediately with the full evidence base. The REB may not expand Shared Storehouse scope under this authority \u2014 only hold or begin a managed lapse. Expansion requires oracle quorum.\n - *72-hour governance handoff:* If the oracle system is not restored within 72 hours of failure, the matter transfers to the emergency deadlock resolution protocol (P-012 AE2.3) for a binding decision. The 3-member arbitration panel has authority to issue a time-bound Shared Storehouse continuation or staged lapse. The survival floor bridge (P-012 AE2.3) is unconditional throughout oracle failure \u2014 Essential Access baseline access is never contingent on oracle availability.\n - *Oracle restoration reconciliation:* When the oracle system begins restoration, a mandatory 24-hour preliminary reconciliation notice names restored-node status, unresolved discrepancies, and any provisional REB decision that appears inconsistent with restored readings. After the 14-day FC-100 verification window, a final Reconciliation Review is published within 7 days with root-cause analysis. Persistent REB-oracle divergence triggers an independent review of the non-oracle physical indicator methodology.\n - *Deliberate-failure escalation:* If oracle failure during active Shared Storehouse is found to be deliberately engineered (oracle manipulation evidence per T-012/T-018), the matter escalates immediately to enforcement \u2014 the conservative hold and first-responder window both continue, but the investigation runs in parallel without waiting for oracle restoration.\n- **Clauses to integrate:** AQ1\u2013AQ5. Amends Annex U (Shared Storehouse termination and continuation procedures). Amends AC2 (P-006 PCRP/REB authority \u2014 Shared Storehouse oracle failure is a distinct REB authority from PCRP). Article VII dashboard extended: oracle status must include a live Shared Storehouse-active indicator so oracle failure during active Shared Storehouse is publicly visible in real time.\n- **Dependencies:** REB formally constituted with defined authority for non-oracle physical indicator assessments. Non-oracle physical indicator methodology must be published and reviewed annually. P-012 AE2.3 emergency deadlock protocol must be operative before P-022 is operative.\n- **New risks introduced:** REB use of non-oracle physical indicators creates a soft-oracle channel not subject to the independence requirements of the main oracle system. Mitigated by: (1) REB authority under P-022 is explicitly scoped to hold-or-lapse decisions only \u2014 no scope expansion; (2) REB decisions are published immediately with evidence base; (3) reconciliation review after oracle restoration creates accountability for REB accuracy; (4) the non-oracle indicator methodology is published and periodically reviewed. Risk: consistent REB-oracle agreement could be engineered by an adversary who also controls the physical indicator sources. Mitigated by: physical indicators (fill rates, inventory reports) are collected from distributed vendor networks \u2014 harder to simultaneously compromise than a concentrated oracle system.\n- **Residual risk:** A deliberate oracle failure timed to active Shared Storehouse, combined with physical indicator manipulation, could force a harmful REB decision during the 48-hour window. This is the highest-consequence compound attack on the Shared Storehouse system. The 72-hour governance handoff provides a backstop, but 72 hours of incorrect Shared Storehouse operation during a genuine shortage is a real harm. Accepted as the best available outcome given the operational constraint that a governance decision cannot be made faster than the arbitration panel can convene.\n- **Compound linkages:** T-024 \u00d7 T-006 (P-022 extends P-006 to cover oracle failure during Shared Storehouse \u2014 P-006 covers measurement lag; P-022 covers measurement absence). T-024 \u00d7 T-014 (triple deadlock during Shared Storehouse oracle failure is the worst-case scenario \u2014 survival floor bridge must be explicitly unconditional regardless of deadlock status). T-024 \u00d7 T-018 (deliberate false-trigger exhaustion designed to overlap with active Shared Storehouse is the highest-risk T-018 compound).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-023 | T-025 | **ACTIVE** | High | Contract-commitment architecture / protected-capital shelter control |\n\n### P-023 \u2014 Contract-Commitment Architecture (Protected-Capital Shelter Control)\n\n- **Status:** ACTIVE\n\n**Constitutional text:** [ANNEX_AR.md](../annexes/ANNEX_AR.md)\n\n- **Evidence package:** [Commons Return and Universal Stake Evidence Test Package](./Commons_Return_Universal_Stake_Evidence_Test_Package.md), plus Annex AR project-finance simulation and procurement red team.\n- **Threat addressed:** T-025 (Investment and Capital-Deployment Shelter Capture).\n- **Direction adopted:** Direction B \u2014 deployment-speed architecture. Investment-channel exemptions are removed entirely. Genuine long-horizon capital needs are served by contract-commitment architecture; protected-capital status requires real deployment, public accounting, and source-base review where Commons Return is implicated.\n- **Red-team pre-analysis:** Ten attack vectors identified and resolved before this patch was written. Vectors: (1) escrow control ambiguity, (2) milestone definition gaming, (3) \"working capital\" as new exemption label, (4) advance procurement rebranded as hoarding, (5) subcontractor chain gaming, (6) essential-sector carve-out pressure, (7) multi-jurisdiction pooling ambiguity, (8) force majeure as wedge for permanent exemptions, (9) sector definitional creep, (10) milestone oracle capture. All resolved in patch rules below.\n\n**P-023.1 \u2014 Zero Shelter Principle**\nNo entity, sector, or project type receives protected-capital shelter by label. The investment-channel exemption architecture from the original P-002 design is deprecated. The concept of \"investment-channel status\" is removed. No project account, escrow window, term pool, infrastructure label, or public-benefit designation may shield idle control from deployment review or Annex D source-base review.\n\n**P-023.2 \u2014 Contract-Commitment Architecture**\nLong-horizon projects are financed through milestone escrow:\n- The commissioning authority deposits Flow into an independent escrow account at project initiation.\n- Deployment-window review, public reporting, and Annex D source-base review apply to escrowed Flow. The commissioning authority bears accountability for delay, creating institutional incentive for timely contracting and completion.\n- Flow is released to the contractor only upon independently verified milestone completion.\n- The contractor holds only current working capital. Protected-capital shelter is unavailable without verified physical deployment.\n\n**P-023.3 \u2014 Independent Escrow Agent**\nEscrow accounts are administered by an independent escrow agent designated by the CRP. The contractor, any entity in the contractor's supply chain, and any entity with a financial interest in the project's outcome may not administer, co-administer, or materially influence the escrow account.\n\n**P-023.4 \u2014 Output Milestone Standard**\nMilestones eligible to trigger escrow releases must satisfy all of the following:\n- Physical deliverables only \u2014 no process milestones, no self-certified planning stages, no administrative completions.\n- Independently inspected and certified by a rotating inspector pool; the contractor does not select inspectors. Pool is administered by the escrow agent under P-017 oracle-independence standards.\n- Defined at contract signing and P-004-locked. No renegotiation of milestone definitions after contract execution.\n- High-value releases (above the threshold defined in Annex AR) require multiple independent verifiers and physical inspection with full audit trail.\n\n**P-023.5 \u2014 Procurement Clarification**\nAdvance procurement of materials means actual purchase: Flow exits the contractor's hands at the transaction. Holding Flow \"in reserve for future procurement\" without a bound deliverable is protected-capital sheltering and receives no protective treatment. Supply chain uncertainty is addressed through competitive procurement, staged purchasing, and futures commitments \u2014 not indefinite balance reserves.\n\n**P-023.6 \u2014 Universal Scope**\nP-023 applies at every tier of the supply chain: prime contractors, subcontractors, sub-subcontractors, and all entities receiving Flow for project work are subject to the same architecture. There is no sector-specific carve-out. Eligibility for contract-commitment structure is determined by deliverable characteristics (verifiable physical milestones + commissioning authority), not sector identity.\n\n**P-023.7 \u2014 Mandatory Deployment Timeline (Commissioning Authorities)**\nCommissioning authorities must contract idle escrowed funds within the deployment window defined in Annex AR. Funds held beyond this window without active contracting trigger mandatory CRP review. Review and publication continue regardless of whether any dormant backstop has been activated. This is an accountability mechanism, not an exemption.\n\n**P-023.8 \u2014 Multi-Jurisdiction Lead Authority**\nFor projects with multiple commissioning authorities pooling Flow, a lead authority must be designated at contract signing. The lead authority bears accountability for pooled escrow delay, publication, and review. Internal cost-sharing between participating authorities is a private arrangement; external accountability runs through the lead authority only.\n\n**P-023.9 \u2014 Force Majeure Escrow Freeze**\nVerified external delays may trigger a temporary freeze of deployment-delay consequences:\n- Qualifying events: permitting delays attributable to regulatory bodies outside the project's control; certified supply chain disruptions (independent third-party certification required); declared natural disasters.\n- Process: contractor applies with documented evidence; an independent assessment panel certifies the external cause and its temporal scope. Panel composition and selection use P-017 oracle-independence standards.\n- Effect: deployment-delay consequences on the affected escrow account are paused for the certified duration only.\n- Limits: freeze is time-limited to the verified external condition; total cumulative freeze time per project is capped at the period defined in Annex AR; freeze does not stack across overlapping events.\n- Gaming deterrent: misrepresentation in a freeze application is an audit trigger and grounds for contractor disqualification from future escrow eligibility.\n\n**P-023.10 \u2014 P-004 Protected Terms**\nThe following terms are added to the P-004 protected vocabulary: *milestone*, *physical deliverable*, *commissioning authority*, *independent escrow agent*, *force majeure* (for protocol purposes), *lead authority*, *verified external delay*, *deployment window*. Definitions may not be modified without a Tier 2 (H-2) amendment.\n\n- **Risk introduced:** (1) Force majeure certification panel is a new oracle \u2014 capture target per T-020/T-021; mitigated by P-017 independence requirements. (2) Mandatory deployment timelines may pressure commissioning authorities to rush contracting rather than hold idle; mitigated by requiring contracts to pass standard procurement integrity checks before they satisfy the timeline. (3) Inspector pool is a new oracle; mitigated by rotating pool under P-017 standards and escrow-agent administration. (4) P-023.4 output-only milestone standard may be challenged as too rigid for novel infrastructure categories; mitigated by P-004 protection \u2014 any redefinition requires H-2 amendment, raising the cost of definitional drift.\n- **Annex:** AR (contract-commitment architecture specification \u2014 high-value release thresholds, deployment window periods, force majeure cumulative freeze cap, inspector pool governance, escrow agent designation process).\n- **Compound linkages:** T-025 \u00d7 T-001 resolved (no investment-channel exemptions means no above-ledger boundary manipulation through exemption classification). T-025 \u00d7 T-007 mitigated (P-004 protection on all P-023.10 terms). T-025 \u00d7 T-008 mitigated (no classification to capture \u2014 sector identity is irrelevant to escrow eligibility).\n\n---\n\n## Operating Rules for the Patch Log\n\n- Every future patch must reference a threat ID and specify the new risk it creates.\n- If a patch only exists in the log and not in the Humane Constitution, it is not yet operative.\n- If a patch changes public explanation, the white paper and technical reference must be synced in the same cycle.\n- When a patch materially changes user experience or institutional authority, the diagram set must be updated too.\n- **PROPOSED** patches become ACTIVE only after formal Humane Constitution integration and oversight sign-off.\n- If two patches conflict, the conflict belongs in the patch log and must be resolved explicitly in the Humane Constitution.\n\n---\n\n## Current Threat/Patch Linkage\n\nThis table is the single source of truth for threat\u2192patch traceability. It covers every patch in the current inventory through P-077. Reserved IDs (P-007, P-010, P-028, P-071) and the draft-only P-063 review packet are listed in the Reserved / Never-Assigned Patch IDs table above. \"Multiple\" has been replaced with enumerated threat (or PRD-/IC-/INV-/ACL-) references throughout; patches with no standalone threat row are marked \"structural \u2014 no threat row.\"\n\n| Threat ID | Patch ID | Status | Master Reference |\n| :--- | :--- | :--- | :--- |\n| T-001 | P-001 | **ACTIVE** | Annex AB |\n| T-004 | P-002 | **ACTIVE** | Annex AB |\n| T-002 | P-003 | **ACTIVE** | Annex AB |\n| T-007 | P-004 | **ACTIVE** | Annex AB |\n| T-005 | P-005 | **ACTIVE** | Annex AC1 |\n| T-006 | P-006 | **ACTIVE** | Annex AC2 |\n| T-008 | P-008 | ACTIVE | Annex AC3 (operative authority superseded by P-025 ACTIVE) |\n| T-009 | P-009 | **ACTIVE** | Annex AF |\n| T-011 | P-011 | **ACTIVE** | Annex AD |\n| T-012\u2013T-015 | P-012 | **ACTIVE** | Annex AE |\n| T-016 | P-013 | **ACTIVE** | Annex AG |\n| T-017 | P-014 | **ACTIVE** | Annex AH |\n| T-018 / T-019 | P-015 | **ACTIVE** | Annex AP \u00b7 Annex AI |\n| T-002 | P-016 | ACTIVE | Annex AK (P-016 is pre-ratification design) |\n| T-020 / T-021 | P-017 | **ACTIVE** | Annex AL \u00b7 FC-030/031/032/033/100 |\n| P-018 | T-022 supplement | **PROPOSED** | Annex AM |\n| T-023 | P-019 | **ACTIVE** | Annex AN |\n| T-017 | P-020 | **ACTIVE** | Annex AH2 |\n| structural \u2014 no threat row (register disclosure protocol) | P-021 | **ACTIVE** | Annex AO |\n| T-024 | P-022 | **ACTIVE** | Annex AQ \u00b7 FC-100 |\n| T-025 | P-023 | **ACTIVE** | Annex AR |\n| T-009 / TR-07 / T-018 | P-024 | **ACTIVE** | Annex AS \u00b7 FC-080/081/082 |\n| T-008 | P-025 | **ACTIVE** | Annex AI \u00b7 FC-090/091/092 |\n| T-026 / T-027 | P-026 | **ACTIVE** | `founding/order/` \u00b7 FC-120/121/122 |\n| T-005 / T-008 | P-027 | **ACTIVE** | `Humane_Constitution.md` \u00b7 `docs/public/04_white_paper.md` |\n| T-016 (public-funding architecture) | P-029 | **ACTIVE** | Annex X \u00a7X8 |\n| PRD-004 | P-030 | **ACTIVE** | Annex X |\n| PRD-009 | P-031 | **ACTIVE** | Annex J \u00a7R1\u2013R2 |\n| PRD-009 | P-032 | **ACTIVE** | Annex J |\n| PRD-008 | P-033 | **ACTIVE** | Annex J |\n| T-016 / INV-007 | P-034 | **ACTIVE** | Annex AV |\n| structural \u2014 no threat row (corrigibility/humility clause) | P-035 | **ACTIVE** | Preamble \u00b7 \u00a70A |\n| structural \u2014 no threat row (keyholder servanthood duty) | P-036 | **ACTIVE** | Article I |\n| structural \u2014 no threat row (identity-serves-person clause) | P-037 | **ACTIVE** | Article II |\n| T-006 | P-038 | **ACTIVE** | Article III |\n| structural \u2014 no threat row (mutual-aid/family/religious protection) | P-039 | **ACTIVE** | Article IV |\n| structural \u2014 no threat row (housing-cap pastoral revision) | P-040 | **ACTIVE** | Article V |\n| T-008 | P-041 | **ACTIVE** | Article VI |\n| structural \u2014 no threat row (community alert pathway) | P-042 | **ACTIVE** | Article VII |\n| T-001 / T-002 / T-004 / T-007 | P-043 | **ACTIVE** | ANNEX_AH \u00b7 ANNEX_Y \u00b7 INVARIANTS \u00b7 SPECIFICATIONS |\n| T-001 / T-002 / T-004 / T-005 / T-007 / T-018 / T-019 | P-044 | **ACTIVE** | ANNEX_AI \u00b7 ANNEX_AP \u00b7 ANNEX_AB \u00b7 ANNEX_AK \u00b7 ANNEX_Y |\n| T-001 / T-002 / T-004 / T-007 / IC-004 | P-045 | **ACTIVE** | ANNEX_AB \u00b7 ANNEX_AK \u00b7 ANNEX_AH \u00a7AH5.1 |\n| T-001 / T-002 / T-007 / T-008 / T-016 (evidence + capture hardening) | P-046 | **ACTIVE** | evidence artifacts \u00b7 capture dashboard |\n| T-025 / T-026 / T-027 (external dependency capture) | P-047 | **ACTIVE** | Annex AT |\n| T-025 / T-026 / T-027 (external dependency capture) | P-048 | **ACTIVE** | Annex AT \u00b7 FC-194\u2013FC-201 |\n| T-025 / T-026 / T-027 (cross-register evidence-gap bridge) | P-049 | **ACTIVE** | Hardening Queue \u00b7 Open Problems \u00b7 Pilot Roadmap \u00b7 README |\n| T-028 | P-050 | **ACTIVE** | ANNEX_AT \u00a7AT6.6 |\n| T-022 | P-051 | **ACTIVE** | ANNEX_AM \u00a7AM8 |\n| T-019 | P-052 | **ACTIVE** | ANNEX_AI \u00a74.12 |\n| Insider retaliation / reporter protection | P-053 | **ACTIVE** | ANNEX_AW \u00b7 Article VII |\n| Identity disclosure as safety vector | P-054 | **ACTIVE** | ANNEX_AX \u00b7 Article II |\n| Delivery gap between guarantee and operation | P-055 | **ACTIVE** | ANNEX_AY \u00b7 Article IV |\n| INV-001 support (identity-related; active identity controls remain P-003/P-016) | P-056 | PROPOSED | ANNEX_AK \u00a7AK8 \u00b7 ANNEX_AZ \u00a7AZ2 |\n| ACL-011 / ACL-010 | P-057 | **PROPOSED** | Pilot site selection criteria |\n| constitutional void support \u2014 no standalone threat row | P-058 | PROPOSED | Jurisdiction Interface Clause |\n| ACL-010 / dignity-floor leverage | P-059 | **PROPOSED** | Vulnerable_Population_Consent_Protocol.md |\n| ACL-005 / founding keyholder capture | P-060 | **PROPOSED** | Founding Team Composition Standard |\n| ACL-007 / Power-Wealth Convergence | P-061 | **PROPOSED** | Founding Capital Framework |\n| ACL-011 / ACL-010 | P-062 | **PROPOSED** | Pilot Timeline Framework |\n| T-028 | P-064 | **ACTIVE** | Essential-Sector Refusal Test Package \u00b7 Capture Dashboard Specification \u00b7 Threat Resolution Matrix \u00b7 Pilot Evidence Roadmap |\n| T-022 | P-065 | **ACTIVE** | ANNEX_AM \u00a7AM3/\u00a7AM8.5\u2013AM8.7 \u00b7 amendment_protocol.md \u00a73 \u00b7 Capture Dashboard Specification \u00b7 Pilot Evidence Roadmap |\n| T-029 | P-066 | **ACTIVE** | ANNEX_D \u00b7 Commons Return and Universal Stake Evidence Test Package \u00b7 Threat Register \u00b7 Claims and Evidence Register |\n| T-030 | P-067 | **ACTIVE** | Cyber Resilience and Availability Evidence Test Package \u00b7 Threat Register \u00b7 Pilot Evidence Roadmap |\n| T-031 | P-068 | **ACTIVE** | Last-Resort Unenrolled Access Evidence Test Package \u00b7 ANNEX_AZ \u00b7 ANNEX_AY |\n| T-032 | P-069 | **ACTIVE** | Monitoring Repurposing Evidence Test Package \u00b7 Annex C \u00b7 Capture Dashboard Specification |\n| T-033 | P-070 | **ACTIVE** | Founding Consent and Civil-Society Review Evidence Test Package \u00b7 Founding Legitimacy Dossier |\n| P-072 | T-025 supplement | **PROPOSED** | Productive Status Register (operative T-025 control remains P-023 ACTIVE) |\n| structural \u2014 no threat row (anti-accretion intake gate) | P-073 | **ACTIVE** | Acceptance_Protocol.md Framework-First Intake |\n| structural \u2014 no threat row (appeal spine) | P-074 | **ACTIVE** | ANNEX_L \u00a7L7 |\n| structural \u2014 no threat row (evidence framework + data stewardship) | P-075 | **ACTIVE** | Evidence_Ladder.md Test Package Template \u00b7 Monitoring Administrative Safety Packet |\n| structural \u2014 no threat row (institution merger audit) | P-076 | **ACTIVE** | ANNEX_AQ \u00b7 ANNEX_AL \u00b7 ANNEX_AM \u00b7 Capacity Measurement Evidence Test Package \u00b7 SPECIFICATIONS |\n| structural \u2014 no threat row (canonical-home discipline) | P-077 | **ACTIVE** | Acceptance_Protocol.md P-073 gate \u00b7 Claims_Evidence_Register \u00b7 ANNEX_L \u00a7L7 \u00b7 Evidence_Ladder \u00b7 Monitoring Administrative Safety Packet |\n\n---\n\n## P-024 \u2014 Attestation-at-Risk Stake Mechanism\n\n### P-024 \u2014 Attestation-at-Risk Stake Mechanism\n\n- **Status:** ACTIVE (promoted 2026-04-25 via Annex AS ratification). FC-080 stake ratio, FC-081 audit window, FC-082 graph density threshold bound in `/founding/commitments.md`.\n\n**Constitutional text:** [ANNEX_AS.md](../annexes/ANNEX_AS.md)\n\n- **Evidence package:** [Service Record Misuse Evidence Test Package](./Service_Record_Misuse_Evidence_Test_Package.md)\n- **Threat addressed:** T-009 (Coordinated False-Positive Suppression), TR-07 (Attestor Collusion), T-018 (Deliberate False-Trigger Exhaustion).\n- **Direction adopted:** Attestors who certify a claim bear skin-in-the-game exposure proportional to the claim's downstream consequence. A slashing schedule fires automatically when a certified claim is later disconfirmed by oracle quorum; redistribution routes slashed stake to the claimant harmed (where identifiable) and to a system integrity reserve.\n- **Introduced design:**\n - *FC-080 stake ratio:* Every attestation above the materiality threshold requires the attesting node to place a stake equal to at least the ratio defined in FC-080. Stake is denominated in the attestor's civic balance \u2014 Service Record for contribution, hardship, and identity attestations; Voice where the attestation directly supports a Voice allocation \u2014 and is locked, not spent, during the audit window.\n - *FC-081 audit window:* Attestations remain auditable for the window defined in FC-081. Within this window any subsequent oracle measurement that contradicts the attested claim by more than the permitted variance triggers an automated slash-and-redistribute event. The audit window is the same for all attestation classes; no class-specific extension may be granted without a Tier 2 (H-2) amendment.\n - *FC-082 graph density threshold:* A graph-density safe harbor protects attestations made by tightly connected communities (cooperatives, mutual-aid networks, family units) from slash penalties that would arise purely from the structural density of their social graph, not from factual error. Attestations above the FC-082 density threshold are flagged for manual review rather than automatic slashing; the Ombuds Duty Sub-Ombuds has 48 hours to certify the density basis before slashing is released. This prevents T-018 attacks that exploit normal community solidarity as evidence of collusion.\n - *Slashed-stake redistribution:* Slashed civic stake is routed according to Annex AS \u00a73: whistleblower share, restitution to a harmed subject where identifiable, Article VII enforcement maintenance fund, and a small retired share. No slashed stake returns to the attesting node or its affiliated entities.\n - *False-claim escalation:* Where slashing evidence reaches the threshold defined in Annex AS \u00a75, the Ombuds Plenum receives a formal referral. A finding of deliberate false attestation (not merely mistaken attestation) triggers disqualification from attestation roles for the period specified in Annex AS \u00a76. Deliberate false-trigger exhaustion (T-018 use of P-024 to drain legitimate attestors) is an aggravated finding with an extended disqualification period.\n- **Clauses integrated:** AS1\u2013AS6. Amends Annex U (adds attestation-stake exposure to bypass-closure layer). Article VII dashboard extended: real-time attestation-stake exposure by class and pending audit-window count are public indicators.\n- **Dependencies:** Independent escrow agent (P-023.3) operative. Oracle quorum system (P-017) operative with at least three independent oracle seats. Ombuds federation (P-025) seated at \u22654 sub-Ombuds before density-threshold manual review is operative. FC-080/081/082 values bound before any attestation-bearing transaction is accepted.\n- **New risks introduced:** (1) Stake requirement may chill legitimate attestation by resource-constrained community members \u2014 mitigated by FC-080 materiality threshold (low-value attestations are stake-exempt) and by graph-density safe harbor. (2) Automated slashing on oracle contradiction may fire incorrectly if oracle error precedes attestation error \u2014 mitigated by 48-hour Ombuds review gate at FC-082 density flag and by audit-window appeals process in Annex AS \u00a74. (3) Slashed-stake redistribution route to integrity reserve creates an incentive for the CRP to manufacture slash events \u2014 mitigated by Ombuds oversight of all slash events above the Annex AS \u00a75 threshold.\n- **Residual risk:** A coordinated oracle-and-attestor compromise that defeats both systems simultaneously remains the highest-risk failure mode. The graph-density safe harbor narrows the T-018 attack surface but cannot eliminate it if the adversary controls both oracle quorum and attestation review.\n- **Compound linkages:** T-009 \u00d7 T-018 (coordinated false-positive suppression paired with deliberate exhaustion is the canonical dual-threat; P-024 raises the cost of both by making attestation financially painful to corrupt). TR-07 \u00d7 P-017 (attestor collusion is detectable via oracle contradiction; P-017 oracle independence is a prerequisite for P-024 slash events to be trustworthy). T-018 \u00d7 FC-082 (density safe harbor is the primary T-018 surface \u2014 its threshold value is the key calibration parameter; see Annex AS \u00a73).\n- **Annex:** AS (attestation-at-risk stake mechanism \u2014 stake ratio schedule, audit window protocol, graph-density threshold methodology, slash-and-redistribute event specification, escalation thresholds, disqualification periods).\n\n---\n\n## P-025 through P-027 \u2014 Ombuds, Founding Order, and Consolidation\n\n### P-025 \u2014 Federated Ombuds Constitution\n\n**Constitutional text:** [ANNEX_AI.md](../annexes/ANNEX_AI.md)\n\n- **Introduced design:** Single-commissioner Ombuds replaced with a five-node federation. Each sub-Ombuds is structurally dispersed along at least four of five dimensions (jurisdictional, institutional-origin, funding, infrastructure, personnel-recruitment). Operational decisions are handled by a rotating Duty Sub-Ombuds; protocol-level decisions require a 4-of-5 Plenum supermajority (FC-091). Staggered 730-day terms (FC-092) with two-consecutive-term limit. Oversight Assembly of 7 members (5-of-7 threshold) certifies structural dispersal annually and activates Concentration Response on loss of dispersal.\n- **Clauses to integrate:** Full rewrite of Annex AI (previously PROPOSED single-commissioner draft) to Annex AI ACTIVE federated constitution. References from the Humane Constitution, Threat Register, and other annexes read through to the federation acting per \u00a73 (operational vs protocol-level classes).\n- **Load-bearing integrations:**\n - **Proposal 1** \u2014 Tier 1 Amendment Integrity Report (Plenum 4-of-5 within 60 days of signature registration under `/architecture/amendment_protocol.md`).\n - **Proposal 3** \u2014 Adversarial oracle seat certification (Annex AL \u00a73.3).\n - **Proposal 6** \u2014 Arbitration panel seat on Annex AQ \u00a73 Shared Storehouse oracle-failure arbitration.\n - **Proposal 7** \u2014 Enforcement Panel appeals on Annex AJ \u00a74 penalty determinations.\n - **Proposal 9** \u2014 Final adjudication of Annex AS attestation false-claim findings and stake-slashing classification.\n- **Dependencies:** At least four sub-Ombuds seated before any Ombuds-dependent function is operative (\u00a72.1 pre-launch gate). Oversight Assembly seated with \u22655 of 7 before first Plenum vote. Duty rotation schedule published for first 90 days before operational activation. Federation secretariat built before operational activation.\n- **New risks introduced:** Duty rotation scheduling is itself a power locus (mitigated by published-in-advance rotation, non-party-choice rule). Five-node federation increases coordination cost on time-sensitive operational decisions (mitigated by operational/protocol-level bifurcation in \u00a73.1). Plenum deadlock (2 of 5 or 3 of 5) may stall matters (mitigated by conservative-default rule in \u00a73.3 \u2014 deadlock favours protection).\n- **Residual risk:** Structural-dispersal criteria can be met formally while capture is achieved through informal coordination (mitigated by Oversight Assembly \u00a75.1 institutional-health reporting; voting-pattern concentration is a published metric). Oversight Assembly itself can be captured at small scale (mitigated by \u00a75.4 meta-capture controls).\n- **Compound linkages:** P-025 \u00d7 P-008 (federation closes the T-008 open question \u2014 \"who audits the auditors of elite formation?\" \u2014 by making the auditor a federation subject to its own dispersal rule); P-025 \u00d7 P-015 (Ombuds-dependent PCRP flag determinations now robust to single-node capture); P-025 \u00d7 P-017 (methodology-class adversarial seat certification now clears 4-of-5 threshold rather than single-commissioner signature); P-025 \u00d7 P-022 (Annex AQ arbitration panel seat rotation is Plenum-certified).\n- **Auto-close clause:** P-025 is standing. It does not auto-close. Changes to the federation structure (FC-090, FC-091, FC-092) require Tier 1 amendment (7-of-9, 180-day timelock).\n\n---\n\n## P-026 \u2014 Founding Order Detail\n\n### P-026 \u2014 Founding Order: Subsidiarity, Consent & Exit\n\n**Constitutional text:** [Founding Order](../../founding/order/README.md)\n\n- **Introduced design:** The protocol acquires a foundational scale-and-consent layer beneath the operational articles. The Founding Order defines *who* consents to be governed, *at what scale*, and *how they withdraw*. Six files under `/founding/order/` cover: (1) README orientation, (2) five-tier scale hierarchy (FC-122: household / neighborhood \u2264500 / locality \u22645,000 / region \u2264500,000 / federation), (3) three-prong subsidiarity competence test (informational, adjudicative, externality-containment) with default-against-escalation rule, (4) affirmative consent protocol (2/3 supermajority, 90-day notice, 60-day deliberation, roll-call, 2/3 minimum participation), (5) exit protocol (FC-120 2/3 supermajority, FC-121 730-day graceful unwind with Essential Access continuity, no exit tax, no forfeiture, T-026 Exit Denial enforcement), (6) re-entry protocol (procedurally symmetric, no penalty, 365-day floor between cycles).\n- **Clauses to integrate:** Humane Constitution \u00a70 Founding Order paragraph; every operational article reads through the Founding Order (smallest-competent-scale default).\n- **Load-bearing integrations:**\n - Federated Ombuds (Annex AI \u00a73.2 challenge process; \u00a73.4 automatic Plenum convocation on exit denial).\n - Annex AJ \u00a74 severity 3 (Institutional) penalties for Exit Denial violations.\n - CSM (Annex Y) as the single Tier 1 exception that binds regardless of consent.\n - Architectural enforcement layer (Proposal 1) locks FC-120/121/122 under Tier 1 process.\n- **Dependencies:** Federated Ombuds seated (four of five sub-Ombuds) before any Founding Order challenge procedure is operative. Drift chain must support federation-scope expansion and contraction events. Scale registry (household through federation) must be initialized at founding.\n- **New risks introduced:** Re-entry 365-day floor could be gamed through individual-personhood cycling (mitigated by individual consent being distinct from unit consent, with the floor applying only to unit cycles). Exit-cost asymmetry \u2014 the 730-day unwind is generous for the unit but introduces a period of dual-authority \u2014 could produce enforcement ambiguity (mitigated by published unwind schedule and Ombuds oversight).\n- **Residual risk:** Subsidiarity is an aggregate property; any single decision's escalation may look reasonable while the cumulative drift toward federation-scale venue is substantial. Aggregate monitoring via the Ombuds \u00a74.3 federation-decision-concentration report is the mitigation \u2014 a threshold breach is itself a T-027 trigger.\n- **Compound linkages:** P-026 \u00d7 P-025 (Ombuds is the Founding Order enforcement organ \u2014 subsidiarity and exit both depend on Ombuds independence); P-026 \u00d7 P-018 (Essential Access-floor-persistence clause is reinforced by Essential Access continuity preservation during the 730-day unwind); P-026 \u00d7 P-008 (exit right structurally constrains elite formation \u2014 elites cannot form a federation they cannot lose).\n- **Auto-close clause:** P-026 is standing. Changes to FC-120/121/122 and the no-exit-tax rule require Tier 1 amendment (7-of-9, 180-day timelock). Strengthening (shorter unwind, lower supermajority) is Tier 2.\n\n---\n\n## P-027 \u2014 Constitutional Consolidation Detail\n\n### P-027 \u2014 Founding Order and Seven-Article Structural Consolidation\n\n**Constitutional text:** [Humane_Constitution.md \u00a7 III](../constitution/Humane_Constitution.md)\n\n- **Introduced design:** the constitutional architecture is consolidated into one Founding Order and seven Articles of Constitutional Order. Rights and rule-bound execution live together in Article I. Essential Access and delivery live together in Article IV. Flow, housing and commons use-rights, enterprise, and PFCR live together in Article V. Voice, Service Record, contribution recognition, and deliberation live together in Article VI. Transparency and environmental scanning live together in Article VII.\n- **Clauses integrated:** Humane Constitution \u00a7III rewritten around the final constitutional structure; White Paper \u00a74 aligned to the same article model.\n- **Load-bearing integrations:**\n - **P-026** \u2014 the Founding Order establishes the scale, consent, and exit foundation across the full architecture.\n - **Proposal 1** \u2014 the architectural enforcement layer remains bound to Article I rights protections.\n - **P-017** \u2014 oracle requirements (N\u22655, three methodology classes, adversarial seat) remain anchored in Article III Physics & Reserves.\n - **P-024** \u2014 attestation stake integrates with Article VI contribution recognition.\n - **P-029 through P-033** \u2014 PFCR, anti-dynasty, stewardship ownership, and enterprise-governance architecture remain integrated inside Article V.\n- **Dependencies:** downstream annexes, simulations, and support docs must stay aligned to the final article structure and instrument names.\n- **New risks introduced:** Article V now concentrates more of the economic surface under one constitutional home. Mitigation: explicit internal boundaries between Flow, housing and commons use-rights, enterprise, and PFCR, plus public interface definitions and audit visibility.\n- **Residual risk:** future edits that blur article boundaries can recreate the fragmentation or overlap this consolidation removed. Mitigation: the constitutional article interfaces in Humane Constitution \u00a7III remain authoritative.\n- **Compound linkages:** P-027 \u00d7 P-026 (the Founding Order supplies the constitutional foundation); P-027 \u00d7 P-017 (Article III inherits the oracle hardening); P-027 \u00d7 P-029 (PFCR remains inside Article V instead of becoming a detached fiscal system); P-027 \u00d7 P-008 (fewer institutional homes reduce elite-formation surface area).\n- **Auto-close clause:** P-027 is standing. Any change to the number of constitutional articles or to the existence of the Founding Order requires Tier 1 amendment (7-of-9, 180-day timelock). Content within the articles may be amended by ordinary process subject to the existing Tier classifications of each clause.\n\n---\n\n### P-035 \u2014 Founding Group Corrigibility and Epistemic Humility\n\n**Threat addressed:** founding group capture / Babel-risk (structural overconfidence)\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Philosophical Preamble (closing paragraph) and \u00a70A (Moral Scope, Spiritual Limits, and Stewardship Orientation)\n\n**Problem diagnosed:**\nThe Preamble's statement \"If it is wrong, people should be able to show where\" is passive \u2014 it does not explicitly subject the founding group to the same corrigibility requirements it names for administrators. The rhetorical confidence of the document can imply that the design team has solved a problem that only ongoing moral community and dependence on God can sustain. This creates Babel-risk: a system that trusts its own architecture more than it trusts the communities and the God it claims to serve.\n\n**Introduced design:**\n- Preamble: explicit statement that founders are not exempt from the failures named in the document; the founding group must be the first to submit to correction.\n- \u00a70A: explicit statement that the system does not claim to reflect the mind of God; it reflects fallible human judgment that remains open to correction.\n\n**New risks introduced:**\n- Overly humble framing could be exploited to argue that all constitutional protections are provisional. Mitigated: the epistemic humility clauses apply to the founders' judgment about design, not to the dignity floor itself (separately protected by Tier 1 amendment requirements).\n\n**Residual risk:** Founding group may still exercise disproportionate influence during the founding window. The corrigibility clause is a normative commitment, not a structural enforcement mechanism. Structural enforcement is addressed by P-036.\n\n---\n\n### P-036 \u2014 Keyholder Servanthood Duty\n\n**Threat addressed:** amendment lock capture by founding group\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article I \u2014 Rights & Rules (Hard locks section)\n\n**Problem diagnosed:**\nThe 7-of-9 amendment lock protects the dignity floor from bad changes. But the same lock also protects the founders' judgment about what the dignity floor contains. If keyholders act in self-interest \u2014 delaying replacement of founding-era text, blocking challenges to their own authority \u2014 the lock becomes a tool of entrenchment rather than protection.\n\n**Introduced design:**\nExplicit constitutional statement that keyholder authority is custodial, not proprietary; keyholders may not use the lock to entrench founding group power; a qualified independent review body may petition for keyholder replacement when self-interest is demonstrated.\n\n**Dependencies:** The independent review body referenced here is the Federated Ombuds structure defined under P-025.\n\n**New risks introduced:**\n- \"Demonstrable self-interest\" requires interpretation. Mitigated: determination is made by the Federated Ombuds (P-025), not by the keyholders themselves.\n\n**Residual risk:** External pressure on keyholders (coercion, blackmail) is not addressed by internal accountability mechanisms. See P-034 residual risk for the same limitation.\n\n---\n\n### P-037 \u2014 Identity Serves the Person\n\n**Threat addressed:** identity system creep / surveillance expansion\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article II \u2014 Personhood, Identity & Continuity\n\n**Problem diagnosed:**\nAny identity system faces institutional pressure to expand verification requirements, cross-reference databases, and build behavioral profiles over time. Without a mandatory review cycle, \"minimum data for minimum access\" tends to expand into a comprehensive scoring regime.\n\n**Introduced design:**\nMandatory triennial review of identity data use; secondary use requires Article VI deliberative authorization with a published sunset date that cannot be made permanent by administrative action alone.\n\n**New risks introduced:**\n- Review cycles could be gamed or delayed. Mitigated: triennial requirement is constitutional; delay beyond the cycle is a reportable failure under Article VII.\n\n**Residual risk:** Administrative pressure to expand identity data use will recur in each review cycle. The review requirement creates a forcing function but does not eliminate the pressure.\n\n---\n\n### P-038 \u2014 Community Voice in Measurement\n\n**Threat addressed:** T-006 (oracle institutional blindness / measurement capture)\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article III \u2014 Real Capacity & Reserves\n\n**Problem diagnosed:**\nThe oracle quorum defends against manipulation but not against shared institutional blindness \u2014 the systematic tendency of measurement systems to reflect the assumptions of the institutions that design them rather than the lived reality of affected communities.\n\n**Introduced design:**\nConstitutional community challenge path: written submission to oracle quorum, mandatory 14-day published response, challenge submissions published alongside official figures.\n\n**Dependencies:** Oracle quorum publication infrastructure must support community submission intake and co-publication.\n\n**New risks introduced:**\n- Challenge system could be flooded with bad-faith submissions. Mitigated: prima facie threshold for mandatory response.\n\n**Residual risk:** Communities with less documentation capacity will use the challenge path less. Outreach and accessibility design are required \u2014 not addressed by this patch alone.\n\n---\n\n### P-039 \u2014 Protection of Pre-Existing Care Networks\n\n**Threat addressed:** institutional crowding-out of voluntary community\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article IV \u2014 Survival\n\n**Problem diagnosed:**\nA comprehensive constitutional delivery floor for survival essentials can inadvertently displace the mutual aid groups, religious food pantries, family networks, and neighborhood care structures that communities depend on \u2014 especially when the delivery system fails.\n\n**Introduced design:**\nConstitutional statement that Article IV is a floor not a monopoly; explicit duty to support pre-existing care networks; affirmation that the constitutional floor protects the conditions for voluntary generosity rather than replacing it.\n\n**New risks introduced:**\n- \"Must not displace\" is a normative commitment difficult to enforce mechanically. Mitigated: Article VII warning system can measure whether voluntary care networks are growing or shrinking post-implementation.\n\n**Residual risk:** Economic logic of consolidated delivery systems tends to crowd out smaller providers regardless of constitutional intent. Periodic measurement and active funding of voluntary-sector infrastructure are required.\n\n---\n\n### P-040 \u2014 Article V Housing Cap Pastoral Revision and Structural Humility\n\n**Threat addressed:** household penalization; Babel-risk structural overconfidence\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article V \u2014 Markets, Commons & Public Finance (housing allocation section; closing paragraph)\n\n**Problem diagnosed:**\n(1) The phrase \"regardless of household composition decisions\" treated a resource constraint as though it were a judgment about family structure. Large families, multigenerational households, and care-intensive arrangements may find the cap hostile if applied without a pastoral presumption of accommodation.\n(2) Article V's closing paragraph presented the five-instrument architecture with confidence that the design prevents exploitation. This exceeds what human institutions can reliably deliver.\n\n**Introduced design:**\n(1) Housing cap language revised: \"fiscal guarantee\" framing retained; pastoral review with strong presumption of accommodation added; \"mercy before procedure\" standard stated.\n(2) Structural humility closing paragraph added: names the limits of structural engineering and requires ongoing community paths to name and correct exploitation.\n\n**New risks introduced:**\n- \"Strong presumption of accommodation\" may be interpreted to override the cap entirely. Mitigated: \"fiscal guarantee\" framing preserved \u2014 the commons does not owe unlimited expansion; the review process applies mercy within real resource constraints.\n\n**Residual risk:** Review panels may apply \"mercy before procedure\" inconsistently across communities. Published review criteria and appeals paths are the mitigation; this patch adds the normative standard.\n\n---\n\n### P-041 \u2014 Recognized-Contribution Audit Requirement\n\n**Threat addressed:** T-008 (elite / professional-contributor capture of civic layer)\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article VI \u2014 Voice, Service Record & Public Decisions (Contribution and capability section)\n\n**Problem diagnosed:**\n\"Verified contribution\" as the basis for civic standing creates systematic pressure to perform contribution in legible, verifiable ways. Contributions that resist easy documentation \u2014 informal care, spiritual leadership, mutual aid, neighborhood presence, parenting \u2014 will be consistently underrepresented in the Service Record eligible pool.\n\n**Introduced design:**\nMandatory biennial audit of the recognized-contribution definition; explicit constitutional statement that informal, spiritual, and pastoral contributions must not be excluded by documentary difficulty alone; 180-day correction requirement when gaps are found.\n\n**Dependencies:** Audit body must be independent of the civic administration it is reviewing \u2014 consistent with Article VII independence requirements.\n\n**New risks introduced:**\n- \"Effect on human flourishing\" as a measurement criterion is harder to verify than documented hours. Mitigated: the audit requirement is about the framework definition, not individual claims.\n\n**Residual risk:** The gap between the ideal (invisible work recognized) and the operational (verification required) will persist. The audit creates a forcing function for closing it over time.\n\n---\n\n### P-042 \u2014 Community Alert Pathway\n\n**Threat addressed:** institutional capture of warning function; prophetic voices blocked\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article VII \u2014 Public Records & Warning Systems\n\n**Problem diagnosed:**\nArticle VII's warning function is defined, funded, and structured by the same apparatus it is meant to watch. Communities affected by systemic failures often see them earlier and more accurately than institutional reviewers \u2014 but currently have no constitutionally protected path to name them.\n\n**Introduced design:**\nConstitutionally protected community alert pathway: low-barrier, optionally anonymous, accessible without legal representation; 30-day acknowledgment requirement; 90-day formal review trigger for prima facie systemic failures; refusal to acknowledge or review is itself a reportable failure.\n\n**Dependencies:** Article VII independence requirement applies \u2014 the body managing community alerts must not be the same body whose performance is being reported.\n\n**New risks introduced:**\n- Alert pathway could be used for political harassment or coordinated false-flag campaigns. Mitigated: prima facie threshold for mandatory review; anonymous alerts published but not automatically elevated without threshold evidence.\n\n**Residual risk:** Power asymmetry between institutional reviewers and community reporters will persist. The pathway lowers the barrier; it does not equalize resources for evidence-gathering.\n\n---\n\n### P-043 \u2014 Logical-Analysis Corpus Corrections\n\n**Threat addressed:** T-001, T-002, T-004, T-007, T-generic (amendment capture, definitional ambiguity, status misrepresentation)\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** ANNEX_AH.md, ANNEX_Y.md, INVARIANTS.md, SPECIFICATIONS.md, Humane_Constitution.md, Patch_Log.md, Threat_Register.md\n\n**Problem diagnosed:**\nSystematic logical analysis identified 18 issues across the corpus: 4 critical (including a Tier 1 amendment architecture paradox and a literal unfilled placeholder), 11 major (internal contradictions, definitional gaps, inconsistent status reporting), and 3 minor (structural tensions and epistemological inconsistencies).\n\n**Introduced design:**\n\n- **ANNEX_AH.md \u00a7AH2 header** \u2014 Updated heading from \"14 Days\" to \"60 Days minimum, per P-020 amendment.\" Heading was not updated when P-020 extended the window.\n- **Patch_Log.md P-014 entry** \u2014 Added parenthetical noting P-020 extended the 14-day challenge window to 60 days minimum.\n- **Threat_Register.md Complete Register Summary** \u2014 Corrected T-001, T-002, T-004, T-007 status from ACTIVE to Active \u2014 unproven to match the dashboard and individual entries.\n- **INVARIANTS.md INV-007** \u2014 Resolved the Tier 1 amendment paradox. \"Unamendable by any in-system process\" is replaced with precise language: Tier 1 is changeable only via the Tier 1 process (7-of-9 keyholder signatures + 180-day timelock, FC-110/FC-111). FC-110 and FC-111 are themselves Tier 1 protected. Changes to the amendment mechanism require H-3 refounding authority. P-014 is permanently closed.\n- **SPECIFICATIONS.md \u00a73.4** \u2014 Replaced \"full constitutional refounding under P-014 procedure\" with Tier 1 amendment process language and H-3 refounding authority reference.\n- **ANNEX_Y.md \u00a7Y5** \u2014 Added: H-3 refounding authority is a full constitutional convention, superseding the closed P-014.\n- **ANNEX_Y.md \u00a7Y4** \u2014 Filled the literal `[ACCEPTABLE_CSM_FAILURE_THRESHOLD]` bracket placeholder with provisional value: 3 verified delivery failures (FC-YT1, pre-launch blocking gate, must be confirmed before operational activation).\n- **SPECIFICATIONS.md \u00a73.3** \u2014 Added caregiver/dependent carve-out to the non-transferability rule, making it consistent with the Constitution's household pooling and delegated spend authority provisions.\n- **SPECIFICATIONS.md \u00a74.2** \u2014 Replaced \"two separate rules\" bridging note with an integration formula: the 300-unit issuance ceiling sets the quarterly stock; the 100-unit weight table caps each individual deployment draw. Sequential constraints, not competing ones.\n- **SPECIFICATIONS.md \u00a74.3** \u2014 Fixed sector ceiling arithmetic justification: reframed from Voice supermajority to Service Record governance panel concentration. Added note that P-008 is PROPOSED and P-025 is the operative ACTIVE authority for the 20% ceiling.\n- **SPECIFICATIONS.md \u00a78** \u2014 Added pre-launch blocking gates note to the Parameter Summary, clarifying that reserved parameters are not design gaps.\n- **Humane_Constitution.md Article V** \u2014 Added operational definitions of \"compounding interest\" (capitalisation-based, includes fee-equivalent traps) and \"household ordinary-life debt\" (personal/family purposes; excludes enterprise debt and voluntary investment instruments).\n- **Humane_Constitution.md Philosophical Preamble** \u2014 Added produced/shared value working test: three concrete examples (land labour, software, enterprise) and an appeal path reference.\n- **Humane_Constitution.md Founding Order** \u2014 Added dignity floor delivery obligation: 2% PFCR cross-boundary allocation minimum, published accounting of unmet commitments in adjacent non-consenting communities.\n\n**New risks introduced:**\n- The provisional CSM failure threshold (3 failures) requires founding commitment confirmation. If not confirmed before activation, the threshold remains provisional \u2014 which is by design (pre-launch blocking gate).\n\n**Residual risk:** Issues 4 (bootstrap circularity), 8 (silence tension), 12 (single-source philosophy), and 18 (structural vs. moral sufficiency tension) are acknowledged as honest philosophical tensions named in the corpus. They are not resolved by this patch; they are monitored as open interpretive questions.\n\n---\n\n### P-044 \u2014 Threat-Strengthening Batch\n\n**Status:** ACTIVE \n**Date:** 2026-05-02 \n**Related threats:** T-001, T-002, T-004, T-005, T-007, T-018, T-019 \n**Core change:** Close mitigation gaps identified by systematic threat survey. Tighten Active \u2014 unproven threats with open gaps, add missing evidentiary standards, and fill operational voids in audit timelines and authority chains.\n\n**Changes included in this patch:**\n\n- **ANNEX_AI.md \u00a74.1** \u2014 Reproduced the T-019 three-criterion evidentiary standards inline (replacing a dangling \"incorporated by reference\" to a deleted prior section). Standards now specify: timing proximity (72-hour window, heightened scrutiny only), proportionality anomaly (disproportionate scope relative to documented need), no documented operational basis (contemporaneous record within 4-hour window). Three-tier outcome logic: all three \u2192 deliberate manufacture; two \u2192 provisional with 48-hour extension; one \u2192 logged only. Conservative default: flag stays active during pendency.\n- **ANNEX_AP.md \u00a7AP1** \u2014 Added cap-reset audit procedure: Federated Ombuds as responsible authority; 7-day open window; 30-day findings deadline; evidentiary standard (clear and convincing evidence); cap-counter freeze during audit; two outcome paths (reset to zero or count unchanged). Closes T-018 cap-reset void.\n- **ANNEX_AB.md \u00a7AB2** \u2014 Added FC-010 calibration methodology requirement: Article VII annual audit must publish the empirical/modelling basis for leakage thresholds, revision triggers, and methodology changes. Thresholds not documented in a published audit are not valid enforcement baselines. (T-001)\n- **ANNEX_AB.md \u00a7AB3** \u2014 Added invisible-work backstop: P-041 biennial recognized-contribution audit named as enforcement backstop for \u00a7AB3; findings requiring correction must be incorporated within 180 days; deficient contribution scores suspended from Voice/Service Record inputs until corrected. (T-004)\n- **ANNEX_AB.md \u00a7AB5** \u2014 Added registry administration clause: Federated Ombuds as custodian; no unilateral definition authority; Tier 2 amendment pathway; annual public review window; prima facie disputes forwarded to CRP. (T-007)\n- **ANNEX_AK.md** \u2014 Promoted the AED commitment architecture and later superseded FC-140 anchors. Current FC-140 values are target \u22642%, upper bound \u22645%, trigger \u22653% per quarter; see `/founding/commitments.md` and the Parameter Calibration Register. (T-002 / P-016)\n- **README.md** \u2014 Updated stale patch counts: 31\u219240 total, 16\u219225 active (two locations).\n- **ANNEX_Y.md \u00a7Y7** \u2014 Filled `[RESERVE_WINDOW_DAYS]` placeholder with provisional value: 90 days (FC-YT2, pre-launch blocking gate).\n- **CLAUDE.md** \u2014 Corrected \"Provenance_Map.md is planned\" \u2192 \"serves as\" (file already exists).\n- **Patch_Log.md P-005** \u2014 Advanced from PROPOSED \u2192 ACTIVE: ANNEX_AC1 design is complete; residual risks (sub-panel capture, throughput theater) are acknowledged and monitored.\n\n**New risks introduced:** This batch promoted statuses and bound provisional fraud-rate anchors, and that introduces residual risk. (1) Premature reliance \u2014 readers may treat the promoted statuses (e.g. P-005 advanced to ACTIVE) as field-tested rather than designed-and-monitored. (2) Parameter confusion \u2014 later FC-140 values supersede this batch's older anchor language and may still be mistaken for proven or evidence-backed thresholds. (3) Calibration drift \u2014 anchors set before pilot confirmation can drift or be quietly normalized as \"the number\" before any pilot evidence validates them. Mitigated by: the parameter register, pre-launch blocking gates, and the residual-risk note below.\n\n**Residual risk:** FC-140 through FC-145 have bound starting values, while FC-146 through FC-150 remain pre-launch commitments pending pilot data and founding adoption. P-016 remains PROPOSED / pre-ratification until the founding coalition confirms rate targets after first-year pilot evidence.\n\n---\n\n### P-045 \u2014 Threat-Mitigation Batch\n\n**Threats addressed:** T-001, T-002, T-004, T-007, IC-004 \n**Status:** ACTIVE | **Priority:** Critical \n**Date:** 2026-05-02\n\n**Constitutional text:** ANNEX_AB.md (\u00a7AB2, \u00a7AB3, \u00a7AB5), ANNEX_AK.md (\u00a77, \u00a78), ANNEX_AH.md (\u00a7AH5.1)\n\n**Problem diagnosed:**\nFive critical threats remained at Active \u2014 unproven status with specific unresolved gaps: T-001 lacked threshold derivation logic (arbitrary numbers); T-002 had no procedural protection for excluded persons before rate targets are formally bound; T-004 had no enumerated floor for invisible/care work; T-007's registry started empty (first-mover capture window); IC-004 had no recovery path after P-013 suspension.\n\n**Introduced design:**\n\n- **ANNEX_AB.md \u00a7AB2** \u2014 Added enforcement-capacity derivation formula: FC-010 thresholds are derived from minimum detectable enforcement rate (N \u00f7 P). FC-010 3% = 2\u00d7 min-detectable rate; 7% = 5% supply-harm threshold. Audit participation designated as a qualified civic duty; resourcing limitations cannot justify raising thresholds. (T-001)\n- **ANNEX_AB.md \u00a7AB3** \u2014 Added enumerated contribution floor: six founding categories (primary caregiving, elder care, mutual aid, spiritual community leadership, unpaid household management, informal health work) with burden reversal. Self-attestation accepted; disproof burden on system. Extension via Tier 2; removal requires Tier 1 + impact assessment. (T-004)\n- **ANNEX_AB.md \u00a7AB5** \u2014 Added founding seed list: 14 Tier 2 protected terms (survival, survival floor, personhood, Essential Access, Flow, Voice, Service Record, non-convertibility, coercion, scarcity, contribution, identity, dignity, capacity) locked at founding. Adversarial review requirement before ratification. (T-007)\n- **ANNEX_AK.md \u00a77** \u2014 Added Asymmetric Default Rule: system bears burden of proof for all exclusion decisions; independent time-bounded review (14-day deadline) required before any Essential Access exclusion is final; exclusions without timely determination automatically reversed. (T-002)\n- **ANNEX_AK.md \u00a78** \u2014 Added Independent Identity Auditor mandate: quarterly public reports on fraud/exclusion rates per tier and vulnerable category; absence-of-data is a reportable failure; two consecutive quarters without data triggers Federated Ombuds referral; IIA appointment/removal requires Tier 2 amendment. (T-002)\n- **ANNEX_AH.md \u00a7AH5.1** \u2014 Replaced IC-004 governance-gap note with Dignity-Only Continuity Mode specification: CSM continues; governance suspended; 180-day trigger opens re-founding petition window (500 joint signatories to submit; 1,000 attestations to advance); P-014 non-precedent status unaffected; CSM floor cannot be suspended. (IC-004)\n\n**New risks introduced:**\n- The founding seed list authors own the semantic baseline permanently \u2014 mitigated by the mandatory adversarial review requirement before ratification.\n- The 14-day independent review deadline for identity exclusions requires review infrastructure to be operational at launch \u2014 this is a pre-launch blocking gate.\n- The 180-day dignity-only continuity period may be too long for urgent governance needs \u2014 mitigated by the automatic petition window at 180 days and the Federated Ombuds continuing to operate throughout.\n\n**Residual risk:** T-001, T-002, T-004, and T-007 remain Active \u2014 unproven pending pilot data confirmation. IC-004 is Active \u2014 unproven \u2014 the governance gap is now specified with a fallback mechanism but has not been field-tested.\n\n---\n\n### P-046 \u2014 Evidence and Capture Hardening Suite\n\n**Threats addressed:** Multiple control-plane and evidence-status risks, including T-005, T-008, T-016, T-017, T-022, T-023, T-025, T-026, T-027, and implementation-drift risk.\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-04\n\n**Constitutional text:** [Humane_Constitution.md \u00a70 and Article VII](../constitution/Humane_Constitution.md); [INVARIANTS.md \u00a7 Invariant Violation Detection](../constitution/INVARIANTS.md); [Acceptance_Protocol.md \u00a7 Pre-Launch Blocking Gates](../constitution/Acceptance_Protocol.md); [ANNEX_AH.md \u00a7 AH2](../annexes/ANNEX_AH.md); [ANNEX_C.md \u00a7 C-3/C-5](../annexes/ANNEX_C.md); [ANNEX_AO.md Part 1/2](../annexes/ANNEX_AO.md)\n\n**Problem diagnosed:**\nThe project had strong mechanisms and evidence packages, but seven proof surfaces remained too implicit: implementation drift, collapse-state traceability, parameter calibration, capture metrics, reusable abuse patterns, claim-evidence levels, and founding legitimacy. Without explicit artifacts, public language could outrun proof and technical compliance could be mistaken for legitimate activation.\n\n**Introduced design:**\n\n- **Implementation Drift Audit Package** \u2014 adds tests for reproducible hashes, append-only log behavior, publication-channel divergence, startup refusal, key custody, timelock response, and supply-chain bypass.\n- **Collapse-State Crosswalk** \u2014 maps every threat to Survival-Trade Bind, Power-Wealth Convergence, Static-Advantage Loop, and control-plane failure.\n- **Parameter Calibration Register** \u2014 tracks high-risk FC values, current status, rationale, capture route, evidence needed, revision trigger, and governing documents.\n- **Capture Dashboard Specification** \u2014 defines privacy-preserving public indicators for civic role concentration, Ombuds independence, definition capture, procurement/legal-wrapper capture, identity gatekeeping, and implementation drift.\n- **Abuse Case Library** \u2014 introduces reusable bad-actor patterns so patch intake and closure must test against plausible corruption routes and false reassurances.\n- **Evidence Ladder** \u2014 defines claim-strength levels, upgrade rules, downgrade rules, and forbidden status jumps.\n- **Founding Legitimacy Dossier** \u2014 defines the evidence burden for founding authority: scope, conflicts, notice, deliberation, consent, objections, exit rehearsal, dignity-floor non-coercion, founder sunset, and independent review.\n- **Architecture files** \u2014 implementation binding and drift chain now distinguish Tier 1 state hashing from implementation attestation records.\n- **Constitution and invariants** \u2014 added narrow cross-references making founding legitimacy and implementation drift public evidence duties.\n\n**New risks introduced:**\n- The new registries can become bureaucratic compliance artifacts if not tied to real tests. Mitigated by Evidence Ladder downgrade rules and Abuse Case Library false-reassurance fields.\n- Capture dashboards can become ranking tools. Mitigated by Article VII privacy language and dashboard rule that ordinary persons may not be ranked.\n- Implementation attestations can create false technical confidence. Mitigated by explicit claim boundaries in the Implementation Drift Audit Package.\n\n**Residual risk:** These upgrades make proof obligations clearer; they do not prove the system works. The highest residual risks remain founding consent theater, keyholder social capture, dashboard gaming, parameter arbitrariness, and technically valid but hostile amendment.\n\n---\n\n### P-047 \u2014 Essential-Sector Conglomerate Transition\n\n**Threats addressed:** T-025, T-026, T-027, T-028, external dependency capture, procurement capture, medicine-access capture, and essential-sector refusal risk.\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-04\n\n**Constitutional text:** [ANNEX_AT.md \u00a7 AT6.5 and AT8](../annexes/ANNEX_AT.md); [Capture_Dashboard_Specification.md \u00a7 Money, Procurement, And Legal Wrapper Capture](./Capture_Dashboard_Specification.md); [Conglomerate_Transition_Dossier.md](./Conglomerate_Transition_Dossier.md)\n\n**Problem diagnosed:**\nThe external-trade and anti-rent architecture named supply-chain dependency, public-return/source-base capture, and legal-wrapper risk, but it did not yet explain how incumbent oil, energy, medicine, logistics, and PBM-style medicine-access conglomerates would operate under the system. Without a sector-specific transition doctrine, the project risked relying on moral persuasion while firms with essential chokepoints could rationally leave, litigate, lobby, retaliate, or route control through foreign affiliates.\n\n**Introduced design:**\n\n- **Conglomerate Transition Dossier** \u2014 defines the operating rule: firms may earn Flow for verified production, reliability, transition work, innovation, and public-interest delivery; they may not convert survival chokepoints into rule authority or survival leverage.\n- **Numeric evidence anchors** \u2014 records real-world scale indicators: energy investment, fossil dependence, petroleum import/export flows, PBM prescription concentration, health spending, public procurement scale, lobbying spend, and beneficial-ownership risk.\n- **Sector models** \u2014 distinguishes oil/fossil firms, energy utilities/grid operators, and medicine manufacturers/PBMs, with allowed activity, prohibited leverage, compliant incentives, and refusal fallback.\n- **Refusal survivability tests** \u2014 requires largest-supplier exit modeling, reserve drawdown duration, medicine stockpile audit, compliant-bidder count, beneficial-owner trace, lobbying/capture exposure, and public fallback capacity before stronger claims.\n- **Annex AT interface** \u2014 adds AT6.5 so essential-sector conglomerates are treated as survival-leverage actors when their refusal, litigation, patent hold, supply-chain delay, or standards-body campaign can materially impair the CSM floor.\n- **Capture dashboard additions** \u2014 adds essential-sector refusal exposure and lobbying/capture exposure by contract value.\n\n**New risks introduced:**\n- Public procurement could overpay incumbents to keep them inside the system, creating disguised bailouts. Mitigated by compliant-margin tests, public fallback modeling, and beneficial-owner trace requirements.\n- Refusal drills could reveal sensitive supply-chain weaknesses. Mitigated by public class-level reporting with restricted operational detail where disclosure would improve attack execution.\n- Regulated utility treatment could entrench incumbents. Mitigated by performance metrics, public receiver authority, distributed/community fallback, and capture dashboard review.\n\n**Residual risk:** This patch makes the hard bargain explicit; it does not prove that fallback capacity can be built fast enough. The largest unresolved question is numeric: how many days can people keep eating, heating, traveling, communicating, and receiving medicine if the largest incumbent in a category says no?\n\n---\n\n### P-048 \u2014 Essential-Sector Refusal Operationalization\n\n**Threats addressed:** T-025, T-026, T-027, T-028, external dependency capture, medicine-access capture, grid/logistics chokepoint risk, and essential-sector refusal leverage.\n**Patch relation:** Operationalizes P-047.\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-04\n\n**Constitutional text:** [ANNEX_AT.md \u00a7 AT2.4 and AT6.5](../annexes/ANNEX_AT.md); [Parameter_Calibration_Register.md \u00a7 Seed Register](./Parameter_Calibration_Register.md); [Essential_Sector_Refusal_Test_Package.md](./Essential_Sector_Refusal_Test_Package.md); [05_life_and_rights.md](../public/05_life_and_rights.md)\n\n**Problem diagnosed:**\nP-047 defined the essential-sector conglomerate transition doctrine, but the project still needed operational drills, parameter rows, tighter Annex AT triggers, public-facing explanation, and a broader evidence pass for medicine patents, shortages, grid bottlenecks, fossil transition risk, and utility regulation.\n\n**Introduced design:**\n\n- **Essential-Sector Refusal Test Package** \u2014 adds largest oil/fuel supplier exit, largest medicine supplier/PBM refusal, and largest grid/logistics delay drills, with reserve drawdown, fallback capacity, compliant-bidder count, capture exposure, evidence packet, pass/fail, and residual-risk requirements.\n- **FC-194 through FC-201** \u2014 adds reserved/draft calibration rows for essential fuel reserves, medicine stockpiles, supplier concentration, public fallback deadlines, procurement concentration, PBM/intermediary separation, logistics redundancy, and essential data/claims portability.\n- **Annex AT tightening** \u2014 defines foreign-affiliate routing, survival-leverage actors, public receiver authority, and compulsory licensing/public manufacturing triggers for CSM-designated medicines.\n- **Public explainer** \u2014 adds \"How Big Companies Work Here\" for non-technical readers: profit remains allowed; hostage power does not.\n- **External evidence expansion** \u2014 adds sources for pharma patent-listing/evergreening risk, drug shortages, transformer/grid supply-chain bottlenecks, fossil transition/stranded-asset exposure, and utility regulation.\n\n**New risks introduced:**\n- Receiver authority and compulsory licensing can be abused if triggered on weak evidence. Mitigated by functional trigger definitions, Article VII publication, compensation/public-use standards, and refusal-drill evidence packets.\n- Public refusal drills can reveal operational weaknesses. Mitigated by class-level public reporting and justified redaction of exploit-enabling details.\n- Parameter draft anchors may be mistaken for proven values. Mitigated by reserved status and the Parameter Calibration Register's revision-trigger discipline.\n\n**Residual risk:** The package makes essential-sector refusal testable; it does not supply the physical reserves, manufacturing capacity, alternate operators, legal judgments, or treaty capacity needed to pass. The decisive future evidence remains sector-by-sector: how long the CSM floor holds when the largest incumbent refuses.\n\n---\n\n### P-049 \u2014 Evidence-Gap Bridge Alignment\n\n**Threats addressed:** Multiple evidence-gap and status-drift risks across founding legitimacy, essential-sector refusal, implementation drift, public readiness, and evidence-register consistency.\n**Status:** ACTIVE | **Priority:** High\n**Date:** 2026-05-04\n\n**Constitutional text:** No new constitutional text. Governance and public-readiness integration only.\n\n**Problem diagnosed:**\nRecent hardening work created stronger test artifacts, but the live dashboards still left some gaps implicit. The Founding Legitimacy Dossier now has an artifact-status register, and the Essential-Sector Refusal Test Package now defines sector drills, but several reader-facing and governance trackers still described the gaps in older, broader language.\n\n**Introduced design:**\n\n- **Hardening Queue alignment** \u2014 connects essential-sector refusal to the dedicated test package and reframes founding legitimacy around artifact production, not only design existence.\n- **Open Problems bridge** \u2014 updates essential-sector and founding rows so required proof points include the newest refusal drills, artifact-status register, medicine/PBM refusal path, grid/logistics delay path, and parameter/capture links.\n- **Pilot Roadmap bridge rules** \u2014 adds explicit Phase 9 and Phase 11 pass boundaries: paper capacity and clean technical integrity cannot substitute for refusal evidence or legitimate founding artifacts.\n- **Public readiness bridge** \u2014 adds plain-language warnings for essential-company refusal and founding-vote theater.\n- **Evidence-gap language** \u2014 narrows source gaps so the project asks for drill outputs and founding artifacts, not only general outside analogies.\n\n**New risks introduced:**\n- Cross-register alignment can create the appearance of progress without real evidence. Mitigated by repeating that these are bridge rules and evidence packets, not passed pilots.\n- More references can increase reader burden. Mitigated by putting the strongest public framing in the Public Readiness Guide and keeping detailed proof duties in governance registers.\n\n**Residual risk:** P-049 improves traceability; it does not close the underlying gaps. The unresolved work remains physical refusal capacity, real founding artifacts, independent review, and pilot evidence.\n\n---\n\n### P-053 \u2014 Whistleblower Protection and Anti-Retaliation Protocol\n\n**Threats addressed:** Insider retaliation risk against community alert reporters and Service Record audit requesters; Priya-type attack path (retaliatory record modification by named respondent before investigation completes).\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-07\n\n**Constitutional text:** [ANNEX_AW.md](../annexes/ANNEX_AW.md); Article VII (reporter protection clause)\n\n**Problem diagnosed:**\nThe community alert pathway (Article VII) and Service Record audit mechanism (Article VI) require ordinary people to name wrongdoing by administrators. Without explicit protection, a corrupt administrator can use their remaining administrative access to modify the reporter's Service Record, flag contributions \"under review,\" and revoke civic eligibility before any investigation completes. The Priya vignette in the Fairness Vignette Library documented this exact attack path. A system that cannot protect its own reporters will quickly teach everyone not to report.\n\n**Introduced design:**\n\n- **Administrative freeze on filing:** named respondents' write access to the reporter's records is automatically suspended from the moment a report is filed.\n- **Automatic escalation of retaliatory actions:** any attempted modification during the protected period is rejected, logged, and escalated to the Federated Ombuds within 24 hours.\n- **\"Under review\" flag governance:** flags require independent reviewer appointment (not self-authorization), evidence-based grounds, 45-day maximum duration, and automatic removal on expiry without finding.\n- **Restoration on exoneration:** retaliatory modifications are reversed; lost civic roles are restored or queued.\n- **Constitutional amendment:** reporter protection clause added to Article VII.\n\n**New risks introduced:**\n- The administrative freeze could be triggered by bad-faith reports. Mitigated by: the freeze affects only write access (not the respondent's own records), bad-faith reports are subject to the same accountability process as any false claim, and the Federated Ombuds reviews the freeze on filing.\n- Coordinated retaliation by multiple actors not individually named. Named as a residual risk in Annex AW \u00a7AW5; monitored through the community alert pathway.\n\n**Residual risk:** Informal retaliation (social pressure, community reputation) cannot be prevented by administrative controls. Culture and enforcement of the broader anti-capture provisions are the only long-term check.\n\n---\n\n### P-054 \u2014 Confidential Enrollment and Safety-Identity Protocol\n\n**Threats addressed:** Identity disclosure as a safety vector for domestic violence survivors, trafficking victims, and persons in safety-compromised situations; Elena-type attack path (wallet identity creates tracking vector for abuser via compromised administrator).\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-07\n\n**Constitutional text:** [ANNEX_AX.md](../annexes/ANNEX_AX.md); Article II (safety-shielded enrollment clause)\n\n**Problem diagnosed:**\nThe one-person-one-wallet requirement links identity to an administrator-visible record. For persons in documented safety situations, this creates a tracking vector for abusers, traffickers, or persecutors who have access to administrative channels. The Elena vignette documented this gap. The existing Asymmetric Error Doctrine (Annex AK) treats this as a calibration problem; P-054 treats it as a safety override \u2014 for persons in documented danger, the safety interest overrides the normal fraud/exclusion calibration.\n\n**Introduced design:**\n\n- **Safety-shielded enrollment pathway:** legal identity linked to wallet through a cryptographically sealed record; all location and identity fields suppressed from administrator-visible database.\n- **Address-blind delivery:** Essential Access delivered through anonymous pickup points, trusted community organizations, or encrypted digital channels without geolocation.\n- **Emergency enrollment:** 30-day temporary access on credible assertion without documentation, with support pathway to full safety-shielded enrollment.\n- **Documentation-free emergency path:** single-use 72-hour tokens for persons with no documentation, with connection to enrollment support organizations.\n- **Sealed record access governance:** sealed records accessible only by court order or Federated Ombuds finding; access requests logged and reported to the enrolled person within 72 hours.\n- **Constitutional amendment:** safety-shielded enrollment clause added to Article II.\n\n**New risks introduced:**\n- Emergency enrollment without documentation could be used for fraud. Mitigated by: 30-day window with transition requirement, the AK fraud-rate monitoring catches aggregate fraud signals, and false safety assertions are subject to accountability.\n- Sealed records could be accessed under pretextual court orders. Mitigated by: access limited to credible fraud investigation (not immigration enforcement or administrative convenience), Ombuds review authority, and notification to the enrolled person on any access request.\n\n**Residual risk:** Persons whose abuser controls their access to enrollment points cannot use this pathway. Long-term immigration or citizenship questions for undocumented persons are not resolved by AX \u2014 Essential Access continuity is provided, not immigration status.\n\n---\n\n### P-055 \u2014 Delivery Sufficiency Standard\n\n**Threats addressed:** Gap between constitutional guarantee of Essential Access and operational delivery for incarcerated persons, non-enrolled communities, persons unable to use digital interfaces, and persons in non-consenting jurisdictions.\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-07\n\n**Constitutional text:** [ANNEX_AY.md](../annexes/ANNEX_AY.md); Article IV (delivery sufficiency obligation clause)\n\n**Problem diagnosed:**\nMultiple vignettes in the Fairness Vignette Library showed that the constitutional guarantee of Essential Access does not translate to operational delivery for several populations (Miriam, Ray, Amara, Yoder Community). The gap between the guarantee and the delivery mechanism was unnamed, untracked, and unaccountable. A constitutional guarantee that does not reach the people it covers is not a guarantee \u2014 it is a statement.\n\n**Introduced design:**\n\n- **Delivery Sufficiency Standard (AY1):** four conditions that must all be met for a population to be considered operationally covered: delivery path exists, is accessible, is monitored, and has an accountable responsible party.\n- **Delivery Sufficiency Register:** quarterly-published accounting of populations not yet meeting the standard, with gap type, current status, commitment, timeline, responsible party, and evidence link.\n- **Founding Register entries:** seven populations entered at founding with open commitments.\n- **Cross-boundary delivery operationalization:** quarterly accounting of the 2% PFCR cross-boundary allocation, flow to intermediary organizations, populations reached, no-enrollment-coercion rule.\n- **Register removal standard:** removal requires responsible party certification, Federated Ombuds independent verification, and published verification \u2014 not just administrative assertion.\n- **Constitutional amendment:** delivery sufficiency obligation clause added to Article IV.\n\n**New risks introduced:**\n- The Register could become a bureaucratic accounting exercise that satisfies the letter while missing the spirit. Mitigated by: the AY1 standard requires accessibility without extraordinary effort (not just existence of a path), and Federated Ombuds escalation authority for missed timelines.\n- Cross-boundary delivery through intermediary organizations could be used to build dependency relationships. Mitigated by: the no-enrollment-coercion rule (\u00a7AY3.3) prohibits conditioning delivery on future enrollment.\n\n**Residual risk:** The Register creates accountability; it does not create capacity. Physical infrastructure, institution enrollment, and intermediary organization funding must follow independently. P-055 makes the gap visible and governed; it does not close the gap operationally.\n\n---\n\n## P-050 through P-052 \u2014 CASP, Constitutional Integrity Panel, and Ombuds Manufacture Standard\n\n### P-050 \u2014 Compliant Alternative Supplier Pre-Registration (CASP)\n\n**Threat addressed:** T-028\n**Status:** ACTIVE | **Priority:** Critical | **Annex:** ANNEX_AT \u00a7AT6.6\n\n- **Introduced design:** Mandatory pre-registration of backup suppliers with automatic-activation contracts before any essential-sector procurement renewal. Procurement authorities must calculate and publish the gap-window \u2014 the period between a primary supplier exit and backup supplier operational readiness \u2014 before each renewal cycle. Any drill classified as drill-secure requires adversarial observation by at least one party outside the procurement authority's organizational chain.\n- **Dependencies:** Essential-sector supplier registry, automatic-activation contract templates approved by the CRP, gap-window calculation methodology published and P-004-protected.\n- **New risks introduced:** Pre-registered backup suppliers could become nominal alternatives with no real capacity. Mitigated by: adversarial observation requirement for drill-secure drills, and gap-window publication creates accountability for calibration accuracy.\n- **Residual risk:** Supplier pre-registration does not guarantee backup capacity is operationally ready in all stress conditions. Gap-window calculation relies on supplier self-reporting, which is subject to optimism bias.\n\n---\n\n### P-051 \u2014 Constitutional Integrity Panel (CIP)\n\n**Threat addressed:** T-022 \n**Status:** ACTIVE | **Priority:** Critical | **Annex:** ANNEX_AM \u00a7AM8\n\n- **Introduced design:** 7-member independent body with staggered terms. Funding is constitutionally fixed at 0.01% of annual Flow issuance \u2014 not subject to legislative appropriation and not reducible by the governing coalition. Appointment requires multi-body sign-off drawn from sources that cannot be simultaneously controlled by a single governing coalition. 5-of-7 quorum required for Tier 1 ratification. Automatic review triggers fire when institutional vacancies exceed 90 days or when mandatory publication lapses exceed 30 days, without requiring the governing coalition to initiate.\n- **Dependencies:** Founding appointment of the initial 7-member panel before constitutional activation. Staggered term schedule published at founding. Flow issuance tracking system for the 0.01% funding calculation.\n- **New risks introduced:** Multi-body appointment requires identifying genuinely independent appointing bodies at founding, which may be difficult in contexts with thin civil society. Mitigated by: P-020 oppose-coalition nomination pathways provide analogous alternatives.\n- **Residual risk:** Constitutional entrenchment of CIP funding can still be dismantled by a sufficiently determined supermajority willing to use the Tier 1 amendment process. The CIP raises the political cost; it does not make repeal impossible.\n\n---\n\n### P-052 \u2014 Federated Ombuds Deliberate-Manufacture Standard\n\n**Threat addressed:** T-019 \n**Status:** ACTIVE | **Priority:** High | **Annex:** ANNEX_AI \u00a74.12\n\n- **Introduced design:** Pre-committed 4-criterion assessment that the Ombuds Plenum must apply when evaluating whether a demand-context flag was deliberately manufactured: (1) timing \u2014 whether the triggering enforcement action was initiated within a sentinel indicator movement window; (2) proportionality \u2014 whether the enforcement action's scope is proportionate to the stated enforcement basis; (3) prior basis \u2014 whether enforcement basis documentation existed before the sentinel indicator moved; (4) knowledge \u2014 whether the enforcing authority had actual or constructive knowledge of sentinel indicator status at initiation. The Plenum must reach a decision within 24 hours. When evidence is inconclusive across all four criteria, the asymmetric default favors PCRP activation rather than flag maintenance. A manufactured-flag finding is automatically referred to the Enforcement Panel, not held within the Ombuds system.\n- **Dependencies:** Federated Ombuds fully constituted per P-025 (\u22654 sub-Ombuds seated). Cross-register timing monitor operative (Annex AI \u00a73.3). Enforcement Panel charter must include manufactured-flag referrals as a defined intake category.\n- **New risks introduced:** 24-hour decision window creates pressure that may produce errors in ambiguous cases. Mitigated by: asymmetric default toward PCRP activation when inconclusive, which is the conservative failure mode.\n- **Residual risk:** The 4-criterion assessment cannot definitively establish intent. A sophisticated actor who sequences enforcement actions to avoid triggering all four criteria simultaneously can manufacture a flag while technically passing the assessment. Accepted as bounded leakage \u2014 the standard raises the operational complexity and coordination cost of deliberate manufacture without eliminating it.\n\n---\n\n### P-056 \u2014 Open-Access Survival Floor (Two-Tier Identity Model)\n\n**Status:** PROPOSED \n**Tier:** Tier 2 \n**Threat addressed:** T-002 (identity exclusion of vulnerable persons); INV-001 operationalization \n**Annex:** ANNEX_AK \u00a7AK8 \n**Summary:** Separates non-duplication (required for CSM) from identity verification (required only for above-floor services and civic instruments). Defines Tier 0 (open-access/pseudonymous survival floor) and Tier 1 (identity-gated services). Establishes civic accountability norm: the system trusts citizens because there is enough for everyone. Aggregate anomaly detection replaces individual surveillance at the survival tier. Token mechanism specification delegated to ANNEX_AZ \u00a7AZ2 as a pre-operational prerequisite.\n\n---\n\n### P-057 \u2014 Pilot Site Selection Criteria\n\n**Threat addressed:** Pilot farming (ACL-011), founding consent theater (ACL-010)\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Pilot_Site_Selection_Criteria.md](./Pilot_Site_Selection_Criteria.md)\n\n**Summary:** Defines required, disqualifying, and preferred characteristics for pilot site selection, including Phase 1 capital reference ranges. Prevents friendly-site selection from producing misleading pilot evidence and blocks sites where consent conditions or jurisdictional conflicts cannot be met.\n\n---\n\n### P-058 \u2014 Jurisdiction Interface Clause\n\n**Threat addressed:** Implementation drift (T-016), constitutional void under external law\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Jurisdiction_Interface_Clause.md](./Jurisdiction_Interface_Clause.md)\n\n**Summary:** Establishes three-layer jurisdiction interface; defines RAC as Layer 1; specifies matters governed by external law; pre-enrollment grace window; retaliation prohibition. Ensures the Humane Constitution operates coherently within, alongside, and\u2014where necessary\u2014in tension with external legal systems.\n\n---\n\n### P-059 \u2014 Vulnerable Population Consent Protocol\n\n**Threat addressed:** Founding consent theater (ACL-010), T-027 (dignity floor leverage)\n**Status:** PROPOSED | **Priority:** Critical\n**Creates:** [docs/governance/Vulnerable_Population_Consent_Protocol.md](./Vulnerable_Population_Consent_Protocol.md)\n\n**Summary:** Defines ICA structure, 30-day cooling-off, teach-back verification, non-waivable exit rights, and pre-recruitment prerequisites for VPCP-scope populations (homeless, justice-exiting, unemployed, disability, elder, refugee). Requires ICA staffed and exit support fund pre-capitalized before any VPCP-scope recruitment begins.\n\n---\n\n### P-060 \u2014 Founding Team Composition Standard\n\n**Threat addressed:** Keyholder social capture (ACL-005), bureaucratic elite formation (T-008)\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Founding_Team_Composition_Standard.md](./Founding_Team_Composition_Standard.md)\n\n**Summary:** Defines founding team composition floor, disqualifying conflicts, 9-seat keyholder allocation, founder sunset rules (FS-1 through FS-7), and Perpetual Humility Review. Seats 3\u20138 nominated by civil-society organizations approved by the adversarial panel member, not selected by the founding team.\n\n---\n\n### P-061 \u2014 Founding Capital Framework\n\n**Threat addressed:** Procurement shell capture (ACL-007), power-wealth convergence\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Founding_Capital_Framework.md](./Founding_Capital_Framework.md)\n\n**Summary:** Defines phase capital targets, 20%/30% concentration limits, Capital Steward structure, constitutional primacy clause, government walk-away rule, CLT land structure, and wind-down reserve. Capital Steward must be independent of the founding team; selection precedes first capital commitment.\n\n---\n\n### P-062 \u2014 Pilot Timeline Framework\n\n**Threat addressed:** Pilot farming (ACL-011), founding consent theater (ACL-010)\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Pilot_Timeline_Framework.md](./Pilot_Timeline_Framework.md)\n\n**Summary:** Five-track parallel timeline with critical-path gates; three recruitment windows; phased occupancy sequence; failure contingency requiring Resident Transition Protocol before Cohort 1. Track A (governance/legal), Track B (infrastructure), Track C (capital), Track D (community/consent), Track E (technology) must all clear defined gates before enrollment opens.\n\n---\n\n### P-064 \u2014 Compliance-Masked Refusal Hardening\n\n**Threat addressed:** T-028\n**Status:** ACTIVE | **Priority:** Critical\n\nThe essential-sector refusal package already tested open exit, medicine/PBM refusal, and grid/logistics delay. The remaining P0 gap was subtler: an incumbent can stay formally compliant while degrading actual delivery through slow paperwork, data withholding, PBM access friction, standards-body delay, affiliate fallback capture, workforce poaching, selective regional degradation, litigation, or concession pressure.\n\n- **Introduced design:** Adds compliance-masked refusal as a named refusal lane in the Essential-Sector Refusal Test Package. Formal compliance is no defense when CSM delivery, CASP activation, fallback control transfer, patient continuity, vulnerable-cohort continuity, or reserve activation fails in practice.\n- **Medicine hardening:** Requires complete access paths, not merely alternate suppliers: manufacturer/API, distributor, pharmacy/specialty pharmacy, claims/formulary data, cold chain, prescribing interface, appeal route, and patient-support path. Adds patient-continuity floor and medicine metrics for time-to-fill, missed doses, PA clock breaches, formulary overrides, affiliated routing, substitution harm, and vulnerable-cohort continuity.\n- **Grid/logistics hardening:** Adds hidden compliance variants for partial restoration, standards objections, data migration delay, workforce poaching, affiliate substitution, and regional degradation. Adds transfer-control metrics for dispatch, routing, warehouse, outage, grid, fleet, inventory, credentialing, emergency data access, full operating package access, and workforce independence.\n- **Dashboard integration:** Adds compliance-masked refusal exposure to the Capture Dashboard and threshold anchors. Watch and active-capture-signal thresholds now cover data/control-system export delay, standards obstruction, PBM access friction, affiliate fallback correlation, workforce poaching, legal delay beyond 14 days, concession requests, vulnerable-cohort failure, CASP blockage, and fallback control-transfer failure.\n- **Evidence integration:** Updates T-028 in the Threat Register and Threat Resolution Matrix, Phase 9 of the Pilot Evidence Roadmap, the Claims and Evidence Register, Hardening Queue, Conglomerate Transition Dossier, and Annex AT CASP independence language.\n- **New risks introduced:** The metric can over-classify genuine operational difficulty as strategic refusal. Mitigated by independent clearance for legitimate delay, two-source confirmation for degradation periods under Annex AT, and affected-population evidence rather than inference from paperwork alone.\n- **Residual risk:** Sophisticated incumbents can distribute obstruction below individual thresholds, especially through informal standards influence, contractor labor markets, insurer/lender pressure, and patient-level administrative friction. The control improves detectability; it does not create physical capacity, independent staff, data escrow, or medicine supply by itself.\n\n---\n\n### P-065 \u2014 CIP Vacancy-Starvation Hardening\n\n**Threat addressed:** T-022\n**Status:** ACTIVE | **Priority:** Critical\n\nThe active CIP design made hostile successor hollowing visible but still had a load-bearing failure mode: a successor government could let CIP seats expire, keep the panel below quorum, delay dashboard publication, and then argue that absent ratification could not block later action. This patch makes vacancy itself self-repairing and makes silence a defect, not consent.\n\n- **Introduced design:** CIP vacancies must be published within 7 days. Ordinary appointing sources must transmit a qualified nominee within 30 days; fallback nomination activates at 45 days through the Federated Ombuds Plenum from a public, multi-source shortlist. The fallback path is a repair duty, not a policy-alignment power.\n- **Staggering enforcement:** Appointments that violate the no-more-than-2-seats-per-year rule are void unless tied to death, incapacity, or removal for cause. Void appointments do not count toward quorum, ratification, or review authority.\n- **Below-quorum rule:** Vacancy does not waive concurrent ratification. A below-quorum CIP may publish records, request fallback nomination, preserve evidence, accept objections, and issue interim risk notices, but may not ratify amendments, close AM3 reviews, waive deadlines, approve funding changes, or appoint itself.\n- **Publication and report fallback:** Dashboard failure routes trigger publication through the public amendment log and independent Ombuds channels. A missing Ombuds Tier 1 integrity report procedurally suspends the amendment until the report or fallback review is complete.\n- **Servant-authority limits:** CIP authority is custodial, corrigible, conduct-based, and subject to ordinary challenge. CIP funding is subordinate to immediate Essential Access relief; no review, vacancy, dispute, or funding issue may delay survival-floor activation.\n- **New risks introduced:** Fallback nomination could become a guardian-class formation path if repeated repairs are dominated by the same civil-society or expert networks. Mitigated by public shortlists, multi-source nomination, Article VII publication, non-renewable terms, ordinary challenge rights, and Capture Dashboard monitoring.\n- **Residual risk:** This patch blocks one hollowing route; it cannot prevent lawful democratic repeal or broad institutional culture collapse. The design can make hollowing visible, slow, and contestable; it cannot make human guardians incorruptible.\n\n---\n\n### P-066 \u2014 Commons Return and Universal Stake Fiscal Sustainability Gate\n\n**Threat addressed:** T-029\n**Status:** ACTIVE | **Priority:** Critical\n\nThe previous active economic spine still treated progressive net-worth demurrage as the primary anti-hoarding and commons-funding mechanism. That left two skipped problems: the active annex did not match the accepted Commons Return and Universal Stake direction, and the corpus had no registered threat for the fiscal question beneath every scale claim \u2014 what funds the floor, at what inflation cost, and who actually bears the burden?\n\n- **Introduced design:** Annex D is rebuilt around Commons Return and Universal Stake. Routine progressive net-worth demurrage, idle-money decay, and continuous personal-balance carrying cost are superseded as active policy. Commons Return applies only to named source bases: land/location value, natural resources, scarce licenses, public-infrastructure uplift, network/platform rents, large succession transfers, and external-capital use of protected commons.\n- **Universal Stake:** A protected civic inheritance may distribute a share of Commons Return after Essential Access, resilience reserves, restoration duties, payment rails, and governance operations are funded. It may not buy Voice, Service Record, office, identity priority, Essential Access priority, or review-body eligibility.\n- **Fiscal gate:** T-029 blocks scale claims unless a costed fiscal adequacy model exists. The model must cover Essential Access cost, delivery cost, source-base receipts, Universal Stake formula, administrative cost, inflation/debasement tolerance, transition cost, downside scenarios, burden incidence, and any remaining taxes, fees, or charges.\n- **Honest tax posture:** The patch does not claim taxes are unnecessary. It says Commons Return should narrow the preferred public burden toward public-created and scarcity-created value, while any residual taxes must be named, costed, dignity-screened, and barred from survival access, ordinary labor, basic household exchange, and modest household reserves unless explicitly justified through the fiscal gate.\n- **Evidence integration:** Creates the Commons Return and Universal Stake Evidence Test Package; updates Threat Register, Threat Resolution Matrix, Hardening Queue, Claims and Evidence Register, Open Problems Resolution Docket, Pilot Evidence Roadmap, Capture Dashboard Specification, Annex Directory, Annex Taxonomy, reader prompts, and corpus registration.\n- **New risks introduced:** Commons Return can become valuation bureaucracy, surveillance, political dividend timing, hidden wealth tax, asset-holder avoidance, or downward burden shift. Mitigated only by source-specific bases, protected ordinary use, appeal rights, privacy limits, lockbox accounting, incidence testing, and public \"who pays\" disclosure.\n- **Residual risk:** Commons Return may still be insufficient or volatile. Some taxes or fees may remain necessary during transition or at scale. The control is not proof of fiscal adequacy; it is a scale-blocking discipline until proof exists.\n\n---\n\n### P-067 \u2014 Cyber Resilience and Availability Gate\n\n**Threat addressed:** T-030\n**Status:** ACTIVE | **Priority:** Critical\n\nThe corpus already had controls for implementation drift, tamper evidence, oracle failure, and delivery sufficiency. Those controls did not answer a different question: what happens when ransomware, breached keys, regional network outage, cloud/provider failure, supply-chain compromise, or payment-rail failure makes the survival floor unreachable?\n\n- **Introduced design:** T-030 registers external cyber availability as a distinct threat. The Cyber Resilience and Availability Evidence Test Package requires a critical-service inventory, ransomware continuity drill, key-compromise and emergency-rotation drill, offline/analog continuity drill, regional failover drill, and supply-chain/dashboard integrity drill.\n- **Continuity standard:** Essential Access must remain deliverable through last-known-valid state, manual/offline provider paths, emergency settlement, and public status channels inside the published tolerance. Aggregate restoration is not enough if vulnerable cohorts, rural users, digitally fragile persons, or critical providers remain cut off.\n- **Claim discipline:** Implementation Drift Audit Package remains the evidence home for unauthorized drift and tamper evidence. The cyber package is the evidence home for whether people can still receive food, water, shelter, medicine, transit, and urgent care when digital systems, keys, providers, or networks fail.\n- **New risks introduced:** Offline fallback can become fraud-prone or privacy-invasive; emergency key rotation can concentrate authority; manual provider settlement can become a hidden bailout or coercive choke point. These are residual risks and must be measured in the evidence packet.\n- **Residual risk:** This patch registers the risk and defines the test path. It does not prove cyber resilience, key custody, recovery time, offline continuity, or supply-chain safety.\n\n---\n\n### P-068 \u2014 Last-Resort Unenrolled Access Gate\n\n**Threat addressed:** T-031\n**Status:** ACTIVE | **Priority:** Critical\n\nThe corpus already names the principle: identity is never a condition of survival access. It also contains the pieces: P-054 safety-shielded emergency access, P-055 delivery sufficiency, P-056 Tier 0 design, Annex AK \u00a7AK8, and Annex AZ's pseudonymous token constraints. The missed question is narrower and more concrete: can a person who never enrolls, never holds a credential, never keeps a wallet, and cannot safely become legible still receive the floor?\n\n- **Introduced design:** T-031 registers last-resort unenrolled access as a distinct critical threat rather than hiding it inside ordinary identity recovery. The Last-Resort Unenrolled Access Evidence Test Package requires access-point mapping, no-credential intake drills, trusted-intermediary drills, analog reconciliation privacy tests, abuse/diversion drills, and dignity interviews.\n- **Claim discipline:** P-056 remains the designed Tier 0 architecture. P-068 is the active evidence gate. No document should claim practical universality of Essential Access until this gate has evidence that the last-resort path works for people outside identity and digital infrastructure.\n- **Continuity standard:** The path must work without a phone, app, QR code, card, stable address, biometric, persistent account, future enrollment promise, or identity-disclosing intermediary. Abandonment counts as exclusion.\n- **New risks introduced:** An analog last-resort route can be exploited by organized brokers, captured by intermediaries, gamed by providers, or converted into a shadow registry through reconciliation records. The evidence package requires aggregate controls and privacy review precisely because individual surveillance would defeat the point.\n- **Residual risk:** This patch does not prove the floor is reachable. It makes the proof requirement explicit and blocks universality claims until no-credential and trusted-intermediary routes pass under dignity review.\n\n---\n\n### P-069 \u2014 Monitoring Repurposing Gate\n\n**Threat addressed:** T-032\n**Status:** ACTIVE | **Priority:** Critical\n\nThe corpus already limits several monitoring surfaces: Annex C gives monitored persons notice and appeal, Annex H requires privacy/surveillance notes for amendments, Annex AK restricts Tier 0 monitoring to aggregate anomaly, Annex AY requires privacy-preserving delivery monitoring, and the Capture Dashboard bans ranking ordinary persons. The gap was cross-cutting: the same data required to enforce protection can be repurposed into the coercive surveillance layer the project opposes.\n\n- **Introduced design:** T-032 registers monitoring repurposing as a distinct critical threat. The Monitoring Repurposing Evidence Test Package requires a Monitoring Purpose Register, purpose-creep red team, linkability/re-identification test, office-separation drill, individual-flag appeal drill, data-minimization and retention audit, and coercive-use scenario.\n- **Claim discipline:** No document should claim enforcement monitoring is bounded, non-surveillant, or safe from repurposing until every monitoring stream has a named purpose, minimum-data rule, access role, retention rule, independent reviewer, appeal path, and explicit secondary-use prohibition.\n- **Continuity standard:** Enforcement may monitor power, institutions, route performance, provider continuity, aggregate anomalies, and control-plane health. It may not silently create a general-purpose behavioral graph, location map, risk list, identity dossier, or ranking system for ordinary persons.\n- **New risks introduced:** Tight monitoring limits can reduce fraud detection or delay enforcement; strong auditability can conflict with deletion; aggregation can hide individual harm; raw records can still be pressured by lawful authorities or captured insiders. These are residual risks and must be measured honestly.\n- **Residual risk:** This patch does not prove monitoring is safe. It makes monitoring itself a test subject and blocks anti-surveillance claims until purpose limitation, linkability resistance, office separation, appealability, retention, and coercive-use tests pass.\n\n---\n\n### P-070 \u2014 Founding Legitimacy Prerequisite Definition Gate\n\n**Threat addressed:** T-033\n**Status:** ACTIVE | **Priority:** Critical\n\nThe corpus already names the founding legitimacy problem through T-017, T-022, T-026, T-027, the Founding Order, Annex AH, the Founding Legitimacy Dossier, the Vulnerable Population Consent Protocol, the Founding Team Composition Standard, and the Pilot Timeline Framework. The gap was not absence of concern. The gap was definition: the two Founding Legitimacy Dossier prerequisites, \"consent evidence\" and \"independent civil-society review,\" could not be produced without a public standard for what counted.\n\n- **Introduced design:** Creates the Founding Consent and Civil-Society Review Evidence Test Package. The package reconciles the Dossier's lower consultation threshold with the Founding Order's binding consent act: for activation authority, 2/3 eligible resident-personhood participation and 2/3 eligible resident-personhood affirmative consent govern, with 90-day notice, 60-day deliberation, roll-call-equivalent record, and drift-chain logging.\n- **Consent evidence standard:** Requires consent model, notice record, deliberation record, participation record, threshold certification, opt-out proof, aid-nonconditioning proof, pressure survey, coercion complaint log, and exit-cost report before the Dossier consent-evidence row can reach PRODUCED.\n- **Civil-society review standard:** Requires at least three qualified reviewer categories from an adversarial-panel shortlist after public challenge. Reviewers must pass financial, governance, affected-community accountability, dissent-capacity, conflict-disclosure, and plain-language-publication tests.\n- **Claim discipline:** Gate A does not clear if founders substitute low-turnout consultation, silence, humanitarian-aid acceptance, friendly expert review, funder-adjacent review, or unpublished reviewer findings for consent and independence evidence.\n- **New risks introduced:** A stricter review gate can be used to delay legitimate founding indefinitely or empower a civil-society gatekeeper class. Mitigations are public shortlists, public challenge records, separate reviewer findings, dissent preservation, affected-community accountability, and explicit Gate A failure reasons.\n- **Residual risk:** No evidence packet can prove perfect founding legitimacy. P-070 makes consent and reviewer independence falsifiable before activation; it does not eliminate the bootstrap problem, informal pressure, class capture, or the need for post-activation audit.\n\n---\n\n### P-072 \u2014 Productive Status Register\n\n**Threat addressed:** T-025\n**Status:** PROPOSED | **Priority:** High\n\nThe word \"productive\" unlocks two benefits on two separate tests: Flow issuance against verified productive commitments (ANNEX_X) and the Commons Return exemption for productive working assets (ANNEX_D \u00a7D3, on ANNEX_J's published Article V stewardship standard). P-023 closed the protected-capital shelter inside the contract-commitment architecture; the residual T-025 variant is *cross-instrument and temporal* \u2014 the same activity classified \"productive\" by the looser test claims both benefits, and because Flow mints at commitment start while the exemption is assessed at settlement, an honest determination at T0 can be exited before any reversal clears.\n\n- **Introduced design:** The [Productive Status Register](Productive_Status_Register.md) \u2014 one canonical productive-status determination per commitment/asset against the single published standard, with three structurally separate roles (standard-author, register-adjudicator, benefit issuer; INV-006 incl. the economic-parameter-setting extension); a **settle-forward escrow** under which the \u00a7D3 exemption vests only after the Flow-side commitment is verified to have stayed in productive use through a full settlement period (non-vesting replaces reversal, wages stay protected by no-clawback); a payroll/escrow fast-path so issuance is never blocked on adjudication; an appeal-bound, independently audited determiner; and the rule that status classifies the activity, never the person (INV-003; \u00a7D6 minimum-necessary data).\n- **Claim discipline:** No document may claim the productive double-dip is closed until the register's evidence test passes (double-dip closure in adversarial simulation; no issuance starvation; determiner non-capture; no person-scoring drift). The instrument is `Designed` and pilot-gated; it binds nothing until then.\n- **New risks introduced:** A single register is a new capture target (bounded by the three-way role split, appeal, audit, and the INV-006 recusal extension); escrowed exemptions add settlement-period accounting complexity; the fast-path's provisional status could be farmed below the de-minimis threshold (the escrow still withholds the exemption, so the farm nets nothing).\n- **Residual risk:** Settle-forward closes the modeled timing attack; it does not prove the published stewardship standard itself cannot be captured (that remains ANNEX_J / Article V territory under T-025), and no pilot evidence exists for adjudication throughput at scale.\n\n**Panel-revised before incorporation** (adversarial, Christ-centered, corpus-fit; source: `docs/superpowers/specs/2026-06-09-productive-register-recusal-redline.md`). The companion Fix 2 of that redline \u2014 the INV-006 economic-parameter-setting recusal extension \u2014 is already constitutional (applied with Session 23).\n\n---\n\n### P-073 \u2014 Framework-First Intake (Anti-Accretion Rule)\n\n**Threat addressed:** structural \u2014 no threat row (rule-count inflation as a systemic failure mode)\n**Status:** ACTIVE | **Priority:** High\n\nA full-corpus simplification audit (2026-06-12, three independent single-role reviews) found that the corpus's protective machinery grew by accretion: each threat received its own patch, and patches repeatedly reimplemented mechanisms the corpus had already designed elsewhere \u2014 at audit time, at least eight collusion-detection instances, eight appeal-path machineries, ten near-identical evidence test packages, seven restatements of the data-minimization rule, six overlapping status registries, and forty-seven standing institutions. Every duplicate mechanism is a new capture surface, a new audit obligation, and a new layer of illegibility between an ordinary person and the rules that govern them.\n\n- **Introduced design:** The Framework-First Intake gate in `Acceptance_Protocol.md`: a proposal introducing a mechanism whose protective function an existing mechanism already performs must extend the most general existing instrument or attach a published justification for why extension cannot serve. Returns are judgment calls, so they carry a published return record (void without it), a point-by-point resubmission ratchet, and escalation of contested duplication questions to the standing adversarial panel member. Extensions that add authority, personnel, data collection, or gatekeeping power receive full new-mechanism scrutiny at the higher applicable tier (no laundering). A simplicity presumption favors consolidation and deletion \u2014 bounded so it never blesses independence-reducing mergers (mechanism count, never independence count) and never costs a protected person their path to protection.\n- **Claim discipline:** This gate is process hygiene, not proof of simplicity. No document may claim the corpus is consolidated or minimal until the consolidation program (status spine, appeal spine, evidence framework, data stewardship standard, institutional mergers) actually lands and the rule shows fruit at real intakes.\n- **New risks introduced:** A captured intake could try to use \"duplicate\" as a veto on new protections (bounded by the return record, ratchet, and adversarial escalation); justification-writing could become ritual boilerplate (watched via the technical-review record requirement); the gate itself is one more rule (accepted: it is the rule that makes the next hundred unnecessary, and it creates no office, register, or new process step).\n- **Residual risk:** The gate stops *new* duplication; it does not remove the existing redundancy (that is the consolidation program's job). Its effectiveness is unproven until tested by real proposals; per its own corrigibility clause, evidence that it suppresses needed protections or relocates complexity into justification documents counts against it.\n\n**Panel process:** four independent single-role reviewers (adversarial systems designer, Christ-centered, corpus-fit, minimalist) reviewed the applied diff in parallel; all four returned APPROVE WITH FIXES and every required fix was incorporated (return-record discipline, anti-laundering tier rule, independence-count bound, protected-person clause, corrigibility clause, functional test replacing a closed family list, P-073 provenance). Christ-centered review recorded as Session 25 in `Christ_Centered_Evaluation.md`.\n\n**Consolidation program landings (running record):** 2026-06-12 \u2014 the status spine landed (first program step under this gate): `Status_Model.md` deleted, its vocabulary and edge rules absorbed into the Claims and Evidence Register's Status methodology section (now the canonical status spine); the Hardening Queue stripped of duplicated status tracking (worklist only, references owners); Threat Register restated patch-statuses converted to pointers. Net ~\u221295 lines; vocabulary-definition sites reduced from five to one. Evidence Ladder deliberately retained standalone (it defines evidence *levels*, a different axis, and its level numbers are cited by app code and seven documents). Named follow-ups: Patch Log single-row mini-tables (same-file restatement, checker-covered) and a single convention for Threat Register per-entry Status lines. 2026-06-12 \u2014 the appeal spine landed (P-074, ANNEX_L \u00a7L7): seven appeal procedures \u2192 one spine + a domain intake table (the ANNEX_AW \u00a7AW3.3 orphan appeal window, RRE-011, is a named follow-up); FC-209's reserved appeal path closed by binding it to the spine. 2026-06-12 \u2014 the evidence framework and data stewardship standard landed (P-075): one test-package template in the Evidence Ladder (ten packages surveyed; four structural follow-ups named), one minimization doctrine + calibration table + linkage rule in the Monitoring Administrative Safety Packet; one restatement site deleted (the ETP baseline) and six domain clauses retained with pointers; the ANNEX_AJ P-004-protected clause recorded unmodified. 2026-06-12 \u2014 the institution merger audit landed (P-076): two phantom bodies resolved to existing ones, oracle council/cohort terminology unified; the two headline merger candidates were honestly rejected (different functions; nonexistent body) \u2014 a wrong merger is worse than none. 2026-06-13 \u2014 follow-up F-5 landed (P-077): the four drift rules the program itself created (status, appeal, evidence, data) collapse into one canonical-home discipline in the P-073 gate; the drift principle now has one definition site instead of four, each home keeping only its own enforcement. The named next target remains this very record's pattern \u2014 the Patch Log's triple-entry restatement.\n\n\n---\n\n### P-074 \u2014 Appeal Spine Consolidation (ANNEX_L \u00a7L7)\n\n**Threat addressed:** structural \u2014 no threat row (appeal-path fragmentation as a systemic failure mode)\n**Status:** ACTIVE | **Priority:** High\n\nThe same simplification audit that produced P-073 counted at least eight separate appeal machineries across the corpus \u2014 each with its own filing rule, window, ladder, and clock. Fragmented appeal procedure is itself an exclusion mechanism: the person most likely to need an appeal is the person least equipped to discover which of eight procedures applies to them. This patch is the first P-073-mandated consolidation of an entire mechanism family.\n\n- **Introduced design:** ANNEX_L \u00a7L7, the canonical appeal spine: one filing rule and 30-day window (L7.1); the survival floor and the status quo ante continue during appeal, with penalties and stakes paused or escrowed until finality (L7.2); a single three-instance ladder with the Ombuds Plenum deliberately kept as a separate final instance for enforcement and attestation questions (L7.3); one timing table (L7.4); a domain intake table replacing scattered procedure (L7.5); and a drift rule in the \u00a7L7 provenance note making the spine govern over any domain restatement. Pointer rewrites in ANNEX_J, ANNEX_I, ANNEX_X, ANNEX_D, ANNEX_U, ANNEX_AJ, ANNEX_AS, the Productive Status Register, the Identity Recovery Evidence Test Package, and the Parameter Calibration Register (FC-209 bound to the spine) replace local appeal machinery with first-instance intake plus a spine citation: seven scattered appeal procedures become spine pointers (with ANNEX_I \u00a7I8's duplicate clocks and ANNEX_AI \u00a74.8's duplicate filing window deleted in favor of the spine); the ANNEX_AW \u00a7AW3.3 orphan appeal window (RRE-011) is a named follow-up, not yet absorbed.\n- **Claim discipline:** No claim that appeals are accessible, timely, or capture-resistant in practice until the appeal-path drills (including the FC-209 both-directions drill) actually run. The spine is `Designed`; consolidation reduces procedure count, not uncertainty.\n- **New risks introduced:** A single procedural spine is a single point of procedural capture \u2014 whoever controls the spine's clocks and intake controls every appeal (bounded by the Plenum/CRP split in L7.3 and the spine-discipline drift rule in the \u00a7L7 provenance note, which makes deviation visible rather than silent). The status-quo-ante rule (L7.2) could be exploited to freeze adverse-but-correct decisions in place during appeal (bounded by the published, reviewable imminent-serious-harm carve-out generalized from ANNEX_U \u00a7U6). The generalized imminent-serious-harm standard is itself unpublished \u2014 until it is authored under the ANNEX_U \u00a7U5 threshold-setting discipline and published (a pre-launch gate), each domain's existing published interim measure governs during appeal, so there is no absolute status quo ante.\n- **Residual risk:** The body names in L7.5 are designed institutions with no pilot evidence behind any of them; the 72-hour, 14-day, and 30-day clocks are design estimates, not measured capabilities. Whether one door genuinely lowers the filing barrier for the least-resourced appellant is unproven until drilled.\n\n**Numbering note:** the held Voice/Service-Record redline provisionally cited P-074 for its civic-misuse proposal; per that redline's own renumbering caveat, it takes the next free number at intake.\n\n---\n\n### P-075 \u2014 Evidence-Test Framework and Data Stewardship Standard\n\n**Threat addressed:** structural \u2014 no threat row (restated evidence-test structure and data-stewardship rules drifting apart across documents)\n**Status:** ACTIVE | **Priority:** High\n\nThe consolidation program's survey of the corpus's ten evidence test packages and its data-handling clauses found the same structural rules restated in slightly different words across many documents \u2014 a drift surface where a future edit to one restatement silently diverges from the others. This patch is the third P-073-mandated consolidation: one canonical skeleton for evidence test packages, and one master minimization and purpose-limitation standard for data about persons.\n\n- **Introduced design:** The Evidence Ladder gains the canonical Test Package Template (P-075): six required structural elements (claim under test, abuse model, required tests with pre-stated failure criteria, adverse-finding protocol, affected-documents update order, residual risk) plus a drift rule under which the template governs over any package restatement, a non-conforming package gates nothing, and new structural patterns require framework-first justification under the Acceptance Protocol's anti-accretion rule (P-073). The Monitoring Administrative Safety Packet gains the master Minimization and Purpose-Limitation Doctrine \u2014 carrying the six-condition baseline formerly stated in the Monitoring Repurposing Evidence Test Package (conditions verbatim, with two declared strengthenings: scope broadened from monitoring to any collection of data about persons, and conditions 5\u20136 bound to the appeal spine and the ANNEX_AM \u00a7AM7 stripping standard), which now tests the doctrine rather than restating it \u2014 plus a quote-sourced per-domain calibration table (seven domains; open gaps marked honestly as \"unspecified \u2014 gap\"), a cross-domain linkage rule generalizing the ANNEX_D \u00a7D6.5 independent-finding standard, and a drift rule under which stricter domain text always governs. One restatement site was deleted (the ETP baseline); the six domain clauses (ANNEX_AJ, ANNEX_AF \u00a7AF3, ANNEX_AK \u00a7AK8.1, ANNEX_D \u00a7D6.1, ANNEX_C, and the Capture Dashboard Specification) were retained as domain substance and gained pointers; ANNEX_K \u00a7K6 and ANNEX_I \u00a7I8's generic restatements now defer to the doctrine; the ANNEX_AJ P-004-protected purpose-limitation clause is recorded in the calibration table unmodified.\n- **Claim discipline:** This consolidates restatements; it proves nothing about practice \u2014 the doctrine's fruit is unproven until tested and the four named calibration gaps remain gaps.\n- **New risks introduced:** A single doctrine is a single drafting-error blast radius (bounded by the stricter-text-governs rule); the calibration table could be misread as licensing the gaps it names (bounded by \"gap is not permission\").\n- **Residual risk:** The unspecified stripping/retention rules in four domains are now visible but still unspecified. Named calibration gaps: G-1 ANNEX_AJ bypass-detection fixed retention period unspecified (owner: ANNEX_AJ); G-2 ANNEX_AF attestation-graph retention-schedule length and stripping point unspecified (owner: ANNEX_AF \u00a7AF3); G-3 ANNEX_D Commons Return stripping point and retention unspecified (owner: ANNEX_D \u00a7D6); G-4 flag-expiry period unspecified (owner: this packet's flag lifecycle + ANNEX_C). Named follow-ups F-1\u2013F-7: prose status normalization in the Anti_Rent, Identity_Recovery, and Service_Record packages (F-1); an affected-documents section for the Capacity_Measurement package (F-2); an abuse model and affected-documents section for the Commons_Return package (F-3); a standalone residual-risk statement for the Cyber_Resilience package (F-4); unify the four drift rules into one doctrine in the P-073 gate \u2014 a constitution change, separate reviewed patch (F-5); checker coverage for the calibration table's quoted text (F-6); ANNEX_A \u00a7A20 cites the doctrine instead of restating it (F-7).\n\n---\n\n### P-076 \u2014 Institution Merger Audit (Phantom Resolution and Terminology Unification)\n\n**Threat addressed:** structural \u2014 no threat row (dangling institutional pointers and duplicate naming creating phantom bodies in the escalation paths)\n**Status:** ACTIVE | **Priority:** Medium\n\nThe consolidation program's 47-institution inventory proposed merger candidates; verification found the headline candidates dissolve on inspection \u2014 this patch records what was actually done and what was honestly rejected.\n\n- **Introduced design:** Three fixes. (1) Conservative Hold's declaring authority in ANNEX_AQ is bound to the existing RCS accreditation body \u2014 the declaring authority for Shared Storehouse suspension under ANNEX_AL \u00a7AL-CORR (Suspension Declaration) \u2014 resolving a dangling \"named in ANNEX_AL \u00a73\" pointer that named no one. (2) The phantom \"Measurement Oversight Body\" in the Capacity Measurement Evidence Test Package is deleted; oracle-disagreement escalation is bound to the independent methodology-review panel constituted under ANNEX_AL \u00a74.1 (composition per P-017 oracle-independence standards, independent of the RCS accreditation body). (3) \"Oracle council\" is unified to \"oracle cohort\" \u2014 FC-033's own unit \u2014 across the Capacity Measurement package and SPECIFICATIONS.md (two occurrences). (4) A stale ANNEX_AM cross-reference to \"Annex AL \u00a73.1\" (a heading that does not exist) is corrected to \u00a73.4, where the FC-031 methodology-class minimum lives.\n- **Claim discipline:** No institution-count reduction may be claimed beyond what happened: two phantom references resolved to existing bodies, one duplicate term unified; the restated effective count is 44 (47 inventoried \u2212 2 phantoms \u2212 1 duplicate term); zero operating bodies merged.\n- **New risks introduced:** Binding Conservative Hold declaration to the RCS accreditation body concentrates one more declaratory act in an existing verifier-side body (accepted: it replaces a pointer to nowhere \u2014 zero effective checks \u2014 with one real, already-audited check; the body gains no allocative power). The same body also controls the quorum denominator through accreditation, so de-accreditation is a theoretical Conservative Hold trigger lever \u2014 bounded by the ANNEX_AM accreditation-count automatic review, the FC-100 14-day restoration ceiling, the operative-without-confirmation rule, and L7 appealability of both wrongful declaration and refusal to confirm.\n- **Residual risk:** The ANNEX_AB \"capacity certifier shall be named\" placeholder remains a named follow-up (substantive designation, not a rename); the institutional inventory itself is unverified beyond the candidates examined. Two proposed mergers were examined and REJECTED with reasons: the register-adjudicator and contribution-verification functions are different functions protecting different people (merging would weaken INV-006), and the \"Temporal Continuity Review Panel\" exists nowhere in the corpus.\n\n**Numbering note:** the held Voice/Service-Record redline takes the next free patch number above P-077 at intake.\n\n---\n\n### P-077 \u2014 Canonical-Home (Anti-Drift) Discipline\n\n**Threat addressed:** structural \u2014 no threat row (the consolidation program's own output: four near-identical drift rules, the largest restatement mass the program created)\n**Status:** ACTIVE | **Priority:** Medium\n\nThe status spine (P-074 era), the appeal spine (P-074), the evidence template, and the data doctrine (P-075) each ended with its own \"domains cite the home; a divergent restatement is drift; the home governs\" rule, written four times in four documents \u2014 the exact restatement pattern the framework-first gate exists to prevent, reproduced by the gate's own consolidations. Follow-up F-5, named at P-075, called for unifying them; this is that patch.\n\n- **Introduced design:** One **canonical-home discipline** is added to the P-073 Framework-First Intake gate in `Acceptance_Protocol.md`: once the framework-first rule produces a canonical home for a function, domain documents cite it and keep only domain-specific substance; a divergent restatement is drift and the home governs \u2014 with one exception that runs only one way (a domain text **strictly more protective of the person** governs and is recorded as a deliberate protection, never a weaker or slower variant, and never for a uniform procedural rule like an appeal clock where uniformity is itself the protection). The gate now carries the index of known homes (status \u2192 Claims and Evidence Register; appeals \u2192 ANNEX_L \u00a7L7; evidence-package structure \u2192 the Evidence Ladder Test Package Template; data minimization \u2192 the Monitoring Administrative Safety Packet doctrine). The four local rules are reduced to pure pointers \u2014 a home-declaration, their own specific enforcement (status build-fail; non-conforming package gates nothing; appeal-spine governs; stricter data text wins), and a citation \u2014 so the drift principle (what drift is, how the stricter-text exception resolves) is stated once, centrally, instead of four times. The central exception also gains teeth the four local versions lacked: a domain claiming a \"more protective\" variant bears the burden of showing it stronger on *every* dimension a person relies on (coverage, retention, revocability, speed, accessibility), records the claim with reasoning, and the claim is itself appealable on the spine; an unrecorded divergence is drift by default. The known-homes index is marked a convenience record \u2014 a home is canonical from its framework-first creation, not from appearing in the list.\n- **Claim discipline:** This is a definition-site collapse for the drift principle (stated 4\u00d7 before, once now), not a behavior change: every home governs exactly as before, the stricter-text exception is unchanged where it already applied (data) and explicitly excluded where it never did (uniform procedure, status), and the added burden-and-appealability clause strengthens the exception without altering any home's outcome. No new home is created; no home's enforcement is weakened. The leaves were shrunk to pointers in panel revision (the first draft left them restating the principle, which would have made the count 5 sites, not 1).\n- **New risks introduced:** Centralizing the discipline in the constitution makes one paragraph the single amendment point for the whole anti-drift principle (bounded: it is Tier-2 protected within the FAP, subject to the gate's own corrigibility clause, and each home still names its own enforcement so a captured central paragraph cannot silently disable a home's build-fail or gates-nothing hook). The stricter-text exception could be misread as licensing a domain to claim \"more protective\" while actually diverging weaker \u2014 bounded by the explicit \"only a stronger one; never a weaker, slower, or looser variant\" language and the uniform-procedure carve-out.\n- **Residual risk:** The discipline is enforced by review and by each home's named mechanism, not by a single script; a domain that restates a home's rule without diverging (harmless redundancy) is not build-caught, only review-caught. The minimalist's named next target \u2014 the Patch Log's own triple-entry pattern (inventory row, detail section, running record) \u2014 remains the largest same-file restatement mass and is not addressed here.\n\n**Panel process:** four independent single-role reviewers (adversarial systems designer, Christ-centered, corpus-fit, minimalist) reviewed the applied diff in parallel. Incorporated fixes: the adversarial burden-and-appealability clause on the stricter-text exception (closing self-certified \"more protective\" divergence); the minimalist reduction of the four leaves from principle-restatements to pure pointers (the first draft had grown them, making the honest count 5 definition sites, not 1) and the corrected claim line; the index marked non-constitutive per the adversarial staleness catch. Corpus-fit and Christ-centered approved without required fixes. Christ-centered review recorded as Session 27 in `Christ_Centered_Evaluation.md` (constitution change to `Acceptance_Protocol.md`).\n", + "content": "# Patch Log\n\n**Running change ledger aligned to the Humane Constitution \u00b7 Current through P-078 (P-071 reserved)**\n\n---\n\n**Purpose.** This log records the hardening changes introduced during the current cycle and keeps a traceable link between threats, mitigations, introduced risks, and remaining open questions.\n\n**Rule.** The patch log is not a substitute for the constitution. The Humane Constitution holds the law-like text; the patch log explains how and why the hardening evolved.\n\n**Patch status convention:** \n- **ACTIVE** = adopted into the document set and awaiting simulation/tuning; not evidence-backed proof. \n- **SUPERSEDED** = replaced by a later patch. \n- **PROPOSED** = designed but not yet accepted into the Humane Constitution.\n- **RETIRED** = intentionally removed.\n\n**Evidence discipline.** A patch can be well designed and still fail in contact with identity errors, measurement lag, legal wrappers, institutional self-protection, or founding politics. Do not treat `ACTIVE` or `PROPOSED` as `RESOLVED`; evidence-backed resolution belongs in the Claims and Evidence Register and the relevant Threat Register residual-risk update.\n\n---\n\n## Patch Inventory\n\n| Patch ID | Related Threat | Status | Priority | Core Change |\n| :--- | :--- | :--- | :--- | :--- |\n| P-001 | T-001 | **ACTIVE** | Critical | Contain shadow convertibility through friction, detection, and broker-focused enforcement. |\n| P-002 | T-004 | **ACTIVE** | Critical | Stabilize incentives with nonlinear reward architecture and anti-gaming design. |\n| P-003 | T-002 | **ACTIVE** | Critical | Replace single-gate identity with differential assurance and recovery-safe continuity. |\n| P-004 | T-007 | **ACTIVE** | Critical | Stop semantic capture through definition governance and anti-laundering rules. |\n| P-005 | T-005 | **ACTIVE** | Critical | Governance throughput: tiered CRP queues, throughput floor, emergency re-declaration. |\n| P-006 | T-006 | **ACTIVE** | Critical | Measurement lag: sentinel mandate, PCRP first-responder authority, Shared Storehouse unwind symmetry. |\n| P-008 | T-008 | **PROPOSED** | High | Elite formation: legibility audit, diversity mandates, verification independence, cohort cooling. PROPOSED and superseded for operative authority by P-025 (Federated Ombuds constitution); P-025 is the live ACTIVE control for T-008. |\n| P-009 | T-009 | **ACTIVE** | Med-High | Grace exploitation: graduated renewal, cross-quarter history, collusion detection, Service Record slow-decay. |\n| P-011 | T-011 | **ACTIVE** | Critical | Narrative hardening: RPCP, pre-committed failure doctrine, CFRL, adversarial narrative simulation. |\n| P-012 | T-012\u2013T-015 | **ACTIVE** | Critical | Interface hardening: oracle independence, categorical throughput floors, deadlock protocol, demand-context flag. |\n| P-013 | T-016 | **ACTIVE** | Critical | FAP integrity: representativeness standard, deadlock timeline, audit epistemic independence, anti-gaming Tier 2. |\n| P-014 | T-017 | **ACTIVE** | Critical | Bootstrap activation: one-time founding instrument for P-013 activation only. |\n| P-015 | T-018 / T-019 | **ACTIVE** | High | PCRP attack surface: false-trigger escalation path, exhaustion alert, manufactured flag assessment. |\n| P-016 | T-002 | **PROPOSED** | Critical | Identity asymmetric error doctrine: quantified fraud/exclusion rate targets, Tier 2 founding commitment. Remains PROPOSED / pre-ratification until founding adoption and pilot-calibrated rate confirmation; FC-140 through FC-145 have bound starting values, while FC-146 through FC-150 remain pre-launch commitments. |\n| P-017 | T-020 / T-021 | **ACTIVE** | Critical | Oracle epistemological and algorithmic independence: methodology-class diversity, AI supply chain transparency, physical ground-truth requirement. Numerical floors (N\u22655, \u22653 classes, \u22640.30 pairwise correlation, \u22651 adversarial seat) bound in `/founding/commitments.md` FC-030/FC-031/FC-032/FC-033. |\n| P-018 | T-022 | **PROPOSED** | Critical | Electoral cycle resilience: entrenchment ladder, Essential Access floor minimum persistence, administrative hollowing triggers, transition continuity protocol. |\n| P-019 | T-023 | **ACTIVE** | Med-High | Pilot external validity gate: stress-condition pilot requirement, red-team challenge window, crisis simulation mandate. |\n| P-020 | T-017 | **ACTIVE** | Critical | Founding window extension: 60-day pre-activation disclosure, oppose-coalition adversarial member nomination. |\n| P-021 | \u2014 | **ACTIVE** | High | Register disclosure protocol: bifurcation into public and restricted versions; operational security for detection thresholds. |\n| P-022 | T-024 | **ACTIVE** | Critical | Shared Storehouse oracle-failure fallback: conservative hold, 48h REB first-responder window, 72h governance handoff, FC-100 14-day restoration verification, reconciliation review. Annex AQ ACTIVE. |\n| P-023 | T-025 | **ACTIVE** | High | Capital-deployment shelter capture: contract-commitment architecture, milestone escrow, verified physical deliverables, and no protected-capital label without deployment. |\n| P-024 | T-009 / TR-07 / T-018 | **ACTIVE** | Critical | Attestation-at-risk stake mechanism: FC-080 stake ratio, FC-081 audit window, FC-082 graph density threshold, slashed-stake redistribution, graph-density safe harbor for legitimate close-knit communities. Annex AS. |\n| P-025 | T-008 | **ACTIVE** | Critical | Federated Ombuds constitution: 5 sub-Ombuds (FC-090), 4-of-5 Plenum supermajority (FC-091), 730-day staggered terms (FC-092), Oversight Assembly (7 members, 5-of-7), structural-dispersal criteria, Concentration Response. Annex AI rewritten. Supersedes single-commissioner draft. |\n| P-026 | T-026 / T-027 | **ACTIVE** | Critical | Founding Order \u2014 Subsidiarity, Consent & Exit: smallest-scale default with three-prong competence test; affirmative consent events at 2/3 supermajority (FC-120); 730-day graceful exit unwind (FC-121) with Essential Access continuity preserved; five-scale hierarchy (FC-122: household/neighborhood \u2264500/locality \u22645,000/region \u2264500,000/federation); re-entry symmetric, no penalty. `/founding/order/` directory. |\n| P-027 | T-005 / T-008 | **ACTIVE** | Critical | Structural consolidation into one Founding Order and seven Articles of Constitutional Order. Rights and execution unified under Article I; Essential Access and delivery unified under Article IV; markets, housing, enterprise, and PFCR unified under Article V; Voice, Service Record, and deliberation unified under Article VI; transparency and environmental scanning unified under Article VII. |\n| P-029 | T-016 | **ACTIVE** | Critical | Public Finance & Commons Revenue (PFCR): structural non-tax public funding, Commons Return source-base receipts, public banking rails as infrastructure, and anti-hidden-debt discipline. |\n| P-030 | PRD-004 | **ACTIVE** | Critical | Protocol-only money creation + household finance boundaries: no private Flow creation, no compounding household ordinary-life debt, no survival-floor securitization. |\n| P-031 | PRD-009 | **ACTIVE** | Critical | Anti-dynasty ownership: count-through beneficial ownership, trust prohibition for extractive continuity, succession limited to continuity and stewardship. |\n| P-032 | PRD-009 | **ACTIVE** | High | Stewardship ownership rule: land, housing, and enterprise rights may not become perpetual passive extraction claims. |\n| P-033 | PRD-008 | **ACTIVE** | High | Worker-owned and mission-locked enterprise preference: financing, procurement, and succession pathways structurally favor stewardship forms over absentee control. |\n| P-034 | T-016 / INV-007 | **ACTIVE** | Critical | Two-key architectural precondition for Tier-1-touching patches: adversarial panel attestation required before FAP intake; FAP reviewer cannot override absence; Beer S3* independence enforced; Buterin defection penalty specified. Annex AV. |\n| P-035 | \u2014 | **ACTIVE** | High | Founding group corrigibility clause + epistemic humility statement in Preamble and \u00a70A. |\n| P-036 | \u2014 | **ACTIVE** | High | Keyholder servanthood duty + replacement mechanism for self-interested keyholders (Article I). |\n| P-037 | \u2014 | **ACTIVE** | High | Identity-serves-person clause with triennial review and sunset requirement on secondary data use (Article II). |\n| P-038 | T-006 | **ACTIVE** | High | Community challenge path for capacity measurement figures with 14-day published response (Article III). |\n| P-039 | \u2014 | **ACTIVE** | High | Explicit protection for pre-existing mutual aid, family, and religious care networks; Article IV as floor not monopoly (Article IV). |\n| P-040 | \u2014 | **ACTIVE** | High | Housing cap pastoral revision (remove cold \"regardless\" language); structural humility closing clause added to Article V. |\n| P-041 | T-008 | **ACTIVE** | High | Biennial recognized-contribution audit to include invisible and pastoral work; 180-day correction requirement (Article VI). |\n| P-042 | \u2014 | **ACTIVE** | High | Low-barrier community alert pathway with 30-day acknowledgment and 90-day review trigger (Article VII). |\n| P-043 | Multiple | ACTIVE | High | Logical-analysis corpus corrections \u2014 documentary, amendment architecture, definitions, placeholder fill |\n| P-044 | Multiple | ACTIVE | High | Threat-strengthening batch \u2014 T-001/T-002/T-004/T-005/T-007/T-018/T-019 mitigation gaps closed |\n| P-045 | T-001 / T-002 / T-004 / T-007 / IC-004 | **ACTIVE** | Critical | Threat-mitigation batch \u2014 threshold derivation, asymmetric exclusion review, contribution floor, protected-term seed list, dignity-only continuity mode (threats remain Active \u2014 unproven; nothing marked Resolved) |\n| P-046 | Multiple | **ACTIVE** | Critical | Evidence and capture hardening \u2014 seven proof artifacts, drift audit, parameter calibration, abuse cases, evidence ladder, founding dossier, and capture dashboard |\n| P-047 | T-025 / T-026 / T-027 / external dependency capture | **ACTIVE** | Critical | Essential-sector conglomerate transition \u2014 profitable compliant path, refusal survivability tests, public fallback capacity, and numeric evidence anchors |\n| P-048 | T-025 / T-026 / T-027 / external dependency capture | **ACTIVE** | Critical | Essential-sector refusal test package \u2014 sector drills, FC-194 through FC-201 calibration rows, Annex AT receiver/licensing triggers, public explainer, and evidence-source expansion |\n| P-049 | Multiple evidence-gap bridges | **ACTIVE** | High | Cross-register bridge pass \u2014 aligns Hardening Queue, Open Problems, Pilot Roadmap, Public Readiness, README, and evidence-gap language with founding artifact status and essential-sector refusal testing |\n| P-050 | T-028 | **ACTIVE** | Critical | Compliant Alternative Supplier Pre-Registration (CASP): mandatory pre-registration of backup suppliers with automatic-activation contracts before essential-sector procurement renewal; gap-window calculation requirement; adversarial observation requirement for drill-secure classification. ANNEX_AT \u00a7AT6.6. |\n| P-051 | T-022 | **ACTIVE** | Critical | Constitutional Integrity Panel (CIP): 7-member independent body with staggered terms, constitutionally fixed funding (0.01% of annual Flow issuance), multi-body appointment preventing governing-coalition control, 5-of-7 quorum for Tier 1 ratification, automatic review triggers for institutional vacancy or publication lapses. ANNEX_AM \u00a7AM8. |\n| P-052 | T-019 | **ACTIVE** | High | Federated Ombuds deliberate-manufacture standard: pre-committed 4-criterion assessment (timing, proportionality, prior-basis, knowledge), 24-hour Plenum decision window, asymmetric default favoring PCRP activation when evidence is inconclusive, manufactured-flag referral to Enforcement Panel. ANNEX_AI \u00a74.12. |\n| P-053 | Insider retaliation / reporter protection | **ACTIVE** | Critical | Whistleblower Protection and Anti-Retaliation Protocol: administrative freeze on respondent write-access from filing; automatic escalation of retaliatory modifications; 45-day \"under review\" cap; restoration on exoneration. ANNEX_AW; Article VII reporter-protection clause. |\n| P-054 | Identity disclosure as safety vector | **ACTIVE** | Critical | Confidential Enrollment and Safety-Identity Protocol: cryptographically sealed identity for safety-compromised persons; address-blind delivery; 30-day emergency enrollment; 72-hour token for undocumented persons; sealed-record governance. ANNEX_AX; Article II safety-shielded enrollment clause. |\n| P-055 | Delivery gap between guarantee and operation | **ACTIVE** | Critical | Delivery Sufficiency Standard: four operational conditions (path exists, accessible, monitored, accountable party); Delivery Sufficiency Register published quarterly; seven founding-population entries; cross-boundary delivery accounting. ANNEX_AY; Article IV delivery-sufficiency obligation. |\n| P-056 | T-002 / INV-001 | **PROPOSED** | Critical | Open-Access Survival Floor (Two-Tier Identity Model): separates non-duplication (required for CSM) from identity verification (required only for above-floor services and civic instruments). Defines Tier 0 (open-access/pseudonymous survival floor) and Tier 1 (identity-gated services). Establishes civic accountability norm: the system trusts citizens because there is enough for everyone. Aggregate anomaly detection replaces individual surveillance at the survival tier. Token mechanism specification delegated to ANNEX_AZ \u00a7AZ2 as a pre-operational prerequisite. ANNEX_AK \u00a7AK8. |\n| P-057 | ACL-011 / ACL-010 | **PROPOSED** | High | Pilot Site Selection Criteria: required, disqualifying, and preferred characteristics for pilot town site selection; Phase 1 capital reference ranges ($15\u201322M); site selection process with adversarial panel member approval requirement. |\n| P-058 | T-016 / constitutional void | **PROPOSED** | High | Jurisdiction Interface Clause: three-layer jurisdiction interface (RAC mediation \u2192 external courts \u2192 federal floor); matters governed by external law enumerated; pre-enrollment 7-day grace window; retaliation prohibition; filing assistance obligation. |\n| P-059 | ACL-010 / dignity-floor leverage | **PROPOSED** | Critical | Vulnerable Population Consent Protocol (VPCP): ICA structure (civil-society nominated, 50% peer specialists, adverse-finding authority); VPCP-001 through VPCP-008 rules; 30-day cooling-off; teach-back verification as founding team obligation; non-waivable exit rights (60-day housing, 90-day healthcare, no clawback); pre-recruitment prerequisites gate. |\n| P-060 | ACL-005 / founding keyholder capture | **PROPOSED** | Critical | Founding Team Composition Standard: composition floor (FT-1 through FT-4); 9-seat keyholder allocation with distributed nomination (Seats 3\u20138 via civil-society organizations approved by adversarial panel member); founder sunset rules (FS-1 through FS-7); Perpetual Humility Review with Humility Declaration. |\n| P-061 | ACL-007 / Power-Wealth Convergence | **PROPOSED** | Critical | Founding Capital Framework: phase targets ($15\u201322M / $35\u201355M / $60\u201390M); 20%/30% funder concentration limits; Capital Steward independent fiduciary; constitutional primacy clause (non-negotiable in all funding agreements); government walk-away rule (4 trigger conditions); CLT land structure; wind-down reserve (6 months EA pre-funded). |\n| P-062 | ACL-011 / ACL-010 | **PROPOSED** | High | Pilot Timeline Framework: five-track parallel structure (Founding Legitimacy, Site Acquisition, Design/Permitting, Construction, Recruitment); three enrollment windows with hard prerequisites; critical-path gates (A2 at Month 8, D2 at Month 26\u201330, INV-LAUNCH-1 clearance); failure contingency requiring Resident Transition Protocol before Cohort 1 occupancy. |\n| P-064 | T-028 | **ACTIVE** | Critical | Compliance-Masked Refusal Hardening: treats lawful-looking obstruction as refusal when formal compliance hides CSM delivery degradation, patient-continuity failure, data/control-system lockout, PBM access friction, standards delay, affiliate fallback capture, workforce poaching, legal delay, or concession pressure. |\n| P-065 | T-022 | **ACTIVE** | Critical | CIP Vacancy-Starvation Hardening: appointment deadlines, fallback nomination, void mass appointments, below-quorum self-repair limits, publication-channel fallback, missed Ombuds-report suspension, conduct-only hollowing triggers, servant-authority and relief-first limits. |\n| P-066 | T-029 | **ACTIVE** | Critical | Commons Return and Universal Stake Fiscal Sustainability Gate: replaces routine progressive net-worth demurrage as active wealth spine, registers fiscal/debasement risk, requires costed public-finance model, source-base revenue testing, remaining-tax disclosure, incidence review, lockbox sufficiency, and scale-blocking fiscal adequacy gate. |\n| P-067 | T-030 | **ACTIVE** | Critical | Cyber Resilience and Availability Gate: registers ransomware, key-compromise, regional-outage, offline-continuity, supply-chain, and public-status failure as a distinct threat to survival-floor delivery. |\n| P-068 | T-031 | **ACTIVE** | Critical | Last-Resort Unenrolled Access Gate: registers the risk that a person who cannot enroll, hold a wallet, or use digital credentials still cannot reach the survival floor; requires no-credential, trusted-intermediary, analog-reconciliation, abuse/diversion, and dignity-interview tests before universality claims. |\n| P-069 | T-032 | **ACTIVE** | Critical | Monitoring Repurposing Gate: registers the risk that protective monitoring becomes surveillance or coercive control; requires purpose register, purpose-creep red team, linkability test, office-separation drill, individual-flag appeal drill, retention audit, and coercive-use scenario. |\n| P-070 | T-033 | **ACTIVE** | Critical | Founding Legitimacy Prerequisite Definition Gate: reconciles consent thresholds, defines admissible non-coercive consent evidence, defines independent civil-society reviewer qualification, and blocks Gate A until consent and review are independently evidenced. |\n| P-072 | T-025 | **PROPOSED** | High | Productive Status Register: one canonical \"productive\" determination shared by Flow issuance (ANNEX_X) and the Commons Return exemption (ANNEX_D \u00a7D3), with settle-forward escrow closing the temporal double-dip. Remains PROPOSED / pilot-gated until its evidence test passes; binds nothing until then. |\n| P-073 | structural \u2014 no threat row | **ACTIVE** | High | Framework-first intake (anti-accretion rule): FAP intake gate requiring any new mechanism to extend the most general existing instrument for its protective function or carry a published justification; published return record with adversarial-panel escalation; simplicity presumption bounded by independence count and protected-person path equivalence. Amends Acceptance_Protocol.md. |\n| P-074 | structural \u2014 no threat row | **ACTIVE** | High | Appeal Spine consolidation: ANNEX_L \u00a7L7 becomes the single canonical appeal procedure (one filing rule, floor + status-quo-ante continue during appeal, one ladder with the Ombuds Plenum kept separate for independence); seven scattered appeal procedures become spine pointers (with ANNEX_I's duplicate clocks and ANNEX_AI \u00a74.8's duplicate window deleted); the ANNEX_AW \u00a7AW3.3 orphan appeal window (RRE-011) is a named follow-up, not yet absorbed. First P-073-mandated consolidation of an entire mechanism family. |\n| P-075 | structural \u2014 no threat row | **ACTIVE** | High | Evidence-test framework + data stewardship standard: Evidence Ladder gains the canonical Test Package Template (drift rule; four package follow-ups named); the Monitoring Administrative Safety Packet gains the master Minimization and Purpose-Limitation Doctrine, a quote-sourced per-domain calibration table (open gaps marked honestly), a cross-domain linkage rule generalizing ANNEX_D \u00a7D6.5, and a drift rule; the Monitoring Repurposing ETP's duplicated six-condition baseline becomes a pointer. |\n| P-076 | structural \u2014 no threat row | **ACTIVE** | Medium | Institution merger audit: Conservative Hold declaring authority bound to the existing RCS accreditation body (dangling ANNEX_AL \u00a73 pointer resolved); phantom \"Measurement Oversight Body\" deleted, escalation bound to the ANNEX_AL \u00a74.1 methodology-review panel; \"oracle council\" unified to \"oracle cohort\" (FC-033's own unit). Two proposed mergers examined and REJECTED with reasons: register-adjudicator vs contribution verification are different functions protecting different people (merging would weaken INV-006), and the \"Temporal Continuity Review Panel\" exists nowhere in the corpus. No operating institution merged; no check removed. |\n| P-077 | structural \u2014 no threat row | **ACTIVE** | Medium | Canonical-home (anti-drift) discipline: the four near-identical drift rules (status spine, appeal spine, evidence template, data doctrine) collapse into one doctrine in the P-073 gate (Acceptance_Protocol) \u2014 domains cite their canonical home and keep only domain substance; a divergent restatement yields to the home, except where domain text is strictly more protective of the person (never for uniform procedural rules). The four local rules shrink to home-declaration + specific enforcement + citation. Constitution change; Christ-centered Session 27. |\n| P-078 | structural \u2014 no threat row | **ACTIVE** | Medium | Data-retention gap closure (G-1..G-4 from P-075): the four \"unspecified \u2014 gap\" retention/stripping cells in the data-stewardship calibration table are specified as FC-211..214 \u2014 retention tied to appeal-spine window close, the corpus 30/90/180/365-day grid, protective hard caps, and pre-activation binding gates. Balanced posture (owner-approved): bypass-detection earns the longest band, the vulnerable-person datasets retain the least. Closes the confessed gaps; supplies the data doctrine's required deletion schedule (not a new mechanism). |\n\n---\n\n## Reserved / Never-Assigned Patch IDs\n\nThese IDs do not appear in the inventory above. They are recorded here so a reader can distinguish a deliberately skipped number from a lost or missing patch. Mirrors the \"Retired and Reserved IDs\" table in the Threat Register.\n\n| Patch ID | Status | Reason |\n| :--- | :--- | :--- |\n| P-007 | **RESERVED** | Reserved at numbering; never assigned a patch. The threat work that would have occupied this slot was absorbed into adjacent patches before formal sequencing. No design exists under this ID. |\n| P-010 | **RESERVED** | Reserved at numbering; never assigned a patch. No design exists under this ID. |\n| P-028 | **RESERVED** | Reserved at numbering; never assigned a patch. The economic-governance integration that would have followed P-027 was consolidated into the P-029 through P-033 batch. No standalone design exists under this ID. |\n| P-063 | **DRAFT-ONLY** | Reserved for the P-063 v15 review packet. It is explicitly not corpus-registered, not adopted into Annex D, and not part of the active Patch Log inventory. |\n| P-071 | **RESERVED** | Reserved for the Harberger/COST shadow-assessment proposal (`docs/superpowers/specs/2026-06-09-commons-return-should-fixes-redline.md`), which is held as a proposal and not incorporated. The number is reserved so cross-references in the pending-proposal redlines stay stable; no design is incorporated under this ID. |\n\n---\n\n## P-029 through P-033 \u2014 Economic Governance Integration\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-029 | T-016 / public-funding architecture | **ACTIVE** | Critical | constitutional fiscal redesign |\n| P-030 | PRD-004 | **ACTIVE** | Critical | monetary + retail-finance boundary |\n| P-031 | PRD-009 | **ACTIVE** | Critical | ownership + succession + anti-circumvention |\n| P-032 | PRD-009 | **ACTIVE** | High | constitutional ownership standard |\n| P-033 | PRD-008 | **ACTIVE** | High | enterprise-preference and succession design |\n\n### P-029 \u2014 Public Finance & Commons Revenue (PFCR)\n\n**Constitutional text:** [ANNEX_X.md \u00a7 X8](../annexes/ANNEX_X.md)\n\n- **Introduced design:** replaces the former catch-all resilience funding model with a dedicated public-funding function. PFCR funds public operations through Commons Return source-base receipts, commons and land-use charges, scarce-license and gateway fees, and bounded public issuance tied to real public production.\n- **Clauses integrated:** no taxes on survival access, ordinary labor, or basic household exchange; public banking rails funded as infrastructure; postal-bank/public-bank option; anti-hidden-debt rules; source-by-source public reporting.\n- **Dependencies:** Commons Return source-base methodology, asset-equivalence review, gateway registry, and budget transparency stack.\n- **New risks introduced:** fiscal dependence on poorly calibrated Commons Return, source-base valuation, or gateway flows; naming disputes over what counts as a prohibited tax. Mitigated by judicial review trigger, source registry, and P-066 fiscal adequacy gate.\n\n### P-030 \u2014 Protocol-Only Money Creation and Household Finance Boundaries\n\n**Constitutional text:** [ANNEX_X.md](../annexes/ANNEX_X.md)\n\n- **Introduced design:** only protocol-authorized issuance bodies may create Flow or Flow-equivalent purchasing power. Private institutions may lend existing Flow, but may not create new Flow, deposit substitutes, or debt-expanded currency-like claims.\n- **Clauses integrated:** compounding interest prohibited on household ordinary-life debt; no securitization of survival-linked household claims; no revolving survival traps; public retail banking floor on the common rail.\n- **Dependencies:** retail-rail charter, prudential supervision of licensed providers, and public option continuity.\n- **New risks introduced:** shadow-credit attempts outside the chartered rail, and pressure to relabel hidden fees as service charges. Mitigated by common-rail enforcement and anti-equivalence review.\n\n### P-031 \u2014 Anti-Dynasty Ownership\n\n**Constitutional text:** [ANNEX_J.md \u00a7 R1\u2013R2](../annexes/ANNEX_J.md)\n\n- **Introduced design:** beneficial ownership always counts through to natural persons or mission-locked/community bodies. Perpetual trusts, shell chains, and equivalent structures may not preserve extractive control across generations.\n- **Clauses integrated:** family continuity protected in modest form, but dynastic landlordism, absentee succession structures, and perpetual extractive wrappers are prohibited.\n- **Dependencies:** beneficial-ownership registry, succession review rules, and housing / enterprise stewardship standards.\n- **New risks introduced:** harder succession planning for legitimate family continuity cases. Mitigated by explicit continuity allowances for homes, tools, dependents, and mission-locked stewardship bodies.\n\n### P-032 \u2014 Stewardship Ownership Standard\n\n**Constitutional text:** [ANNEX_J.md \u00a7 R1\u2013R2](../annexes/ANNEX_J.md)\n\n- **Introduced design:** ownership across land, housing, and enterprise is reframed as stewardship rather than a perpetual tribute right. Capital may be rewarded for risk and contribution, but not for endless passive extraction from necessity or labor.\n- **Clauses integrated:** bounded capital claims, anti-rent use-right logic, and judicially reviewable passive-extraction prohibitions.\n- **Dependencies:** housing and commons use-right enforcement, capital-instrument redesign, and ACC / anti-monopoly enforcement.\n- **New risks introduced:** valuation disputes around what counts as productive stewardship. Mitigated by published criteria, appeal paths, and mission-lock documentation.\n\n### P-033 \u2014 Worker-Owned and Mission-Locked Enterprise Preference\n\n**Constitutional text:** [ANNEX_J.md \u00a7 R1](../annexes/ANNEX_J.md)\n\n- **Introduced design:** worker-owned, cooperative, and mission-locked firms receive structural preference in PFCR-backed finance, procurement, retained-earnings treatment, worker buyout pathways, and founder-exit conversion rules.\n- **Clauses integrated:** natural monopolies moved to a separate regulated-utility track; outside capital claims must be capped, redeemable, sunset, or otherwise bounded.\n- **Dependencies:** procurement rules, cooperative finance tools, public venture / buyout facilities, and utility-governance charter.\n- **New risks introduced:** preferential treatment could be gamed by sham cooperatives. Mitigated by governance-proof requirements, payout constraints, and beneficial-ownership transparency.\n\n---\n\n### P-034 \u2014 Two-Key Architectural Precondition for Tier-1 Invariant Enforcement\n\n**Threat addressed:** T-016 / INV-007 \n**Audit finding:** PRD-001 / Phase 1 Article I adversarial audit; confirmed still open in Phase 4 follow-up check \n**Status:** ACTIVE | **Priority:** Critical | **Annex:** AV (Acceptance_Protocol.md \u00a7Structural Precondition Gate)\n\n**Constitutional text:** [ANNEX_AV.md](../annexes/ANNEX_AV.md)\n\n**Problem diagnosed:** \nThe prior INV-007 enforcement relied on a single FAP reviewer checking patch proposals against INVARIANTS.md before intake. This is a single point of failure: a captured, compromised, or mistaken reviewer can admit a Tier-1-touching proposal simply by not flagging the violation. The Beer VSM logic gate test (Phase 1) confirmed this: the normative model collapses to `defect \u2192 bypass` because the reviewer is both S3 (operational control) and the entire S3* (audit channel). A single captured actor voids all seven invariants simultaneously.\n\n**Introduced design \u2014 two-key architectural precondition (Annex AV):**\n- Any patch tagged `modifies_tier1=True` must carry cryptographic attestation from the standing adversarial panel member before FAP intake opens.\n- The FAP reviewer's authority is explicitly scoped to exclude the ability to waive or override the absence of attestation.\n- The adversarial panel member is nominated by the oppose-coalition body (AH2.3), not the founding coalition \u2014 structurally independent of FAP administration.\n- Defection penalty: improper admission attestation \u2192 permanent removal + forfeiture of seat to oppose-coalition nominating body + public defection finding. Honest attestation (including rejections) carries no penalty. The payoff matrix favors honest behavior.\n\n**Beer VSM fix:** S3* (adversarial panel attestation) is now structurally independent of S3 (FAP reviewer). Collapsing S3* into S3 is architecturally impossible \u2014 the adversarial panel member holds a key the FAP reviewer does not control.\n\n**Buterin incentive alignment fix:** Defection (improper admission) is costly (removal + public record). Honesty is safe. The reviewer incentive is also corrected: a reviewer who admits a proposal that lacks attestation has acted outside their authority \u2014 no benefit accrues, only liability.\n\n**Clauses integrated:** INV-007 mechanical boundary (amended), INVARIANTS.md \u00a7Invariant Violation Detection (precondition block added), Acceptance_Protocol.md \u00a7AV1\u2013AV6, Annex AV \u00a7AV7\u2013AV10 operational procedure.\n\n**Dependencies:** Adversarial panel member must be seated (per AH2.3) before any `modifies_tier1=True` proposal may be submitted. P-034 becomes operational the moment the adversarial panel member's key is registered.\n\n**New risks introduced:**\n- If the adversarial panel member seat goes vacant, no Tier-1-touching proposals can advance. Mitigated: vacancy is observable and not covert; it is a conservative failure mode (proposals stall, not wrongly admitted).\n- Oppose-coalition nominating body could itself be captured. Mitigated: AH2.3 qualifications exclude organizations with funding relationships with the founding coalition; three-year lookback applies.\n\n**Residual risk (acknowledged):** The adversarial panel member can be defected through external pressure not covered by the internal penalty structure (coercion, external blackmail). This is documented as a known residual rather than a resolved problem. Physical-world coercion cannot be fully eliminated by protocol design; conservative failure mode (panel member refuses to attest rather than attesting fraudulently) is the design target.\n\n## P-001 through P-004 \u2014 Core Convertibility Controls\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-001 | T-001 | **ACTIVE** | Critical | structural + behavioral detection + targeted enforcement. |\n\n### P-001 \u2014 Shadow Convertibility Containment\n\n**Constitutional text:** [ANNEX_AB.md \u00a7 AB2](../annexes/ANNEX_AB.md)\n\n- **Introduced design:** Essential Access-only channels, non-delegable redemption, context-locking where proportionate, anomaly detection, broker targeting, and an explicit leakage-tolerance concept.\n- **Clauses to integrate:** Essential Access Exclusivity, Non-Delegable Consumption, Leakage Tolerance, Broker-Focused Enforcement.\n- **Dependencies:** identity assurance, coercion reporting pathways, and sufficiently accurate essential-supply management.\n- **New risks introduced:** over-surveillance, false positives, user friction, and migration of abuse into proxy-identity channels.\n- **Residual risk:** small-scale favors and informal pooling remain acceptable if they do not scale into arbitrage infrastructure.\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-002 | T-004 | **ACTIVE** | Critical | economic + behavioral + contribution architecture. |\n\n### P-002 \u2014 Incentive System Stabilization\n\n**Constitutional text:** [ANNEX_AB.md \u00a7 AB3](../annexes/ANNEX_AB.md)\n\n- **Evidence package:** [Service Record Misuse Evidence Test Package](./Service_Record_Misuse_Evidence_Test_Package.md)\n- **Introduced design:** nonlinear reward curves, multi-channel rewards (Flow, civic standing, status/recognition), opportunity access, time/flexibility rewards, and anti-gaming contribution assessment.\n- **Clauses to integrate:** Incentive Nonlinearity, Multi-Channel Reward, Outcome-Based Contribution, Anti-Gaming Contribution.\n- **Dependencies:** identity attribution, contribution verification, and governance rules for how civic standing can matter without becoming coercive privilege.\n- **New risks introduced:** status hierarchy, burnout optimization, and domain bias toward easier-to-measure work.\n- **Residual risk:** optimization behavior remains, but the design goal is to align it with contribution rather than suppress it.\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-003 | T-002 | **ACTIVE** | Critical | structural + security + continuity protection. |\n\n### P-003 \u2014 Identity System Hardening\n\n**Constitutional text:** [ANNEX_AB.md \u00a7 AB4](../annexes/ANNEX_AB.md)\n\n- **Evidence package:** [Identity and Recovery Evidence Test Package](./Identity_Recovery_Evidence_Test_Package.md)\n- **Introduced design:** four assurance tiers (survival floor, provisional, core, civic activation), multi-evidence thresholding, no single universal credential, hardened recovery, anti-Sybil controls, and no-survival-lockout under uncertainty.\n- **Clauses to integrate:** Identity Adversarial Reality, Differential Assurance, Recovery Safety, No Master Credential, Identity Failure Continuity.\n- **Dependencies:** appeals architecture, ombuds/advocate pathways, and clear separation between verification and monitoring.\n- **New risks introduced:** complexity, onboarding friction, and slower recovery for legitimate edge cases if poorly implemented.\n- **Residual risk:** low-level fraud remains possible and should be contained rather than denied in theory.\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-004 | T-007 | **ACTIVE** | Critical | governance + constitutional anti-capture control. |\n\n### P-004 \u2014 Definition Drift Protection\n\n**Constitutional text:** [ANNEX_AB.md \u00a7 AB5](../annexes/ANNEX_AB.md)\n\n- **Introduced design:** protected term classes, semantic effect test, worked-example requirement, public definition registry, upward classification default, and anti-laundering control across code, vendor, and standards layers.\n- **Clauses to integrate:** Definition Integrity, Semantic Effect, Upward Classification Default, Worked Example Requirement, Definition Registry, Anti-Laundering.\n- **Dependencies:** classification authority, change-control process, and review capacity.\n- **New risks introduced:** process friction, slower iteration, and semantic bureaucracy if overbuilt.\n- **Residual risk:** subtle drift can still occur unless registry, examples, and challenge windows are actually used.\n\n---\n\n## P-005 through P-012 \u2014 Governance and Operational Resilience\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-005 | T-005 | **ACTIVE** | Critical | structural + procedural + monitoring |\n\n### P-005 \u2014 Governance Throughput Hardening\n\n**Constitutional text:** [ANNEX_AC.md \u00a7 AC1](../annexes/ANNEX_AC.md)\n\n- **Change type:** structural + procedural + monitoring.\n- **Introduced design:** CRP dual-queue separation (constitutional vs. operational); minimum operational throughput floor (5 priority decisions per quarter, non-blockable by constitutional challenges); sequential emergency re-declaration cap (2 consecutive quarters max, requires independent audit and public justification to extend); intake throttle with priority scoring (impact \u00d7 urgency \u00d7 reversibility; Voice-signal for urgency; overflow is public); cross-quarter interim authorization bridge (Ombuds + 1 rotating CRP member + regional exec; scope-locked to emergency declaration; provisional only; cannot narrow Essential Access access or touch constitutional matters); decision quality audit metrics (alternatives-presented ratio, reversal rate, minority dissent rate); [Ambitious] real-time throughput dashboard with auto-escalation trigger.\n- **Clauses to integrate:** CRP Dual-Queue Separation; Minimum Throughput Floor; Sequential Emergency Cap; Intake Throttle and Priority Scoring; Cross-Quarter Interim Bridge; Decision Quality Metrics. See Annex AC1.\n- **Dependencies:** Annex L (CRP sub-panel composition); Annex T (simulation mandate extension); Article V compliance matrix; Level 3\u20134 emergency cascade table.\n- **New risks introduced:** Operational sub-panel capture if composition predictable; interim bridge scope creep; priority scoring gaming; [ambitious] throughput dashboard exposure of vulnerability windows (mitigated by 48-hour publication lag).\n- **Residual risk:** Throughput theater remains hard to detect. Patient actor can operate within throughput floors while maintaining effective paralysis through distributed delay across proposals.\n- **Compound linkages:** T-005 \u00d7 T-006 (PCRP window synchronization); T-005 \u00d7 T-008 (PCRP authority as new power locus); T-005 \u00d7 T-001 (paralysis extends cadence exploit windows).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-006 | T-006 | **ACTIVE** | Critical | structural + authority definition + measurement architecture |\n\n### P-006 \u2014 Measurement Lag and Supply Shock Hardening\n\n**Constitutional text:** [ANNEX_AC.md \u00a7 AC2](../annexes/ANNEX_AC.md)\n\n- **Change type:** structural + authority definition + measurement architecture.\n- **Introduced design:** Sentinel indicator mandate \u2014 every slow-audit essential category requires a faster low-fidelity signal; max lag by volatility class (48h high / 7d medium / 30d low). Pre-Confirmation Response Protocol (PCRP) \u2014 defined first-responder authority (Regional Executive Body, joint activation); permitted: 70% above-baseline issuance reduction, reserve release, expedited oracle review (survival floor issuance stays 100%); prohibited: full Shared Storehouse, survival floor narrowing, other categories, beyond 72h without oracle confirmation; false-trigger tracking \u2014 3 false activations per 4 quarters triggers mandatory independent audit. Shared Storehouse unwind symmetry \u2014 recovery fast-track mirrors PCRP; conservative bias applies to activation, not prolonged restriction after recovery. Cadence-adjusted U8 bridge \u2014 48-hour trigger for high-volatility categories; 7-day retained for medium-volatility. [Ambitious] Essential Access redemption velocity as native sentinel (150% spike threshold). [Ambitious] Cross-category demand surge detector.\n- **Clauses to integrate:** Sentinel Indicator Mandate; PCRP; PCRP Scope Definition (protected term under P-004); Shared Storehouse Unwind Symmetry; Cadence-Adjusted U8 Bridge. See Annex AC2.\n- **Dependencies:** Regional Executive Body formally constituted with joint-activation rules. Essential Access ledger redemption velocity in privacy-preserving aggregate form. Annex M extended with cadence floors. Annex U8 modified.\n- **New risks introduced:** PCRP soft-power weaponization; two-source corroboration gaming; recovery fast-track exploit via manufactured sentinel signals; [ambitious] Essential Access velocity oracle suppression gaming (mitigated by anomaly detection on suppression patterns).\n- **Residual risk:** Inter-cycle gap is compressed not eliminated. 'Supply shock' must be a protected term under P-004 with worked examples to prevent scope creep.\n- **Compound linkages:** T-006 \u00d7 T-001 (cadence windows = black market opportunity); T-006 \u00d7 T-005 (PCRP window synchronization); T-006 \u00d7 T-008 (PCRP authority at REB = elite formation risk).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-008 | T-008 | **PROPOSED** | High | structural + measurement + institutional design |\n\n### P-008 \u2014 Bureaucratic Elite Formation Hardening\n\n**Constitutional text:** [ANNEX_AC.md \u00a7 AC3](../annexes/ANNEX_AC.md)\n\n- **Status basis:** **PROPOSED.** P-008 is designed but was not accepted as the operative authority for T-008. P-025 (Federated Ombuds constitution) supersedes it and is the live ACTIVE control \u2014 see SPECIFICATIONS.md \u00a74.3, which records that P-008 is PROPOSED and P-025 is the operative ACTIVE authority for the 20% sector ceiling. The legibility-audit, diversity, verification-independence, and cohort-cooling designs below are retained as design reference; their operative enforcement runs through P-025.\n- **Evidence package:** [Service Record Misuse Evidence Test Package](./Service_Record_Misuse_Evidence_Test_Package.md)\n- **Change type:** structural + measurement + institutional design.\n- **Introduced design:** Legibility gap audit \u2014 quarterly Article VI reporting tracks verification approval rate, evidence burden, appeals rate, and abandonment rate by contribution category; 20-point disparity triggers independent process audit (not by incumbent verifier pool). Service Record sector ceiling specification mandate \u2014 max 25% per sector, max 35% per identifiable institutional-origin cluster in any Service Record-governed service pool; specified at founding as precondition under Annex N. Epistemic diversity requirement \u2014 three-axis standard (institutional origin \u226430%, contribution-type diversity \u226530% informal/care, geography \u226525% non-urban-dense) for all oversight bodies >5 members; pool design requirement. Verification independence rule \u2014 verifiers cannot review claims in own primary contribution category; applies to mid-range and above claims. Cooling-off cohort rule \u2014 cohort tracking by Ombuds Office; max 2 cohort members sharing review authority over same subject simultaneously. [Ambitious] Qualification standard governance \u2014 competence criteria added to P-004 protected terms registry; standard-setting body must include \u226540% from non-qualifying backgrounds. [Ambitious] Real-time concentration dashboard.\n- **Clauses to integrate:** Legibility Gap Audit; Service Record Sector Ceiling Specification (founding precondition Annex N); Epistemic Diversity Requirement; Verification Independence Rule; Cooling-Off Cohort Rule; Qualification Standard Governance (P-004 extension); Concentration Dashboard. See Annex AC3.\n- **Dependencies:** Service Record sector ceilings specified at founding (pre-CRP constitution). Article VI U7 extended for verifier category independence. P-004 protected terms registry extended. Pool-depth health metrics added to Article VII.\n- **New risks introduced:** Epistemic diversity pool-depth constraint interacts with P-005 throughput vulnerability. Verification independence adds legitimate friction to high-impact claims. Cohort tracking system is a power locus if Ombuds Office itself captured. [Ambitious] concentration dashboard gaming below thresholds (mitigated by 30-day data lag).\n- **Residual risk:** Class formation through informal social networks has no hard control. Open question: Ombuds Office carries three load-bearing functions (cohort tracking, legibility audit, diversity certification) \u2014 if Ombuds becomes an elite formation site all three are compromised. Who audits the auditors of elite formation?\n- **Compound linkages:** T-008 \u00d7 T-011 (elite formation creates narrative attack surface; P-008 dashboard provides defense evidence base); T-008 \u00d7 T-005 (PCRP authority concentration); T-008 \u00d7 T-006 (PCRP regional bodies subject to elite formation).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-011 | T-011 | **ACTIVE** | Critical | communication architecture + transparency + pre-commitment |\n\n### P-011 \u2014 Narrative Attack Surface Hardening\n\n**Constitutional text:** [ANNEX_AD.md](../annexes/ANNEX_AD.md)\n\n- **Change type:** communication architecture + transparency + pre-commitment doctrine.\n- **Introduced design:** Rapid Public Communication Protocol (RPCP) \u2014 4-hour structured template for any public-visibility operational event; covers what happened, system response, access status, next steps; does not replace 7-day post-mortem; pre-authorized publication authority required. Pre-committed failure communication doctrine \u2014 published pre-launch document acknowledging expected failures (PCRP false triggers, oracle disputes, Shared Storehouse activations, enforcement errors, measurement uncertainty) with containment mechanisms; converts failures from surprises to acknowledged expected events. Citizen-Facing Rights Layer (CFRL) \u2014 one page, 8th-grade level, pre-launch, translated; governed as P-004 protected specification. Adversarial Narrative Simulation \u2014 added to Annex T annual mandate; hostile framing team publishes simulated attack; system responds within 4 hours; report published. Hostile Frame Pre-emption Registry \u2014 top 10 mischaracterizations with accurate rebuttals and Article VII evidence; updated quarterly; published as 'Common Misunderstandings.' [Ambitious] Narrative Health Dashboard \u2014 public understanding accuracy surveys, hostile framing prevalence index, RPCP response time metric; Level 1 watch auto-trigger. [Ambitious] Pre-Launch Narrative Audit \u2014 independent adversarial audit by communications professionals; findings and mitigations published simultaneously.\n- **Clauses to integrate:** RPCP; Pre-Committed Failure Doctrine; CFRL (P-004 protected spec); Adversarial Narrative Simulation (Annex T extension); Hostile Frame Registry. See Annex AD.\n- **Dependencies:** Operative elite-formation controls are prerequisite for elite formation narrative rebuttal \u2014 these run through P-025 (ACTIVE), the operative authority for T-008, since P-008 is PROPOSED. Article VII infrastructure must support 4-hour publication SLA. White Paper sync required before launch (AD6). CFRL added to P-004 protected terms registry.\n- **New risks introduced:** Pre-committed failure document weaponized to prime failure expectation \u2014 mitigated by simultaneous publication of containment mechanisms. CFRL creates false certainty \u2014 mitigated by 'Humane Constitution governs' disclaimer. ANS report as hostile playbook \u2014 mitigated by publishing after exercise completion. Hostile frame registry amplifies framings \u2014 mitigated by 'common misunderstandings' framing.\n- **Residual risk:** Narrative defense is bounded by actual system performance. No communication architecture survives sustained failure. Pre-launch framing window (18+ months before launch) cannot be closed by protocol \u2014 only by early CFRL and pre-commitment doctrine deployment.\n- **Compound linkages:** T-011 \u00d7 T-008 (elite formation is factual hook for 'captured by professionals' narrative; P-008 concentration dashboard is the counter-narrative evidence base). T-011 \u00d7 T-006 (PCRP false triggers are the highest-visibility predictable failure). T-011 \u00d7 T-005 (governance paralysis generates narrative events).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-012 | T-012/013/014/015 | **ACTIVE** | Critical | structural + protocol + measurement |\n\n### P-012 \u2014 Interface Hardening and Deadlock Prevention\n\n**Constitutional text:** [ANNEX_AE.md \u00a7 AE2.1\u2013AE2.4](../annexes/ANNEX_AE.md)\n\n- **Change type:** structural + protocol + measurement architecture.\n- **Introduced design:** PCRP oracle independence requirement \u2014 two-source corroboration must use structurally independent measurement systems; manipulated oracle counts as one source regardless of downstream channels; single-source PCRP activates at reduced scope with Ombuds co-certification. Categorical throughput minimums \u2014 P-005 floor amended from single aggregate to 5 categorical minimums (identity, supply, enforcement, governance, unreserved); single category capped at 3 of 5 slots. Emergency deadlock resolution protocol \u2014 auto-declaration when mandatory decision is blocked by 2+ valid processes; 3-member arbitration panel within 6 hours; survival floor bridge unconditional; scope freeze; mandatory root-cause review. Demand-context flag for Essential Access velocity oracle \u2014 discount applied during Flow enforcement actions, mass re-verification campaigns, or regional defection; Ombuds co-certification required for PCRP. RPCP contested-status template \u2014 separates physical event from legal characterization during active CRP review. Cumulative procedural drift trigger \u2014 extends P-004 to 20 Tier 3 decisions in 8 quarters reducing Tier 2/1 decision space; triggers mandatory CRP cumulative review.\n- **Clauses to integrate:** AE2.1\u2013AE2.6. Amends AC1.2 (throughput floor), AC2.2 (PCRP), AD1 (RPCP), AB5 (P-004 drift).\n- **Dependencies:** operational demand-context register (new data feed); RPCP contested-status template library extension; CRP cumulative review procedure.\n- **New risks introduced:** Deadlock panel engineered as bypass route \u2014 bad actors deliberately trigger triple-block to force panel arbitration. Demand-context flag delays legitimate PCRP during enforcement periods. Categorical floor gaming \u2014 proposals reframed to occupy minimum category slots. Cumulative drift review weaponized against legitimate operational evolution.\n- **Residual risk:** Second-generation deadlock has no defined resolution beyond Level 5 structural review. T-009 (Grace Exploitation Loop) remains OPEN and is the next hardening target.\n- **Compound linkages:** All of T-012/013/014/015 inter-linked through PCRP, throughput floor, and deadlock protocol.\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-009 | T-009 | **ACTIVE** | Med-High | behavioral + verification + structural |\n\n### P-009 \u2014 Grace Exploitation Loop Hardening\n\n**Constitutional text:** [ANNEX_AF.md](../annexes/ANNEX_AF.md)\n\n- **Evidence package:** [Service Record Misuse Evidence Test Package](./Service_Record_Misuse_Evidence_Test_Package.md)\n- **Change type:** behavioral + verification architecture + structural.\n- **Introduced design:** Graduated renewal intensity \u2014 first activation lightweight; first renewal structured; second renewal mid-intensity with support service confirmation; third+ renewal high-intensity independent panel. All qualifying hardship approved under any standard. Cross-quarter history review \u2014 full pause history assessed at every renewal; category switching flagged for elevated scrutiny at next renewal. Hardship attestation collusion detection \u2014 P-002 analytics extended to hardship networks; detects mutual pairs, star clusters, temporal clustering; community-disaster safe harbor for 2 quarters on oracle-verified regional emergency. Service Record slow-decay at 20% of normal rate during pause \u2014 Voice freeze unchanged; 4-quarter pause produces ~8% Service Record loss (negligible); 12-quarter rotation produces ~22% loss (drains high-impact threshold). Service pool pause-saturation monitoring \u2014 >20% simultaneous pause triggers pool-health alert and review; never bars individual activation. [Ambitious] Capability development pathway \u2014 up to 15% quarterly Service Record earnable through pause-appropriate stewardship during pause. [Ambitious] T-009 \u00d7 P-008 explicit closure \u2014 paused cohort members count toward P-008 cohort cooling concurrent maximum; active members accommodate, not paused person.\n- **Clauses to integrate:** AF1\u2013AF7. Annex K4 amended (graduated renewal; Service Record slow-decay). P-002 analytics extended (AF3). AC3.5 amended (AF7). Article VII dashboard extended (AF5).\n- **Dependencies:** P-002 collusion analytics infrastructure extended to hardship attestation graph. Service Record slow-decay rate requires Article VI / Annex K4 protocol-level calibration. P-011 CFRL must communicate graduated renewal clearly before launch. [Ambitious] P-004 registry: 'pause-appropriate stewardship' as protected term. [Ambitious] P-008 AC3.5 amended per AF7.\n- **New risks introduced:** Graduated renewal deters genuine long-term hardship if perceived as punitive \u2014 mitigated by CFRL communication and calibration. Service Record slow-decay may deter activation \u2014 mitigated by clear communication and negligible 4-quarter loss. Community-disaster safe harbor exploitable by manufactured disaster claims \u2014 mitigated by oracle verification requirement. Pool saturation monitoring creates perverse incentive against legitimate pause at bad timing \u2014 mitigated by review-only trigger.\n- **Residual risk:** Involuntary unemployment category remains most exploitable \u2014 disproof requires intrusive investigation incompatible with non-surveillance commitment. Accept as contained leakage: graduate renewal intensity is the best available control. Low-level 1-2 quarter grace exploitation is acceptable system leakage \u2014 the cost of genuinely frictionless access for legitimate hardship.\n- **Compound linkages:** T-009 \u00d7 T-008 (primary bypass route for P-008 controls \u2014 AF7 addresses it at design level; evidence remains pending); T-009 \u00d7 T-011 (graduated renewal must be communicated through CFRL or becomes narrative attack surface).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-013 | T-016 | **ACTIVE** | Critical | structural + governance + audit architecture |\n\n### P-013 \u2014 Formal Acceptance Process Integrity\n\n**Constitutional text:** [ANNEX_AG.md](../annexes/ANNEX_AG.md)\n\n- **Change type:** structural + governance + audit architecture.\n- **Introduced design:** Pilot representativeness standard \u2014 pilot region requires published 4-dimension assessment; >1 favorable dimension requires second stress-tested region; single favorable region = PILOT only, not ACTIVE. Deadlock resolution timeline \u2014 30d negotiation, 60d published mediation, day 61 CRP binding ruling (14-day SLA); substitute review if CRP is party. Audit epistemic independence \u2014 4-year institutional affiliation bar; domain-diversity requirement; adversarial audit member for I=5 patches (multi-member team, no veto). Anti-gaming constitutional upgrade \u2014 evidence waiver prohibition reclassified Tier 2; urgency bypass now requires H-2 amendment process. Stagnation documentation quality \u2014 3-question review (accurate? progress? resolvable?); structural obstacles trigger bootstrap review not continued documentation. [Ambitious] Bootstrap Resolution Protocol \u2014 minimum viable bootstrap micro-patch for circular dependencies; 2-authority expedited sign-off; auto-sunset; P-008 legibility gap audit as first bootstrap candidate. [Ambitious] FAP concentration controls \u2014 cohort cooling on sign-off cluster; audit body meets AC3.3 diversity standard; independent Article VII monitoring (not Ombuds-managed).\n- **Clauses to integrate:** AG1\u2013AG7. FAP document amended directly. Anti-gaming rules reclassified Tier 2 (H-2 required for amendment). Representativeness criteria added to P-004 protected terms registry.\n- **Dependencies:** P-005 categorical floor extended to include FAP deadlock resolution slot. P-004 protected terms registry extended for representativeness criteria. P-008 AC3.3 epistemic diversity standard referenced for audit body. Article VII AC3.7 concentration dashboard extended for FAP sign-off cluster. Independent concentration monitoring (not Ombuds) required before FAP becomes operative.\n- **New risks introduced:** Two-region pilot requirement increases cost and time; 'close enough' stress-tested region designation risk (mitigated by published representativeness assessment). 60-day deadlock window creates operational gap (mitigated by Annex C-6 emergency patching remaining available as separate pathway). Adversarial auditor produces hostile reports (mitigated by multi-member team). [Ambitious] Bootstrap micro-patch normalized as general bypass channel (mitigated by 2-authority sign-off, survival floor requirement, auto-sunset). [Ambitious] FAP concentration controls risk infinite regress (mitigated by self-executing Article VII publication).\n- **Residual risk:** Evidence farming in stress-tested pilot region remains possible if representativeness assessment criteria are gamed at the definition stage \u2014 criteria require P-004 protection. Deadlock resolution creates new CRP workload at day 61; if CRP is congested (T-005 risk), the deadline may not be met \u2014 P-005 categorical floor must include FAP deadlock as a guaranteed slot. At root: the FAP cannot be made exploitation-proof without being made unusable. P-013 accepts this and chooses calibrated friction over either extreme.\n- **Compound linkages:** T-016 \u00d7 T-005 (deadlock resolution congests CRP; P-005 floor must accommodate). T-016 \u00d7 T-008 (audit capture via intellectual-cousin exploit \u2014 mitigated by AG3). T-016 \u00d7 T-011 (stagnation of critical patches is narrative attack: 'the system cannot fix itself').\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-014 | T-017 | **ACTIVE** | Critical | founding governance + one-time exception |\n\n### P-014 \u2014 P-013 Bootstrap Activation (One-Time Founding Instrument)\n\n**Constitutional text:** [ANNEX_AH.md \u00a7 AH1\u2013AH7](../annexes/ANNEX_AH.md)\n\n**Special status.** P-014 is not a standing patch. It is a one-time founding instrument. It has no standing effect after P-013 reaches ACTIVE. It closes permanently upon P-013 activation.\n\n- **Nature:** One-time founding instrument, not a standing patch. Closes permanently upon P-013 ACTIVE.\n- **Change type:** founding governance + constitutional one-time exception.\n- **Introduced design:** 5-stage process: (1) Pre-activation disclosure \u2014 60-day minimum public challenge window (extended by P-020; see ANNEX_AH.md \u00a7AH2); circular dependency analysis published; founding exception statement from Threat Register Owner; panel composition disclosed before sign-off. (2) Heightened 5-member panel \u2014 Threat Register Owner, 1 CRP reserve member (lot-drawn, not involved in P-013 design), 1 external systems reviewer from outside design-team domain, 1 Ombuds officer, 1 public-interest advocate (lot-drawn). All attest no 5-year affiliation with design team (externally verified). Adversarial member required; dissent published. 4/5 votes required. (3) Substitute evidence \u2014 desk review of 3+ real-world analogue cases; adversarial red-team analysis; scope-limitation certification; sunset compatibility check. (4) Activation and permanent sealing \u2014 P-013 ACTIVE; P-014 closes permanently; full activation record published; non-precedent statement embedded with Tier 2 protection; P-006 and P-009 immediately enter the Formal Acceptance Protocol pilot stage. (5) Post-activation audit within 90 days \u2014 using P-013's own now-operative standards; adversarial member required; if compromised \u2192 P-013 suspended and re-submitted through the now-operative Formal Acceptance Protocol.\n- **Non-precedent statement (Tier 2 protected):** 'P-014 was invoked once, for P-013 only, because no other process was available. It may not be cited as authority for any future activation, exception, or urgency bypass. Any invocation of P-014 logic for any purpose requires H-2 amendment process.'\n- **Clauses to integrate:** AH1\u2013AH7. Annex N/U2 as constitutional anchor.\n- **New risks introduced:** Founding panel subject to capture during pre-activation window (mitigated by 60-day minimum disclosure, lot-drawing, external conflict verification, adversarial member, and the Founding Legitimacy Dossier). Post-activation audit finding of compromise suspends P-013 \u2014 creates a window where the Formal Acceptance Protocol is operative but its governing patch is suspended (mitigated by the prior Formal Acceptance Protocol fallback during suspension; suspension published immediately). Pre-activation disclosure creates a hostile narrative window (mitigated by framing as transparency demonstration).\n- **Residual risk:** Desk review cases may be selected to confirm rather than challenge P-013 \u2014 adversarial member's case selection is the primary control; cases published for independent scrutiny. Second-order self-reference if post-activation audit finds compromise \u2014 accepted as less circular than the original bootstrap problem.\n- **Auto-close clause:** P-014 closes permanently upon P-013 ACTIVE status. No re-opening, no emergency extension, no analogical application. This clause is Tier 2 protected.\n- **Compound linkages:** T-017 \u00d7 T-016 (bootstrap paradox is the exploit surface T-016 bad actors use for indefinite delay of P-013). T-017 \u00d7 T-011 (bootstrap paradox is a narrative attack surface \u2014 P-014 pre-activation disclosure converts it into a transparency demonstration).\n\n---\n\n## P-013 through P-025 \u2014 Founding Mechanics and Attack Surface Closure\n\n*Red-team hardening cycle. Addresses T-018 through T-023 and closes residual risks identified in T-001, T-002, T-017, and the register's own operational security posture.*\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-015 | T-018 / T-019 | **ACTIVE** | High | structural + protocol + escalation path |\n\n### P-015 \u2014 PCRP Attack Surface Hardening\n\n**Constitutional text:** [ANNEX_AP.md](../annexes/ANNEX_AP.md)\n\n- **Change type:** structural + protocol + escalation path.\n- **Addresses:** T-018 (False-Trigger Exhaustion Attack), T-019 (Demand-Context Flag Suppression Attack).\n- **Introduced design:**\n - *False-trigger escalation path (T-018):* False PCRP triggers accompanied by oracle manipulation evidence or coordination timing signatures do not count toward the 3-trigger audit cap \u2014 they escalate immediately to the enforcement track with formal investigation. Cap reset is available via independent audit finding of deliberate manipulation. A \"trigger exhaustion alert\" fires when 2 of 3 cap slots are consumed within a single quarter, prompting pre-emptive review before the third activation.\n - *Demand-context manufactured flag assessment (T-019):* Ombuds co-certification during demand-context periods must include an explicit assessment of whether the triggering enforcement action was manufactured or strategically timed; this assessment is a required step with a defined 4-hour timeline, not an optional judgment. A cross-register timing monitor flags any enforcement action initiated within 48 hours of sentinel indicator movement \u2014 this does not block the enforcement action but elevates scrutiny on any resulting demand-context flag. If Ombuds finds deliberate flag manufacture, the demand-context designation is lifted and PCRP activation proceeds at standard scope.\n - *Ombuds constitution pre-condition:* Annex AI (Federated Ombuds constitution) specifies explicit authority, decision criteria, and the 4-hour determination timeline for manufactured-flag assessments. **Annex AI is a pre-launch blocking gate \u2014 P-015 is not operative until at least four of five sub-Ombuds are appointed, challenged, and seated, and the Ombuds Oversight Assembly is seated.**\n- **Clauses to integrate:** AP1\u2013AP4. Amends AC2.3 (false-trigger cap rules). Amends AE2.4 (demand-context Ombuds certification procedure). See Annex AI for full Ombuds mandate and independence requirements.\n- **Dependencies:** Federated Ombuds formally constituted per Annex AI (at least four of five sub-Ombuds seated, Oversight Assembly seated, manufactured-flag criteria published). P-006 PCRP false-trigger tracking infrastructure operative. P-012 demand-context flag register operative. Cross-register timing monitor (Annex AI Section 3.3) technically implemented and tested.\n- **New risks introduced:** False-trigger escalation path can be weaponized in reverse \u2014 a genuine false trigger attributed to manipulation to avoid the audit cap. Mitigated by: escalation requires two independent evidence types (oracle manipulation evidence AND timing cluster), not a single officer judgment. Manufactured-flag assessment timeline (4 hours) creates pressure that could produce errors; mitigated by conservative default (maintain demand-context designation while assessment runs, but PCRP can activate at reduced scope with single-source authorization).\n- **Residual risk:** Real-time distinction between genuine oracle failure and engineered false trigger remains unreliable; escalation path applies retroactively. Low-level demand-context flag suppression using a genuinely valid enforcement action remains possible \u2014 accepted as operational leakage below detection threshold.\n- **Compound linkages:** T-018 \u00d7 T-019 (compound PCRP attack \u2014 both simultaneously executed is highest-risk scenario; P-015 must address the compound case explicitly). T-018 \u00d7 T-013 (audit load from false-trigger investigation consumes CRP capacity).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-016 | T-002 | **PROPOSED** | Critical | constitutional commitment + quantified doctrine |\n\n### P-016 \u2014 Identity Asymmetric Error Doctrine\n\n**Constitutional text:** [ANNEX_AK.md](../annexes/ANNEX_AK.md)\n\n- **Change type:** constitutional commitment + quantified doctrine.\n- **Status basis:** **PROPOSED / pre-ratification** for deploy-state; **designed, needs evidence** for maturity. Annex AK is incorporated as the live design candidate, but P-016 is not evidence-backed and not ratified into a founding until the founding coalition adopts the doctrine, confirms pilot-calibrated rates, and binds remaining FC values.\n- **Addresses:** T-002 \u2014 calibrating fraud tolerance without making the system unusable for vulnerable populations. Extends P-003.\n- **Introduced design:** The founding coalition must publish and formally adopt an **Asymmetric Error Doctrine** (AED) as a Tier 2 founding commitment before deployment. The AED must specify:\n - (a) Maximum acceptable fraud rate per instrument tier (Essential Access, Voice, Service Record) \u2014 expressed as a percentage of enrolled population per quarter, with confidence interval.\n - (b) Maximum acceptable exclusion rate for vulnerable populations (displaced, undocumented, digitally fragile persons) per tier \u2014 expressed as a percentage of estimated vulnerable population.\n - (c) The review trigger when either rate is exceeded \u2014 automatic publication and independent audit within 30 days.\n - (d) The decision rule when the two error types trade off: when reducing fraud exclusion would increase vulnerable-population exclusion by more than a specified ratio, the exclusion reduction takes priority unless the fraud rate exceeds a specified ceiling.\n - (e) Annual recalibration review by an independent panel with at least one member from a vulnerable-population advocacy organization.\n- **Clauses to integrate:** AK1\u2013AK5. Annex B (identity architecture) extended. AED added to P-004 protected terms registry. Founding preconditions checklist extended (Annex N).\n- **Dependencies:** Identity system operational data required for calibration. AED is therefore a Tier 2 design commitment at founding: FC-140 through FC-145 have bound starting values, FC-146 through FC-150 remain pre-launch commitments, and all values must be tested before scale-up. The commitment to publish and honor the doctrine is the founding obligation; passing the evidence gates is the scale-up obligation.\n- **New risks introduced:** Quantified targets create goodhart's-law gaming \u2014 operators optimize to the metric rather than the underlying goal. Mitigated by: AED specifies both rates and requires independent measurement (not self-reported). Published targets also create narrative attack surface (\"the system allows X% fraud\"). Mitigated by: pre-committed publication converts this from a vulnerability into a transparency demonstration consistent with P-011.\n- **Residual risk:** Some exclusion is structurally unavoidable with any identity system. The AED does not solve this; it makes the trade-off explicit and governable rather than implicit and subject to political manipulation.\n- **Compound linkages:** T-002 \u00d7 T-011 (AED publication is a narrative attack surface \u2014 simultaneously the correct response). T-002 \u00d7 T-008 (vulnerable population exclusion rates must be tracked independently from the same bodies that operate the identity system \u2014 Ombuds Office or equivalent).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-017 | T-020 / T-021 | **ACTIVE** | Critical | measurement architecture + accreditation + supply-chain transparency |\n\n### P-017 \u2014 Oracle Epistemological and Algorithmic Independence\n\n**Status: ACTIVE (promoted 2026-04-18 via Proposal 3 close-out).** Numerical floors bound in `/founding/commitments.md` FC-030 (N\u22655), FC-031 (\u22653 methodology classes), FC-032 (pairwise correlation \u22640.30), FC-033 (\u22651 adversarial seat), FC-100 (14-day quorum-loss restoration window). Annex AL promoted to ACTIVE with its former founding-parameter slots fully bound.\n\n**Constitutional text:** [ANNEX_AL.md](../annexes/ANNEX_AL.md)\n\n- **Change type:** measurement architecture + accreditation standards + supply-chain transparency.\n- **Addresses:** T-020 (Epistemological Oracle Capture), T-021 (Algorithmic Oracle Capture).\n- **Introduced design:**\n - *Methodology-class diversity mandate (T-020):* RCS accreditation must include at least one measurement node per high-volatility essential category using a fundamentally different methodology class (e.g., community-based participatory research vs. institutional statistical modeling vs. independent physical sampling). The specific methodology classes are defined as a P-004 protected term (Annex AL \u2014 \"methodology class\" definition with worked examples).\n - *Methodological divergence signal (T-020):* Systematic divergence between methodology classes is a first-order sentinel indicator requiring investigation, not an anomaly requiring suppression. A divergence above a defined threshold triggers an independent methodological review before that category can be used for Shared Storehouse activation.\n - *Standards-funding transparency (T-020):* Any RCS-accredited node must disclose funding sources for the methodological standards it relies on, with a three-year lookback. Funding from parties with material interest in oracle outputs triggers additional scrutiny.\n - *Anti-monoculture review trigger (T-020):* If three or more oracle nodes rely on the same standards body for a given category, an independent methodological review is required before that category can be used for Shared Storehouse activation.\n - *AI supply chain transparency (T-021):* Any oracle node using ML or AI components must disclose model provenance, training data sources, and any shared upstream dependencies with other oracle nodes. This disclosure is published and part of the independence certification.\n - *Algorithmic independence certification (T-021):* Oracle independence audit must include explicit verification that no two corroborating oracle nodes share a common upstream AI model, training dataset, or fine-tuning pipeline, and that formally independent nodes are not producing same-direction material errors that evade FC-032 pairwise-correlation checks.\n - *Physical ground-truth requirement (T-021):* At least one measurement node per high-volatility category must use direct physical sampling (not model-derived estimates) as its primary measurement method.\n- **Clauses to integrate:** AL1\u2013AL7. Annex M (oracle architecture) extended. \"Methodology class\" and \"algorithmic independence\" added to P-004 protected terms registry per Annex AL. RCS accreditation standards document updated.\n- **Dependencies:** Annex AL (methodology-class definitions) published and initial methodology-class registry populated before first oracle set is accredited. **Annex AL is a pre-launch blocking gate \u2014 P-017 is not operative until the methodology-class registry is published and the standards-body concentration tracking system is built.** P-004 protected terms registry must be operative. Oracle independence audit capacity must include algorithmic supply chain review \u2014 new capability requirement. Physical sampling for high-volatility categories requires resource commitment from founding coalition.\n- **New risks introduced:** Methodology-class diversity requirement increases oracle system cost and coordination complexity. Physical sampling is expensive; cost pressure may produce under-investment that weakens the ground-truth requirement over time \u2014 addressed by Article VII publication of sampling frequency and method per category. AI supply chain disclosure creates competitive sensitivity concerns for oracle node operators \u2014 mitigated by: disclosure is to auditors, not publicly; methodology-level information is published but not proprietary implementation details.\n- **Residual risk:** Defining \"fundamentally different methodology class\" is subject to T-007 definition drift. Pairwise correlation alone can miss directional bias, so Annex AL now requires direction-of-error review and adversarial-seat certification before activation votes. Small pilot populations can also overclaim independence; Cohort 1 requires a small-population oracle plan if below 500 persons. Annex AL Sections 1 and 2 are P-004 protected; Sections 3 and 4 are updated through annual audit (Annex AL Section 5). The annual review panel must include an adversarial methodologist whose role is to find exploitation paths in the current definitions.\n- **Compound linkages:** T-020 \u00d7 T-021 (both target oracle epistemological foundations; P-017 addresses both). T-020 \u00d7 T-012 (structural oracle independence is necessary but not sufficient; P-017 adds the epistemological layer). T-020 \u00d7 T-008 (epistemic monoculture in oracle methodology parallels elite formation in oversight \u2014 P-008 and P-017 share the diversity-mandate logic).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-018 | T-022 | **PROPOSED** | Critical | constitutional architecture + political durability |\n\n### P-018 \u2014 Electoral Cycle Resilience\n\n**Constitutional text:** [ANNEX_AM.md](../annexes/ANNEX_AM.md)\n\n- **Change type:** constitutional architecture + political durability + transition protocol.\n- **Addresses:** T-022 (Electoral Cycle Capture).\n- **Introduced design:**\n - *Entrenchment ladder (direct repeal route):* Tier 1 invariants require not just a legislative supermajority but concurrent ratification by an independent constitutional body. The constitutional body's composition must be specified at founding such that it cannot be reconstituted entirely by the governing coalition within a single electoral term.\n - *Essential Access floor minimum persistence (administrative hollowing route):* A minimum Essential Access floor \u2014 defined at founding as 70% of the founding basket \u2014 is constitutionally self-executing: it does not require legislative appropriation and cannot be suspended by executive action. This floor persists through any governing coalition transition unless repealed via the full Tier 1 amendment process.\n - *Administrative hollowing triggers:* If a founding institution is unfilled for more than 90 days, or post-mortem publication lapses for more than 30 days, or oracle accreditation count drops below a specified minimum, an automatic constitutional review is triggered that does not require the governing coalition's initiation. The review is initiated by the constitutional body and is self-executing.\n - *Transition continuity protocol:* When a new governing coalition takes office, a mandatory 180-day transition audit is required before any changes to Tier 2 or Tier 1 provisions. The audit is conducted by the constitutional body, not the incoming government. During the 180-day window, no Tier 2 or higher changes may be made except through emergency deadlock resolution (P-012 AE2.3).\n - *Treaty override protection (jurisdictional fragmentation route):* International agreements that require modification to the non-convertibility architecture trigger a mandatory Tier 2 impact assessment before ratification. An agreement that would produce cumulative Tier 2 impact (by T-007/P-012 cumulative drift trigger standards) requires the full Tier 2 amendment process for each applicable provision.\n- **Clauses to integrate:** AM1\u2013AM6. Tier 1 amendment process modified (Annex A). Essential Access floor persistence clause added to Article IV. Administrative hollowing triggers added to the Article VII dashboard as auto-publication requirements. Transition continuity protocol added to the operational layer.\n- **Dependencies:** Independent constitutional body formally constituted at founding with staggered terms and confirmed independence from governing coalition appointment. Essential Access floor minimum definition requires RCS capacity confirmation.\n- **New risks introduced:** Self-executing Essential Access floor minimum requires RCS capacity to be maintained regardless of political will \u2014 if oracle system degrades, the self-executing floor has no measurement basis. Mitigated by: oracle degradation itself triggers an administrative hollowing review. Transition continuity audit creates 180-day governance window \u2014 addressed by: audit has a defined 30-day maximum scope for routine transitions; extensions require independent authorization.\n- **Residual risk:** A government with sufficient political will and supermajority can repeal constitutional entrenchment. The designed defense buys time and raises political cost; it cannot prevent determined repeal. Ultimate residual risk: protocol durability depends on political culture. No design can substitute for a political culture that values the commitments.\n- **Compound linkages:** T-022 \u00d7 T-011 (hostile electoral success often follows narrative attack \u2014 P-011 and P-018 are jointly necessary). T-022 \u00d7 T-008 (elite formation inside institutions may assist administrative hollowing by a hostile government). T-022 \u00d7 T-017 (T-022 success produces a new bootstrap problem \u2014 recursive T-017). T-022 \u00d7 T-016 (hostile government can capture FAP sign-off authorities).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-019 | T-023 | **ACTIVE** | Med-High | evidence architecture + scale-up gating |\n\n### P-019 \u2014 Pilot External Validity Gate\n\n**Constitutional text:** [ANNEX_AN.md](../annexes/ANNEX_AN.md)\n\n- **Change type:** evidence architecture + scale-up gating + simulation mandate.\n- **Addresses:** T-023 (Pilot External Validity Collapse).\n- **Introduced design:**\n - *Stress-condition pilot gate:* Scale-up approval requires the pilot evidence record to include at least one each of: an economic stress event (recession, significant unemployment spike, or supply price shock affecting the pilot region); a compound supply disruption (two or more essential categories simultaneously below adequate levels); and documented operation during a formal political opposition campaign against the system. Where a condition could not be tested in the pilot, the evidence record must include: (a) explicit documentation of why it could not be tested; (b) a designated substitute evidence source (e.g., analogous case from another jurisdiction, red-team analysis); (c) a residual-risk statement acknowledging the gap; and (d) a post-scale monitoring commitment specific to the untested condition.\n - *Red-team challenge window (T-016 companion):* Before any scale-up vote, a mandatory 30-day adversarial challenge window allows independent reviewers to contest the external validity of the evidence base. Challengers must have access to the full evidence record, not just the summary. Responses to challenges are published before the vote.\n - *Crisis simulation mandate:* The Annual Compound Simulation must include at least one compound-crisis scenario not previously simulated before each scale-up gate. The talent drain scenario and civic legibility scenario fulfill this requirement for the first scale-up gate only.\n- **Clauses to integrate:** AN1\u2013AN5. FAP (Formal Acceptance Protocol) extended \u2014 scale-up gate conditions added to evidence requirements. Annex T (simulation mandate) extended. P-013 representativeness standard cross-referenced (stress-condition pilot is a representativeness requirement).\n- **Dependencies:** Annual Compound Simulation must be updated to include new scenarios before each scale-up gate. Red-team challenge window requires independent reviewer access infrastructure.\n- **New risks introduced:** Stress-condition requirement may delay scale-up indefinitely if adverse conditions do not occur in the pilot region within a reasonable window. Mitigated by: substitute evidence pathway is explicitly available; the requirement is for good-faith engagement with external validity, not for a manufactured crisis. Red-team challenge window creates a blocking mechanism \u2014 mitigated by: challengers must propose specific residual-risk mitigations, not merely object.\n- **Residual risk:** Some external validity gaps cannot be filled by any pilot. A deliberately engineered crisis to satisfy the stress-condition requirement would satisfy the letter but not the spirit of P-019. Ultimate residual risk: the evidence base for a system of this scale will always be incomplete.\n- **Compound linkages:** T-023 \u00d7 T-016 (honest insufficient pilot is the complement to dishonest evidence farming \u2014 both require evidence quality controls). T-023 \u00d7 T-011 (scale-up failure after smooth pilot is a maximum-impact narrative attack). T-023 \u00d7 T-022 (hostile electoral challenge is one of the hardest conditions to include in a controlled pilot; substitute evidence pathway must address this explicitly).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-020 | T-017 | **ACTIVE** | Critical | founding governance + window extension |\n\n### P-020 \u2014 Founding Window Extension\n\n**Constitutional text:** [ANNEX_AH.md \u00a7 AH2.1\u2013AH2.4](../annexes/ANNEX_AH.md)\n\n- **Change type:** founding governance amendment \u2014 extends P-014 Annex AH.\n- **Addresses:** T-017 residual risk \u2014 14-day pre-activation disclosure window is insufficient for independent critique to organize against a coordinated founding capture attempt.\n- **Introduced design (Annex AH2, amending AH1):**\n - *60-day pre-activation disclosure (replacing 14-day):* The P-014 pre-activation challenge window is extended from 14 days to 60 days minimum. The 60-day clock begins when the circular dependency analysis, founding exception statement, and panel composition are simultaneously published. No stage of P-014 may proceed until the 60-day window closes with no unresolved structural objections requiring response.\n - *Oppose-coalition adversarial member nomination:* The adversarial panel member required by P-014 may not be appointed by the same nominating process as the other four panel members. The adversarial member must be nominated by a body that is structurally opposed to or independent from the founding coalition's interests \u2014 specifically: (a) a civil liberties or human rights organization not affiliated with the founding coalition; (b) a registered opposition political party or civic organization; or (c) an independent academic institution with no material funding relationship with founding coalition members. The nominating body's selection rationale must be published as part of the founding record.\n - *Objection response requirement:* Any structural objection submitted during the 60-day window that identifies a specific P-013 standard not met by the P-014 process must receive a written response from the founding panel before the window closes. Unresponded objections extend the window by 14 days, non-cumulatively.\n- **Non-precedent statement (extends AH1 Tier 2 protection):** 'P-020 amends P-014. The 60-day window and oppose-coalition nomination are P-014 requirements only. They do not set a precedent for other patch activations, emergency processes, or governance decisions. Any invocation of P-020 logic for any other purpose requires H-2 amendment process.'\n- **Clauses to integrate:** AH2.1\u2013AH2.4. P-014 founding checklist extended. Annex N founding preconditions updated.\n- **Dependencies:** Oppose-coalition nominating body must be identified before P-014 stage 1 begins. 60-day window requires that the founding timeline allow for this \u2014 founding planning should budget 90 days for the P-014 process from first public disclosure to panel sign-off.\n- **New risks introduced:** 60-day window provides more time for coordinated opposition to manufacture procedural objections that are technically valid but strategically motivated. Mitigated by: objection response requirement specifies that only structural objections (identifying a specific P-013 standard not met) require response; procedural objections without structural grounding do not extend the window. Oppose-coalition nomination process requires identifying a legitimate opposition body \u2014 in contexts without organized opposition, this may be difficult. Mitigated by: the three pathways (civil liberties org, opposition party, academic institution) provide alternatives.\n- **Residual risk:** A 60-day window with published panel composition still allows founding panel capture if the oppose-coalition nomination process is itself captured. Ultimate residual: founding legitimacy depends on the quality of the political culture and civil society present at the founding moment. No procedural design fully compensates for absent civil society.\n- **Compound linkages:** T-017 \u00d7 T-022 (T-022 attack recurs as T-017 after a successful dismantling \u2014 P-020 hardened founding reduces risk of both initial capture and post-T-022 refounding capture). T-017 \u00d7 T-011 (60-day public window converts founding moment into sustained transparency demonstration).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-021 | \u2014 | **ACTIVE** | High | register architecture + disclosure policy |\n\n### P-021 \u2014 Register Disclosure Protocol\n\n**Constitutional text:** [ANNEX_AO.md](../annexes/ANNEX_AO.md)\n\n- **Change type:** register architecture + operational security + transparency calibration.\n- **Addresses:** Open threat register as attack surface \u2014 the current register publishes specific detection thresholds, timing windows, and exploit paths that constitute an operational manual for sophisticated attackers. This is not a new threat ID (the vulnerability is architectural, not a distinct attack class); it is a structural change to how the register is maintained.\n- **Introduced design:** The register is bifurcated into:\n - *Public Register:* Threat categories, mechanisms (described at class level, not with specific thresholds), mitigation approaches, residual risks, risk scores, and compound linkages. The public register is published in the open GitHub repository and is the primary accountability and transparency artifact. The current `Threat_Register.md` is the public register.\n - *Restricted Register Annex:* Specific detection thresholds (e.g., exact trigger counts and time windows), precise timing windows for exploitation, operational detection patterns and signatures, and calibration data used to set automated alerts. The Restricted Annex is available to: credentialed auditors under NDA; adversarial panel members in the P-013/P-014 acceptance process; the constitutional review body; and Ombuds Office staff. It is not published publicly. It is version-controlled privately with access logs.\n - *Consistency requirement:* Both versions must be updated simultaneously. Any discrepancy between the public and restricted versions triggers a T-007 definition-drift review. The restricted version is the authoritative operational document; the public version is the transparency artifact.\n - *Reclassification review:* Annually, the Threat Register Owner reviews whether any restricted-version content can be declassified to the public version (because the window of operational sensitivity has passed) or whether any public-version content should be reclassified to restricted (because specific operational details have been added).\n- **Clauses to integrate:** AO1\u2013AO5. Annex AO (Register Disclosure Protocol) \u2014 see `docs/annexes/ANNEX_AO.md`. P-004 protected terms registry: 'restricted annex' and 'public register' defined.\n- **Dependencies:** Restricted Annex infrastructure (private version-controlled repository with access controls) must be established before P-021 is operative. Threat Register Owner role must be formally constituted with authority to manage both versions.\n- **New risks introduced:** Bifurcation creates an accountability gap \u2014 the public cannot verify that the restricted version is consistent with stated mitigations. Mitigated by: credentialed auditors can access restricted version and publish a consistency attestation (not the content) annually. Restricted version existence itself creates an information asymmetry that could be used to claim mitigations are more robust than they are. Mitigated by: consistency attestation is published; any disclosed gap between public claims and restricted reality is a T-007 event.\n- **Residual risk:** The bifurcation design assumes that restricted content stays restricted. Leaks are possible. The design accepts this and treats the restricted version as reducing adversarial advantage, not eliminating it \u2014 full security through obscurity is not the goal.\n- **Compound linkages:** P-021 \u00d7 T-011 (restricted register removes some transparency \u2014 P-021 must be communicated publicly as a deliberate operational security choice, not a transparency failure, or it becomes a narrative attack surface).\n\n---\n\n## P-022 through P-023 \u2014 Operational Gap Closure\n\n*Operational gap closure (P-022) and design-discussion registration (P-023).*\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-022 | T-024 | **ACTIVE** | Critical | protocol + authority definition + FC-100 restoration verification + reconciliation |\n\n### P-022 \u2014 Shared Storehouse Oracle-Failure Fallback Protocol\n\n**Status: ACTIVE (promoted 2026-04-18 via Proposal 6 close-out).** FC-100 `ORACLE_QUORUM_LOSS_RESTORATION_WINDOW` = 14 days bound in `/founding/commitments.md`. Annex AQ promoted to ACTIVE with full protocol detail, survival floor unconditionality confirmed, Reconciliation Review specified.\n\n**Constitutional text:** [ANNEX_AQ.md](../annexes/ANNEX_AQ.md)\n\n- **Change type:** protocol + authority definition + oracle reconciliation procedure.\n- **Addresses:** T-024 (Shared Storehouse Oracle-Failure During Active Rationing) \u2014 the operational void where Shared Storehouse is active and the oracle system fails, loses quorum, or enters an unresolvable dispute with no defined decision path.\n- **Introduced design:**\n - *Conservative hold default:* When the oracle system loses quorum or enters an unresolvable dispute while Shared Storehouse is active, Shared Storehouse holds at its current activation level. No escalation. No expansion to new categories. No automatic lapse. The conservative hold is the designed default \u2014 not doing nothing, but doing the least-harm thing until authority is restored.\n - *48-hour REB first-responder window:* The Regional Executive Body (REB), using its existing P-006 first-responder authority, may issue a provisional continuation or provisional lapse within 48 hours of oracle failure based on non-oracle physical indicators: distribution fill rates, vendor inventory reports, and logistics data. The REB decision is published immediately with the full evidence base. The REB may not expand Shared Storehouse scope under this authority \u2014 only hold or begin a managed lapse. Expansion requires oracle quorum.\n - *72-hour governance handoff:* If the oracle system is not restored within 72 hours of failure, the matter transfers to the emergency deadlock resolution protocol (P-012 AE2.3) for a binding decision. The 3-member arbitration panel has authority to issue a time-bound Shared Storehouse continuation or staged lapse. The survival floor bridge (P-012 AE2.3) is unconditional throughout oracle failure \u2014 Essential Access baseline access is never contingent on oracle availability.\n - *Oracle restoration reconciliation:* When the oracle system begins restoration, a mandatory 24-hour preliminary reconciliation notice names restored-node status, unresolved discrepancies, and any provisional REB decision that appears inconsistent with restored readings. After the 14-day FC-100 verification window, a final Reconciliation Review is published within 7 days with root-cause analysis. Persistent REB-oracle divergence triggers an independent review of the non-oracle physical indicator methodology.\n - *Deliberate-failure escalation:* If oracle failure during active Shared Storehouse is found to be deliberately engineered (oracle manipulation evidence per T-012/T-018), the matter escalates immediately to enforcement \u2014 the conservative hold and first-responder window both continue, but the investigation runs in parallel without waiting for oracle restoration.\n- **Clauses to integrate:** AQ1\u2013AQ5. Amends Annex U (Shared Storehouse termination and continuation procedures). Amends AC2 (P-006 PCRP/REB authority \u2014 Shared Storehouse oracle failure is a distinct REB authority from PCRP). Article VII dashboard extended: oracle status must include a live Shared Storehouse-active indicator so oracle failure during active Shared Storehouse is publicly visible in real time.\n- **Dependencies:** REB formally constituted with defined authority for non-oracle physical indicator assessments. Non-oracle physical indicator methodology must be published and reviewed annually. P-012 AE2.3 emergency deadlock protocol must be operative before P-022 is operative.\n- **New risks introduced:** REB use of non-oracle physical indicators creates a soft-oracle channel not subject to the independence requirements of the main oracle system. Mitigated by: (1) REB authority under P-022 is explicitly scoped to hold-or-lapse decisions only \u2014 no scope expansion; (2) REB decisions are published immediately with evidence base; (3) reconciliation review after oracle restoration creates accountability for REB accuracy; (4) the non-oracle indicator methodology is published and periodically reviewed. Risk: consistent REB-oracle agreement could be engineered by an adversary who also controls the physical indicator sources. Mitigated by: physical indicators (fill rates, inventory reports) are collected from distributed vendor networks \u2014 harder to simultaneously compromise than a concentrated oracle system.\n- **Residual risk:** A deliberate oracle failure timed to active Shared Storehouse, combined with physical indicator manipulation, could force a harmful REB decision during the 48-hour window. This is the highest-consequence compound attack on the Shared Storehouse system. The 72-hour governance handoff provides a backstop, but 72 hours of incorrect Shared Storehouse operation during a genuine shortage is a real harm. Accepted as the best available outcome given the operational constraint that a governance decision cannot be made faster than the arbitration panel can convene.\n- **Compound linkages:** T-024 \u00d7 T-006 (P-022 extends P-006 to cover oracle failure during Shared Storehouse \u2014 P-006 covers measurement lag; P-022 covers measurement absence). T-024 \u00d7 T-014 (triple deadlock during Shared Storehouse oracle failure is the worst-case scenario \u2014 survival floor bridge must be explicitly unconditional regardless of deadlock status). T-024 \u00d7 T-018 (deliberate false-trigger exhaustion designed to overlap with active Shared Storehouse is the highest-risk T-018 compound).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-023 | T-025 | **ACTIVE** | High | Contract-commitment architecture / protected-capital shelter control |\n\n### P-023 \u2014 Contract-Commitment Architecture (Protected-Capital Shelter Control)\n\n- **Status:** ACTIVE\n\n**Constitutional text:** [ANNEX_AR.md](../annexes/ANNEX_AR.md)\n\n- **Evidence package:** [Commons Return and Universal Stake Evidence Test Package](./Commons_Return_Universal_Stake_Evidence_Test_Package.md), plus Annex AR project-finance simulation and procurement red team.\n- **Threat addressed:** T-025 (Investment and Capital-Deployment Shelter Capture).\n- **Direction adopted:** Direction B \u2014 deployment-speed architecture. Investment-channel exemptions are removed entirely. Genuine long-horizon capital needs are served by contract-commitment architecture; protected-capital status requires real deployment, public accounting, and source-base review where Commons Return is implicated.\n- **Red-team pre-analysis:** Ten attack vectors identified and resolved before this patch was written. Vectors: (1) escrow control ambiguity, (2) milestone definition gaming, (3) \"working capital\" as new exemption label, (4) advance procurement rebranded as hoarding, (5) subcontractor chain gaming, (6) essential-sector carve-out pressure, (7) multi-jurisdiction pooling ambiguity, (8) force majeure as wedge for permanent exemptions, (9) sector definitional creep, (10) milestone oracle capture. All resolved in patch rules below.\n\n**P-023.1 \u2014 Zero Shelter Principle**\nNo entity, sector, or project type receives protected-capital shelter by label. The investment-channel exemption architecture from the original P-002 design is deprecated. The concept of \"investment-channel status\" is removed. No project account, escrow window, term pool, infrastructure label, or public-benefit designation may shield idle control from deployment review or Annex D source-base review.\n\n**P-023.2 \u2014 Contract-Commitment Architecture**\nLong-horizon projects are financed through milestone escrow:\n- The commissioning authority deposits Flow into an independent escrow account at project initiation.\n- Deployment-window review, public reporting, and Annex D source-base review apply to escrowed Flow. The commissioning authority bears accountability for delay, creating institutional incentive for timely contracting and completion.\n- Flow is released to the contractor only upon independently verified milestone completion.\n- The contractor holds only current working capital. Protected-capital shelter is unavailable without verified physical deployment.\n\n**P-023.3 \u2014 Independent Escrow Agent**\nEscrow accounts are administered by an independent escrow agent designated by the CRP. The contractor, any entity in the contractor's supply chain, and any entity with a financial interest in the project's outcome may not administer, co-administer, or materially influence the escrow account.\n\n**P-023.4 \u2014 Output Milestone Standard**\nMilestones eligible to trigger escrow releases must satisfy all of the following:\n- Physical deliverables only \u2014 no process milestones, no self-certified planning stages, no administrative completions.\n- Independently inspected and certified by a rotating inspector pool; the contractor does not select inspectors. Pool is administered by the escrow agent under P-017 oracle-independence standards.\n- Defined at contract signing and P-004-locked. No renegotiation of milestone definitions after contract execution.\n- High-value releases (above the threshold defined in Annex AR) require multiple independent verifiers and physical inspection with full audit trail.\n\n**P-023.5 \u2014 Procurement Clarification**\nAdvance procurement of materials means actual purchase: Flow exits the contractor's hands at the transaction. Holding Flow \"in reserve for future procurement\" without a bound deliverable is protected-capital sheltering and receives no protective treatment. Supply chain uncertainty is addressed through competitive procurement, staged purchasing, and futures commitments \u2014 not indefinite balance reserves.\n\n**P-023.6 \u2014 Universal Scope**\nP-023 applies at every tier of the supply chain: prime contractors, subcontractors, sub-subcontractors, and all entities receiving Flow for project work are subject to the same architecture. There is no sector-specific carve-out. Eligibility for contract-commitment structure is determined by deliverable characteristics (verifiable physical milestones + commissioning authority), not sector identity.\n\n**P-023.7 \u2014 Mandatory Deployment Timeline (Commissioning Authorities)**\nCommissioning authorities must contract idle escrowed funds within the deployment window defined in Annex AR. Funds held beyond this window without active contracting trigger mandatory CRP review. Review and publication continue regardless of whether any dormant backstop has been activated. This is an accountability mechanism, not an exemption.\n\n**P-023.8 \u2014 Multi-Jurisdiction Lead Authority**\nFor projects with multiple commissioning authorities pooling Flow, a lead authority must be designated at contract signing. The lead authority bears accountability for pooled escrow delay, publication, and review. Internal cost-sharing between participating authorities is a private arrangement; external accountability runs through the lead authority only.\n\n**P-023.9 \u2014 Force Majeure Escrow Freeze**\nVerified external delays may trigger a temporary freeze of deployment-delay consequences:\n- Qualifying events: permitting delays attributable to regulatory bodies outside the project's control; certified supply chain disruptions (independent third-party certification required); declared natural disasters.\n- Process: contractor applies with documented evidence; an independent assessment panel certifies the external cause and its temporal scope. Panel composition and selection use P-017 oracle-independence standards.\n- Effect: deployment-delay consequences on the affected escrow account are paused for the certified duration only.\n- Limits: freeze is time-limited to the verified external condition; total cumulative freeze time per project is capped at the period defined in Annex AR; freeze does not stack across overlapping events.\n- Gaming deterrent: misrepresentation in a freeze application is an audit trigger and grounds for contractor disqualification from future escrow eligibility.\n\n**P-023.10 \u2014 P-004 Protected Terms**\nThe following terms are added to the P-004 protected vocabulary: *milestone*, *physical deliverable*, *commissioning authority*, *independent escrow agent*, *force majeure* (for protocol purposes), *lead authority*, *verified external delay*, *deployment window*. Definitions may not be modified without a Tier 2 (H-2) amendment.\n\n- **Risk introduced:** (1) Force majeure certification panel is a new oracle \u2014 capture target per T-020/T-021; mitigated by P-017 independence requirements. (2) Mandatory deployment timelines may pressure commissioning authorities to rush contracting rather than hold idle; mitigated by requiring contracts to pass standard procurement integrity checks before they satisfy the timeline. (3) Inspector pool is a new oracle; mitigated by rotating pool under P-017 standards and escrow-agent administration. (4) P-023.4 output-only milestone standard may be challenged as too rigid for novel infrastructure categories; mitigated by P-004 protection \u2014 any redefinition requires H-2 amendment, raising the cost of definitional drift.\n- **Annex:** AR (contract-commitment architecture specification \u2014 high-value release thresholds, deployment window periods, force majeure cumulative freeze cap, inspector pool governance, escrow agent designation process).\n- **Compound linkages:** T-025 \u00d7 T-001 resolved (no investment-channel exemptions means no above-ledger boundary manipulation through exemption classification). T-025 \u00d7 T-007 mitigated (P-004 protection on all P-023.10 terms). T-025 \u00d7 T-008 mitigated (no classification to capture \u2014 sector identity is irrelevant to escrow eligibility).\n\n---\n\n## Operating Rules for the Patch Log\n\n- Every future patch must reference a threat ID and specify the new risk it creates.\n- If a patch only exists in the log and not in the Humane Constitution, it is not yet operative.\n- If a patch changes public explanation, the white paper and technical reference must be synced in the same cycle.\n- When a patch materially changes user experience or institutional authority, the diagram set must be updated too.\n- **PROPOSED** patches become ACTIVE only after formal Humane Constitution integration and oversight sign-off.\n- If two patches conflict, the conflict belongs in the patch log and must be resolved explicitly in the Humane Constitution.\n\n---\n\n## Current Threat/Patch Linkage\n\nThis table is the single source of truth for threat\u2192patch traceability. It covers every patch in the current inventory through P-078. Reserved IDs (P-007, P-010, P-028, P-071) and the draft-only P-063 review packet are listed in the Reserved / Never-Assigned Patch IDs table above. \"Multiple\" has been replaced with enumerated threat (or PRD-/IC-/INV-/ACL-) references throughout; patches with no standalone threat row are marked \"structural \u2014 no threat row.\"\n\n| Threat ID | Patch ID | Status | Master Reference |\n| :--- | :--- | :--- | :--- |\n| T-001 | P-001 | **ACTIVE** | Annex AB |\n| T-004 | P-002 | **ACTIVE** | Annex AB |\n| T-002 | P-003 | **ACTIVE** | Annex AB |\n| T-007 | P-004 | **ACTIVE** | Annex AB |\n| T-005 | P-005 | **ACTIVE** | Annex AC1 |\n| T-006 | P-006 | **ACTIVE** | Annex AC2 |\n| T-008 | P-008 | ACTIVE | Annex AC3 (operative authority superseded by P-025 ACTIVE) |\n| T-009 | P-009 | **ACTIVE** | Annex AF |\n| T-011 | P-011 | **ACTIVE** | Annex AD |\n| T-012\u2013T-015 | P-012 | **ACTIVE** | Annex AE |\n| T-016 | P-013 | **ACTIVE** | Annex AG |\n| T-017 | P-014 | **ACTIVE** | Annex AH |\n| T-018 / T-019 | P-015 | **ACTIVE** | Annex AP \u00b7 Annex AI |\n| T-002 | P-016 | ACTIVE | Annex AK (P-016 is pre-ratification design) |\n| T-020 / T-021 | P-017 | **ACTIVE** | Annex AL \u00b7 FC-030/031/032/033/100 |\n| P-018 | T-022 supplement | **PROPOSED** | Annex AM |\n| T-023 | P-019 | **ACTIVE** | Annex AN |\n| T-017 | P-020 | **ACTIVE** | Annex AH2 |\n| structural \u2014 no threat row (register disclosure protocol) | P-021 | **ACTIVE** | Annex AO |\n| T-024 | P-022 | **ACTIVE** | Annex AQ \u00b7 FC-100 |\n| T-025 | P-023 | **ACTIVE** | Annex AR |\n| T-009 / TR-07 / T-018 | P-024 | **ACTIVE** | Annex AS \u00b7 FC-080/081/082 |\n| T-008 | P-025 | **ACTIVE** | Annex AI \u00b7 FC-090/091/092 |\n| T-026 / T-027 | P-026 | **ACTIVE** | `founding/order/` \u00b7 FC-120/121/122 |\n| T-005 / T-008 | P-027 | **ACTIVE** | `Humane_Constitution.md` \u00b7 `docs/public/04_white_paper.md` |\n| T-016 (public-funding architecture) | P-029 | **ACTIVE** | Annex X \u00a7X8 |\n| PRD-004 | P-030 | **ACTIVE** | Annex X |\n| PRD-009 | P-031 | **ACTIVE** | Annex J \u00a7R1\u2013R2 |\n| PRD-009 | P-032 | **ACTIVE** | Annex J |\n| PRD-008 | P-033 | **ACTIVE** | Annex J |\n| T-016 / INV-007 | P-034 | **ACTIVE** | Annex AV |\n| structural \u2014 no threat row (corrigibility/humility clause) | P-035 | **ACTIVE** | Preamble \u00b7 \u00a70A |\n| structural \u2014 no threat row (keyholder servanthood duty) | P-036 | **ACTIVE** | Article I |\n| structural \u2014 no threat row (identity-serves-person clause) | P-037 | **ACTIVE** | Article II |\n| T-006 | P-038 | **ACTIVE** | Article III |\n| structural \u2014 no threat row (mutual-aid/family/religious protection) | P-039 | **ACTIVE** | Article IV |\n| structural \u2014 no threat row (housing-cap pastoral revision) | P-040 | **ACTIVE** | Article V |\n| T-008 | P-041 | **ACTIVE** | Article VI |\n| structural \u2014 no threat row (community alert pathway) | P-042 | **ACTIVE** | Article VII |\n| T-001 / T-002 / T-004 / T-007 | P-043 | **ACTIVE** | ANNEX_AH \u00b7 ANNEX_Y \u00b7 INVARIANTS \u00b7 SPECIFICATIONS |\n| T-001 / T-002 / T-004 / T-005 / T-007 / T-018 / T-019 | P-044 | **ACTIVE** | ANNEX_AI \u00b7 ANNEX_AP \u00b7 ANNEX_AB \u00b7 ANNEX_AK \u00b7 ANNEX_Y |\n| T-001 / T-002 / T-004 / T-007 / IC-004 | P-045 | **ACTIVE** | ANNEX_AB \u00b7 ANNEX_AK \u00b7 ANNEX_AH \u00a7AH5.1 |\n| T-001 / T-002 / T-007 / T-008 / T-016 (evidence + capture hardening) | P-046 | **ACTIVE** | evidence artifacts \u00b7 capture dashboard |\n| T-025 / T-026 / T-027 (external dependency capture) | P-047 | **ACTIVE** | Annex AT |\n| T-025 / T-026 / T-027 (external dependency capture) | P-048 | **ACTIVE** | Annex AT \u00b7 FC-194\u2013FC-201 |\n| T-025 / T-026 / T-027 (cross-register evidence-gap bridge) | P-049 | **ACTIVE** | Hardening Queue \u00b7 Open Problems \u00b7 Pilot Roadmap \u00b7 README |\n| T-028 | P-050 | **ACTIVE** | ANNEX_AT \u00a7AT6.6 |\n| T-022 | P-051 | **ACTIVE** | ANNEX_AM \u00a7AM8 |\n| T-019 | P-052 | **ACTIVE** | ANNEX_AI \u00a74.12 |\n| Insider retaliation / reporter protection | P-053 | **ACTIVE** | ANNEX_AW \u00b7 Article VII |\n| Identity disclosure as safety vector | P-054 | **ACTIVE** | ANNEX_AX \u00b7 Article II |\n| Delivery gap between guarantee and operation | P-055 | **ACTIVE** | ANNEX_AY \u00b7 Article IV |\n| INV-001 support (identity-related; active identity controls remain P-003/P-016) | P-056 | PROPOSED | ANNEX_AK \u00a7AK8 \u00b7 ANNEX_AZ \u00a7AZ2 |\n| ACL-011 / ACL-010 | P-057 | **PROPOSED** | Pilot site selection criteria |\n| constitutional void support \u2014 no standalone threat row | P-058 | PROPOSED | Jurisdiction Interface Clause |\n| ACL-010 / dignity-floor leverage | P-059 | **PROPOSED** | Vulnerable_Population_Consent_Protocol.md |\n| ACL-005 / founding keyholder capture | P-060 | **PROPOSED** | Founding Team Composition Standard |\n| ACL-007 / Power-Wealth Convergence | P-061 | **PROPOSED** | Founding Capital Framework |\n| ACL-011 / ACL-010 | P-062 | **PROPOSED** | Pilot Timeline Framework |\n| T-028 | P-064 | **ACTIVE** | Essential-Sector Refusal Test Package \u00b7 Capture Dashboard Specification \u00b7 Threat Resolution Matrix \u00b7 Pilot Evidence Roadmap |\n| T-022 | P-065 | **ACTIVE** | ANNEX_AM \u00a7AM3/\u00a7AM8.5\u2013AM8.7 \u00b7 amendment_protocol.md \u00a73 \u00b7 Capture Dashboard Specification \u00b7 Pilot Evidence Roadmap |\n| T-029 | P-066 | **ACTIVE** | ANNEX_D \u00b7 Commons Return and Universal Stake Evidence Test Package \u00b7 Threat Register \u00b7 Claims and Evidence Register |\n| T-030 | P-067 | **ACTIVE** | Cyber Resilience and Availability Evidence Test Package \u00b7 Threat Register \u00b7 Pilot Evidence Roadmap |\n| T-031 | P-068 | **ACTIVE** | Last-Resort Unenrolled Access Evidence Test Package \u00b7 ANNEX_AZ \u00b7 ANNEX_AY |\n| T-032 | P-069 | **ACTIVE** | Monitoring Repurposing Evidence Test Package \u00b7 Annex C \u00b7 Capture Dashboard Specification |\n| T-033 | P-070 | **ACTIVE** | Founding Consent and Civil-Society Review Evidence Test Package \u00b7 Founding Legitimacy Dossier |\n| P-072 | T-025 supplement | **PROPOSED** | Productive Status Register (operative T-025 control remains P-023 ACTIVE) |\n| structural \u2014 no threat row (anti-accretion intake gate) | P-073 | **ACTIVE** | Acceptance_Protocol.md Framework-First Intake |\n| structural \u2014 no threat row (appeal spine) | P-074 | **ACTIVE** | ANNEX_L \u00a7L7 |\n| structural \u2014 no threat row (evidence framework + data stewardship) | P-075 | **ACTIVE** | Evidence_Ladder.md Test Package Template \u00b7 Monitoring Administrative Safety Packet |\n| structural \u2014 no threat row (institution merger audit) | P-076 | **ACTIVE** | ANNEX_AQ \u00b7 ANNEX_AL \u00b7 ANNEX_AM \u00b7 Capacity Measurement Evidence Test Package \u00b7 SPECIFICATIONS |\n| structural \u2014 no threat row (canonical-home discipline) | P-077 | **ACTIVE** | Acceptance_Protocol.md P-073 gate \u00b7 Claims_Evidence_Register \u00b7 ANNEX_L \u00a7L7 \u00b7 Evidence_Ladder \u00b7 Monitoring Administrative Safety Packet |\n| structural \u2014 no threat row (data-retention gap closure) | P-078 | **ACTIVE** | Parameter_Calibration_Register FC-211..214 \u00b7 Monitoring Administrative Safety Packet \u00b7 ANNEX_AJ \u00b7 ANNEX_AF \u00b7 ANNEX_D \u00b7 ANNEX_C |\n\n---\n\n## P-024 \u2014 Attestation-at-Risk Stake Mechanism\n\n### P-024 \u2014 Attestation-at-Risk Stake Mechanism\n\n- **Status:** ACTIVE (promoted 2026-04-25 via Annex AS ratification). FC-080 stake ratio, FC-081 audit window, FC-082 graph density threshold bound in `/founding/commitments.md`.\n\n**Constitutional text:** [ANNEX_AS.md](../annexes/ANNEX_AS.md)\n\n- **Evidence package:** [Service Record Misuse Evidence Test Package](./Service_Record_Misuse_Evidence_Test_Package.md)\n- **Threat addressed:** T-009 (Coordinated False-Positive Suppression), TR-07 (Attestor Collusion), T-018 (Deliberate False-Trigger Exhaustion).\n- **Direction adopted:** Attestors who certify a claim bear skin-in-the-game exposure proportional to the claim's downstream consequence. A slashing schedule fires automatically when a certified claim is later disconfirmed by oracle quorum; redistribution routes slashed stake to the claimant harmed (where identifiable) and to a system integrity reserve.\n- **Introduced design:**\n - *FC-080 stake ratio:* Every attestation above the materiality threshold requires the attesting node to place a stake equal to at least the ratio defined in FC-080. Stake is denominated in the attestor's civic balance \u2014 Service Record for contribution, hardship, and identity attestations; Voice where the attestation directly supports a Voice allocation \u2014 and is locked, not spent, during the audit window.\n - *FC-081 audit window:* Attestations remain auditable for the window defined in FC-081. Within this window any subsequent oracle measurement that contradicts the attested claim by more than the permitted variance triggers an automated slash-and-redistribute event. The audit window is the same for all attestation classes; no class-specific extension may be granted without a Tier 2 (H-2) amendment.\n - *FC-082 graph density threshold:* A graph-density safe harbor protects attestations made by tightly connected communities (cooperatives, mutual-aid networks, family units) from slash penalties that would arise purely from the structural density of their social graph, not from factual error. Attestations above the FC-082 density threshold are flagged for manual review rather than automatic slashing; the Ombuds Duty Sub-Ombuds has 48 hours to certify the density basis before slashing is released. This prevents T-018 attacks that exploit normal community solidarity as evidence of collusion.\n - *Slashed-stake redistribution:* Slashed civic stake is routed according to Annex AS \u00a73: whistleblower share, restitution to a harmed subject where identifiable, Article VII enforcement maintenance fund, and a small retired share. No slashed stake returns to the attesting node or its affiliated entities.\n - *False-claim escalation:* Where slashing evidence reaches the threshold defined in Annex AS \u00a75, the Ombuds Plenum receives a formal referral. A finding of deliberate false attestation (not merely mistaken attestation) triggers disqualification from attestation roles for the period specified in Annex AS \u00a76. Deliberate false-trigger exhaustion (T-018 use of P-024 to drain legitimate attestors) is an aggravated finding with an extended disqualification period.\n- **Clauses integrated:** AS1\u2013AS6. Amends Annex U (adds attestation-stake exposure to bypass-closure layer). Article VII dashboard extended: real-time attestation-stake exposure by class and pending audit-window count are public indicators.\n- **Dependencies:** Independent escrow agent (P-023.3) operative. Oracle quorum system (P-017) operative with at least three independent oracle seats. Ombuds federation (P-025) seated at \u22654 sub-Ombuds before density-threshold manual review is operative. FC-080/081/082 values bound before any attestation-bearing transaction is accepted.\n- **New risks introduced:** (1) Stake requirement may chill legitimate attestation by resource-constrained community members \u2014 mitigated by FC-080 materiality threshold (low-value attestations are stake-exempt) and by graph-density safe harbor. (2) Automated slashing on oracle contradiction may fire incorrectly if oracle error precedes attestation error \u2014 mitigated by 48-hour Ombuds review gate at FC-082 density flag and by audit-window appeals process in Annex AS \u00a74. (3) Slashed-stake redistribution route to integrity reserve creates an incentive for the CRP to manufacture slash events \u2014 mitigated by Ombuds oversight of all slash events above the Annex AS \u00a75 threshold.\n- **Residual risk:** A coordinated oracle-and-attestor compromise that defeats both systems simultaneously remains the highest-risk failure mode. The graph-density safe harbor narrows the T-018 attack surface but cannot eliminate it if the adversary controls both oracle quorum and attestation review.\n- **Compound linkages:** T-009 \u00d7 T-018 (coordinated false-positive suppression paired with deliberate exhaustion is the canonical dual-threat; P-024 raises the cost of both by making attestation financially painful to corrupt). TR-07 \u00d7 P-017 (attestor collusion is detectable via oracle contradiction; P-017 oracle independence is a prerequisite for P-024 slash events to be trustworthy). T-018 \u00d7 FC-082 (density safe harbor is the primary T-018 surface \u2014 its threshold value is the key calibration parameter; see Annex AS \u00a73).\n- **Annex:** AS (attestation-at-risk stake mechanism \u2014 stake ratio schedule, audit window protocol, graph-density threshold methodology, slash-and-redistribute event specification, escalation thresholds, disqualification periods).\n\n---\n\n## P-025 through P-027 \u2014 Ombuds, Founding Order, and Consolidation\n\n### P-025 \u2014 Federated Ombuds Constitution\n\n**Constitutional text:** [ANNEX_AI.md](../annexes/ANNEX_AI.md)\n\n- **Introduced design:** Single-commissioner Ombuds replaced with a five-node federation. Each sub-Ombuds is structurally dispersed along at least four of five dimensions (jurisdictional, institutional-origin, funding, infrastructure, personnel-recruitment). Operational decisions are handled by a rotating Duty Sub-Ombuds; protocol-level decisions require a 4-of-5 Plenum supermajority (FC-091). Staggered 730-day terms (FC-092) with two-consecutive-term limit. Oversight Assembly of 7 members (5-of-7 threshold) certifies structural dispersal annually and activates Concentration Response on loss of dispersal.\n- **Clauses to integrate:** Full rewrite of Annex AI (previously PROPOSED single-commissioner draft) to Annex AI ACTIVE federated constitution. References from the Humane Constitution, Threat Register, and other annexes read through to the federation acting per \u00a73 (operational vs protocol-level classes).\n- **Load-bearing integrations:**\n - **Proposal 1** \u2014 Tier 1 Amendment Integrity Report (Plenum 4-of-5 within 60 days of signature registration under `/architecture/amendment_protocol.md`).\n - **Proposal 3** \u2014 Adversarial oracle seat certification (Annex AL \u00a73.3).\n - **Proposal 6** \u2014 Arbitration panel seat on Annex AQ \u00a73 Shared Storehouse oracle-failure arbitration.\n - **Proposal 7** \u2014 Enforcement Panel appeals on Annex AJ \u00a74 penalty determinations.\n - **Proposal 9** \u2014 Final adjudication of Annex AS attestation false-claim findings and stake-slashing classification.\n- **Dependencies:** At least four sub-Ombuds seated before any Ombuds-dependent function is operative (\u00a72.1 pre-launch gate). Oversight Assembly seated with \u22655 of 7 before first Plenum vote. Duty rotation schedule published for first 90 days before operational activation. Federation secretariat built before operational activation.\n- **New risks introduced:** Duty rotation scheduling is itself a power locus (mitigated by published-in-advance rotation, non-party-choice rule). Five-node federation increases coordination cost on time-sensitive operational decisions (mitigated by operational/protocol-level bifurcation in \u00a73.1). Plenum deadlock (2 of 5 or 3 of 5) may stall matters (mitigated by conservative-default rule in \u00a73.3 \u2014 deadlock favours protection).\n- **Residual risk:** Structural-dispersal criteria can be met formally while capture is achieved through informal coordination (mitigated by Oversight Assembly \u00a75.1 institutional-health reporting; voting-pattern concentration is a published metric). Oversight Assembly itself can be captured at small scale (mitigated by \u00a75.4 meta-capture controls).\n- **Compound linkages:** P-025 \u00d7 P-008 (federation closes the T-008 open question \u2014 \"who audits the auditors of elite formation?\" \u2014 by making the auditor a federation subject to its own dispersal rule); P-025 \u00d7 P-015 (Ombuds-dependent PCRP flag determinations now robust to single-node capture); P-025 \u00d7 P-017 (methodology-class adversarial seat certification now clears 4-of-5 threshold rather than single-commissioner signature); P-025 \u00d7 P-022 (Annex AQ arbitration panel seat rotation is Plenum-certified).\n- **Auto-close clause:** P-025 is standing. It does not auto-close. Changes to the federation structure (FC-090, FC-091, FC-092) require Tier 1 amendment (7-of-9, 180-day timelock).\n\n---\n\n## P-026 \u2014 Founding Order Detail\n\n### P-026 \u2014 Founding Order: Subsidiarity, Consent & Exit\n\n**Constitutional text:** [Founding Order](../../founding/order/README.md)\n\n- **Introduced design:** The protocol acquires a foundational scale-and-consent layer beneath the operational articles. The Founding Order defines *who* consents to be governed, *at what scale*, and *how they withdraw*. Six files under `/founding/order/` cover: (1) README orientation, (2) five-tier scale hierarchy (FC-122: household / neighborhood \u2264500 / locality \u22645,000 / region \u2264500,000 / federation), (3) three-prong subsidiarity competence test (informational, adjudicative, externality-containment) with default-against-escalation rule, (4) affirmative consent protocol (2/3 supermajority, 90-day notice, 60-day deliberation, roll-call, 2/3 minimum participation), (5) exit protocol (FC-120 2/3 supermajority, FC-121 730-day graceful unwind with Essential Access continuity, no exit tax, no forfeiture, T-026 Exit Denial enforcement), (6) re-entry protocol (procedurally symmetric, no penalty, 365-day floor between cycles).\n- **Clauses to integrate:** Humane Constitution \u00a70 Founding Order paragraph; every operational article reads through the Founding Order (smallest-competent-scale default).\n- **Load-bearing integrations:**\n - Federated Ombuds (Annex AI \u00a73.2 challenge process; \u00a73.4 automatic Plenum convocation on exit denial).\n - Annex AJ \u00a74 severity 3 (Institutional) penalties for Exit Denial violations.\n - CSM (Annex Y) as the single Tier 1 exception that binds regardless of consent.\n - Architectural enforcement layer (Proposal 1) locks FC-120/121/122 under Tier 1 process.\n- **Dependencies:** Federated Ombuds seated (four of five sub-Ombuds) before any Founding Order challenge procedure is operative. Drift chain must support federation-scope expansion and contraction events. Scale registry (household through federation) must be initialized at founding.\n- **New risks introduced:** Re-entry 365-day floor could be gamed through individual-personhood cycling (mitigated by individual consent being distinct from unit consent, with the floor applying only to unit cycles). Exit-cost asymmetry \u2014 the 730-day unwind is generous for the unit but introduces a period of dual-authority \u2014 could produce enforcement ambiguity (mitigated by published unwind schedule and Ombuds oversight).\n- **Residual risk:** Subsidiarity is an aggregate property; any single decision's escalation may look reasonable while the cumulative drift toward federation-scale venue is substantial. Aggregate monitoring via the Ombuds \u00a74.3 federation-decision-concentration report is the mitigation \u2014 a threshold breach is itself a T-027 trigger.\n- **Compound linkages:** P-026 \u00d7 P-025 (Ombuds is the Founding Order enforcement organ \u2014 subsidiarity and exit both depend on Ombuds independence); P-026 \u00d7 P-018 (Essential Access-floor-persistence clause is reinforced by Essential Access continuity preservation during the 730-day unwind); P-026 \u00d7 P-008 (exit right structurally constrains elite formation \u2014 elites cannot form a federation they cannot lose).\n- **Auto-close clause:** P-026 is standing. Changes to FC-120/121/122 and the no-exit-tax rule require Tier 1 amendment (7-of-9, 180-day timelock). Strengthening (shorter unwind, lower supermajority) is Tier 2.\n\n---\n\n## P-027 \u2014 Constitutional Consolidation Detail\n\n### P-027 \u2014 Founding Order and Seven-Article Structural Consolidation\n\n**Constitutional text:** [Humane_Constitution.md \u00a7 III](../constitution/Humane_Constitution.md)\n\n- **Introduced design:** the constitutional architecture is consolidated into one Founding Order and seven Articles of Constitutional Order. Rights and rule-bound execution live together in Article I. Essential Access and delivery live together in Article IV. Flow, housing and commons use-rights, enterprise, and PFCR live together in Article V. Voice, Service Record, contribution recognition, and deliberation live together in Article VI. Transparency and environmental scanning live together in Article VII.\n- **Clauses integrated:** Humane Constitution \u00a7III rewritten around the final constitutional structure; White Paper \u00a74 aligned to the same article model.\n- **Load-bearing integrations:**\n - **P-026** \u2014 the Founding Order establishes the scale, consent, and exit foundation across the full architecture.\n - **Proposal 1** \u2014 the architectural enforcement layer remains bound to Article I rights protections.\n - **P-017** \u2014 oracle requirements (N\u22655, three methodology classes, adversarial seat) remain anchored in Article III Physics & Reserves.\n - **P-024** \u2014 attestation stake integrates with Article VI contribution recognition.\n - **P-029 through P-033** \u2014 PFCR, anti-dynasty, stewardship ownership, and enterprise-governance architecture remain integrated inside Article V.\n- **Dependencies:** downstream annexes, simulations, and support docs must stay aligned to the final article structure and instrument names.\n- **New risks introduced:** Article V now concentrates more of the economic surface under one constitutional home. Mitigation: explicit internal boundaries between Flow, housing and commons use-rights, enterprise, and PFCR, plus public interface definitions and audit visibility.\n- **Residual risk:** future edits that blur article boundaries can recreate the fragmentation or overlap this consolidation removed. Mitigation: the constitutional article interfaces in Humane Constitution \u00a7III remain authoritative.\n- **Compound linkages:** P-027 \u00d7 P-026 (the Founding Order supplies the constitutional foundation); P-027 \u00d7 P-017 (Article III inherits the oracle hardening); P-027 \u00d7 P-029 (PFCR remains inside Article V instead of becoming a detached fiscal system); P-027 \u00d7 P-008 (fewer institutional homes reduce elite-formation surface area).\n- **Auto-close clause:** P-027 is standing. Any change to the number of constitutional articles or to the existence of the Founding Order requires Tier 1 amendment (7-of-9, 180-day timelock). Content within the articles may be amended by ordinary process subject to the existing Tier classifications of each clause.\n\n---\n\n### P-035 \u2014 Founding Group Corrigibility and Epistemic Humility\n\n**Threat addressed:** founding group capture / Babel-risk (structural overconfidence)\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Philosophical Preamble (closing paragraph) and \u00a70A (Moral Scope, Spiritual Limits, and Stewardship Orientation)\n\n**Problem diagnosed:**\nThe Preamble's statement \"If it is wrong, people should be able to show where\" is passive \u2014 it does not explicitly subject the founding group to the same corrigibility requirements it names for administrators. The rhetorical confidence of the document can imply that the design team has solved a problem that only ongoing moral community and dependence on God can sustain. This creates Babel-risk: a system that trusts its own architecture more than it trusts the communities and the God it claims to serve.\n\n**Introduced design:**\n- Preamble: explicit statement that founders are not exempt from the failures named in the document; the founding group must be the first to submit to correction.\n- \u00a70A: explicit statement that the system does not claim to reflect the mind of God; it reflects fallible human judgment that remains open to correction.\n\n**New risks introduced:**\n- Overly humble framing could be exploited to argue that all constitutional protections are provisional. Mitigated: the epistemic humility clauses apply to the founders' judgment about design, not to the dignity floor itself (separately protected by Tier 1 amendment requirements).\n\n**Residual risk:** Founding group may still exercise disproportionate influence during the founding window. The corrigibility clause is a normative commitment, not a structural enforcement mechanism. Structural enforcement is addressed by P-036.\n\n---\n\n### P-036 \u2014 Keyholder Servanthood Duty\n\n**Threat addressed:** amendment lock capture by founding group\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article I \u2014 Rights & Rules (Hard locks section)\n\n**Problem diagnosed:**\nThe 7-of-9 amendment lock protects the dignity floor from bad changes. But the same lock also protects the founders' judgment about what the dignity floor contains. If keyholders act in self-interest \u2014 delaying replacement of founding-era text, blocking challenges to their own authority \u2014 the lock becomes a tool of entrenchment rather than protection.\n\n**Introduced design:**\nExplicit constitutional statement that keyholder authority is custodial, not proprietary; keyholders may not use the lock to entrench founding group power; a qualified independent review body may petition for keyholder replacement when self-interest is demonstrated.\n\n**Dependencies:** The independent review body referenced here is the Federated Ombuds structure defined under P-025.\n\n**New risks introduced:**\n- \"Demonstrable self-interest\" requires interpretation. Mitigated: determination is made by the Federated Ombuds (P-025), not by the keyholders themselves.\n\n**Residual risk:** External pressure on keyholders (coercion, blackmail) is not addressed by internal accountability mechanisms. See P-034 residual risk for the same limitation.\n\n---\n\n### P-037 \u2014 Identity Serves the Person\n\n**Threat addressed:** identity system creep / surveillance expansion\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article II \u2014 Personhood, Identity & Continuity\n\n**Problem diagnosed:**\nAny identity system faces institutional pressure to expand verification requirements, cross-reference databases, and build behavioral profiles over time. Without a mandatory review cycle, \"minimum data for minimum access\" tends to expand into a comprehensive scoring regime.\n\n**Introduced design:**\nMandatory triennial review of identity data use; secondary use requires Article VI deliberative authorization with a published sunset date that cannot be made permanent by administrative action alone.\n\n**New risks introduced:**\n- Review cycles could be gamed or delayed. Mitigated: triennial requirement is constitutional; delay beyond the cycle is a reportable failure under Article VII.\n\n**Residual risk:** Administrative pressure to expand identity data use will recur in each review cycle. The review requirement creates a forcing function but does not eliminate the pressure.\n\n---\n\n### P-038 \u2014 Community Voice in Measurement\n\n**Threat addressed:** T-006 (oracle institutional blindness / measurement capture)\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article III \u2014 Real Capacity & Reserves\n\n**Problem diagnosed:**\nThe oracle quorum defends against manipulation but not against shared institutional blindness \u2014 the systematic tendency of measurement systems to reflect the assumptions of the institutions that design them rather than the lived reality of affected communities.\n\n**Introduced design:**\nConstitutional community challenge path: written submission to oracle quorum, mandatory 14-day published response, challenge submissions published alongside official figures.\n\n**Dependencies:** Oracle quorum publication infrastructure must support community submission intake and co-publication.\n\n**New risks introduced:**\n- Challenge system could be flooded with bad-faith submissions. Mitigated: prima facie threshold for mandatory response.\n\n**Residual risk:** Communities with less documentation capacity will use the challenge path less. Outreach and accessibility design are required \u2014 not addressed by this patch alone.\n\n---\n\n### P-039 \u2014 Protection of Pre-Existing Care Networks\n\n**Threat addressed:** institutional crowding-out of voluntary community\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article IV \u2014 Survival\n\n**Problem diagnosed:**\nA comprehensive constitutional delivery floor for survival essentials can inadvertently displace the mutual aid groups, religious food pantries, family networks, and neighborhood care structures that communities depend on \u2014 especially when the delivery system fails.\n\n**Introduced design:**\nConstitutional statement that Article IV is a floor not a monopoly; explicit duty to support pre-existing care networks; affirmation that the constitutional floor protects the conditions for voluntary generosity rather than replacing it.\n\n**New risks introduced:**\n- \"Must not displace\" is a normative commitment difficult to enforce mechanically. Mitigated: Article VII warning system can measure whether voluntary care networks are growing or shrinking post-implementation.\n\n**Residual risk:** Economic logic of consolidated delivery systems tends to crowd out smaller providers regardless of constitutional intent. Periodic measurement and active funding of voluntary-sector infrastructure are required.\n\n---\n\n### P-040 \u2014 Article V Housing Cap Pastoral Revision and Structural Humility\n\n**Threat addressed:** household penalization; Babel-risk structural overconfidence\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article V \u2014 Markets, Commons & Public Finance (housing allocation section; closing paragraph)\n\n**Problem diagnosed:**\n(1) The phrase \"regardless of household composition decisions\" treated a resource constraint as though it were a judgment about family structure. Large families, multigenerational households, and care-intensive arrangements may find the cap hostile if applied without a pastoral presumption of accommodation.\n(2) Article V's closing paragraph presented the five-instrument architecture with confidence that the design prevents exploitation. This exceeds what human institutions can reliably deliver.\n\n**Introduced design:**\n(1) Housing cap language revised: \"fiscal guarantee\" framing retained; pastoral review with strong presumption of accommodation added; \"mercy before procedure\" standard stated.\n(2) Structural humility closing paragraph added: names the limits of structural engineering and requires ongoing community paths to name and correct exploitation.\n\n**New risks introduced:**\n- \"Strong presumption of accommodation\" may be interpreted to override the cap entirely. Mitigated: \"fiscal guarantee\" framing preserved \u2014 the commons does not owe unlimited expansion; the review process applies mercy within real resource constraints.\n\n**Residual risk:** Review panels may apply \"mercy before procedure\" inconsistently across communities. Published review criteria and appeals paths are the mitigation; this patch adds the normative standard.\n\n---\n\n### P-041 \u2014 Recognized-Contribution Audit Requirement\n\n**Threat addressed:** T-008 (elite / professional-contributor capture of civic layer)\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article VI \u2014 Voice, Service Record & Public Decisions (Contribution and capability section)\n\n**Problem diagnosed:**\n\"Verified contribution\" as the basis for civic standing creates systematic pressure to perform contribution in legible, verifiable ways. Contributions that resist easy documentation \u2014 informal care, spiritual leadership, mutual aid, neighborhood presence, parenting \u2014 will be consistently underrepresented in the Service Record eligible pool.\n\n**Introduced design:**\nMandatory biennial audit of the recognized-contribution definition; explicit constitutional statement that informal, spiritual, and pastoral contributions must not be excluded by documentary difficulty alone; 180-day correction requirement when gaps are found.\n\n**Dependencies:** Audit body must be independent of the civic administration it is reviewing \u2014 consistent with Article VII independence requirements.\n\n**New risks introduced:**\n- \"Effect on human flourishing\" as a measurement criterion is harder to verify than documented hours. Mitigated: the audit requirement is about the framework definition, not individual claims.\n\n**Residual risk:** The gap between the ideal (invisible work recognized) and the operational (verification required) will persist. The audit creates a forcing function for closing it over time.\n\n---\n\n### P-042 \u2014 Community Alert Pathway\n\n**Threat addressed:** institutional capture of warning function; prophetic voices blocked\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article VII \u2014 Public Records & Warning Systems\n\n**Problem diagnosed:**\nArticle VII's warning function is defined, funded, and structured by the same apparatus it is meant to watch. Communities affected by systemic failures often see them earlier and more accurately than institutional reviewers \u2014 but currently have no constitutionally protected path to name them.\n\n**Introduced design:**\nConstitutionally protected community alert pathway: low-barrier, optionally anonymous, accessible without legal representation; 30-day acknowledgment requirement; 90-day formal review trigger for prima facie systemic failures; refusal to acknowledge or review is itself a reportable failure.\n\n**Dependencies:** Article VII independence requirement applies \u2014 the body managing community alerts must not be the same body whose performance is being reported.\n\n**New risks introduced:**\n- Alert pathway could be used for political harassment or coordinated false-flag campaigns. Mitigated: prima facie threshold for mandatory review; anonymous alerts published but not automatically elevated without threshold evidence.\n\n**Residual risk:** Power asymmetry between institutional reviewers and community reporters will persist. The pathway lowers the barrier; it does not equalize resources for evidence-gathering.\n\n---\n\n### P-043 \u2014 Logical-Analysis Corpus Corrections\n\n**Threat addressed:** T-001, T-002, T-004, T-007, T-generic (amendment capture, definitional ambiguity, status misrepresentation)\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** ANNEX_AH.md, ANNEX_Y.md, INVARIANTS.md, SPECIFICATIONS.md, Humane_Constitution.md, Patch_Log.md, Threat_Register.md\n\n**Problem diagnosed:**\nSystematic logical analysis identified 18 issues across the corpus: 4 critical (including a Tier 1 amendment architecture paradox and a literal unfilled placeholder), 11 major (internal contradictions, definitional gaps, inconsistent status reporting), and 3 minor (structural tensions and epistemological inconsistencies).\n\n**Introduced design:**\n\n- **ANNEX_AH.md \u00a7AH2 header** \u2014 Updated heading from \"14 Days\" to \"60 Days minimum, per P-020 amendment.\" Heading was not updated when P-020 extended the window.\n- **Patch_Log.md P-014 entry** \u2014 Added parenthetical noting P-020 extended the 14-day challenge window to 60 days minimum.\n- **Threat_Register.md Complete Register Summary** \u2014 Corrected T-001, T-002, T-004, T-007 status from ACTIVE to Active \u2014 unproven to match the dashboard and individual entries.\n- **INVARIANTS.md INV-007** \u2014 Resolved the Tier 1 amendment paradox. \"Unamendable by any in-system process\" is replaced with precise language: Tier 1 is changeable only via the Tier 1 process (7-of-9 keyholder signatures + 180-day timelock, FC-110/FC-111). FC-110 and FC-111 are themselves Tier 1 protected. Changes to the amendment mechanism require H-3 refounding authority. P-014 is permanently closed.\n- **SPECIFICATIONS.md \u00a73.4** \u2014 Replaced \"full constitutional refounding under P-014 procedure\" with Tier 1 amendment process language and H-3 refounding authority reference.\n- **ANNEX_Y.md \u00a7Y5** \u2014 Added: H-3 refounding authority is a full constitutional convention, superseding the closed P-014.\n- **ANNEX_Y.md \u00a7Y4** \u2014 Filled the literal `[ACCEPTABLE_CSM_FAILURE_THRESHOLD]` bracket placeholder with provisional value: 3 verified delivery failures (FC-YT1, pre-launch blocking gate, must be confirmed before operational activation).\n- **SPECIFICATIONS.md \u00a73.3** \u2014 Added caregiver/dependent carve-out to the non-transferability rule, making it consistent with the Constitution's household pooling and delegated spend authority provisions.\n- **SPECIFICATIONS.md \u00a74.2** \u2014 Replaced \"two separate rules\" bridging note with an integration formula: the 300-unit issuance ceiling sets the quarterly stock; the 100-unit weight table caps each individual deployment draw. Sequential constraints, not competing ones.\n- **SPECIFICATIONS.md \u00a74.3** \u2014 Fixed sector ceiling arithmetic justification: reframed from Voice supermajority to Service Record governance panel concentration. Added note that P-008 is PROPOSED and P-025 is the operative ACTIVE authority for the 20% ceiling.\n- **SPECIFICATIONS.md \u00a78** \u2014 Added pre-launch blocking gates note to the Parameter Summary, clarifying that reserved parameters are not design gaps.\n- **Humane_Constitution.md Article V** \u2014 Added operational definitions of \"compounding interest\" (capitalisation-based, includes fee-equivalent traps) and \"household ordinary-life debt\" (personal/family purposes; excludes enterprise debt and voluntary investment instruments).\n- **Humane_Constitution.md Philosophical Preamble** \u2014 Added produced/shared value working test: three concrete examples (land labour, software, enterprise) and an appeal path reference.\n- **Humane_Constitution.md Founding Order** \u2014 Added dignity floor delivery obligation: 2% PFCR cross-boundary allocation minimum, published accounting of unmet commitments in adjacent non-consenting communities.\n\n**New risks introduced:**\n- The provisional CSM failure threshold (3 failures) requires founding commitment confirmation. If not confirmed before activation, the threshold remains provisional \u2014 which is by design (pre-launch blocking gate).\n\n**Residual risk:** Issues 4 (bootstrap circularity), 8 (silence tension), 12 (single-source philosophy), and 18 (structural vs. moral sufficiency tension) are acknowledged as honest philosophical tensions named in the corpus. They are not resolved by this patch; they are monitored as open interpretive questions.\n\n---\n\n### P-044 \u2014 Threat-Strengthening Batch\n\n**Status:** ACTIVE \n**Date:** 2026-05-02 \n**Related threats:** T-001, T-002, T-004, T-005, T-007, T-018, T-019 \n**Core change:** Close mitigation gaps identified by systematic threat survey. Tighten Active \u2014 unproven threats with open gaps, add missing evidentiary standards, and fill operational voids in audit timelines and authority chains.\n\n**Changes included in this patch:**\n\n- **ANNEX_AI.md \u00a74.1** \u2014 Reproduced the T-019 three-criterion evidentiary standards inline (replacing a dangling \"incorporated by reference\" to a deleted prior section). Standards now specify: timing proximity (72-hour window, heightened scrutiny only), proportionality anomaly (disproportionate scope relative to documented need), no documented operational basis (contemporaneous record within 4-hour window). Three-tier outcome logic: all three \u2192 deliberate manufacture; two \u2192 provisional with 48-hour extension; one \u2192 logged only. Conservative default: flag stays active during pendency.\n- **ANNEX_AP.md \u00a7AP1** \u2014 Added cap-reset audit procedure: Federated Ombuds as responsible authority; 7-day open window; 30-day findings deadline; evidentiary standard (clear and convincing evidence); cap-counter freeze during audit; two outcome paths (reset to zero or count unchanged). Closes T-018 cap-reset void.\n- **ANNEX_AB.md \u00a7AB2** \u2014 Added FC-010 calibration methodology requirement: Article VII annual audit must publish the empirical/modelling basis for leakage thresholds, revision triggers, and methodology changes. Thresholds not documented in a published audit are not valid enforcement baselines. (T-001)\n- **ANNEX_AB.md \u00a7AB3** \u2014 Added invisible-work backstop: P-041 biennial recognized-contribution audit named as enforcement backstop for \u00a7AB3; findings requiring correction must be incorporated within 180 days; deficient contribution scores suspended from Voice/Service Record inputs until corrected. (T-004)\n- **ANNEX_AB.md \u00a7AB5** \u2014 Added registry administration clause: Federated Ombuds as custodian; no unilateral definition authority; Tier 2 amendment pathway; annual public review window; prima facie disputes forwarded to CRP. (T-007)\n- **ANNEX_AK.md** \u2014 Promoted the AED commitment architecture and later superseded FC-140 anchors. Current FC-140 values are target \u22642%, upper bound \u22645%, trigger \u22653% per quarter; see `/founding/commitments.md` and the Parameter Calibration Register. (T-002 / P-016)\n- **README.md** \u2014 Updated stale patch counts: 31\u219240 total, 16\u219225 active (two locations).\n- **ANNEX_Y.md \u00a7Y7** \u2014 Filled `[RESERVE_WINDOW_DAYS]` placeholder with provisional value: 90 days (FC-YT2, pre-launch blocking gate).\n- **CLAUDE.md** \u2014 Corrected \"Provenance_Map.md is planned\" \u2192 \"serves as\" (file already exists).\n- **Patch_Log.md P-005** \u2014 Advanced from PROPOSED \u2192 ACTIVE: ANNEX_AC1 design is complete; residual risks (sub-panel capture, throughput theater) are acknowledged and monitored.\n\n**New risks introduced:** This batch promoted statuses and bound provisional fraud-rate anchors, and that introduces residual risk. (1) Premature reliance \u2014 readers may treat the promoted statuses (e.g. P-005 advanced to ACTIVE) as field-tested rather than designed-and-monitored. (2) Parameter confusion \u2014 later FC-140 values supersede this batch's older anchor language and may still be mistaken for proven or evidence-backed thresholds. (3) Calibration drift \u2014 anchors set before pilot confirmation can drift or be quietly normalized as \"the number\" before any pilot evidence validates them. Mitigated by: the parameter register, pre-launch blocking gates, and the residual-risk note below.\n\n**Residual risk:** FC-140 through FC-145 have bound starting values, while FC-146 through FC-150 remain pre-launch commitments pending pilot data and founding adoption. P-016 remains PROPOSED / pre-ratification until the founding coalition confirms rate targets after first-year pilot evidence.\n\n---\n\n### P-045 \u2014 Threat-Mitigation Batch\n\n**Threats addressed:** T-001, T-002, T-004, T-007, IC-004 \n**Status:** ACTIVE | **Priority:** Critical \n**Date:** 2026-05-02\n\n**Constitutional text:** ANNEX_AB.md (\u00a7AB2, \u00a7AB3, \u00a7AB5), ANNEX_AK.md (\u00a77, \u00a78), ANNEX_AH.md (\u00a7AH5.1)\n\n**Problem diagnosed:**\nFive critical threats remained at Active \u2014 unproven status with specific unresolved gaps: T-001 lacked threshold derivation logic (arbitrary numbers); T-002 had no procedural protection for excluded persons before rate targets are formally bound; T-004 had no enumerated floor for invisible/care work; T-007's registry started empty (first-mover capture window); IC-004 had no recovery path after P-013 suspension.\n\n**Introduced design:**\n\n- **ANNEX_AB.md \u00a7AB2** \u2014 Added enforcement-capacity derivation formula: FC-010 thresholds are derived from minimum detectable enforcement rate (N \u00f7 P). FC-010 3% = 2\u00d7 min-detectable rate; 7% = 5% supply-harm threshold. Audit participation designated as a qualified civic duty; resourcing limitations cannot justify raising thresholds. (T-001)\n- **ANNEX_AB.md \u00a7AB3** \u2014 Added enumerated contribution floor: six founding categories (primary caregiving, elder care, mutual aid, spiritual community leadership, unpaid household management, informal health work) with burden reversal. Self-attestation accepted; disproof burden on system. Extension via Tier 2; removal requires Tier 1 + impact assessment. (T-004)\n- **ANNEX_AB.md \u00a7AB5** \u2014 Added founding seed list: 14 Tier 2 protected terms (survival, survival floor, personhood, Essential Access, Flow, Voice, Service Record, non-convertibility, coercion, scarcity, contribution, identity, dignity, capacity) locked at founding. Adversarial review requirement before ratification. (T-007)\n- **ANNEX_AK.md \u00a77** \u2014 Added Asymmetric Default Rule: system bears burden of proof for all exclusion decisions; independent time-bounded review (14-day deadline) required before any Essential Access exclusion is final; exclusions without timely determination automatically reversed. (T-002)\n- **ANNEX_AK.md \u00a78** \u2014 Added Independent Identity Auditor mandate: quarterly public reports on fraud/exclusion rates per tier and vulnerable category; absence-of-data is a reportable failure; two consecutive quarters without data triggers Federated Ombuds referral; IIA appointment/removal requires Tier 2 amendment. (T-002)\n- **ANNEX_AH.md \u00a7AH5.1** \u2014 Replaced IC-004 governance-gap note with Dignity-Only Continuity Mode specification: CSM continues; governance suspended; 180-day trigger opens re-founding petition window (500 joint signatories to submit; 1,000 attestations to advance); P-014 non-precedent status unaffected; CSM floor cannot be suspended. (IC-004)\n\n**New risks introduced:**\n- The founding seed list authors own the semantic baseline permanently \u2014 mitigated by the mandatory adversarial review requirement before ratification.\n- The 14-day independent review deadline for identity exclusions requires review infrastructure to be operational at launch \u2014 this is a pre-launch blocking gate.\n- The 180-day dignity-only continuity period may be too long for urgent governance needs \u2014 mitigated by the automatic petition window at 180 days and the Federated Ombuds continuing to operate throughout.\n\n**Residual risk:** T-001, T-002, T-004, and T-007 remain Active \u2014 unproven pending pilot data confirmation. IC-004 is Active \u2014 unproven \u2014 the governance gap is now specified with a fallback mechanism but has not been field-tested.\n\n---\n\n### P-046 \u2014 Evidence and Capture Hardening Suite\n\n**Threats addressed:** Multiple control-plane and evidence-status risks, including T-005, T-008, T-016, T-017, T-022, T-023, T-025, T-026, T-027, and implementation-drift risk.\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-04\n\n**Constitutional text:** [Humane_Constitution.md \u00a70 and Article VII](../constitution/Humane_Constitution.md); [INVARIANTS.md \u00a7 Invariant Violation Detection](../constitution/INVARIANTS.md); [Acceptance_Protocol.md \u00a7 Pre-Launch Blocking Gates](../constitution/Acceptance_Protocol.md); [ANNEX_AH.md \u00a7 AH2](../annexes/ANNEX_AH.md); [ANNEX_C.md \u00a7 C-3/C-5](../annexes/ANNEX_C.md); [ANNEX_AO.md Part 1/2](../annexes/ANNEX_AO.md)\n\n**Problem diagnosed:**\nThe project had strong mechanisms and evidence packages, but seven proof surfaces remained too implicit: implementation drift, collapse-state traceability, parameter calibration, capture metrics, reusable abuse patterns, claim-evidence levels, and founding legitimacy. Without explicit artifacts, public language could outrun proof and technical compliance could be mistaken for legitimate activation.\n\n**Introduced design:**\n\n- **Implementation Drift Audit Package** \u2014 adds tests for reproducible hashes, append-only log behavior, publication-channel divergence, startup refusal, key custody, timelock response, and supply-chain bypass.\n- **Collapse-State Crosswalk** \u2014 maps every threat to Survival-Trade Bind, Power-Wealth Convergence, Static-Advantage Loop, and control-plane failure.\n- **Parameter Calibration Register** \u2014 tracks high-risk FC values, current status, rationale, capture route, evidence needed, revision trigger, and governing documents.\n- **Capture Dashboard Specification** \u2014 defines privacy-preserving public indicators for civic role concentration, Ombuds independence, definition capture, procurement/legal-wrapper capture, identity gatekeeping, and implementation drift.\n- **Abuse Case Library** \u2014 introduces reusable bad-actor patterns so patch intake and closure must test against plausible corruption routes and false reassurances.\n- **Evidence Ladder** \u2014 defines claim-strength levels, upgrade rules, downgrade rules, and forbidden status jumps.\n- **Founding Legitimacy Dossier** \u2014 defines the evidence burden for founding authority: scope, conflicts, notice, deliberation, consent, objections, exit rehearsal, dignity-floor non-coercion, founder sunset, and independent review.\n- **Architecture files** \u2014 implementation binding and drift chain now distinguish Tier 1 state hashing from implementation attestation records.\n- **Constitution and invariants** \u2014 added narrow cross-references making founding legitimacy and implementation drift public evidence duties.\n\n**New risks introduced:**\n- The new registries can become bureaucratic compliance artifacts if not tied to real tests. Mitigated by Evidence Ladder downgrade rules and Abuse Case Library false-reassurance fields.\n- Capture dashboards can become ranking tools. Mitigated by Article VII privacy language and dashboard rule that ordinary persons may not be ranked.\n- Implementation attestations can create false technical confidence. Mitigated by explicit claim boundaries in the Implementation Drift Audit Package.\n\n**Residual risk:** These upgrades make proof obligations clearer; they do not prove the system works. The highest residual risks remain founding consent theater, keyholder social capture, dashboard gaming, parameter arbitrariness, and technically valid but hostile amendment.\n\n---\n\n### P-047 \u2014 Essential-Sector Conglomerate Transition\n\n**Threats addressed:** T-025, T-026, T-027, T-028, external dependency capture, procurement capture, medicine-access capture, and essential-sector refusal risk.\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-04\n\n**Constitutional text:** [ANNEX_AT.md \u00a7 AT6.5 and AT8](../annexes/ANNEX_AT.md); [Capture_Dashboard_Specification.md \u00a7 Money, Procurement, And Legal Wrapper Capture](./Capture_Dashboard_Specification.md); [Conglomerate_Transition_Dossier.md](./Conglomerate_Transition_Dossier.md)\n\n**Problem diagnosed:**\nThe external-trade and anti-rent architecture named supply-chain dependency, public-return/source-base capture, and legal-wrapper risk, but it did not yet explain how incumbent oil, energy, medicine, logistics, and PBM-style medicine-access conglomerates would operate under the system. Without a sector-specific transition doctrine, the project risked relying on moral persuasion while firms with essential chokepoints could rationally leave, litigate, lobby, retaliate, or route control through foreign affiliates.\n\n**Introduced design:**\n\n- **Conglomerate Transition Dossier** \u2014 defines the operating rule: firms may earn Flow for verified production, reliability, transition work, innovation, and public-interest delivery; they may not convert survival chokepoints into rule authority or survival leverage.\n- **Numeric evidence anchors** \u2014 records real-world scale indicators: energy investment, fossil dependence, petroleum import/export flows, PBM prescription concentration, health spending, public procurement scale, lobbying spend, and beneficial-ownership risk.\n- **Sector models** \u2014 distinguishes oil/fossil firms, energy utilities/grid operators, and medicine manufacturers/PBMs, with allowed activity, prohibited leverage, compliant incentives, and refusal fallback.\n- **Refusal survivability tests** \u2014 requires largest-supplier exit modeling, reserve drawdown duration, medicine stockpile audit, compliant-bidder count, beneficial-owner trace, lobbying/capture exposure, and public fallback capacity before stronger claims.\n- **Annex AT interface** \u2014 adds AT6.5 so essential-sector conglomerates are treated as survival-leverage actors when their refusal, litigation, patent hold, supply-chain delay, or standards-body campaign can materially impair the CSM floor.\n- **Capture dashboard additions** \u2014 adds essential-sector refusal exposure and lobbying/capture exposure by contract value.\n\n**New risks introduced:**\n- Public procurement could overpay incumbents to keep them inside the system, creating disguised bailouts. Mitigated by compliant-margin tests, public fallback modeling, and beneficial-owner trace requirements.\n- Refusal drills could reveal sensitive supply-chain weaknesses. Mitigated by public class-level reporting with restricted operational detail where disclosure would improve attack execution.\n- Regulated utility treatment could entrench incumbents. Mitigated by performance metrics, public receiver authority, distributed/community fallback, and capture dashboard review.\n\n**Residual risk:** This patch makes the hard bargain explicit; it does not prove that fallback capacity can be built fast enough. The largest unresolved question is numeric: how many days can people keep eating, heating, traveling, communicating, and receiving medicine if the largest incumbent in a category says no?\n\n---\n\n### P-048 \u2014 Essential-Sector Refusal Operationalization\n\n**Threats addressed:** T-025, T-026, T-027, T-028, external dependency capture, medicine-access capture, grid/logistics chokepoint risk, and essential-sector refusal leverage.\n**Patch relation:** Operationalizes P-047.\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-04\n\n**Constitutional text:** [ANNEX_AT.md \u00a7 AT2.4 and AT6.5](../annexes/ANNEX_AT.md); [Parameter_Calibration_Register.md \u00a7 Seed Register](./Parameter_Calibration_Register.md); [Essential_Sector_Refusal_Test_Package.md](./Essential_Sector_Refusal_Test_Package.md); [05_life_and_rights.md](../public/05_life_and_rights.md)\n\n**Problem diagnosed:**\nP-047 defined the essential-sector conglomerate transition doctrine, but the project still needed operational drills, parameter rows, tighter Annex AT triggers, public-facing explanation, and a broader evidence pass for medicine patents, shortages, grid bottlenecks, fossil transition risk, and utility regulation.\n\n**Introduced design:**\n\n- **Essential-Sector Refusal Test Package** \u2014 adds largest oil/fuel supplier exit, largest medicine supplier/PBM refusal, and largest grid/logistics delay drills, with reserve drawdown, fallback capacity, compliant-bidder count, capture exposure, evidence packet, pass/fail, and residual-risk requirements.\n- **FC-194 through FC-201** \u2014 adds reserved/draft calibration rows for essential fuel reserves, medicine stockpiles, supplier concentration, public fallback deadlines, procurement concentration, PBM/intermediary separation, logistics redundancy, and essential data/claims portability.\n- **Annex AT tightening** \u2014 defines foreign-affiliate routing, survival-leverage actors, public receiver authority, and compulsory licensing/public manufacturing triggers for CSM-designated medicines.\n- **Public explainer** \u2014 adds \"How Big Companies Work Here\" for non-technical readers: profit remains allowed; hostage power does not.\n- **External evidence expansion** \u2014 adds sources for pharma patent-listing/evergreening risk, drug shortages, transformer/grid supply-chain bottlenecks, fossil transition/stranded-asset exposure, and utility regulation.\n\n**New risks introduced:**\n- Receiver authority and compulsory licensing can be abused if triggered on weak evidence. Mitigated by functional trigger definitions, Article VII publication, compensation/public-use standards, and refusal-drill evidence packets.\n- Public refusal drills can reveal operational weaknesses. Mitigated by class-level public reporting and justified redaction of exploit-enabling details.\n- Parameter draft anchors may be mistaken for proven values. Mitigated by reserved status and the Parameter Calibration Register's revision-trigger discipline.\n\n**Residual risk:** The package makes essential-sector refusal testable; it does not supply the physical reserves, manufacturing capacity, alternate operators, legal judgments, or treaty capacity needed to pass. The decisive future evidence remains sector-by-sector: how long the CSM floor holds when the largest incumbent refuses.\n\n---\n\n### P-049 \u2014 Evidence-Gap Bridge Alignment\n\n**Threats addressed:** Multiple evidence-gap and status-drift risks across founding legitimacy, essential-sector refusal, implementation drift, public readiness, and evidence-register consistency.\n**Status:** ACTIVE | **Priority:** High\n**Date:** 2026-05-04\n\n**Constitutional text:** No new constitutional text. Governance and public-readiness integration only.\n\n**Problem diagnosed:**\nRecent hardening work created stronger test artifacts, but the live dashboards still left some gaps implicit. The Founding Legitimacy Dossier now has an artifact-status register, and the Essential-Sector Refusal Test Package now defines sector drills, but several reader-facing and governance trackers still described the gaps in older, broader language.\n\n**Introduced design:**\n\n- **Hardening Queue alignment** \u2014 connects essential-sector refusal to the dedicated test package and reframes founding legitimacy around artifact production, not only design existence.\n- **Open Problems bridge** \u2014 updates essential-sector and founding rows so required proof points include the newest refusal drills, artifact-status register, medicine/PBM refusal path, grid/logistics delay path, and parameter/capture links.\n- **Pilot Roadmap bridge rules** \u2014 adds explicit Phase 9 and Phase 11 pass boundaries: paper capacity and clean technical integrity cannot substitute for refusal evidence or legitimate founding artifacts.\n- **Public readiness bridge** \u2014 adds plain-language warnings for essential-company refusal and founding-vote theater.\n- **Evidence-gap language** \u2014 narrows source gaps so the project asks for drill outputs and founding artifacts, not only general outside analogies.\n\n**New risks introduced:**\n- Cross-register alignment can create the appearance of progress without real evidence. Mitigated by repeating that these are bridge rules and evidence packets, not passed pilots.\n- More references can increase reader burden. Mitigated by putting the strongest public framing in the Public Readiness Guide and keeping detailed proof duties in governance registers.\n\n**Residual risk:** P-049 improves traceability; it does not close the underlying gaps. The unresolved work remains physical refusal capacity, real founding artifacts, independent review, and pilot evidence.\n\n---\n\n### P-053 \u2014 Whistleblower Protection and Anti-Retaliation Protocol\n\n**Threats addressed:** Insider retaliation risk against community alert reporters and Service Record audit requesters; Priya-type attack path (retaliatory record modification by named respondent before investigation completes).\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-07\n\n**Constitutional text:** [ANNEX_AW.md](../annexes/ANNEX_AW.md); Article VII (reporter protection clause)\n\n**Problem diagnosed:**\nThe community alert pathway (Article VII) and Service Record audit mechanism (Article VI) require ordinary people to name wrongdoing by administrators. Without explicit protection, a corrupt administrator can use their remaining administrative access to modify the reporter's Service Record, flag contributions \"under review,\" and revoke civic eligibility before any investigation completes. The Priya vignette in the Fairness Vignette Library documented this exact attack path. A system that cannot protect its own reporters will quickly teach everyone not to report.\n\n**Introduced design:**\n\n- **Administrative freeze on filing:** named respondents' write access to the reporter's records is automatically suspended from the moment a report is filed.\n- **Automatic escalation of retaliatory actions:** any attempted modification during the protected period is rejected, logged, and escalated to the Federated Ombuds within 24 hours.\n- **\"Under review\" flag governance:** flags require independent reviewer appointment (not self-authorization), evidence-based grounds, 45-day maximum duration, and automatic removal on expiry without finding.\n- **Restoration on exoneration:** retaliatory modifications are reversed; lost civic roles are restored or queued.\n- **Constitutional amendment:** reporter protection clause added to Article VII.\n\n**New risks introduced:**\n- The administrative freeze could be triggered by bad-faith reports. Mitigated by: the freeze affects only write access (not the respondent's own records), bad-faith reports are subject to the same accountability process as any false claim, and the Federated Ombuds reviews the freeze on filing.\n- Coordinated retaliation by multiple actors not individually named. Named as a residual risk in Annex AW \u00a7AW5; monitored through the community alert pathway.\n\n**Residual risk:** Informal retaliation (social pressure, community reputation) cannot be prevented by administrative controls. Culture and enforcement of the broader anti-capture provisions are the only long-term check.\n\n---\n\n### P-054 \u2014 Confidential Enrollment and Safety-Identity Protocol\n\n**Threats addressed:** Identity disclosure as a safety vector for domestic violence survivors, trafficking victims, and persons in safety-compromised situations; Elena-type attack path (wallet identity creates tracking vector for abuser via compromised administrator).\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-07\n\n**Constitutional text:** [ANNEX_AX.md](../annexes/ANNEX_AX.md); Article II (safety-shielded enrollment clause)\n\n**Problem diagnosed:**\nThe one-person-one-wallet requirement links identity to an administrator-visible record. For persons in documented safety situations, this creates a tracking vector for abusers, traffickers, or persecutors who have access to administrative channels. The Elena vignette documented this gap. The existing Asymmetric Error Doctrine (Annex AK) treats this as a calibration problem; P-054 treats it as a safety override \u2014 for persons in documented danger, the safety interest overrides the normal fraud/exclusion calibration.\n\n**Introduced design:**\n\n- **Safety-shielded enrollment pathway:** legal identity linked to wallet through a cryptographically sealed record; all location and identity fields suppressed from administrator-visible database.\n- **Address-blind delivery:** Essential Access delivered through anonymous pickup points, trusted community organizations, or encrypted digital channels without geolocation.\n- **Emergency enrollment:** 30-day temporary access on credible assertion without documentation, with support pathway to full safety-shielded enrollment.\n- **Documentation-free emergency path:** single-use 72-hour tokens for persons with no documentation, with connection to enrollment support organizations.\n- **Sealed record access governance:** sealed records accessible only by court order or Federated Ombuds finding; access requests logged and reported to the enrolled person within 72 hours.\n- **Constitutional amendment:** safety-shielded enrollment clause added to Article II.\n\n**New risks introduced:**\n- Emergency enrollment without documentation could be used for fraud. Mitigated by: 30-day window with transition requirement, the AK fraud-rate monitoring catches aggregate fraud signals, and false safety assertions are subject to accountability.\n- Sealed records could be accessed under pretextual court orders. Mitigated by: access limited to credible fraud investigation (not immigration enforcement or administrative convenience), Ombuds review authority, and notification to the enrolled person on any access request.\n\n**Residual risk:** Persons whose abuser controls their access to enrollment points cannot use this pathway. Long-term immigration or citizenship questions for undocumented persons are not resolved by AX \u2014 Essential Access continuity is provided, not immigration status.\n\n---\n\n### P-055 \u2014 Delivery Sufficiency Standard\n\n**Threats addressed:** Gap between constitutional guarantee of Essential Access and operational delivery for incarcerated persons, non-enrolled communities, persons unable to use digital interfaces, and persons in non-consenting jurisdictions.\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-07\n\n**Constitutional text:** [ANNEX_AY.md](../annexes/ANNEX_AY.md); Article IV (delivery sufficiency obligation clause)\n\n**Problem diagnosed:**\nMultiple vignettes in the Fairness Vignette Library showed that the constitutional guarantee of Essential Access does not translate to operational delivery for several populations (Miriam, Ray, Amara, Yoder Community). The gap between the guarantee and the delivery mechanism was unnamed, untracked, and unaccountable. A constitutional guarantee that does not reach the people it covers is not a guarantee \u2014 it is a statement.\n\n**Introduced design:**\n\n- **Delivery Sufficiency Standard (AY1):** four conditions that must all be met for a population to be considered operationally covered: delivery path exists, is accessible, is monitored, and has an accountable responsible party.\n- **Delivery Sufficiency Register:** quarterly-published accounting of populations not yet meeting the standard, with gap type, current status, commitment, timeline, responsible party, and evidence link.\n- **Founding Register entries:** seven populations entered at founding with open commitments.\n- **Cross-boundary delivery operationalization:** quarterly accounting of the 2% PFCR cross-boundary allocation, flow to intermediary organizations, populations reached, no-enrollment-coercion rule.\n- **Register removal standard:** removal requires responsible party certification, Federated Ombuds independent verification, and published verification \u2014 not just administrative assertion.\n- **Constitutional amendment:** delivery sufficiency obligation clause added to Article IV.\n\n**New risks introduced:**\n- The Register could become a bureaucratic accounting exercise that satisfies the letter while missing the spirit. Mitigated by: the AY1 standard requires accessibility without extraordinary effort (not just existence of a path), and Federated Ombuds escalation authority for missed timelines.\n- Cross-boundary delivery through intermediary organizations could be used to build dependency relationships. Mitigated by: the no-enrollment-coercion rule (\u00a7AY3.3) prohibits conditioning delivery on future enrollment.\n\n**Residual risk:** The Register creates accountability; it does not create capacity. Physical infrastructure, institution enrollment, and intermediary organization funding must follow independently. P-055 makes the gap visible and governed; it does not close the gap operationally.\n\n---\n\n## P-050 through P-052 \u2014 CASP, Constitutional Integrity Panel, and Ombuds Manufacture Standard\n\n### P-050 \u2014 Compliant Alternative Supplier Pre-Registration (CASP)\n\n**Threat addressed:** T-028\n**Status:** ACTIVE | **Priority:** Critical | **Annex:** ANNEX_AT \u00a7AT6.6\n\n- **Introduced design:** Mandatory pre-registration of backup suppliers with automatic-activation contracts before any essential-sector procurement renewal. Procurement authorities must calculate and publish the gap-window \u2014 the period between a primary supplier exit and backup supplier operational readiness \u2014 before each renewal cycle. Any drill classified as drill-secure requires adversarial observation by at least one party outside the procurement authority's organizational chain.\n- **Dependencies:** Essential-sector supplier registry, automatic-activation contract templates approved by the CRP, gap-window calculation methodology published and P-004-protected.\n- **New risks introduced:** Pre-registered backup suppliers could become nominal alternatives with no real capacity. Mitigated by: adversarial observation requirement for drill-secure drills, and gap-window publication creates accountability for calibration accuracy.\n- **Residual risk:** Supplier pre-registration does not guarantee backup capacity is operationally ready in all stress conditions. Gap-window calculation relies on supplier self-reporting, which is subject to optimism bias.\n\n---\n\n### P-051 \u2014 Constitutional Integrity Panel (CIP)\n\n**Threat addressed:** T-022 \n**Status:** ACTIVE | **Priority:** Critical | **Annex:** ANNEX_AM \u00a7AM8\n\n- **Introduced design:** 7-member independent body with staggered terms. Funding is constitutionally fixed at 0.01% of annual Flow issuance \u2014 not subject to legislative appropriation and not reducible by the governing coalition. Appointment requires multi-body sign-off drawn from sources that cannot be simultaneously controlled by a single governing coalition. 5-of-7 quorum required for Tier 1 ratification. Automatic review triggers fire when institutional vacancies exceed 90 days or when mandatory publication lapses exceed 30 days, without requiring the governing coalition to initiate.\n- **Dependencies:** Founding appointment of the initial 7-member panel before constitutional activation. Staggered term schedule published at founding. Flow issuance tracking system for the 0.01% funding calculation.\n- **New risks introduced:** Multi-body appointment requires identifying genuinely independent appointing bodies at founding, which may be difficult in contexts with thin civil society. Mitigated by: P-020 oppose-coalition nomination pathways provide analogous alternatives.\n- **Residual risk:** Constitutional entrenchment of CIP funding can still be dismantled by a sufficiently determined supermajority willing to use the Tier 1 amendment process. The CIP raises the political cost; it does not make repeal impossible.\n\n---\n\n### P-052 \u2014 Federated Ombuds Deliberate-Manufacture Standard\n\n**Threat addressed:** T-019 \n**Status:** ACTIVE | **Priority:** High | **Annex:** ANNEX_AI \u00a74.12\n\n- **Introduced design:** Pre-committed 4-criterion assessment that the Ombuds Plenum must apply when evaluating whether a demand-context flag was deliberately manufactured: (1) timing \u2014 whether the triggering enforcement action was initiated within a sentinel indicator movement window; (2) proportionality \u2014 whether the enforcement action's scope is proportionate to the stated enforcement basis; (3) prior basis \u2014 whether enforcement basis documentation existed before the sentinel indicator moved; (4) knowledge \u2014 whether the enforcing authority had actual or constructive knowledge of sentinel indicator status at initiation. The Plenum must reach a decision within 24 hours. When evidence is inconclusive across all four criteria, the asymmetric default favors PCRP activation rather than flag maintenance. A manufactured-flag finding is automatically referred to the Enforcement Panel, not held within the Ombuds system.\n- **Dependencies:** Federated Ombuds fully constituted per P-025 (\u22654 sub-Ombuds seated). Cross-register timing monitor operative (Annex AI \u00a73.3). Enforcement Panel charter must include manufactured-flag referrals as a defined intake category.\n- **New risks introduced:** 24-hour decision window creates pressure that may produce errors in ambiguous cases. Mitigated by: asymmetric default toward PCRP activation when inconclusive, which is the conservative failure mode.\n- **Residual risk:** The 4-criterion assessment cannot definitively establish intent. A sophisticated actor who sequences enforcement actions to avoid triggering all four criteria simultaneously can manufacture a flag while technically passing the assessment. Accepted as bounded leakage \u2014 the standard raises the operational complexity and coordination cost of deliberate manufacture without eliminating it.\n\n---\n\n### P-056 \u2014 Open-Access Survival Floor (Two-Tier Identity Model)\n\n**Status:** PROPOSED \n**Tier:** Tier 2 \n**Threat addressed:** T-002 (identity exclusion of vulnerable persons); INV-001 operationalization \n**Annex:** ANNEX_AK \u00a7AK8 \n**Summary:** Separates non-duplication (required for CSM) from identity verification (required only for above-floor services and civic instruments). Defines Tier 0 (open-access/pseudonymous survival floor) and Tier 1 (identity-gated services). Establishes civic accountability norm: the system trusts citizens because there is enough for everyone. Aggregate anomaly detection replaces individual surveillance at the survival tier. Token mechanism specification delegated to ANNEX_AZ \u00a7AZ2 as a pre-operational prerequisite.\n\n---\n\n### P-057 \u2014 Pilot Site Selection Criteria\n\n**Threat addressed:** Pilot farming (ACL-011), founding consent theater (ACL-010)\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Pilot_Site_Selection_Criteria.md](./Pilot_Site_Selection_Criteria.md)\n\n**Summary:** Defines required, disqualifying, and preferred characteristics for pilot site selection, including Phase 1 capital reference ranges. Prevents friendly-site selection from producing misleading pilot evidence and blocks sites where consent conditions or jurisdictional conflicts cannot be met.\n\n---\n\n### P-058 \u2014 Jurisdiction Interface Clause\n\n**Threat addressed:** Implementation drift (T-016), constitutional void under external law\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Jurisdiction_Interface_Clause.md](./Jurisdiction_Interface_Clause.md)\n\n**Summary:** Establishes three-layer jurisdiction interface; defines RAC as Layer 1; specifies matters governed by external law; pre-enrollment grace window; retaliation prohibition. Ensures the Humane Constitution operates coherently within, alongside, and\u2014where necessary\u2014in tension with external legal systems.\n\n---\n\n### P-059 \u2014 Vulnerable Population Consent Protocol\n\n**Threat addressed:** Founding consent theater (ACL-010), T-027 (dignity floor leverage)\n**Status:** PROPOSED | **Priority:** Critical\n**Creates:** [docs/governance/Vulnerable_Population_Consent_Protocol.md](./Vulnerable_Population_Consent_Protocol.md)\n\n**Summary:** Defines ICA structure, 30-day cooling-off, teach-back verification, non-waivable exit rights, and pre-recruitment prerequisites for VPCP-scope populations (homeless, justice-exiting, unemployed, disability, elder, refugee). Requires ICA staffed and exit support fund pre-capitalized before any VPCP-scope recruitment begins.\n\n---\n\n### P-060 \u2014 Founding Team Composition Standard\n\n**Threat addressed:** Keyholder social capture (ACL-005), bureaucratic elite formation (T-008)\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Founding_Team_Composition_Standard.md](./Founding_Team_Composition_Standard.md)\n\n**Summary:** Defines founding team composition floor, disqualifying conflicts, 9-seat keyholder allocation, founder sunset rules (FS-1 through FS-7), and Perpetual Humility Review. Seats 3\u20138 nominated by civil-society organizations approved by the adversarial panel member, not selected by the founding team.\n\n---\n\n### P-061 \u2014 Founding Capital Framework\n\n**Threat addressed:** Procurement shell capture (ACL-007), power-wealth convergence\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Founding_Capital_Framework.md](./Founding_Capital_Framework.md)\n\n**Summary:** Defines phase capital targets, 20%/30% concentration limits, Capital Steward structure, constitutional primacy clause, government walk-away rule, CLT land structure, and wind-down reserve. Capital Steward must be independent of the founding team; selection precedes first capital commitment.\n\n---\n\n### P-062 \u2014 Pilot Timeline Framework\n\n**Threat addressed:** Pilot farming (ACL-011), founding consent theater (ACL-010)\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Pilot_Timeline_Framework.md](./Pilot_Timeline_Framework.md)\n\n**Summary:** Five-track parallel timeline with critical-path gates; three recruitment windows; phased occupancy sequence; failure contingency requiring Resident Transition Protocol before Cohort 1. Track A (governance/legal), Track B (infrastructure), Track C (capital), Track D (community/consent), Track E (technology) must all clear defined gates before enrollment opens.\n\n---\n\n### P-064 \u2014 Compliance-Masked Refusal Hardening\n\n**Threat addressed:** T-028\n**Status:** ACTIVE | **Priority:** Critical\n\nThe essential-sector refusal package already tested open exit, medicine/PBM refusal, and grid/logistics delay. The remaining P0 gap was subtler: an incumbent can stay formally compliant while degrading actual delivery through slow paperwork, data withholding, PBM access friction, standards-body delay, affiliate fallback capture, workforce poaching, selective regional degradation, litigation, or concession pressure.\n\n- **Introduced design:** Adds compliance-masked refusal as a named refusal lane in the Essential-Sector Refusal Test Package. Formal compliance is no defense when CSM delivery, CASP activation, fallback control transfer, patient continuity, vulnerable-cohort continuity, or reserve activation fails in practice.\n- **Medicine hardening:** Requires complete access paths, not merely alternate suppliers: manufacturer/API, distributor, pharmacy/specialty pharmacy, claims/formulary data, cold chain, prescribing interface, appeal route, and patient-support path. Adds patient-continuity floor and medicine metrics for time-to-fill, missed doses, PA clock breaches, formulary overrides, affiliated routing, substitution harm, and vulnerable-cohort continuity.\n- **Grid/logistics hardening:** Adds hidden compliance variants for partial restoration, standards objections, data migration delay, workforce poaching, affiliate substitution, and regional degradation. Adds transfer-control metrics for dispatch, routing, warehouse, outage, grid, fleet, inventory, credentialing, emergency data access, full operating package access, and workforce independence.\n- **Dashboard integration:** Adds compliance-masked refusal exposure to the Capture Dashboard and threshold anchors. Watch and active-capture-signal thresholds now cover data/control-system export delay, standards obstruction, PBM access friction, affiliate fallback correlation, workforce poaching, legal delay beyond 14 days, concession requests, vulnerable-cohort failure, CASP blockage, and fallback control-transfer failure.\n- **Evidence integration:** Updates T-028 in the Threat Register and Threat Resolution Matrix, Phase 9 of the Pilot Evidence Roadmap, the Claims and Evidence Register, Hardening Queue, Conglomerate Transition Dossier, and Annex AT CASP independence language.\n- **New risks introduced:** The metric can over-classify genuine operational difficulty as strategic refusal. Mitigated by independent clearance for legitimate delay, two-source confirmation for degradation periods under Annex AT, and affected-population evidence rather than inference from paperwork alone.\n- **Residual risk:** Sophisticated incumbents can distribute obstruction below individual thresholds, especially through informal standards influence, contractor labor markets, insurer/lender pressure, and patient-level administrative friction. The control improves detectability; it does not create physical capacity, independent staff, data escrow, or medicine supply by itself.\n\n---\n\n### P-065 \u2014 CIP Vacancy-Starvation Hardening\n\n**Threat addressed:** T-022\n**Status:** ACTIVE | **Priority:** Critical\n\nThe active CIP design made hostile successor hollowing visible but still had a load-bearing failure mode: a successor government could let CIP seats expire, keep the panel below quorum, delay dashboard publication, and then argue that absent ratification could not block later action. This patch makes vacancy itself self-repairing and makes silence a defect, not consent.\n\n- **Introduced design:** CIP vacancies must be published within 7 days. Ordinary appointing sources must transmit a qualified nominee within 30 days; fallback nomination activates at 45 days through the Federated Ombuds Plenum from a public, multi-source shortlist. The fallback path is a repair duty, not a policy-alignment power.\n- **Staggering enforcement:** Appointments that violate the no-more-than-2-seats-per-year rule are void unless tied to death, incapacity, or removal for cause. Void appointments do not count toward quorum, ratification, or review authority.\n- **Below-quorum rule:** Vacancy does not waive concurrent ratification. A below-quorum CIP may publish records, request fallback nomination, preserve evidence, accept objections, and issue interim risk notices, but may not ratify amendments, close AM3 reviews, waive deadlines, approve funding changes, or appoint itself.\n- **Publication and report fallback:** Dashboard failure routes trigger publication through the public amendment log and independent Ombuds channels. A missing Ombuds Tier 1 integrity report procedurally suspends the amendment until the report or fallback review is complete.\n- **Servant-authority limits:** CIP authority is custodial, corrigible, conduct-based, and subject to ordinary challenge. CIP funding is subordinate to immediate Essential Access relief; no review, vacancy, dispute, or funding issue may delay survival-floor activation.\n- **New risks introduced:** Fallback nomination could become a guardian-class formation path if repeated repairs are dominated by the same civil-society or expert networks. Mitigated by public shortlists, multi-source nomination, Article VII publication, non-renewable terms, ordinary challenge rights, and Capture Dashboard monitoring.\n- **Residual risk:** This patch blocks one hollowing route; it cannot prevent lawful democratic repeal or broad institutional culture collapse. The design can make hollowing visible, slow, and contestable; it cannot make human guardians incorruptible.\n\n---\n\n### P-066 \u2014 Commons Return and Universal Stake Fiscal Sustainability Gate\n\n**Threat addressed:** T-029\n**Status:** ACTIVE | **Priority:** Critical\n\nThe previous active economic spine still treated progressive net-worth demurrage as the primary anti-hoarding and commons-funding mechanism. That left two skipped problems: the active annex did not match the accepted Commons Return and Universal Stake direction, and the corpus had no registered threat for the fiscal question beneath every scale claim \u2014 what funds the floor, at what inflation cost, and who actually bears the burden?\n\n- **Introduced design:** Annex D is rebuilt around Commons Return and Universal Stake. Routine progressive net-worth demurrage, idle-money decay, and continuous personal-balance carrying cost are superseded as active policy. Commons Return applies only to named source bases: land/location value, natural resources, scarce licenses, public-infrastructure uplift, network/platform rents, large succession transfers, and external-capital use of protected commons.\n- **Universal Stake:** A protected civic inheritance may distribute a share of Commons Return after Essential Access, resilience reserves, restoration duties, payment rails, and governance operations are funded. It may not buy Voice, Service Record, office, identity priority, Essential Access priority, or review-body eligibility.\n- **Fiscal gate:** T-029 blocks scale claims unless a costed fiscal adequacy model exists. The model must cover Essential Access cost, delivery cost, source-base receipts, Universal Stake formula, administrative cost, inflation/debasement tolerance, transition cost, downside scenarios, burden incidence, and any remaining taxes, fees, or charges.\n- **Honest tax posture:** The patch does not claim taxes are unnecessary. It says Commons Return should narrow the preferred public burden toward public-created and scarcity-created value, while any residual taxes must be named, costed, dignity-screened, and barred from survival access, ordinary labor, basic household exchange, and modest household reserves unless explicitly justified through the fiscal gate.\n- **Evidence integration:** Creates the Commons Return and Universal Stake Evidence Test Package; updates Threat Register, Threat Resolution Matrix, Hardening Queue, Claims and Evidence Register, Open Problems Resolution Docket, Pilot Evidence Roadmap, Capture Dashboard Specification, Annex Directory, Annex Taxonomy, reader prompts, and corpus registration.\n- **New risks introduced:** Commons Return can become valuation bureaucracy, surveillance, political dividend timing, hidden wealth tax, asset-holder avoidance, or downward burden shift. Mitigated only by source-specific bases, protected ordinary use, appeal rights, privacy limits, lockbox accounting, incidence testing, and public \"who pays\" disclosure.\n- **Residual risk:** Commons Return may still be insufficient or volatile. Some taxes or fees may remain necessary during transition or at scale. The control is not proof of fiscal adequacy; it is a scale-blocking discipline until proof exists.\n\n---\n\n### P-067 \u2014 Cyber Resilience and Availability Gate\n\n**Threat addressed:** T-030\n**Status:** ACTIVE | **Priority:** Critical\n\nThe corpus already had controls for implementation drift, tamper evidence, oracle failure, and delivery sufficiency. Those controls did not answer a different question: what happens when ransomware, breached keys, regional network outage, cloud/provider failure, supply-chain compromise, or payment-rail failure makes the survival floor unreachable?\n\n- **Introduced design:** T-030 registers external cyber availability as a distinct threat. The Cyber Resilience and Availability Evidence Test Package requires a critical-service inventory, ransomware continuity drill, key-compromise and emergency-rotation drill, offline/analog continuity drill, regional failover drill, and supply-chain/dashboard integrity drill.\n- **Continuity standard:** Essential Access must remain deliverable through last-known-valid state, manual/offline provider paths, emergency settlement, and public status channels inside the published tolerance. Aggregate restoration is not enough if vulnerable cohorts, rural users, digitally fragile persons, or critical providers remain cut off.\n- **Claim discipline:** Implementation Drift Audit Package remains the evidence home for unauthorized drift and tamper evidence. The cyber package is the evidence home for whether people can still receive food, water, shelter, medicine, transit, and urgent care when digital systems, keys, providers, or networks fail.\n- **New risks introduced:** Offline fallback can become fraud-prone or privacy-invasive; emergency key rotation can concentrate authority; manual provider settlement can become a hidden bailout or coercive choke point. These are residual risks and must be measured in the evidence packet.\n- **Residual risk:** This patch registers the risk and defines the test path. It does not prove cyber resilience, key custody, recovery time, offline continuity, or supply-chain safety.\n\n---\n\n### P-068 \u2014 Last-Resort Unenrolled Access Gate\n\n**Threat addressed:** T-031\n**Status:** ACTIVE | **Priority:** Critical\n\nThe corpus already names the principle: identity is never a condition of survival access. It also contains the pieces: P-054 safety-shielded emergency access, P-055 delivery sufficiency, P-056 Tier 0 design, Annex AK \u00a7AK8, and Annex AZ's pseudonymous token constraints. The missed question is narrower and more concrete: can a person who never enrolls, never holds a credential, never keeps a wallet, and cannot safely become legible still receive the floor?\n\n- **Introduced design:** T-031 registers last-resort unenrolled access as a distinct critical threat rather than hiding it inside ordinary identity recovery. The Last-Resort Unenrolled Access Evidence Test Package requires access-point mapping, no-credential intake drills, trusted-intermediary drills, analog reconciliation privacy tests, abuse/diversion drills, and dignity interviews.\n- **Claim discipline:** P-056 remains the designed Tier 0 architecture. P-068 is the active evidence gate. No document should claim practical universality of Essential Access until this gate has evidence that the last-resort path works for people outside identity and digital infrastructure.\n- **Continuity standard:** The path must work without a phone, app, QR code, card, stable address, biometric, persistent account, future enrollment promise, or identity-disclosing intermediary. Abandonment counts as exclusion.\n- **New risks introduced:** An analog last-resort route can be exploited by organized brokers, captured by intermediaries, gamed by providers, or converted into a shadow registry through reconciliation records. The evidence package requires aggregate controls and privacy review precisely because individual surveillance would defeat the point.\n- **Residual risk:** This patch does not prove the floor is reachable. It makes the proof requirement explicit and blocks universality claims until no-credential and trusted-intermediary routes pass under dignity review.\n\n---\n\n### P-069 \u2014 Monitoring Repurposing Gate\n\n**Threat addressed:** T-032\n**Status:** ACTIVE | **Priority:** Critical\n\nThe corpus already limits several monitoring surfaces: Annex C gives monitored persons notice and appeal, Annex H requires privacy/surveillance notes for amendments, Annex AK restricts Tier 0 monitoring to aggregate anomaly, Annex AY requires privacy-preserving delivery monitoring, and the Capture Dashboard bans ranking ordinary persons. The gap was cross-cutting: the same data required to enforce protection can be repurposed into the coercive surveillance layer the project opposes.\n\n- **Introduced design:** T-032 registers monitoring repurposing as a distinct critical threat. The Monitoring Repurposing Evidence Test Package requires a Monitoring Purpose Register, purpose-creep red team, linkability/re-identification test, office-separation drill, individual-flag appeal drill, data-minimization and retention audit, and coercive-use scenario.\n- **Claim discipline:** No document should claim enforcement monitoring is bounded, non-surveillant, or safe from repurposing until every monitoring stream has a named purpose, minimum-data rule, access role, retention rule, independent reviewer, appeal path, and explicit secondary-use prohibition.\n- **Continuity standard:** Enforcement may monitor power, institutions, route performance, provider continuity, aggregate anomalies, and control-plane health. It may not silently create a general-purpose behavioral graph, location map, risk list, identity dossier, or ranking system for ordinary persons.\n- **New risks introduced:** Tight monitoring limits can reduce fraud detection or delay enforcement; strong auditability can conflict with deletion; aggregation can hide individual harm; raw records can still be pressured by lawful authorities or captured insiders. These are residual risks and must be measured honestly.\n- **Residual risk:** This patch does not prove monitoring is safe. It makes monitoring itself a test subject and blocks anti-surveillance claims until purpose limitation, linkability resistance, office separation, appealability, retention, and coercive-use tests pass.\n\n---\n\n### P-070 \u2014 Founding Legitimacy Prerequisite Definition Gate\n\n**Threat addressed:** T-033\n**Status:** ACTIVE | **Priority:** Critical\n\nThe corpus already names the founding legitimacy problem through T-017, T-022, T-026, T-027, the Founding Order, Annex AH, the Founding Legitimacy Dossier, the Vulnerable Population Consent Protocol, the Founding Team Composition Standard, and the Pilot Timeline Framework. The gap was not absence of concern. The gap was definition: the two Founding Legitimacy Dossier prerequisites, \"consent evidence\" and \"independent civil-society review,\" could not be produced without a public standard for what counted.\n\n- **Introduced design:** Creates the Founding Consent and Civil-Society Review Evidence Test Package. The package reconciles the Dossier's lower consultation threshold with the Founding Order's binding consent act: for activation authority, 2/3 eligible resident-personhood participation and 2/3 eligible resident-personhood affirmative consent govern, with 90-day notice, 60-day deliberation, roll-call-equivalent record, and drift-chain logging.\n- **Consent evidence standard:** Requires consent model, notice record, deliberation record, participation record, threshold certification, opt-out proof, aid-nonconditioning proof, pressure survey, coercion complaint log, and exit-cost report before the Dossier consent-evidence row can reach PRODUCED.\n- **Civil-society review standard:** Requires at least three qualified reviewer categories from an adversarial-panel shortlist after public challenge. Reviewers must pass financial, governance, affected-community accountability, dissent-capacity, conflict-disclosure, and plain-language-publication tests.\n- **Claim discipline:** Gate A does not clear if founders substitute low-turnout consultation, silence, humanitarian-aid acceptance, friendly expert review, funder-adjacent review, or unpublished reviewer findings for consent and independence evidence.\n- **New risks introduced:** A stricter review gate can be used to delay legitimate founding indefinitely or empower a civil-society gatekeeper class. Mitigations are public shortlists, public challenge records, separate reviewer findings, dissent preservation, affected-community accountability, and explicit Gate A failure reasons.\n- **Residual risk:** No evidence packet can prove perfect founding legitimacy. P-070 makes consent and reviewer independence falsifiable before activation; it does not eliminate the bootstrap problem, informal pressure, class capture, or the need for post-activation audit.\n\n---\n\n### P-072 \u2014 Productive Status Register\n\n**Threat addressed:** T-025\n**Status:** PROPOSED | **Priority:** High\n\nThe word \"productive\" unlocks two benefits on two separate tests: Flow issuance against verified productive commitments (ANNEX_X) and the Commons Return exemption for productive working assets (ANNEX_D \u00a7D3, on ANNEX_J's published Article V stewardship standard). P-023 closed the protected-capital shelter inside the contract-commitment architecture; the residual T-025 variant is *cross-instrument and temporal* \u2014 the same activity classified \"productive\" by the looser test claims both benefits, and because Flow mints at commitment start while the exemption is assessed at settlement, an honest determination at T0 can be exited before any reversal clears.\n\n- **Introduced design:** The [Productive Status Register](Productive_Status_Register.md) \u2014 one canonical productive-status determination per commitment/asset against the single published standard, with three structurally separate roles (standard-author, register-adjudicator, benefit issuer; INV-006 incl. the economic-parameter-setting extension); a **settle-forward escrow** under which the \u00a7D3 exemption vests only after the Flow-side commitment is verified to have stayed in productive use through a full settlement period (non-vesting replaces reversal, wages stay protected by no-clawback); a payroll/escrow fast-path so issuance is never blocked on adjudication; an appeal-bound, independently audited determiner; and the rule that status classifies the activity, never the person (INV-003; \u00a7D6 minimum-necessary data).\n- **Claim discipline:** No document may claim the productive double-dip is closed until the register's evidence test passes (double-dip closure in adversarial simulation; no issuance starvation; determiner non-capture; no person-scoring drift). The instrument is `Designed` and pilot-gated; it binds nothing until then.\n- **New risks introduced:** A single register is a new capture target (bounded by the three-way role split, appeal, audit, and the INV-006 recusal extension); escrowed exemptions add settlement-period accounting complexity; the fast-path's provisional status could be farmed below the de-minimis threshold (the escrow still withholds the exemption, so the farm nets nothing).\n- **Residual risk:** Settle-forward closes the modeled timing attack; it does not prove the published stewardship standard itself cannot be captured (that remains ANNEX_J / Article V territory under T-025), and no pilot evidence exists for adjudication throughput at scale.\n\n**Panel-revised before incorporation** (adversarial, Christ-centered, corpus-fit; source: `docs/superpowers/specs/2026-06-09-productive-register-recusal-redline.md`). The companion Fix 2 of that redline \u2014 the INV-006 economic-parameter-setting recusal extension \u2014 is already constitutional (applied with Session 23).\n\n---\n\n### P-073 \u2014 Framework-First Intake (Anti-Accretion Rule)\n\n**Threat addressed:** structural \u2014 no threat row (rule-count inflation as a systemic failure mode)\n**Status:** ACTIVE | **Priority:** High\n\nA full-corpus simplification audit (2026-06-12, three independent single-role reviews) found that the corpus's protective machinery grew by accretion: each threat received its own patch, and patches repeatedly reimplemented mechanisms the corpus had already designed elsewhere \u2014 at audit time, at least eight collusion-detection instances, eight appeal-path machineries, ten near-identical evidence test packages, seven restatements of the data-minimization rule, six overlapping status registries, and forty-seven standing institutions. Every duplicate mechanism is a new capture surface, a new audit obligation, and a new layer of illegibility between an ordinary person and the rules that govern them.\n\n- **Introduced design:** The Framework-First Intake gate in `Acceptance_Protocol.md`: a proposal introducing a mechanism whose protective function an existing mechanism already performs must extend the most general existing instrument or attach a published justification for why extension cannot serve. Returns are judgment calls, so they carry a published return record (void without it), a point-by-point resubmission ratchet, and escalation of contested duplication questions to the standing adversarial panel member. Extensions that add authority, personnel, data collection, or gatekeeping power receive full new-mechanism scrutiny at the higher applicable tier (no laundering). A simplicity presumption favors consolidation and deletion \u2014 bounded so it never blesses independence-reducing mergers (mechanism count, never independence count) and never costs a protected person their path to protection.\n- **Claim discipline:** This gate is process hygiene, not proof of simplicity. No document may claim the corpus is consolidated or minimal until the consolidation program (status spine, appeal spine, evidence framework, data stewardship standard, institutional mergers) actually lands and the rule shows fruit at real intakes.\n- **New risks introduced:** A captured intake could try to use \"duplicate\" as a veto on new protections (bounded by the return record, ratchet, and adversarial escalation); justification-writing could become ritual boilerplate (watched via the technical-review record requirement); the gate itself is one more rule (accepted: it is the rule that makes the next hundred unnecessary, and it creates no office, register, or new process step).\n- **Residual risk:** The gate stops *new* duplication; it does not remove the existing redundancy (that is the consolidation program's job). Its effectiveness is unproven until tested by real proposals; per its own corrigibility clause, evidence that it suppresses needed protections or relocates complexity into justification documents counts against it.\n\n**Panel process:** four independent single-role reviewers (adversarial systems designer, Christ-centered, corpus-fit, minimalist) reviewed the applied diff in parallel; all four returned APPROVE WITH FIXES and every required fix was incorporated (return-record discipline, anti-laundering tier rule, independence-count bound, protected-person clause, corrigibility clause, functional test replacing a closed family list, P-073 provenance). Christ-centered review recorded as Session 25 in `Christ_Centered_Evaluation.md`.\n\n**Consolidation program landings (running record):** 2026-06-12 \u2014 the status spine landed (first program step under this gate): `Status_Model.md` deleted, its vocabulary and edge rules absorbed into the Claims and Evidence Register's Status methodology section (now the canonical status spine); the Hardening Queue stripped of duplicated status tracking (worklist only, references owners); Threat Register restated patch-statuses converted to pointers. Net ~\u221295 lines; vocabulary-definition sites reduced from five to one. Evidence Ladder deliberately retained standalone (it defines evidence *levels*, a different axis, and its level numbers are cited by app code and seven documents). Named follow-ups: Patch Log single-row mini-tables (same-file restatement, checker-covered) and a single convention for Threat Register per-entry Status lines. 2026-06-12 \u2014 the appeal spine landed (P-074, ANNEX_L \u00a7L7): seven appeal procedures \u2192 one spine + a domain intake table (the ANNEX_AW \u00a7AW3.3 orphan appeal window, RRE-011, is a named follow-up); FC-209's reserved appeal path closed by binding it to the spine. 2026-06-12 \u2014 the evidence framework and data stewardship standard landed (P-075): one test-package template in the Evidence Ladder (ten packages surveyed; four structural follow-ups named), one minimization doctrine + calibration table + linkage rule in the Monitoring Administrative Safety Packet; one restatement site deleted (the ETP baseline) and six domain clauses retained with pointers; the ANNEX_AJ P-004-protected clause recorded unmodified. 2026-06-12 \u2014 the institution merger audit landed (P-076): two phantom bodies resolved to existing ones, oracle council/cohort terminology unified; the two headline merger candidates were honestly rejected (different functions; nonexistent body) \u2014 a wrong merger is worse than none. 2026-06-13 \u2014 follow-up F-5 landed (P-077): the four drift rules the program itself created (status, appeal, evidence, data) collapse into one canonical-home discipline in the P-073 gate; the drift principle now has one definition site instead of four, each home keeping only its own enforcement. The named next target remains this very record's pattern \u2014 the Patch Log's triple-entry restatement. 2026-06-13 \u2014 the G-1..G-4 data-retention gaps closed (P-078): the four confessed \"unspecified \u2014 gap\" cells specified as FC-211..214 (owner-approved Balanced posture), retention tied to the appeal-spine window + the corpus day-grid with hard caps \u2014 the data doctrine's required deletion schedule supplied.\n\n\n---\n\n### P-074 \u2014 Appeal Spine Consolidation (ANNEX_L \u00a7L7)\n\n**Threat addressed:** structural \u2014 no threat row (appeal-path fragmentation as a systemic failure mode)\n**Status:** ACTIVE | **Priority:** High\n\nThe same simplification audit that produced P-073 counted at least eight separate appeal machineries across the corpus \u2014 each with its own filing rule, window, ladder, and clock. Fragmented appeal procedure is itself an exclusion mechanism: the person most likely to need an appeal is the person least equipped to discover which of eight procedures applies to them. This patch is the first P-073-mandated consolidation of an entire mechanism family.\n\n- **Introduced design:** ANNEX_L \u00a7L7, the canonical appeal spine: one filing rule and 30-day window (L7.1); the survival floor and the status quo ante continue during appeal, with penalties and stakes paused or escrowed until finality (L7.2); a single three-instance ladder with the Ombuds Plenum deliberately kept as a separate final instance for enforcement and attestation questions (L7.3); one timing table (L7.4); a domain intake table replacing scattered procedure (L7.5); and a drift rule in the \u00a7L7 provenance note making the spine govern over any domain restatement. Pointer rewrites in ANNEX_J, ANNEX_I, ANNEX_X, ANNEX_D, ANNEX_U, ANNEX_AJ, ANNEX_AS, the Productive Status Register, the Identity Recovery Evidence Test Package, and the Parameter Calibration Register (FC-209 bound to the spine) replace local appeal machinery with first-instance intake plus a spine citation: seven scattered appeal procedures become spine pointers (with ANNEX_I \u00a7I8's duplicate clocks and ANNEX_AI \u00a74.8's duplicate filing window deleted in favor of the spine); the ANNEX_AW \u00a7AW3.3 orphan appeal window (RRE-011) is a named follow-up, not yet absorbed.\n- **Claim discipline:** No claim that appeals are accessible, timely, or capture-resistant in practice until the appeal-path drills (including the FC-209 both-directions drill) actually run. The spine is `Designed`; consolidation reduces procedure count, not uncertainty.\n- **New risks introduced:** A single procedural spine is a single point of procedural capture \u2014 whoever controls the spine's clocks and intake controls every appeal (bounded by the Plenum/CRP split in L7.3 and the spine-discipline drift rule in the \u00a7L7 provenance note, which makes deviation visible rather than silent). The status-quo-ante rule (L7.2) could be exploited to freeze adverse-but-correct decisions in place during appeal (bounded by the published, reviewable imminent-serious-harm carve-out generalized from ANNEX_U \u00a7U6). The generalized imminent-serious-harm standard is itself unpublished \u2014 until it is authored under the ANNEX_U \u00a7U5 threshold-setting discipline and published (a pre-launch gate), each domain's existing published interim measure governs during appeal, so there is no absolute status quo ante.\n- **Residual risk:** The body names in L7.5 are designed institutions with no pilot evidence behind any of them; the 72-hour, 14-day, and 30-day clocks are design estimates, not measured capabilities. Whether one door genuinely lowers the filing barrier for the least-resourced appellant is unproven until drilled.\n\n**Numbering note:** the held Voice/Service-Record redline provisionally cited P-074 for its civic-misuse proposal; per that redline's own renumbering caveat, it takes the next free number at intake.\n\n---\n\n### P-075 \u2014 Evidence-Test Framework and Data Stewardship Standard\n\n**Threat addressed:** structural \u2014 no threat row (restated evidence-test structure and data-stewardship rules drifting apart across documents)\n**Status:** ACTIVE | **Priority:** High\n\nThe consolidation program's survey of the corpus's ten evidence test packages and its data-handling clauses found the same structural rules restated in slightly different words across many documents \u2014 a drift surface where a future edit to one restatement silently diverges from the others. This patch is the third P-073-mandated consolidation: one canonical skeleton for evidence test packages, and one master minimization and purpose-limitation standard for data about persons.\n\n- **Introduced design:** The Evidence Ladder gains the canonical Test Package Template (P-075): six required structural elements (claim under test, abuse model, required tests with pre-stated failure criteria, adverse-finding protocol, affected-documents update order, residual risk) plus a drift rule under which the template governs over any package restatement, a non-conforming package gates nothing, and new structural patterns require framework-first justification under the Acceptance Protocol's anti-accretion rule (P-073). The Monitoring Administrative Safety Packet gains the master Minimization and Purpose-Limitation Doctrine \u2014 carrying the six-condition baseline formerly stated in the Monitoring Repurposing Evidence Test Package (conditions verbatim, with two declared strengthenings: scope broadened from monitoring to any collection of data about persons, and conditions 5\u20136 bound to the appeal spine and the ANNEX_AM \u00a7AM7 stripping standard), which now tests the doctrine rather than restating it \u2014 plus a quote-sourced per-domain calibration table (seven domains; open gaps marked honestly as \"unspecified \u2014 gap\"), a cross-domain linkage rule generalizing the ANNEX_D \u00a7D6.5 independent-finding standard, and a drift rule under which stricter domain text always governs. One restatement site was deleted (the ETP baseline); the six domain clauses (ANNEX_AJ, ANNEX_AF \u00a7AF3, ANNEX_AK \u00a7AK8.1, ANNEX_D \u00a7D6.1, ANNEX_C, and the Capture Dashboard Specification) were retained as domain substance and gained pointers; ANNEX_K \u00a7K6 and ANNEX_I \u00a7I8's generic restatements now defer to the doctrine; the ANNEX_AJ P-004-protected purpose-limitation clause is recorded in the calibration table unmodified.\n- **Claim discipline:** This consolidates restatements; it proves nothing about practice \u2014 the doctrine's fruit is unproven until tested and the four named calibration gaps remain gaps.\n- **New risks introduced:** A single doctrine is a single drafting-error blast radius (bounded by the stricter-text-governs rule); the calibration table could be misread as licensing the gaps it names (bounded by \"gap is not permission\").\n- **Residual risk:** The unspecified stripping/retention rules in four domains are now visible but still unspecified. Named calibration gaps [SPECIFIED by P-078 \u2014 values RESERVED, FC-211..214]: G-1 ANNEX_AJ bypass-detection fixed retention period specified as FC-211 by P-078 (owner: ANNEX_AJ); G-2 ANNEX_AF attestation-graph retention-schedule length and stripping point specified as FC-212 by P-078 (owner: ANNEX_AF \u00a7AF3); G-3 ANNEX_D Commons Return stripping point and retention specified as FC-213 by P-078 (owner: ANNEX_D \u00a7D6); G-4 flag-expiry period specified as FC-214 by P-078 (owner: this packet's flag lifecycle + ANNEX_C). Named follow-ups F-1\u2013F-7: prose status normalization in the Anti_Rent, Identity_Recovery, and Service_Record packages (F-1); an affected-documents section for the Capacity_Measurement package (F-2); an abuse model and affected-documents section for the Commons_Return package (F-3); a standalone residual-risk statement for the Cyber_Resilience package (F-4); unify the four drift rules into one doctrine in the P-073 gate \u2014 a constitution change, separate reviewed patch (F-5); checker coverage for the calibration table's quoted text (F-6); ANNEX_A \u00a7A20 cites the doctrine instead of restating it (F-7).\n\n---\n\n### P-076 \u2014 Institution Merger Audit (Phantom Resolution and Terminology Unification)\n\n**Threat addressed:** structural \u2014 no threat row (dangling institutional pointers and duplicate naming creating phantom bodies in the escalation paths)\n**Status:** ACTIVE | **Priority:** Medium\n\nThe consolidation program's 47-institution inventory proposed merger candidates; verification found the headline candidates dissolve on inspection \u2014 this patch records what was actually done and what was honestly rejected.\n\n- **Introduced design:** Three fixes. (1) Conservative Hold's declaring authority in ANNEX_AQ is bound to the existing RCS accreditation body \u2014 the declaring authority for Shared Storehouse suspension under ANNEX_AL \u00a7AL-CORR (Suspension Declaration) \u2014 resolving a dangling \"named in ANNEX_AL \u00a73\" pointer that named no one. (2) The phantom \"Measurement Oversight Body\" in the Capacity Measurement Evidence Test Package is deleted; oracle-disagreement escalation is bound to the independent methodology-review panel constituted under ANNEX_AL \u00a74.1 (composition per P-017 oracle-independence standards, independent of the RCS accreditation body). (3) \"Oracle council\" is unified to \"oracle cohort\" \u2014 FC-033's own unit \u2014 across the Capacity Measurement package and SPECIFICATIONS.md (two occurrences). (4) A stale ANNEX_AM cross-reference to \"Annex AL \u00a73.1\" (a heading that does not exist) is corrected to \u00a73.4, where the FC-031 methodology-class minimum lives.\n- **Claim discipline:** No institution-count reduction may be claimed beyond what happened: two phantom references resolved to existing bodies, one duplicate term unified; the restated effective count is 44 (47 inventoried \u2212 2 phantoms \u2212 1 duplicate term); zero operating bodies merged.\n- **New risks introduced:** Binding Conservative Hold declaration to the RCS accreditation body concentrates one more declaratory act in an existing verifier-side body (accepted: it replaces a pointer to nowhere \u2014 zero effective checks \u2014 with one real, already-audited check; the body gains no allocative power). The same body also controls the quorum denominator through accreditation, so de-accreditation is a theoretical Conservative Hold trigger lever \u2014 bounded by the ANNEX_AM accreditation-count automatic review, the FC-100 14-day restoration ceiling, the operative-without-confirmation rule, and L7 appealability of both wrongful declaration and refusal to confirm.\n- **Residual risk:** The ANNEX_AB \"capacity certifier shall be named\" placeholder remains a named follow-up (substantive designation, not a rename); the institutional inventory itself is unverified beyond the candidates examined. Two proposed mergers were examined and REJECTED with reasons: the register-adjudicator and contribution-verification functions are different functions protecting different people (merging would weaken INV-006), and the \"Temporal Continuity Review Panel\" exists nowhere in the corpus.\n\n**Numbering note:** the held Voice/Service-Record redline takes the next free patch number above P-078 at intake.\n\n---\n\n### P-077 \u2014 Canonical-Home (Anti-Drift) Discipline\n\n**Threat addressed:** structural \u2014 no threat row (the consolidation program's own output: four near-identical drift rules, the largest restatement mass the program created)\n**Status:** ACTIVE | **Priority:** Medium\n\nThe status spine (P-074 era), the appeal spine (P-074), the evidence template, and the data doctrine (P-075) each ended with its own \"domains cite the home; a divergent restatement is drift; the home governs\" rule, written four times in four documents \u2014 the exact restatement pattern the framework-first gate exists to prevent, reproduced by the gate's own consolidations. Follow-up F-5, named at P-075, called for unifying them; this is that patch.\n\n- **Introduced design:** One **canonical-home discipline** is added to the P-073 Framework-First Intake gate in `Acceptance_Protocol.md`: once the framework-first rule produces a canonical home for a function, domain documents cite it and keep only domain-specific substance; a divergent restatement is drift and the home governs \u2014 with one exception that runs only one way (a domain text **strictly more protective of the person** governs and is recorded as a deliberate protection, never a weaker or slower variant, and never for a uniform procedural rule like an appeal clock where uniformity is itself the protection). The gate now carries the index of known homes (status \u2192 Claims and Evidence Register; appeals \u2192 ANNEX_L \u00a7L7; evidence-package structure \u2192 the Evidence Ladder Test Package Template; data minimization \u2192 the Monitoring Administrative Safety Packet doctrine). The four local rules are reduced to pure pointers \u2014 a home-declaration, their own specific enforcement (status build-fail; non-conforming package gates nothing; appeal-spine governs; stricter data text wins), and a citation \u2014 so the drift principle (what drift is, how the stricter-text exception resolves) is stated once, centrally, instead of four times. The central exception also gains teeth the four local versions lacked: a domain claiming a \"more protective\" variant bears the burden of showing it stronger on *every* dimension a person relies on (coverage, retention, revocability, speed, accessibility), records the claim with reasoning, and the claim is itself appealable on the spine; an unrecorded divergence is drift by default. The known-homes index is marked a convenience record \u2014 a home is canonical from its framework-first creation, not from appearing in the list.\n- **Claim discipline:** This is a definition-site collapse for the drift principle (stated 4\u00d7 before, once now), not a behavior change: every home governs exactly as before, the stricter-text exception is unchanged where it already applied (data) and explicitly excluded where it never did (uniform procedure, status), and the added burden-and-appealability clause strengthens the exception without altering any home's outcome. No new home is created; no home's enforcement is weakened. The leaves were shrunk to pointers in panel revision (the first draft left them restating the principle, which would have made the count 5 sites, not 1).\n- **New risks introduced:** Centralizing the discipline in the constitution makes one paragraph the single amendment point for the whole anti-drift principle (bounded: it is Tier-2 protected within the FAP, subject to the gate's own corrigibility clause, and each home still names its own enforcement so a captured central paragraph cannot silently disable a home's build-fail or gates-nothing hook). The stricter-text exception could be misread as licensing a domain to claim \"more protective\" while actually diverging weaker \u2014 bounded by the explicit \"only a stronger one; never a weaker, slower, or looser variant\" language and the uniform-procedure carve-out.\n- **Residual risk:** The discipline is enforced by review and by each home's named mechanism, not by a single script; a domain that restates a home's rule without diverging (harmless redundancy) is not build-caught, only review-caught. The minimalist's named next target \u2014 the Patch Log's own triple-entry pattern (inventory row, detail section, running record) \u2014 remains the largest same-file restatement mass and is not addressed here.\n\n**Panel process:** four independent single-role reviewers (adversarial systems designer, Christ-centered, corpus-fit, minimalist) reviewed the applied diff in parallel. Incorporated fixes: the adversarial burden-and-appealability clause on the stricter-text exception (closing self-certified \"more protective\" divergence); the minimalist reduction of the four leaves from principle-restatements to pure pointers (the first draft had grown them, making the honest count 5 definition sites, not 1) and the corrected claim line; the index marked non-constitutive per the adversarial staleness catch. Corpus-fit and Christ-centered approved without required fixes. Christ-centered review recorded as Session 27 in `Christ_Centered_Evaluation.md` (constitution change to `Acceptance_Protocol.md`).\n\n### P-078 \u2014 Data-Retention Gap Closure (G-1..G-4)\n\n**Threat addressed:** structural \u2014 no threat row (the P-075 consolidation's own confessed output: four \"unspecified \u2014 gap\" retention/stripping cells)\n**Status:** ACTIVE | **Priority:** Medium\n\nThe P-075 data-stewardship consolidation confessed four unspecified retention/stripping rules \u2014 bypass detection (G-1), the hardship attestation graph (G-2), Commons Return assessment (G-3), and monitored-person flag expiry (G-4) \u2014 and the Christ-centered reviewer called them \"confession without repentance.\" This is the repentance: the four gap cells are specified, supplying the deletion schedule the data doctrine's \"deletion-bound\u2026 published schedule\" condition already required.\n\n- **Introduced design:** Four calibration parameters in the Parameter Calibration Register, owner-approved at the Balanced posture: FC-211 bypass-detection (enforcement-matter finality + 90d, 180d open-build ceiling, 365d cap); FC-212 attestation graph (appeal-close + 30d, 180d ceiling, case-pseudonym at intake); FC-213 Commons Return assessment (appeal-close + 30d strip, 18-month cap); FC-214 person-flags (resolution + 30d, 180d max age, irreversible unlink) \u2014 full rules in the Parameter Calibration Register and founding/commitments.md. Each gate is RESERVED \u2014 bound before the relevant infrastructure activates.\n- **Claim discipline:** These specify the data doctrine's already-required deletion schedule \u2014 they do not bind final operational numbers (RESERVED, bound before activation) and create no new mechanism (P-073-conformant: calibrating the canonical home, not inventing one).\n- **New risks introduced:** Concrete anchors could be mistaken for bound values \u2014 bounded by the explicit RESERVED / bind-before-activation gate on every parameter. The longer bands (G-1's 90d/180d) are a detection-vs-surveillance tradeoff, capped hard at 365d per AJ's own anti-Babel clause; the vulnerable-person datasets (G-2 hardship graph, G-3 household-linkable assessment) retain the least, tied to appeal-window close rather than a standing clock.\n- **Residual risk:** Final values await founding binding by the named owners; the appeal-window-tie assumes the L7 spine's clocks hold.\n\n**Numbering note:** the held Voice/Service-Record redline takes the next free patch number above P-078 at intake.\n", "headings": [ { "level": 1, @@ -1929,10 +1929,15 @@ "level": 3, "text": "P-077 \u2014 Canonical-Home (Anti-Drift) Discipline", "slug": "p-077-canonical-home-anti-drift-discipline" + }, + { + "level": 3, + "text": "P-078 \u2014 Data-Retention Gap Closure (G-1..G-4)", + "slug": "p-078-data-retention-gap-closure-g-1g-4" } ], - "wordCount": 29930, - "headingCount": 87 + "wordCount": 30474, + "headingCount": 88 }, { "id": "docs__governance__Provenance_Map_md", @@ -2735,7 +2740,7 @@ "status": "", "statusBucket": "reference", "summary": "This register tracks high-risk parameters whose numbers matter enough that they should not remain \"because the document says so.\"", - "content": "# Parameter Calibration Register\n\nThis register tracks high-risk parameters whose numbers matter enough that they should not remain \"because the document says so.\"\n\nIt complements `/founding/commitments.md` and `architecture/parameter_registry.md`. Those files bind values. This file records why values are plausible, how they should be tested, and what evidence would force revision.\n\n---\n\n## Row Standard\n\nEvery high-risk parameter should eventually have:\n\n| Field | Meaning |\n|---|---|\n| Parameter | FC identifier or named constitutional threshold. |\n| Current value | Bound, provisional, reserved, or proposed value. |\n| Tier | Tier 1, Tier 2, Tier 3, or pre-launch blocking gate. |\n| Why this value exists | Plain-language rationale, not just cross-reference. |\n| Capture route | How a bad actor benefits from this value being too high, too low, vague, or stale. |\n| Evidence needed | Simulation, pilot, audit, legal review, or outside source needed. |\n| Revision trigger | What result forces review. |\n| Governing docs | Where the value is bound and where consequences appear. |\n\n---\n\n## Seed Register\n\n| Parameter | Current value | Tier | Why this value exists | Capture route | Evidence needed | Revision trigger | Governing docs |\n|---|---:|---|---|---|---|---|---|\n| FC-010 leakage thresholds | 3% routine target; 7% systemic review | Tier 1 / active-unproven | Converts shadow-convertibility enforcement capacity into published thresholds. | Too high normalizes broker markets; too low justifies surveillance. | Proxy-market red team; enforcement-capacity audit. | Broker profitability remains positive or ordinary households face overbroad enforcement. | Annex AB; Threat Register T-001. |\n| FC-020 Protected Pause floor | 0.30 Voice | Tier 1 | Prevents hardship from erasing civic continuity. | Too high preserves incumbents; too low punishes illness and care. | Hardship-pause abuse test. | Pause rings preserve roles or genuine hardship users avoid protection. | Annex AF; Service Record Misuse Evidence Test Package. |\n| FC-030 oracle N_MIN | 5 nodes | Tier 1 | Prevents single-source measurement control. | Too low enables capture; too high causes paralysis. | Capacity measurement and oracle-failure drill. | Quorum failure blocks response or correlated error persists. | Annex AL; Capacity Measurement Evidence Test Package. |\n| FC-031 methodology classes | 3 classes | Tier 1 | Reduces shared epistemic failure. | Standards bodies define all classes in their own image. | Methodology-class audit. | Method classes share data, funding, model supply chain, or standards body. | Annex AL; T-020/T-021. |\n| FC-032 pairwise correlation max | 0.30 Pearson, supplemented by directional-bias review | Tier 1 | Makes formal independence testable while preventing same-direction bias from passing merely because co-movement is low. | Actors tune reporting to pass correlation while sharing assumptions or incentives that push all errors in the same direction. | Forecast-vs-actual, directional-bias table, and oracle independence audit. | Shared error exceeds threshold during stress, or same-direction material error recurs without corrective action. | Annex AL; T-020/T-021. |\n| FC-033 adversarial oracle seats | 1 per cohort | Tier 1 | Forces hostile-method review inside measurement. | Seat becomes symbolic or captured by same professional network. | Adversarial-seat independence review. | Dissent never changes outcomes or is not resourced. | Annex AL; T-020/T-021. |\n| FC-040 penalty base multiplier | 5.0x | Tier 1 / active-unproven | Makes detected conversion expected-value negative. | Too low invites arbitrage; too high punishes edge cases harshly. | Annual deterrence audit. | Violations remain profitable or appeals show disproportionate harm. | Annex AJ; T-001/T-007. |\n| FC-041 detection assumption | 0.85 | Tier 1 / active-unproven | Supplies expected-value calculation for penalties. | Overstated detection hides under-enforcement. | Detection-rate audit. | Actual detection probability materially lower than assumed. | Annex AJ; Enforcement Panel audit. |\n| FC-202 Commons Return source-base list | Reserved \u2014 bind before CRUS activation | Tier 1 / pre-launch gate | Defines the closed list of allowed Commons Return bases (land/location value, natural resources, spectrum, monopoly licenses, platform/network rents, high-value concessions, large successions). The list is closed under INV-008: downward extension onto ordinary life is a Tier-1 amendment. | Source-base definitions quietly broadened to reach ordinary labor, homes, tools, or savings. | Source-base mapping pilot and incidence model. | Any base reaches an INV-008-protected category. | ANNEX_D; INVARIANTS INV-008; Commons Return and Universal Stake Evidence Package. |\n| FC-203 Commons Return assessment rate schedule | Reserved \u2014 calibrated by source base before activation | Tier 2 / pre-launch gate | Sets the per-base assessment rate without making ordinary labor or survival access the funding base. | Rates tuned to spare connected asset classes; valuation hiding. | Incidence, valuation-hiding, and external-capital-arbitrage tests. | Burden lands on ordinary households or productive stewardship instead of scarcity privilege. | ANNEX_D; CRUS Simulation Protocol. |\n| FC-204 protected ordinary-use threshold (formerly registered here as FC-052) | Reserved \u2014 bind before CRUS activation; initial reference remains 18 months \u00d7 regional median monthly consumption until replaced by the CRUS fiscal dossier | Tier 2 / pre-launch gate | Defines the ordinary household reserve that may not become the public funding base under Annex D protected-use rules. | Too low reaches ordinary households; too high shelters concentrated control under household labels. | Commons Return incidence model and household/small-operator burden review. | Ordinary households, caregivers, small operators, elders, disabled persons, or rural households bear Commons Return burden meant for scarcity privilege or public-created value. | ANNEX_D; Commons Return and Universal Stake Evidence Package; founding/commitments.md FC-204. |\n| FC-205 Universal Stake distribution cadence | Reserved \u2014 bind before first distribution | Tier 2 / pre-launch gate | Makes Stake timing reliable for households and useless as a political reward instrument; a distribution may be authorized only after the floor and reserves are funded (INV-014). | Distribution timed to elections or withheld as punishment. | Distribution drill with INV-014 ordering check. | Any distribution authorized while floor or reserves underfunded. | ANNEX_D; INVARIANTS INV-014. |\n| FC-206 Universal Stake eligibility rule | Reserved \u2014 bind before first distribution | Tier 1 / pre-launch gate | Keeps the Stake universal and non-convertible (no sale, assignment, garnishment, pledge, inheritance, or purchase of membership/priority/standing/office/Voice). | Eligibility narrowed to exclude the inconvenient; conversion pathways laundered through legal wrappers. | Non-convertibility red team. | Any conversion pathway clears. | ANNEX_D; ANNEX_AK; INVARIANTS INV-002/INV-017. |\n| FC-207 CRUS anti-capture gates | Reserved \u2014 bind before CRUS activation | Tier 1 / pre-launch gate | Public accounting, no patronage discretion, data minimization, auditability, appeal rights. | Fund administrators become patronage allocators. | Capture Dashboard drill. | Discretionary or targeted allocation observed. | ANNEX_D; Capture Dashboard Specification. |\n| FC-208 PFCR / lockbox reserve and routing rule (formerly registered here as FC-054) | Reserved | Tier 2 / pre-launch gate | Splits Commons Return receipts between Essential Access support, public rails, restoration, resilience reserves, infrastructure, and Universal Stake. | Too much to one channel creates fiscal dependency; too little weakens commons funding or turns Universal Stake into political dividend timing. | Fiscal adequacy model, source-base revenue model, lockbox sufficiency test, and burden-incidence review. | PFCR becomes dependent on inflation, hidden debt, or prohibited tax bases; or cannot fund baseline commons. | ANNEX_D; Article V; SPECIFICATIONS; founding/commitments.md FC-208. |\n| FC-209 CRUS appeal path | Bound to the appeal spine (ANNEX_L \u00a7L7): first instance Commons Return assessment review per ANNEX_D \u00a7D6, escalation per the spine \u2014 appeal-path drill still required pre-launch | Tier 1 / pre-launch gate | Human appeal for assessed holders and excluded claimants without letting high-value actors stall assessment. | Procedural delay as avoidance; appeal priced out of reach of the poor claimant. | Appeal-path drill (both directions). | Appeals stall assessment or exclude the unrepresented. | ANNEX_L \u00a7L7; ANNEX_D \u00a7D6; Federated Ombuds. |\n| FC-210 CRUS review cadence | Reserved \u2014 bind before CRUS activation | Tier 2 / pre-launch gate | Scheduled review of incidence, eligibility, valuation, bases, distribution, reserves, capture metrics; a missed cadence is itself a failure. | Review quietly skipped in good years. | Cadence compliance audit. | Missed cadence or missing data. | ANNEX_D; Capture Dashboard Specification; Pilot Evidence Roadmap. |\n| Dormant \u00a7D9 backstop schedule (no live FC ID; a revival patch would assign one) | Superseded as an active parameter; no routine balance or net-worth decay schedule is operative unless a new patch, fiscal/dignity evidence, public review, and applicable amendment process revive a narrow dormant backstop. | Dormant / not operative | Preserves historical traceability for the retired demurrage designs without letting old rates govern by accident. The retired idle-balance parameters are tombstoned in founding/commitments.md FC-050\u2013FC-052, FC-054. | If treated as active, it can burden ordinary households, illiquid owners, or working savers while bypassing the Commons Return source-base test. | Dormant-backstop incidence model, dignity review, household burden model, and explicit amendment activation record before any use. | Any document or implementation treats old rates or \u03bb brackets as active, funds Essential Access from them, or applies routine balance/net-worth decay by interpretation. | ANNEX_D \u00a7D1 and \u00a7D9; SPECIFICATIONS. |\n| FC-055 issuance ceiling function | Reserved | Tier 1 / pre-launch gate | Links Flow supply to verified productive commitments. | Too loose inflates claims; too tight starves production. | Flow issuance simulation and productive-commitment audit. | Circulation detaches from real production or needed projects cannot clear. | Article V; SPECIFICATIONS. |\n| FC-058 CSM basket/regional adjustment | Reserved | Tier 1 / regional launch gate | Prevents one abstract basket from ignoring local climate, food, medicine, and shelter needs. | Under-adjustment harms high-need regions; over-adjustment invites political inflation. | Regional CSM pilot and capacity review. | Regional needs are mismeasured or adjustment becomes patronage. | Article III; Annex Y; SPECIFICATIONS. |\n| FC-060 Voice sector ceiling | 0.20 | Tier 1 | Prevents one sector dominating civic weighting. | Sector labels are split or merged to hide concentration. | Capture Dashboard Specification. | Sector concentration remains high through reclassification. | Article VI; Annex AC. |\n| FC-061 per-person cap | See commitments | Tier 1 | Prevents extreme individual civic weight. | Cap can still permit coordinated class control. | Civic-pool concentration review. | Repeat-role networks dominate despite compliance. | Article VI; Annex Z. |\n| FC-062 Service Record decay | See commitments | Tier 1 | Keeps standing tied to recent service. | Slow decay preserves old class; fast decay erases real long-term service. | Service Record misuse and hardship-pause tests. | Role pools become stale or participation becomes burnout. | Annex Z; Annex AF. |\n| FC-070 reserve window | 45 days x CSM x population | Tier 1 | Gives survival floor time during supply shock. | Under-reserve creates rationing; over-reserve creates hoarding bureaucracy. | Capacity stress test by essential category. | Reserves fail before recovery window or drain ordinary supply. | Annex Y; Article III. |\n| FC-071 CSM cluster failure threshold | 3 per 10,000 residents per 30 days | Tier 1 | Detects survival-floor delivery failure. | Too high hides local harm; too low causes noisy emergency churn. | Delivery pilot and small-cell privacy review. | Cluster failures undercount vulnerable groups. | Annex Y; Article VII. |\n| FC-072 Shared Storehouse activation threshold rule | Reserved by category | Tier 1 / activation gate | Prevents emergency rationing from activating on vague scarcity claims. | Too loose normalizes rationing; too strict delays needed protection. | Scarcity activation and unwind drill by essential category. | Shared Storehouse activates without real scarcity or fails during shortage. | Article III; Annex AQ; SPECIFICATIONS. |\n| FC-080 attestation stake ratio | See commitments | Tier 1 | Makes false high-impact attestations costly. | Rich actors buy credibility; poor attestors withdraw. | Attestation market test. | False claims persist or isolated people lose recognition. | Annex AS; Service Record package. |\n| FC-081 audit window | See commitments | Tier 1 | Keeps attestations reviewable long enough to catch false claims. | Too short invites delayed fraud; too long chills honest help. | Attestation/collusion pilot. | Disconfirmations arrive after window or honest attestation drops. | Annex AS. |\n| FC-082 graph density threshold | See commitments | Tier 1 | Protects close-knit communities from automatic collusion penalties. | Rings hide as community density. | Dense-community safe-harbor test. | Mutual-aid networks or fraud rings are misclassified. | Annex AS. |\n| FC-090 Ombuds sub-count | 5 nodes | Tier 1 | Distributes audit authority. | Five offices can still coordinate informally. | Capture Dashboard Specification. | Voting-pattern and staffing overlap exceed threshold. | Annex AI. |\n| FC-091 Ombuds supermajority | 4 of 5 | Tier 1 | Prevents one sub-node from ruling alone. | Minority can block needed correction; majority can coordinate. | Ombuds deadlock and collusion drill. | Repeated 3-2 deadlocks or rubber-stamp 5-0 patterns. | Annex AI. |\n| FC-100 quorum-loss restoration | 14 days | Tier 1 | Limits emergency hold under oracle loss. | Too long normalizes emergency; too short forces unsafe unwind. | Shared Storehouse oracle blackout drill. | Restoration misses reality or holds persist after recovery. | Annex AQ. |\n| FC-110 Tier 1 signatures | 7 of 9 | Tier 1 recursive | Blocks small-coalition amendment of core rules. | Three holders can block; seven can be captured socially. | Keyholder custody and capture review. | Holder concentration or coercion makes threshold easier than assumed. | Amendment Protocol. |\n| FC-111 Tier 1 timelock | 180 days | Tier 1 recursive | Creates public response and exit window. | Delay can be waited out or used for paralysis. | Timelock response drill. | Affected communities cannot understand, challenge, or exit in time. | Amendment Protocol; Drift Chain. |\n| FC-120 exit threshold | 2/3 resident personhood | Tier 1 | Prevents small faction exit capture. | Too high traps dissenters; too low enables hostile breakaway. | Exit rehearsal and participation-barrier audit. | Exit is formal but practically unavailable. | Founding Order. |\n| FC-121 exit unwind | 730 days | Tier 1 | Preserves Essential Access during exit. | Too long becomes exit denial; too short harms dependents. | Exit transition simulation. | Essential services fail or exit becomes punitive. | Founding Order. |\n| FC-140 identity fraud band | target \u22642% / upper bound \u22645% / trigger \u22653% per quarter | Tier 2 / pre-launch gate | Sets starting Essential Access identity-fraud tolerance while keeping fraud visible before it drains physical survival supply. | Over-tightening excludes vulnerable people; over-loosening lets identity fraud consume food, medicine, shelter, or other CSM capacity. | Identity and Recovery Evidence Test Package; Annex AK; founding commitments. | Exclusion rises, fraud drains Essential Access, or pilot evidence shows the band is too loose or too tight for vulnerable populations. | Annex AK; founding/commitments.md. |\n| FC-160-184 contract parameters | Reserved / proposed | Pre-launch gate | Escrow, deployment-window, force-majeure, and inspector-pool controls need calibration. | Loose terms recreate hoarding; tight terms block infrastructure. | Commons Return and Universal Stake Evidence Test Package, project-finance simulation, and procurement red team. | Escrows become protected-capital shelter markets or project finance stalls. | Annex AR; ANNEX_D. |\n| FC-185-193 external trade and strategic floor parameters | Reserved / draft anchors | Tier 1 / Tier 2 mixed | Strategic reserves and external-capital gates decide whether outside dependency can threaten the survival floor. | Too loose creates foreign-capital or supplier capture; too strict blocks useful trade. | External trade stress test, supplier concentration audit, reserve adequacy review. | Strategic categories fall below floor or capital controls become arbitrary. | Annex AT. |\n| FC-194 essential fuel reserve minimum | Reserved; draft anchor 60-90 days by region and season | Tier 1 / pre-launch gate | Fuel continuity is a refusal chokepoint for food, heat, emergency transport, and grid recovery. | Too low lets a conglomerate or import shock force capitulation; too high creates stockpile capture and spoilage bureaucracy. | Fuel reserve adequacy model; seasonal logistics drill; refinery and transport dependency audit. | Any region falls below minimum during a 30-day refusal scenario or reserve turnover degrades usable supply. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-195 essential medicine stockpile minimum | Reserved; draft anchor 90-180 days for critical lists | Tier 1 / pre-launch gate | Medicines with fragile supply chains need a longer buffer than ordinary inventory because substitution can be clinically impossible. | Too low lets suppliers, PBMs, or distributors ration access; too high causes expiry waste and favors incumbents with warehousing. | Critical medicine list; expiry and rotation audit; shortage simulation by region and care setting. | Critical medicine availability drops below clinical continuity floor or stock rotation losses become material. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-196 maximum essential supplier concentration | Reserved; draft anchor no supplier above 25% of regional essential throughput | Tier 1 / launch gate | Prevents one firm from becoming the practical veto point for survival-floor delivery. | Too loose permits single-supplier refusal; too strict blocks emergency use of scarce specialist capacity. | Supplier concentration audit; regional substitution map; refusal tabletop exercise. | One supplier can interrupt more than a quarter of regional essential throughput without a public fallback already active. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-197 public fallback activation deadline | Reserved; draft anchor 72 hours for critical interruption, 14 days for managed transition | Tier 1 / activation gate | Refusal protection only works if public or cooperative fallback capacity starts before households hit survival-floor failure. | Too slow lets private operators bargain through delay; too fast may trigger wasteful takeover before facts are verified. | Public fallback readiness drill; emergency procurement rehearsal; legal activation review. | Verified interruption persists past deadline without fallback service or false activations recur. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-198 procurement concentration threshold | Reserved; draft anchor review above 30%, mandatory remediation above 40% of essential category spend | Tier 2 / pre-launch gate | Public purchasing can accidentally rebuild the same conglomerate dependency it is meant to neutralize. | Too loose funnels demand to incumbents; too strict fragments procurement below quality and reliability needs. | Procurement spend audit; vendor capacity review; anti-collusion screen. | Essential procurement share exceeds remediation threshold for two review periods or fragmentation causes delivery failure. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-199 PBM/intermediary separation threshold | Reserved; draft anchor separation review at 10% cross-owned claims or dispensing volume, mandatory firewall above 20% | Tier 1 / launch gate | Pharmacy benefit managers and similar intermediaries can deny access while appearing to manage price or claims. | Too loose lets intermediaries steer patients and suppliers; too strict may disrupt legitimate administrative clearing. | PBM ownership and routing audit; claims-denial review; patient access stress test. | Cross-owned routing exceeds threshold, denial patterns favor affiliated entities, or independent access deteriorates. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-200 critical logistics redundancy floor | Reserved; draft anchor two independent routes and operators per essential region | Tier 1 / launch gate | Stockpiles do not matter if a conglomerate controls the practical path from reserve to household or clinic. | Too low creates carrier or warehouse chokepoints; too high imposes costly duplication in sparse regions. | Logistics dependency map; cold-chain and last-mile drill; emergency carrier substitution test. | A single operator, warehouse, port, rail spur, or cold-chain provider can block regional essential delivery. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-201 essential data and claims portability deadline | Reserved; draft anchor 24 hours for emergency export, 30 days for full transition package | Tier 2 / transition gate | Conglomerate refusal can happen through records, claims, formularies, and routing data even when physical supply exists. | Too loose lets incumbents hold operations hostage; too strict risks unsafe or incomplete data transfer. | Data escrow rehearsal; claims and formulary export audit; receiving-operator validation. | Public fallback cannot adjudicate, dispense, route, or reconcile essential service within deadline. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| RHL protected-channel ceiling | Reserved \u2014 Tier 2 founding commitment; any TFP/RHL ceiling must be re-derived under Annex D protected ordinary use, Annex X stale-purpose rules, Commons Return source-base review, and the Anti-Rent Legal Wrapper Evidence Test Package. | Tier 2 / pre-launch gate | Prevents protected savings or project-finance channels from becoming unlimited shelters for concentrated control while preserving ordinary retirement and household continuity. | Too high shelters concentrated wealth under protected labels; too low blocks ordinary savings, retirement planning, or productive small-operator resilience. | Household savings simulation; concentration impact assessment; source-base avoidance review; legal-wrapper review; comparison with floor needs over 5, 10, and 20 years. | High-balance households use TFP/RHL faster than expected to avoid Commons Return/source-base review, or ordinary retirement savers cannot reach the participation floor. | ANNEX_D; ANNEX_X; Anti-Rent Legal Wrapper Evidence Test Package. |\n| CASP price corridor | \u00b115% of the registered pricing index for the relevant category, adjusted quarterly for verified regional inflation | Tier 2 / operational | Prevents essential-sector suppliers from exploiting captive-buyer position through price spikes, while allowing legitimate cost fluctuation. | Too narrow blocks legitimate price adjustment; too wide defeats the price protection purpose. | Price corridor red team; inflation adjustment audit; supplier profitability review at corridor boundary. | Suppliers systematically price at corridor ceiling or exit when corridor prevents premium pricing. | Annex AT \u00a7AT6.6. |\n| CASP service-level baseline dimensions | Minimum four measurable dimensions co-signed at pre-registration: delivery timeliness, fill rate, quality certification rate, and incident response time; plus any category-specific additions | Tier 2 / operational | Makes degradation trigger (clause d) measurable and enforceable; prevents slow-squeeze through informal service erosion. | Too few dimensions misses degradation; too many dimensions creates gaming through selectively meeting some. | Degradation detection drill; supplier behavior under watch conditions. | Suppliers meet formal dimensions while degrading overall service or dimension gaming becomes observable. | Annex AT \u00a7AT6.6. |\n| CIP absolute funding floor | Reserved \u2014 Tier 2 founding commitment established before CIP constitution; must cover staff for 7 members, independent legal and technical review for 4 Tier-1-touching proposals per year, and publication infrastructure | Tier 2 / pre-launch gate | Prevents under-reporting of Flow issuance as a mechanism for CIP budget suppression below operating capacity. | Too low renders CIP ineffective; too high creates fiscal dependency risk. | CIP operating cost estimate; comparable constitutional body audit. | CIP cannot staff an adversarial review of a Tier-1-touching proposal within its budget or funding-floor breach goes unpublished. | Annex AM \u00a7AM8.3. |\n| FC-T0-01 | Tier 0 aggregate anomaly threshold | 5% of CSM capacity per category | 2%\u201315% | Ombuds via standard FAP | Baseline consumption data from Phase 2 pilot; revisit if physical-fraud rate exceeds threshold in stress test | ANNEX_AK \u00a7AK8.3 |\n\n---\n\n## Maintenance Rule\n\nNo parameter should move from provisional to bound without a row here, an evidence path, and a revision trigger. No parameter should stay bound after evidence shows it is causing the collapse state it was meant to prevent.\n", + "content": "# Parameter Calibration Register\n\nThis register tracks high-risk parameters whose numbers matter enough that they should not remain \"because the document says so.\"\n\nIt complements `/founding/commitments.md` and `architecture/parameter_registry.md`. Those files bind values. This file records why values are plausible, how they should be tested, and what evidence would force revision.\n\n---\n\n## Row Standard\n\nEvery high-risk parameter should eventually have:\n\n| Field | Meaning |\n|---|---|\n| Parameter | FC identifier or named constitutional threshold. |\n| Current value | Bound, provisional, reserved, or proposed value. |\n| Tier | Tier 1, Tier 2, Tier 3, or pre-launch blocking gate. |\n| Why this value exists | Plain-language rationale, not just cross-reference. |\n| Capture route | How a bad actor benefits from this value being too high, too low, vague, or stale. |\n| Evidence needed | Simulation, pilot, audit, legal review, or outside source needed. |\n| Revision trigger | What result forces review. |\n| Governing docs | Where the value is bound and where consequences appear. |\n\n---\n\n## Seed Register\n\n| Parameter | Current value | Tier | Why this value exists | Capture route | Evidence needed | Revision trigger | Governing docs |\n|---|---:|---|---|---|---|---|---|\n| FC-010 leakage thresholds | 3% routine target; 7% systemic review | Tier 1 / active-unproven | Converts shadow-convertibility enforcement capacity into published thresholds. | Too high normalizes broker markets; too low justifies surveillance. | Proxy-market red team; enforcement-capacity audit. | Broker profitability remains positive or ordinary households face overbroad enforcement. | Annex AB; Threat Register T-001. |\n| FC-020 Protected Pause floor | 0.30 Voice | Tier 1 | Prevents hardship from erasing civic continuity. | Too high preserves incumbents; too low punishes illness and care. | Hardship-pause abuse test. | Pause rings preserve roles or genuine hardship users avoid protection. | Annex AF; Service Record Misuse Evidence Test Package. |\n| FC-030 oracle N_MIN | 5 nodes | Tier 1 | Prevents single-source measurement control. | Too low enables capture; too high causes paralysis. | Capacity measurement and oracle-failure drill. | Quorum failure blocks response or correlated error persists. | Annex AL; Capacity Measurement Evidence Test Package. |\n| FC-031 methodology classes | 3 classes | Tier 1 | Reduces shared epistemic failure. | Standards bodies define all classes in their own image. | Methodology-class audit. | Method classes share data, funding, model supply chain, or standards body. | Annex AL; T-020/T-021. |\n| FC-032 pairwise correlation max | 0.30 Pearson, supplemented by directional-bias review | Tier 1 | Makes formal independence testable while preventing same-direction bias from passing merely because co-movement is low. | Actors tune reporting to pass correlation while sharing assumptions or incentives that push all errors in the same direction. | Forecast-vs-actual, directional-bias table, and oracle independence audit. | Shared error exceeds threshold during stress, or same-direction material error recurs without corrective action. | Annex AL; T-020/T-021. |\n| FC-033 adversarial oracle seats | 1 per cohort | Tier 1 | Forces hostile-method review inside measurement. | Seat becomes symbolic or captured by same professional network. | Adversarial-seat independence review. | Dissent never changes outcomes or is not resourced. | Annex AL; T-020/T-021. |\n| FC-040 penalty base multiplier | 5.0x | Tier 1 / active-unproven | Makes detected conversion expected-value negative. | Too low invites arbitrage; too high punishes edge cases harshly. | Annual deterrence audit. | Violations remain profitable or appeals show disproportionate harm. | Annex AJ; T-001/T-007. |\n| FC-041 detection assumption | 0.85 | Tier 1 / active-unproven | Supplies expected-value calculation for penalties. | Overstated detection hides under-enforcement. | Detection-rate audit. | Actual detection probability materially lower than assumed. | Annex AJ; Enforcement Panel audit. |\n| FC-202 Commons Return source-base list | Reserved \u2014 bind before CRUS activation | Tier 1 / pre-launch gate | Defines the closed list of allowed Commons Return bases (land/location value, natural resources, spectrum, monopoly licenses, platform/network rents, high-value concessions, large successions). The list is closed under INV-008: downward extension onto ordinary life is a Tier-1 amendment. | Source-base definitions quietly broadened to reach ordinary labor, homes, tools, or savings. | Source-base mapping pilot and incidence model. | Any base reaches an INV-008-protected category. | ANNEX_D; INVARIANTS INV-008; Commons Return and Universal Stake Evidence Package. |\n| FC-203 Commons Return assessment rate schedule | Reserved \u2014 calibrated by source base before activation | Tier 2 / pre-launch gate | Sets the per-base assessment rate without making ordinary labor or survival access the funding base. | Rates tuned to spare connected asset classes; valuation hiding. | Incidence, valuation-hiding, and external-capital-arbitrage tests. | Burden lands on ordinary households or productive stewardship instead of scarcity privilege. | ANNEX_D; CRUS Simulation Protocol. |\n| FC-204 protected ordinary-use threshold (formerly registered here as FC-052) | Reserved \u2014 bind before CRUS activation; initial reference remains 18 months \u00d7 regional median monthly consumption until replaced by the CRUS fiscal dossier | Tier 2 / pre-launch gate | Defines the ordinary household reserve that may not become the public funding base under Annex D protected-use rules. | Too low reaches ordinary households; too high shelters concentrated control under household labels. | Commons Return incidence model and household/small-operator burden review. | Ordinary households, caregivers, small operators, elders, disabled persons, or rural households bear Commons Return burden meant for scarcity privilege or public-created value. | ANNEX_D; Commons Return and Universal Stake Evidence Package; founding/commitments.md FC-204. |\n| FC-205 Universal Stake distribution cadence | Reserved \u2014 bind before first distribution | Tier 2 / pre-launch gate | Makes Stake timing reliable for households and useless as a political reward instrument; a distribution may be authorized only after the floor and reserves are funded (INV-014). | Distribution timed to elections or withheld as punishment. | Distribution drill with INV-014 ordering check. | Any distribution authorized while floor or reserves underfunded. | ANNEX_D; INVARIANTS INV-014. |\n| FC-206 Universal Stake eligibility rule | Reserved \u2014 bind before first distribution | Tier 1 / pre-launch gate | Keeps the Stake universal and non-convertible (no sale, assignment, garnishment, pledge, inheritance, or purchase of membership/priority/standing/office/Voice). | Eligibility narrowed to exclude the inconvenient; conversion pathways laundered through legal wrappers. | Non-convertibility red team. | Any conversion pathway clears. | ANNEX_D; ANNEX_AK; INVARIANTS INV-002/INV-017. |\n| FC-207 CRUS anti-capture gates | Reserved \u2014 bind before CRUS activation | Tier 1 / pre-launch gate | Public accounting, no patronage discretion, data minimization, auditability, appeal rights. | Fund administrators become patronage allocators. | Capture Dashboard drill. | Discretionary or targeted allocation observed. | ANNEX_D; Capture Dashboard Specification. |\n| FC-208 PFCR / lockbox reserve and routing rule (formerly registered here as FC-054) | Reserved | Tier 2 / pre-launch gate | Splits Commons Return receipts between Essential Access support, public rails, restoration, resilience reserves, infrastructure, and Universal Stake. | Too much to one channel creates fiscal dependency; too little weakens commons funding or turns Universal Stake into political dividend timing. | Fiscal adequacy model, source-base revenue model, lockbox sufficiency test, and burden-incidence review. | PFCR becomes dependent on inflation, hidden debt, or prohibited tax bases; or cannot fund baseline commons. | ANNEX_D; Article V; SPECIFICATIONS; founding/commitments.md FC-208. |\n| FC-209 CRUS appeal path | Bound to the appeal spine (ANNEX_L \u00a7L7): first instance Commons Return assessment review per ANNEX_D \u00a7D6, escalation per the spine \u2014 appeal-path drill still required pre-launch | Tier 1 / pre-launch gate | Human appeal for assessed holders and excluded claimants without letting high-value actors stall assessment. | Procedural delay as avoidance; appeal priced out of reach of the poor claimant. | Appeal-path drill (both directions). | Appeals stall assessment or exclude the unrepresented. | ANNEX_L \u00a7L7; ANNEX_D \u00a7D6; Federated Ombuds. |\n| FC-210 CRUS review cadence | Reserved \u2014 bind before CRUS activation | Tier 2 / pre-launch gate | Scheduled review of incidence, eligibility, valuation, bases, distribution, reserves, capture metrics; a missed cadence is itself a failure. | Review quietly skipped in good years. | Cadence compliance audit. | Missed cadence or missing data. | ANNEX_D; Capture Dashboard Specification; Pilot Evidence Roadmap. |\n| FC-211 ANNEX_AJ bypass-detection retention ceiling | RESERVED \u2014 bind before AJ detection infrastructure activates; draft anchor 90 days post enforcement-matter finality; 180-day ceiling on identifiable hold while no case has formed (open pattern-build); 365-day absolute hard cap from collection, beyond which data must be aggregate or deleted (PII-stripping point unchanged: earliest point consistent with detection per ANNEX_AM \u00a7AM7). The 365-day \"from collection\" cap is anchored per underlying record at first ingestion of that person's data and is never reset by re-derivation, feature re-extraction, or opening a new pattern-build; a pattern-build that has run 180 days without a formed case strips to aggregate regardless of build status. Where enforcement-matter finality + 90 days would exceed 365 days from collection, the 365-day absolute cap governs: identifiable data strips to aggregate at 365 days regardless of whether finality has been reached, and a matter unresolved at 365 days continues on aggregate or case-pseudonym data only. Numeric thresholds may be Restricted-Register (P-021). | Tier 2 / data-practice calibration, pre-launch gate | Closes G-1: the data doctrine requires a published deletion schedule for bypass-detection records; this supplies it without letting a detection asset become open-ended surveillance. Bypass detection earns the longest band because patterns form across cases and time. Bound by the Enforcement Panel + Federated Ombuds. | Identifiable detection data held past need and quietly repurposed into a general-population surveillance asset (the Babel-risk AJ names against itself). | Retention-clock compliance audit; PII-strip-point audit (AM7). | Identifiable hold exceeds the ceiling/cap, or stripping slips past the earliest detection-consistent point. | ANNEX_AJ; Monitoring Administrative Safety Packet; ANNEX_L \u00a7L7; ANNEX_AM \u00a7AM7. |\n| FC-212 ANNEX_AF \u00a7AF3 attestation-graph retention/stripping | RESERVED \u2014 bind before AF3 collusion-detection activates; subgraph purged once the review AND its appeal-spine (ANNEX_L \u00a7L7) window have closed + 30 days; safe-harbor / innocent-explanation cases purged at closure; 180-day ceiling past appeal-window close. PII-stripping point: stripped to a case-pseudonym at intake into the review subgraph, full purge at window-close + 30 days (the graph is inherently identifying in use, so stripping = scope-narrowing + purge per AM7). | Tier 2 / data-practice calibration, pre-launch gate | Closes G-2: supplies the fixed retention schedule and stripping point the AF3 minimization clause and the data doctrine both require, for the most sensitive dataset (the support networks of people in hardship). The vulnerable-person graph retains the least: tied to the appeal-spine close, not to a standing clock. Bound by the ANNEX_AF reviewing body + Federated Ombuds. | A hardship support-network graph kept past the review that justified it, becoming a reusable surveillance asset. | Purge-on-schedule audit; case-pseudonym-at-intake audit. | Graph retained past appeal-close + 30 days or stripping deferred past intake. | ANNEX_AF \u00a7AF3; Monitoring Administrative Safety Packet; ANNEX_L \u00a7L7; ANNEX_AM \u00a7AM7. |\n| FC-213 ANNEX_D \u00a7D6 Commons Return assessment retention/stripping | RESERVED \u2014 bind before CRUS assessment streams operate; assessment data retained until the assessment is final and its ANNEX_L \u00a7L7 appeal window closes + 30 days, then PII-stripped to aggregate; 18-month total identifiable hard cap from collection. PII-stripping point: at assessment finality (the \u00a7D6.5 escalation-tier household-linkable records stripped first; raw household-linkable records never retained past finality + 30 days). Ties to the \u00a7D6.1 Monitoring Purpose Register retention-clock gate (FC-207 anti-capture family). | Tier 2 / data-practice calibration, pre-launch gate | Closes G-3: supplies the stripping point and retention schedule the \u00a7D6.1 minimization clause and the data doctrine both leave open, for household-linkable assessment data. The vulnerable-person dataset retains the least identifiable form: aggregate at finality, household-linkable records stripped first. Bound via the \u00a7D6.1 register gate (FC-207 family). | Household-linkable Commons Return data held past assessment finality and reused for policing, immigration, credit, or social ranking (the \u00a7D6.1 forbidden-reuse list). | Retention-clock audit against the \u00a7D6.1 register; strip-at-finality audit. | Household-linkable records survive past finality + 30 days, or identifiable hold exceeds 18 months. | ANNEX_D \u00a7D6; Monitoring Administrative Safety Packet; ANNEX_L \u00a7L7; ANNEX_AM \u00a7AM7. |\n| FC-214 monitored-person flag expiry | RESERVED \u2014 bind before any individual-flag stream operates; a flag expires (cannot trigger action, cannot be reused) at the earlier of resolution + 30 days, or 180-day max age if never resolved; expiry is an irreversible unlink, not a soft-delete, and is non-extendable (an expired flag is gone, not archived); 365-day absolute cap on flag age. One rule governs all flag streams. | Tier 2 / data-practice calibration, pre-launch gate | Closes G-4: the flag lifecycle says cleared flags expire but never bounds the period; this binds it. Expiry as irreversible unlink \u2014 not archive \u2014 keeps a cleared flag from becoming hidden suspicion. Bound by this packet's owner + the ANNEX_C reviewer. | An \"expired\" flag that is really archived, resurfacing later as civic-standing, employment, lending, or policing leverage against a person already cleared. | Flag-age audit; unlink-irreversibility test. | Any flag persists past 180-day max age (365-day cap), or expiry is reversible/soft. | Monitoring Administrative Safety Packet; ANNEX_C; ANNEX_L \u00a7L7. |\n| Dormant \u00a7D9 backstop schedule (no live FC ID; a revival patch would assign one) | Superseded as an active parameter; no routine balance or net-worth decay schedule is operative unless a new patch, fiscal/dignity evidence, public review, and applicable amendment process revive a narrow dormant backstop. | Dormant / not operative | Preserves historical traceability for the retired demurrage designs without letting old rates govern by accident. The retired idle-balance parameters are tombstoned in founding/commitments.md FC-050\u2013FC-052, FC-054. | If treated as active, it can burden ordinary households, illiquid owners, or working savers while bypassing the Commons Return source-base test. | Dormant-backstop incidence model, dignity review, household burden model, and explicit amendment activation record before any use. | Any document or implementation treats old rates or \u03bb brackets as active, funds Essential Access from them, or applies routine balance/net-worth decay by interpretation. | ANNEX_D \u00a7D1 and \u00a7D9; SPECIFICATIONS. |\n| FC-055 issuance ceiling function | Reserved | Tier 1 / pre-launch gate | Links Flow supply to verified productive commitments. | Too loose inflates claims; too tight starves production. | Flow issuance simulation and productive-commitment audit. | Circulation detaches from real production or needed projects cannot clear. | Article V; SPECIFICATIONS. |\n| FC-058 CSM basket/regional adjustment | Reserved | Tier 1 / regional launch gate | Prevents one abstract basket from ignoring local climate, food, medicine, and shelter needs. | Under-adjustment harms high-need regions; over-adjustment invites political inflation. | Regional CSM pilot and capacity review. | Regional needs are mismeasured or adjustment becomes patronage. | Article III; Annex Y; SPECIFICATIONS. |\n| FC-060 Voice sector ceiling | 0.20 | Tier 1 | Prevents one sector dominating civic weighting. | Sector labels are split or merged to hide concentration. | Capture Dashboard Specification. | Sector concentration remains high through reclassification. | Article VI; Annex AC. |\n| FC-061 per-person cap | See commitments | Tier 1 | Prevents extreme individual civic weight. | Cap can still permit coordinated class control. | Civic-pool concentration review. | Repeat-role networks dominate despite compliance. | Article VI; Annex Z. |\n| FC-062 Service Record decay | See commitments | Tier 1 | Keeps standing tied to recent service. | Slow decay preserves old class; fast decay erases real long-term service. | Service Record misuse and hardship-pause tests. | Role pools become stale or participation becomes burnout. | Annex Z; Annex AF. |\n| FC-070 reserve window | 45 days x CSM x population | Tier 1 | Gives survival floor time during supply shock. | Under-reserve creates rationing; over-reserve creates hoarding bureaucracy. | Capacity stress test by essential category. | Reserves fail before recovery window or drain ordinary supply. | Annex Y; Article III. |\n| FC-071 CSM cluster failure threshold | 3 per 10,000 residents per 30 days | Tier 1 | Detects survival-floor delivery failure. | Too high hides local harm; too low causes noisy emergency churn. | Delivery pilot and small-cell privacy review. | Cluster failures undercount vulnerable groups. | Annex Y; Article VII. |\n| FC-072 Shared Storehouse activation threshold rule | Reserved by category | Tier 1 / activation gate | Prevents emergency rationing from activating on vague scarcity claims. | Too loose normalizes rationing; too strict delays needed protection. | Scarcity activation and unwind drill by essential category. | Shared Storehouse activates without real scarcity or fails during shortage. | Article III; Annex AQ; SPECIFICATIONS. |\n| FC-080 attestation stake ratio | See commitments | Tier 1 | Makes false high-impact attestations costly. | Rich actors buy credibility; poor attestors withdraw. | Attestation market test. | False claims persist or isolated people lose recognition. | Annex AS; Service Record package. |\n| FC-081 audit window | See commitments | Tier 1 | Keeps attestations reviewable long enough to catch false claims. | Too short invites delayed fraud; too long chills honest help. | Attestation/collusion pilot. | Disconfirmations arrive after window or honest attestation drops. | Annex AS. |\n| FC-082 graph density threshold | See commitments | Tier 1 | Protects close-knit communities from automatic collusion penalties. | Rings hide as community density. | Dense-community safe-harbor test. | Mutual-aid networks or fraud rings are misclassified. | Annex AS. |\n| FC-090 Ombuds sub-count | 5 nodes | Tier 1 | Distributes audit authority. | Five offices can still coordinate informally. | Capture Dashboard Specification. | Voting-pattern and staffing overlap exceed threshold. | Annex AI. |\n| FC-091 Ombuds supermajority | 4 of 5 | Tier 1 | Prevents one sub-node from ruling alone. | Minority can block needed correction; majority can coordinate. | Ombuds deadlock and collusion drill. | Repeated 3-2 deadlocks or rubber-stamp 5-0 patterns. | Annex AI. |\n| FC-100 quorum-loss restoration | 14 days | Tier 1 | Limits emergency hold under oracle loss. | Too long normalizes emergency; too short forces unsafe unwind. | Shared Storehouse oracle blackout drill. | Restoration misses reality or holds persist after recovery. | Annex AQ. |\n| FC-110 Tier 1 signatures | 7 of 9 | Tier 1 recursive | Blocks small-coalition amendment of core rules. | Three holders can block; seven can be captured socially. | Keyholder custody and capture review. | Holder concentration or coercion makes threshold easier than assumed. | Amendment Protocol. |\n| FC-111 Tier 1 timelock | 180 days | Tier 1 recursive | Creates public response and exit window. | Delay can be waited out or used for paralysis. | Timelock response drill. | Affected communities cannot understand, challenge, or exit in time. | Amendment Protocol; Drift Chain. |\n| FC-120 exit threshold | 2/3 resident personhood | Tier 1 | Prevents small faction exit capture. | Too high traps dissenters; too low enables hostile breakaway. | Exit rehearsal and participation-barrier audit. | Exit is formal but practically unavailable. | Founding Order. |\n| FC-121 exit unwind | 730 days | Tier 1 | Preserves Essential Access during exit. | Too long becomes exit denial; too short harms dependents. | Exit transition simulation. | Essential services fail or exit becomes punitive. | Founding Order. |\n| FC-140 identity fraud band | target \u22642% / upper bound \u22645% / trigger \u22653% per quarter | Tier 2 / pre-launch gate | Sets starting Essential Access identity-fraud tolerance while keeping fraud visible before it drains physical survival supply. | Over-tightening excludes vulnerable people; over-loosening lets identity fraud consume food, medicine, shelter, or other CSM capacity. | Identity and Recovery Evidence Test Package; Annex AK; founding commitments. | Exclusion rises, fraud drains Essential Access, or pilot evidence shows the band is too loose or too tight for vulnerable populations. | Annex AK; founding/commitments.md. |\n| FC-160-184 contract parameters | Reserved / proposed | Pre-launch gate | Escrow, deployment-window, force-majeure, and inspector-pool controls need calibration. | Loose terms recreate hoarding; tight terms block infrastructure. | Commons Return and Universal Stake Evidence Test Package, project-finance simulation, and procurement red team. | Escrows become protected-capital shelter markets or project finance stalls. | Annex AR; ANNEX_D. |\n| FC-185-193 external trade and strategic floor parameters | Reserved / draft anchors | Tier 1 / Tier 2 mixed | Strategic reserves and external-capital gates decide whether outside dependency can threaten the survival floor. | Too loose creates foreign-capital or supplier capture; too strict blocks useful trade. | External trade stress test, supplier concentration audit, reserve adequacy review. | Strategic categories fall below floor or capital controls become arbitrary. | Annex AT. |\n| FC-194 essential fuel reserve minimum | Reserved; draft anchor 60-90 days by region and season | Tier 1 / pre-launch gate | Fuel continuity is a refusal chokepoint for food, heat, emergency transport, and grid recovery. | Too low lets a conglomerate or import shock force capitulation; too high creates stockpile capture and spoilage bureaucracy. | Fuel reserve adequacy model; seasonal logistics drill; refinery and transport dependency audit. | Any region falls below minimum during a 30-day refusal scenario or reserve turnover degrades usable supply. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-195 essential medicine stockpile minimum | Reserved; draft anchor 90-180 days for critical lists | Tier 1 / pre-launch gate | Medicines with fragile supply chains need a longer buffer than ordinary inventory because substitution can be clinically impossible. | Too low lets suppliers, PBMs, or distributors ration access; too high causes expiry waste and favors incumbents with warehousing. | Critical medicine list; expiry and rotation audit; shortage simulation by region and care setting. | Critical medicine availability drops below clinical continuity floor or stock rotation losses become material. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-196 maximum essential supplier concentration | Reserved; draft anchor no supplier above 25% of regional essential throughput | Tier 1 / launch gate | Prevents one firm from becoming the practical veto point for survival-floor delivery. | Too loose permits single-supplier refusal; too strict blocks emergency use of scarce specialist capacity. | Supplier concentration audit; regional substitution map; refusal tabletop exercise. | One supplier can interrupt more than a quarter of regional essential throughput without a public fallback already active. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-197 public fallback activation deadline | Reserved; draft anchor 72 hours for critical interruption, 14 days for managed transition | Tier 1 / activation gate | Refusal protection only works if public or cooperative fallback capacity starts before households hit survival-floor failure. | Too slow lets private operators bargain through delay; too fast may trigger wasteful takeover before facts are verified. | Public fallback readiness drill; emergency procurement rehearsal; legal activation review. | Verified interruption persists past deadline without fallback service or false activations recur. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-198 procurement concentration threshold | Reserved; draft anchor review above 30%, mandatory remediation above 40% of essential category spend | Tier 2 / pre-launch gate | Public purchasing can accidentally rebuild the same conglomerate dependency it is meant to neutralize. | Too loose funnels demand to incumbents; too strict fragments procurement below quality and reliability needs. | Procurement spend audit; vendor capacity review; anti-collusion screen. | Essential procurement share exceeds remediation threshold for two review periods or fragmentation causes delivery failure. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-199 PBM/intermediary separation threshold | Reserved; draft anchor separation review at 10% cross-owned claims or dispensing volume, mandatory firewall above 20% | Tier 1 / launch gate | Pharmacy benefit managers and similar intermediaries can deny access while appearing to manage price or claims. | Too loose lets intermediaries steer patients and suppliers; too strict may disrupt legitimate administrative clearing. | PBM ownership and routing audit; claims-denial review; patient access stress test. | Cross-owned routing exceeds threshold, denial patterns favor affiliated entities, or independent access deteriorates. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-200 critical logistics redundancy floor | Reserved; draft anchor two independent routes and operators per essential region | Tier 1 / launch gate | Stockpiles do not matter if a conglomerate controls the practical path from reserve to household or clinic. | Too low creates carrier or warehouse chokepoints; too high imposes costly duplication in sparse regions. | Logistics dependency map; cold-chain and last-mile drill; emergency carrier substitution test. | A single operator, warehouse, port, rail spur, or cold-chain provider can block regional essential delivery. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-201 essential data and claims portability deadline | Reserved; draft anchor 24 hours for emergency export, 30 days for full transition package | Tier 2 / transition gate | Conglomerate refusal can happen through records, claims, formularies, and routing data even when physical supply exists. | Too loose lets incumbents hold operations hostage; too strict risks unsafe or incomplete data transfer. | Data escrow rehearsal; claims and formulary export audit; receiving-operator validation. | Public fallback cannot adjudicate, dispense, route, or reconcile essential service within deadline. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| RHL protected-channel ceiling | Reserved \u2014 Tier 2 founding commitment; any TFP/RHL ceiling must be re-derived under Annex D protected ordinary use, Annex X stale-purpose rules, Commons Return source-base review, and the Anti-Rent Legal Wrapper Evidence Test Package. | Tier 2 / pre-launch gate | Prevents protected savings or project-finance channels from becoming unlimited shelters for concentrated control while preserving ordinary retirement and household continuity. | Too high shelters concentrated wealth under protected labels; too low blocks ordinary savings, retirement planning, or productive small-operator resilience. | Household savings simulation; concentration impact assessment; source-base avoidance review; legal-wrapper review; comparison with floor needs over 5, 10, and 20 years. | High-balance households use TFP/RHL faster than expected to avoid Commons Return/source-base review, or ordinary retirement savers cannot reach the participation floor. | ANNEX_D; ANNEX_X; Anti-Rent Legal Wrapper Evidence Test Package. |\n| CASP price corridor | \u00b115% of the registered pricing index for the relevant category, adjusted quarterly for verified regional inflation | Tier 2 / operational | Prevents essential-sector suppliers from exploiting captive-buyer position through price spikes, while allowing legitimate cost fluctuation. | Too narrow blocks legitimate price adjustment; too wide defeats the price protection purpose. | Price corridor red team; inflation adjustment audit; supplier profitability review at corridor boundary. | Suppliers systematically price at corridor ceiling or exit when corridor prevents premium pricing. | Annex AT \u00a7AT6.6. |\n| CASP service-level baseline dimensions | Minimum four measurable dimensions co-signed at pre-registration: delivery timeliness, fill rate, quality certification rate, and incident response time; plus any category-specific additions | Tier 2 / operational | Makes degradation trigger (clause d) measurable and enforceable; prevents slow-squeeze through informal service erosion. | Too few dimensions misses degradation; too many dimensions creates gaming through selectively meeting some. | Degradation detection drill; supplier behavior under watch conditions. | Suppliers meet formal dimensions while degrading overall service or dimension gaming becomes observable. | Annex AT \u00a7AT6.6. |\n| CIP absolute funding floor | Reserved \u2014 Tier 2 founding commitment established before CIP constitution; must cover staff for 7 members, independent legal and technical review for 4 Tier-1-touching proposals per year, and publication infrastructure | Tier 2 / pre-launch gate | Prevents under-reporting of Flow issuance as a mechanism for CIP budget suppression below operating capacity. | Too low renders CIP ineffective; too high creates fiscal dependency risk. | CIP operating cost estimate; comparable constitutional body audit. | CIP cannot staff an adversarial review of a Tier-1-touching proposal within its budget or funding-floor breach goes unpublished. | Annex AM \u00a7AM8.3. |\n| FC-T0-01 | Tier 0 aggregate anomaly threshold | 5% of CSM capacity per category | 2%\u201315% | Ombuds via standard FAP | Baseline consumption data from Phase 2 pilot; revisit if physical-fraud rate exceeds threshold in stress test | ANNEX_AK \u00a7AK8.3 |\n\n---\n\n## Maintenance Rule\n\nNo parameter should move from provisional to bound without a row here, an evidence path, and a revision trigger. No parameter should stay bound after evidence shows it is causing the collapse state it was meant to prevent.\n", "headings": [ { "level": 1, @@ -2758,7 +2763,7 @@ "slug": "maintenance-rule" } ], - "wordCount": 3587, + "wordCount": 4447, "headingCount": 4 }, { @@ -4362,7 +4367,7 @@ "status": "Status: Designed", "statusBucket": "reference", "summary": "This packet is not field evidence. It is an operating safety specification for any monitoring stream the corpus later pilots or deploys.", - "content": "# Monitoring Administrative Safety Packet\n\n**Status:** Designed\n\nThis packet is not field evidence. It is an operating safety specification for any monitoring stream the corpus later pilots or deploys.\n\n**Purpose:** Prevent protective monitoring from becoming a general-purpose surveillance, ranking, punishment, or administrative-control system.\n\n**Governs with:** [Monitoring Repurposing Evidence Test Package](./Monitoring_Repurposing_Evidence_Test_Package.md), [Capture Dashboard Specification](./Capture_Dashboard_Specification.md), [ANNEX_C](../annexes/ANNEX_C.md), [ANNEX_D](../annexes/ANNEX_D.md), [ANNEX_X](../annexes/ANNEX_X.md), [Threat Register](./Threat_Register.md) T-032, and [Patch Log](./Patch_Log.md) P-069.\n\n---\n\n## Plain-Language Summary\n\nThe project needs some monitoring. It must know whether food reaches people, whether providers refuse essential service, whether public money is being misused, whether legal wrappers hide control, and whether dashboards are being gamed.\n\nBut monitoring creates power. A record built to protect someone can later be used to locate them, rank them, shame them, deny them housing, pressure their employer, expose their immigration risk, or punish a community.\n\nThis packet sets the operating rule:\n\n> No monitoring stream may exist first and find its limits later.\n\nBefore a stream operates, the project must name exactly why it exists, what it collects, who can see it, when it dies, who can challenge it, and what uses are forbidden.\n\n---\n\n## Governing Rule\n\nMonitoring is permitted only as a bounded protective instrument.\n\nIt is void if it becomes:\n\n- a score of human worth;\n- a civic eligibility shortcut;\n- a housing, employment, credit, insurance, school, vendor, immigration, policing, or political-screening input;\n- a permanent behavioral file;\n- a hidden enforcement feed;\n- a dashboard that exposes vulnerable people through small cells, timing, location, or repeated-route patterns;\n- an operating-office self-certification tool without independent review.\n\nThe burden is on the monitoring sponsor to prove the stream is necessary, narrow, challengeable, and deletion-bound.\n\n---\n\n## Pre-Operation Gate\n\nNo monitoring stream may collect live data, issue a flag, feed a dashboard, support a quarantine, or trigger an adverse action until all seven gate items are complete.\n\n| Gate | Required artifact | Failure rule |\n|---|---|---|\n| 1. Named purpose | Monitoring Purpose Register row | A stream without a named purpose is void. |\n| 2. Minimum-data design | Field list with why each field is necessary | Any field without a necessity reason is removed. |\n| 3. Lane assignment | Data lane, access roles, and raw-access rule | Raw access without lane assignment is prohibited. |\n| 4. Retention clock | Deletion, aggregation, or irreversible unlinking schedule | No retention clock means no collection. |\n| 5. Appeal path | Plain notice, helper right, reviewer, and maximum clock | Individual flags cannot operate without appeal. |\n| 6. Independent reviewer | Reviewer outside the operating office | Self-certification is not enough. |\n| 7. Forbidden-use list | Explicit secondary uses barred before operation | Unnamed reuse is forbidden by default. |\n\nEmergency collection may not bypass this gate except under the narrow emergency rule in this packet.\n\n---\n\n## Monitoring Purpose Register\n\nThe Monitoring Purpose Register is the operating ledger for monitoring powers. It must be public in aggregate, inspectable by independent reviewers, and understandable to ordinary readers.\n\nEach row must include:\n\n| Field | Required content |\n|---|---|\n| Stream ID | Stable identifier that appears in dashboards, appeals, and audit reports |\n| Plain-language name | What ordinary people would call the stream |\n| Control purpose | The exact threat, patch, annex, metric, or evidence test it supports |\n| Sponsor | Office asking for the stream |\n| Operator | Office or vendor collecting or processing the stream |\n| Independent reviewer | Office or body authorized to inspect the stream |\n| Data fields | Exact fields, source, frequency, and format |\n| Data lane | One of the lanes in this packet |\n| Personal linkability | None, low, medium, or high, with reason |\n| Small-cell risk | Whether small groups, places, routes, or vulnerable cohorts could be exposed |\n| Raw-access rule | Who may see raw records and under what written finding |\n| Retention clock | Deletion, aggregation, or unlinking schedule |\n| Join limits | Which other streams may not be joined |\n| Forbidden uses | Uses barred even if convenient |\n| Flag effects | Whether a flag is advisory, review-triggering, or adverse-action capable |\n| Notice and appeal | How affected people are told, helped, and reviewed |\n| Public output | What aggregate information may be published |\n| Evidence status | Designed, paper-tested, pilot-tested, failed, or suspended |\n\nIf the row is incomplete, the stream cannot operate.\n\n---\n\n## Data Lanes\n\nMonitoring data must be assigned to the least powerful lane that can do the job.\n\n| Lane | Use | Access rule | Public output |\n|---|---|---|---|\n| Lane 0 - Public aggregate | Counts, rates, trend lines, and published thresholds | Public | Published with small-cell suppression and delay |\n| Lane 1 - Reviewer aggregate | Aggregate records with more detail for independent review | Independent reviewer and dashboard method auditor | Published only after suppression |\n| Lane 2 - Entity review | Provider, office, contractor, sponsor, or institutional records | Purpose-bound reviewers with written need | Entity findings only after notice and response where feasible |\n| Lane 3 - Individual flag | Person- or household-linkable flag | Human reviewer, appeal path, and least-harm interim status required | No public person-level output |\n| Lane 4 - Sealed emergency | Temporary raw records during immediate CSM harm or security incident | Time-limited emergency reviewers only | Post-event public summary without identifying details |\n\nLane escalation requires a written finding that lower lanes cannot answer the control purpose. Convenience is not a reason to escalate.\n\n---\n\n## Minimization And Purpose-Limitation Doctrine (P-075)\n\nThis is the corpus's one master statement of data minimization and purpose limitation. Domain texts keep domain substance; this doctrine states the rule. It carries the six-condition baseline formerly stated in the [Monitoring Repurposing Evidence Test Package](./Monitoring_Repurposing_Evidence_Test_Package.md) \u2014 conditions verbatim, with two declared strengthenings: scope broadened from monitoring to any collection of data about persons, and conditions 5\u20136 bound to the appeal spine and the ANNEX_AM \u00a7AM7 stripping standard. That package now tests this doctrine rather than restating it.\n\nAny collection of data about persons, households, providers, or support networks under this corpus is permitted only when all six conditions hold:\n\n1. **Purpose-bound:** the data is collected for a named control and cannot be reused for another purpose without explicit review \u2014 published before reuse, by a reviewer independent of the operating office (for cross-domain joins, the Cross-Domain Linkage Rule below; otherwise [ANNEX_C](../annexes/ANNEX_C.md)'s secondary-use challenge standard).\n2. **Minimum necessary:** the monitoring uses the least personal, least durable, least linkable data that can do the job.\n3. **Aggregation-first:** population, route, office, provider, and category metrics are preferred over individual tracking.\n4. **Office-separated:** the body that operates a service may not be the sole body that interprets its monitoring performance.\n5. **Appealable:** any person affected by an individual-level flag receives notice, plain-language reasons, and a path to human review ([ANNEX_C](../annexes/ANNEX_C.md); appeal spine, [ANNEX_L \u00a7L7](../annexes/ANNEX_L.md)).\n6. **Deletion-bound:** raw monitoring data expires or is transformed into non-identifying aggregate records on a published schedule. Where publication is involved, PII stripping follows the [ANNEX_AM \u00a7AM7](../annexes/ANNEX_AM.md) standard.\n\nA tool that cannot satisfy these conditions must be redesigned, narrowed, or explicitly recorded as a residual risk before it is used.\n\n---\n\n## Per-Domain Calibration Table (P-075)\n\nThis table records each domain's actual current rule from live text. Where a domain is stricter than the doctrine, the stricter rule governs \u2014 calibration never averages a protection down. \"Unspecified \u2014 gap\" is an honest gap, not permission. A domain operating inside a gap cell is governed by the doctrine's defaults until the gap is closed: no published retention schedule means no collection of identifiable data, and unnamed reuse is forbidden. A gap cell may be cited only as a reason to close the gap, never as authority to act within it.\n\n| Domain | Data | PII-stripping point | Retention | Access role | Purpose boundary |\n|---|---|---|---|---|---|\n| Monitoring streams generally (this packet) | Per-stream register field list | Set per register row; no global point \u2014 unspecified \u2014 gap pending register | \"Deletion, aggregation, or unlinking schedule\" per row; \"No retention clock means no collection\" | Per data lane (Lanes 0\u20134) and register row | Named control purpose; forbidden-use list; unnamed reuse forbidden by default |\n| Bypass detection ([ANNEX_AJ](../annexes/ANNEX_AJ.md), P-004 protected) | Vendor-level and population-level bypass-pattern data | \"PII-stripped at the earliest point consistent with detection (per Annex AM)\" | \"Retained only for the bounded period necessary to establish patterns and adjudicate findings and is then deleted\"; fixed period unspecified \u2014 gap | Enforcement Panel and mandated detection staff (ANNEX_AJ) | Bypass-detection and AJ \u00a74 enforcement only; \"never repurposed for general population surveillance, civic scoring, eligibility determination, commercial use\" (P-004-protected clause, quoted unmodified) |\n| Hardship attestation graph ([ANNEX_AF \u00a7AF3](../annexes/ANNEX_AF.md)) | Support-network attestation graph | Inherently identifying in use; access narrowed to \"only the subgraph relevant to the case under review\"; stripping point unspecified \u2014 gap | \"Purged on a fixed retention schedule once a review and its appeal window have closed\"; safe-harbor and innocent-explanation cases \"purged at closure\"; schedule length unspecified \u2014 gap | Reviewing bodies in active review only; access logged (ANNEX_AF \u00a7AF3) | Exploitation review only; no export, sale, or sharing (ANNEX_AF \u00a7AF3) |\n| Tier-0 identity ([ANNEX_AK \u00a7AK8.1](../annexes/ANNEX_AK.md)) | Single-session pseudonymous token; allocation count | By construction: \"No persistent identifier is created\"; node records consumption \"not by whom\" | None beyond session; \"infrastructure cannot reconstruct session linkage after the session closes\" | Issuing node; Federated Ombuds aggregate-only after 30+ days of anomaly (ANNEX_AK \u00a7AK8.1) | Tier-0 allocation accounting; individual-level investigation prohibited (ANNEX_AK \u00a7AK8.1) |\n| Commons Return assessment ([ANNEX_D \u00a7D6](../annexes/ANNEX_D.md)) | \"Only the data needed to determine the named source base, protected ordinary use, and beneficial control\" | Unspecified \u2014 gap | Unspecified \u2014 gap | Assessors; household-linkable escalation only via D6.5 independent finding | Named source-base determination; forbidden-reuse list (ANNEX_D \u00a7D6.1) |\n| Monitored-person flags ([ANNEX_C](../annexes/ANNEX_C.md) + flag lifecycle above) | Anomaly, fraud, and coercion flags on identifiable people | Unspecified \u2014 gap | \"Unresolved or cleared flags expire and cannot be reused\"; expiry period unspecified \u2014 gap | Named human reviewer; Federated Ombuds escalation | Register-named control purpose; secondary use requires published review (ANNEX_C) |\n| Capture Dashboard ([Capture Dashboard Specification](./Capture_Dashboard_Specification.md)) | Aggregate capture metrics from register-cited streams only | Before publication: \"aggregation, small-cell suppression, delay, and privacy-preserving methods\" | Per the cited register row | Dashboard office with no hidden raw-data access (this packet's dashboard rules); dashboard method auditor | Public accountability metrics only; every metric cites a register row before publication (Capture Dashboard Specification) |\n\n---\n\n## Cross-Domain Linkage Rule (P-075)\n\nJoining two domains' data is never an operational decision. Before use, a join requires: (1) both domains' register rows (or domain-equivalent governing clauses) permit the join \u2014 silence forbids; (2) a written finding by an independent reviewer outside both operating offices that no less-intrusive method answers the named purpose (the [ANNEX_D \u00a7D6.5](../annexes/ANNEX_D.md) standard, generalized); (3) publication of the finding before use, challengeable under [ANNEX_C](../annexes/ANNEX_C.md)'s secondary-use challenge, with the challenged join paused unless an emergency finding \u2014 published by a reviewer independent of both operating offices \u2014 states why delay would create immediate CSM harm. An emergency finding expires after 30 days unless renewed by the same standard, and the underlying challenge is resolved on its merits regardless of the emergency; if the challenge succeeds, the join's products fall under the inadmissibility rule from that point. A join executed without these is void and its products are inadmissible in any adverse action. Inadmissibility attaches to the join's products, not to the underlying facts: evidence independently obtained through an authorized process is unaffected, and executing an unauthorized join is itself a sanctionable act that confers no immunity on anyone.\n\n---\n\n## Drift Rule (P-075)\n\nThis doctrine is the canonical home for data minimization and purpose limitation (P-073 canonical-home discipline); domains cite this standard and keep only domain-specific substance \u2014 their data, thresholds, reviewer, purpose boundary. The discipline's stricter-text exception is most load-bearing here, because a domain may always guard a person's data more tightly than the floor: notably ANNEX_AJ's P-004-protected purpose-limitation clause is recorded in the calibration table unmodified and never relaxed from here. Enforcement: a weaker domain data rule yields to the stricter, per the burden and appealability the discipline sets.\n\n---\n\n## Raw-Access Rule\n\nRaw data is the most dangerous monitoring form. It may be accessed only when all conditions are met:\n\n1. the Monitoring Purpose Register row permits raw access;\n2. the requested access matches the named purpose;\n3. the requester states the exact fields needed;\n4. an independent reviewer records why aggregate or entity-level data is insufficient;\n5. access is time-limited;\n6. access is logged;\n7. the affected person receives notice if the access can support an individual adverse action, unless a short emergency delay is independently justified.\n\nRaw data may not be copied into a general repository, training dataset, search index, permanent risk model, or cross-office file.\n\n---\n\n## Flag Lifecycle\n\nA flag is not proof. It is a claim that must be handled carefully.\n\nEvery flag must move through this lifecycle:\n\n1. **Signal:** a rule-defined pattern is detected.\n2. **Triage:** a human or independent reviewer decides whether the signal is likely error, benign variance, abuse risk, or immediate harm.\n3. **Notice:** if the flag can affect a person, household, provider, or protected ordinary use, the affected party receives a plain-language explanation.\n4. **Least-harm interim status:** unresolved suspicion may not freeze Essential Access, ordinary household access, wage receipt, essential-provider continuity, protected ordinary use, or necessary care.\n5. **Review:** the affected party may challenge the flag with a human reviewer and trusted helper.\n6. **Decision:** the reviewer records the evidence, rule, remedy, and appeal result.\n7. **Correction:** wrong data is corrected at the source and propagated to every dependent record.\n8. **Expiration:** unresolved or cleared flags expire and cannot be reused.\n\nCleared flags may not become hidden suspicion. They cannot be used later for civic standing, housing, employment, lending, vendor access, provider exclusion, ranking, immigration action, policing, or unrelated enforcement.\n\n---\n\n## Appeal And Helper Rights\n\nAny person affected by an individual-level flag, quarantine, assessment, source-base review, identity decision, delivery denial, provider refusal claim, or monitoring-derived adverse action has the right to:\n\n- plain-language notice;\n- the exact rule and evidence basis;\n- oral explanation where needed;\n- translation and offline access;\n- a named human reviewer;\n- a trusted helper, navigator, advocate, family member, faith-community support, or community representative;\n- review before the same flag is treated as proof;\n- correction of erroneous data;\n- a written outcome;\n- escalation to the relevant Ombuds path.\n\nAppeal design must be tested with elderly, disabled, low-literacy, rural, undocumented, safety-shielded, caregiver, digitally fragile, and low-income users.\n\n---\n\n## Emergency Use\n\nEmergency monitoring may occur only to prevent immediate CSM harm, preserve essential delivery, contain active fraud causing direct survival harm, or respond to a live security incident.\n\nEmergency use is bounded by:\n\n- shortest feasible duration;\n- narrowest field set;\n- no unrelated enforcement use;\n- no public person-level output;\n- independent after-action review;\n- public post-mortem within the ordinary emergency-reporting window;\n- deletion or irreversible aggregation after the emergency window closes.\n\nEmergency monitoring may not become a standing feed. Renewal requires a new written finding and review.\n\n---\n\n## Dashboard Publication Limits\n\nDashboards exist to show institutional power and system health, not to expose ordinary people.\n\nDashboard publication must use:\n\n- aggregation-first reporting;\n- small-cell suppression;\n- delay where live data would expose people or help adversaries;\n- method publication;\n- threshold publication;\n- clear distinction between absence of evidence and clean status;\n- no ranking of ordinary persons;\n- no household, route, whistleblower, or vulnerable-cohort exposure;\n- no hidden raw-data access by the dashboard office.\n\nIf a dashboard cannot publish a metric safely, it must publish the reason the metric is suppressed rather than silently omitting the domain.\n\n---\n\n## Vendor And Tool Controls\n\nNo vendor, contractor, model provider, analytics tool, fraud tool, identity service, payment processor, dashboard host, or data warehouse may receive monitoring data unless the contract includes:\n\n- purpose limitation;\n- no secondary use;\n- no model training or product improvement from protected data without explicit public approval;\n- no sale, brokerage, enrichment, or external matching;\n- deletion and return obligations;\n- audit access;\n- breach notice;\n- subcontractor disclosure;\n- jurisdiction and remedy terms;\n- no claim that vendor policy overrides corpus protections.\n\nVendor convenience cannot justify expanding monitoring powers.\n\n---\n\n## Public-Reader Promise\n\nAn ordinary person should be able to read the public version of the Monitoring Purpose Register and know:\n\n- what is being watched;\n- why it is being watched;\n- whether people can be identified;\n- who can see it;\n- when it disappears;\n- what uses are forbidden;\n- how to challenge a flag;\n- who reviews the office doing the watching.\n\nIf a reader cannot understand that, the monitoring design has failed its public-comprehension gate.\n\n---\n\n## Required Evidence Artifacts\n\nBefore the project may claim that monitoring is bounded and non-surveillant, it must produce:\n\n1. complete Monitoring Purpose Register;\n2. lane-assignment table for every stream;\n3. raw-access log sample and review standard;\n4. retention and deletion proof;\n5. flag-lifecycle drill results;\n6. cleared-flag reuse test;\n7. small-cell and linkability test;\n8. purpose-creep red-team report;\n9. office-separation drill;\n10. emergency-use after-action sample;\n11. vendor contract standard;\n12. public-comprehension test with ordinary readers.\n\nUntil those artifacts exist, the honest claim is:\n\n> The corpus has designed administrative safety rules for monitoring, but it has not proven that monitoring can operate without surveillance or coercive reuse.\n\n---\n\n## Christ-Centered Dignity Test\n\nThis packet is a human-made guardrail. It does not baptize monitoring as righteous. It asks whether a necessary civil instrument remains subordinate to love of neighbor, care for the poor, truthful witness, and refusal to treat people as inventory.\n\nFor any monitoring stream, reviewers must ask:\n\n- Does this protect the person in need, or make them legible for control?\n- Does it expose the poor more than the powerful?\n- Does it make the watched person able to answer, appeal, and be heard?\n- Does it preserve mercy for error, disability, confusion, displacement, and hardship?\n- Would the same rule restrain the powerful office that wants the data?\n\nThe fruit test is not a cleaner dashboard. The fruit test is whether people are fed, housed, healed, heard, and protected without being watched, ranked, priced, or managed as objects.\n\n---\n\n## Residual Risk\n\nMonitoring always creates danger. The safest stream is the one never collected. When monitoring is necessary, it should be narrow, temporary, reviewable, and humble.\n\nThis packet reduces administrative danger. It does not eliminate it. If tests show that monitoring cannot protect people without building coercive infrastructure, the corpus must prefer less monitoring, slower enforcement, or redesigned protections over a system that sees everyone too well.\n", + "content": "# Monitoring Administrative Safety Packet\n\n**Status:** Designed\n\nThis packet is not field evidence. It is an operating safety specification for any monitoring stream the corpus later pilots or deploys.\n\n**Purpose:** Prevent protective monitoring from becoming a general-purpose surveillance, ranking, punishment, or administrative-control system.\n\n**Governs with:** [Monitoring Repurposing Evidence Test Package](./Monitoring_Repurposing_Evidence_Test_Package.md), [Capture Dashboard Specification](./Capture_Dashboard_Specification.md), [ANNEX_C](../annexes/ANNEX_C.md), [ANNEX_D](../annexes/ANNEX_D.md), [ANNEX_X](../annexes/ANNEX_X.md), [Threat Register](./Threat_Register.md) T-032, and [Patch Log](./Patch_Log.md) P-069.\n\n---\n\n## Plain-Language Summary\n\nThe project needs some monitoring. It must know whether food reaches people, whether providers refuse essential service, whether public money is being misused, whether legal wrappers hide control, and whether dashboards are being gamed.\n\nBut monitoring creates power. A record built to protect someone can later be used to locate them, rank them, shame them, deny them housing, pressure their employer, expose their immigration risk, or punish a community.\n\nThis packet sets the operating rule:\n\n> No monitoring stream may exist first and find its limits later.\n\nBefore a stream operates, the project must name exactly why it exists, what it collects, who can see it, when it dies, who can challenge it, and what uses are forbidden.\n\n---\n\n## Governing Rule\n\nMonitoring is permitted only as a bounded protective instrument.\n\nIt is void if it becomes:\n\n- a score of human worth;\n- a civic eligibility shortcut;\n- a housing, employment, credit, insurance, school, vendor, immigration, policing, or political-screening input;\n- a permanent behavioral file;\n- a hidden enforcement feed;\n- a dashboard that exposes vulnerable people through small cells, timing, location, or repeated-route patterns;\n- an operating-office self-certification tool without independent review.\n\nThe burden is on the monitoring sponsor to prove the stream is necessary, narrow, challengeable, and deletion-bound.\n\n---\n\n## Pre-Operation Gate\n\nNo monitoring stream may collect live data, issue a flag, feed a dashboard, support a quarantine, or trigger an adverse action until all seven gate items are complete.\n\n| Gate | Required artifact | Failure rule |\n|---|---|---|\n| 1. Named purpose | Monitoring Purpose Register row | A stream without a named purpose is void. |\n| 2. Minimum-data design | Field list with why each field is necessary | Any field without a necessity reason is removed. |\n| 3. Lane assignment | Data lane, access roles, and raw-access rule | Raw access without lane assignment is prohibited. |\n| 4. Retention clock | Deletion, aggregation, or irreversible unlinking schedule | No retention clock means no collection. |\n| 5. Appeal path | Plain notice, helper right, reviewer, and maximum clock | Individual flags cannot operate without appeal. |\n| 6. Independent reviewer | Reviewer outside the operating office | Self-certification is not enough. |\n| 7. Forbidden-use list | Explicit secondary uses barred before operation | Unnamed reuse is forbidden by default. |\n\nEmergency collection may not bypass this gate except under the narrow emergency rule in this packet.\n\n---\n\n## Monitoring Purpose Register\n\nThe Monitoring Purpose Register is the operating ledger for monitoring powers. It must be public in aggregate, inspectable by independent reviewers, and understandable to ordinary readers.\n\nEach row must include:\n\n| Field | Required content |\n|---|---|\n| Stream ID | Stable identifier that appears in dashboards, appeals, and audit reports |\n| Plain-language name | What ordinary people would call the stream |\n| Control purpose | The exact threat, patch, annex, metric, or evidence test it supports |\n| Sponsor | Office asking for the stream |\n| Operator | Office or vendor collecting or processing the stream |\n| Independent reviewer | Office or body authorized to inspect the stream |\n| Data fields | Exact fields, source, frequency, and format |\n| Data lane | One of the lanes in this packet |\n| Personal linkability | None, low, medium, or high, with reason |\n| Small-cell risk | Whether small groups, places, routes, or vulnerable cohorts could be exposed |\n| Raw-access rule | Who may see raw records and under what written finding |\n| Retention clock | Deletion, aggregation, or unlinking schedule |\n| Join limits | Which other streams may not be joined |\n| Forbidden uses | Uses barred even if convenient |\n| Flag effects | Whether a flag is advisory, review-triggering, or adverse-action capable |\n| Notice and appeal | How affected people are told, helped, and reviewed |\n| Public output | What aggregate information may be published |\n| Evidence status | Designed, paper-tested, pilot-tested, failed, or suspended |\n\nIf the row is incomplete, the stream cannot operate.\n\n---\n\n## Data Lanes\n\nMonitoring data must be assigned to the least powerful lane that can do the job.\n\n| Lane | Use | Access rule | Public output |\n|---|---|---|---|\n| Lane 0 - Public aggregate | Counts, rates, trend lines, and published thresholds | Public | Published with small-cell suppression and delay |\n| Lane 1 - Reviewer aggregate | Aggregate records with more detail for independent review | Independent reviewer and dashboard method auditor | Published only after suppression |\n| Lane 2 - Entity review | Provider, office, contractor, sponsor, or institutional records | Purpose-bound reviewers with written need | Entity findings only after notice and response where feasible |\n| Lane 3 - Individual flag | Person- or household-linkable flag | Human reviewer, appeal path, and least-harm interim status required | No public person-level output |\n| Lane 4 - Sealed emergency | Temporary raw records during immediate CSM harm or security incident | Time-limited emergency reviewers only | Post-event public summary without identifying details |\n\nLane escalation requires a written finding that lower lanes cannot answer the control purpose. Convenience is not a reason to escalate.\n\n---\n\n## Minimization And Purpose-Limitation Doctrine (P-075)\n\nThis is the corpus's one master statement of data minimization and purpose limitation. Domain texts keep domain substance; this doctrine states the rule. It carries the six-condition baseline formerly stated in the [Monitoring Repurposing Evidence Test Package](./Monitoring_Repurposing_Evidence_Test_Package.md) \u2014 conditions verbatim, with two declared strengthenings: scope broadened from monitoring to any collection of data about persons, and conditions 5\u20136 bound to the appeal spine and the ANNEX_AM \u00a7AM7 stripping standard. That package now tests this doctrine rather than restating it.\n\nAny collection of data about persons, households, providers, or support networks under this corpus is permitted only when all six conditions hold:\n\n1. **Purpose-bound:** the data is collected for a named control and cannot be reused for another purpose without explicit review \u2014 published before reuse, by a reviewer independent of the operating office (for cross-domain joins, the Cross-Domain Linkage Rule below; otherwise [ANNEX_C](../annexes/ANNEX_C.md)'s secondary-use challenge standard).\n2. **Minimum necessary:** the monitoring uses the least personal, least durable, least linkable data that can do the job.\n3. **Aggregation-first:** population, route, office, provider, and category metrics are preferred over individual tracking.\n4. **Office-separated:** the body that operates a service may not be the sole body that interprets its monitoring performance.\n5. **Appealable:** any person affected by an individual-level flag receives notice, plain-language reasons, and a path to human review ([ANNEX_C](../annexes/ANNEX_C.md); appeal spine, [ANNEX_L \u00a7L7](../annexes/ANNEX_L.md)).\n6. **Deletion-bound:** raw monitoring data expires or is transformed into non-identifying aggregate records on a published schedule. Where publication is involved, PII stripping follows the [ANNEX_AM \u00a7AM7](../annexes/ANNEX_AM.md) standard. The default retention spine is: identifiable data is deleted at appeal-window-close + 30 days, with a hard cap and no collection absent a published schedule; FC-211\u2013FC-214 are the per-domain deviations from this spine (bypass-detection retains longest, vulnerable-person datasets least).\n\nA tool that cannot satisfy these conditions must be redesigned, narrowed, or explicitly recorded as a residual risk before it is used.\n\n---\n\n## Per-Domain Calibration Table (P-075)\n\nThis table records each domain's actual current rule from live text. Where a domain is stricter than the doctrine, the stricter rule governs \u2014 calibration never averages a protection down. \"Unspecified \u2014 gap\" is an honest gap, not permission. A domain operating inside a gap cell is governed by the doctrine's defaults until the gap is closed: no published retention schedule means no collection of identifiable data, and unnamed reuse is forbidden. A gap cell may be cited only as a reason to close the gap, never as authority to act within it. Where no appeal is filed, the L7 appeal window is deemed closed for retention-clock purposes 30 days after constructive receipt of the adverse or closure notice ([ANNEX_L \u00a7L7.1](../annexes/ANNEX_L.md)); the L7.1 defective-notice extension tolls the re-opening of an appeal but does not suspend the retention clock, and a later-revived appeal triggers re-collection from the source rather than retention of the stripped record.\n\n| Domain | Data | PII-stripping point | Retention | Access role | Purpose boundary |\n|---|---|---|---|---|---|\n| Monitoring streams generally (this packet) | Per-stream register field list | Set per register row; no global point \u2014 unspecified \u2014 gap pending register | \"Deletion, aggregation, or unlinking schedule\" per row; \"No retention clock means no collection\" | Per data lane (Lanes 0\u20134) and register row | Named control purpose; forbidden-use list; unnamed reuse forbidden by default |\n| Bypass detection ([ANNEX_AJ](../annexes/ANNEX_AJ.md), P-004 protected) | Vendor-level and population-level bypass-pattern data | \"PII-stripped at the earliest point consistent with detection (per Annex AM)\" | \"Retained only for the bounded period necessary to establish patterns and adjudicate findings and is then deleted\"; Reserved (FC-211): finality + 90d; 180d open-build ceiling; 365d hard cap | Enforcement Panel and mandated detection staff (ANNEX_AJ) | Bypass-detection and AJ \u00a74 enforcement only; \"never repurposed for general population surveillance, civic scoring, eligibility determination, commercial use\" (P-004-protected clause, quoted unmodified) |\n| Hardship attestation graph ([ANNEX_AF \u00a7AF3](../annexes/ANNEX_AF.md)) | Support-network attestation graph | Inherently identifying in use; access narrowed to \"only the subgraph relevant to the case under review\"; Reserved (FC-212): case-pseudonym at intake; full purge at appeal-close + 30d (per AM7) | \"Purged on a fixed retention schedule once a review and its appeal window have closed\"; safe-harbor and innocent-explanation cases \"purged at closure\"; Reserved (FC-212): appeal-close + 30d; 180d ceiling | Reviewing bodies in active review only; access logged (ANNEX_AF \u00a7AF3) | Exploitation review only; no export, sale, or sharing (ANNEX_AF \u00a7AF3) |\n| Tier-0 identity ([ANNEX_AK \u00a7AK8.1](../annexes/ANNEX_AK.md)) | Single-session pseudonymous token; allocation count | By construction: \"No persistent identifier is created\"; node records consumption \"not by whom\" | None beyond session; \"infrastructure cannot reconstruct session linkage after the session closes\" | Issuing node; Federated Ombuds aggregate-only after 30+ days of anomaly (ANNEX_AK \u00a7AK8.1) | Tier-0 allocation accounting; individual-level investigation prohibited (ANNEX_AK \u00a7AK8.1) |\n| Commons Return assessment ([ANNEX_D \u00a7D6](../annexes/ANNEX_D.md)) | \"Only the data needed to determine the named source base, protected ordinary use, and beneficial control\" | Reserved (FC-213): at assessment finality (D6.5 records first) | Reserved (FC-213): appeal-close + 30d to strip; 18-month cap | Assessors; household-linkable escalation only via D6.5 independent finding | Named source-base determination; forbidden-reuse list (ANNEX_D \u00a7D6.1) |\n| Monitored-person flags ([ANNEX_C](../annexes/ANNEX_C.md) + flag lifecycle above) | Anomaly, fraud, and coercion flags on identifiable people | Unspecified \u2014 gap | \"Unresolved or cleared flags expire and cannot be reused\"; Reserved (FC-214): resolution + 30d; 180d max age; 365d cap | Named human reviewer; Federated Ombuds escalation | Register-named control purpose; secondary use requires published review (ANNEX_C) |\n| Capture Dashboard ([Capture Dashboard Specification](./Capture_Dashboard_Specification.md)) | Aggregate capture metrics from register-cited streams only | Before publication: \"aggregation, small-cell suppression, delay, and privacy-preserving methods\" | Per the cited register row | Dashboard office with no hidden raw-data access (this packet's dashboard rules); dashboard method auditor | Public accountability metrics only; every metric cites a register row before publication (Capture Dashboard Specification) |\n\n---\n\n## Cross-Domain Linkage Rule (P-075)\n\nJoining two domains' data is never an operational decision. Before use, a join requires: (1) both domains' register rows (or domain-equivalent governing clauses) permit the join \u2014 silence forbids; (2) a written finding by an independent reviewer outside both operating offices that no less-intrusive method answers the named purpose (the [ANNEX_D \u00a7D6.5](../annexes/ANNEX_D.md) standard, generalized); (3) publication of the finding before use, challengeable under [ANNEX_C](../annexes/ANNEX_C.md)'s secondary-use challenge, with the challenged join paused unless an emergency finding \u2014 published by a reviewer independent of both operating offices \u2014 states why delay would create immediate CSM harm. An emergency finding expires after 30 days unless renewed by the same standard, and the underlying challenge is resolved on its merits regardless of the emergency; if the challenge succeeds, the join's products fall under the inadmissibility rule from that point. A join executed without these is void and its products are inadmissible in any adverse action. Inadmissibility attaches to the join's products, not to the underlying facts: evidence independently obtained through an authorized process is unaffected, and executing an unauthorized join is itself a sanctionable act that confers no immunity on anyone.\n\n---\n\n## Drift Rule (P-075)\n\nThis doctrine is the canonical home for data minimization and purpose limitation (P-073 canonical-home discipline); domains cite this standard and keep only domain-specific substance \u2014 their data, thresholds, reviewer, purpose boundary. The discipline's stricter-text exception is most load-bearing here, because a domain may always guard a person's data more tightly than the floor: notably ANNEX_AJ's P-004-protected purpose-limitation clause is recorded in the calibration table unmodified and never relaxed from here. Enforcement: a weaker domain data rule yields to the stricter, per the burden and appealability the discipline sets.\n\n---\n\n## Raw-Access Rule\n\nRaw data is the most dangerous monitoring form. It may be accessed only when all conditions are met:\n\n1. the Monitoring Purpose Register row permits raw access;\n2. the requested access matches the named purpose;\n3. the requester states the exact fields needed;\n4. an independent reviewer records why aggregate or entity-level data is insufficient;\n5. access is time-limited;\n6. access is logged;\n7. the affected person receives notice if the access can support an individual adverse action, unless a short emergency delay is independently justified.\n\nRaw data may not be copied into a general repository, training dataset, search index, permanent risk model, or cross-office file.\n\n---\n\n## Flag Lifecycle\n\nA flag is not proof. It is a claim that must be handled carefully.\n\nEvery flag must move through this lifecycle:\n\n1. **Signal:** a rule-defined pattern is detected.\n2. **Triage:** a human or independent reviewer decides whether the signal is likely error, benign variance, abuse risk, or immediate harm.\n3. **Notice:** if the flag can affect a person, household, provider, or protected ordinary use, the affected party receives a plain-language explanation.\n4. **Least-harm interim status:** unresolved suspicion may not freeze Essential Access, ordinary household access, wage receipt, essential-provider continuity, protected ordinary use, or necessary care.\n5. **Review:** the affected party may challenge the flag with a human reviewer and trusted helper.\n6. **Decision:** the reviewer records the evidence, rule, remedy, and appeal result.\n7. **Correction:** wrong data is corrected at the source and propagated to every dependent record.\n8. **Expiration:** unresolved or cleared flags expire and cannot be reused. A flag expires \u2014 irreversibly unlinked, not archived \u2014 at the earlier of resolution + 30 days or a 180-day max age, with a 365-day absolute cap (FC-214, RESERVED).\n\nCleared flags may not become hidden suspicion. They cannot be used later for civic standing, housing, employment, lending, vendor access, provider exclusion, ranking, immigration action, policing, or unrelated enforcement.\n\n---\n\n## Appeal And Helper Rights\n\nAny person affected by an individual-level flag, quarantine, assessment, source-base review, identity decision, delivery denial, provider refusal claim, or monitoring-derived adverse action has the right to:\n\n- plain-language notice;\n- the exact rule and evidence basis;\n- oral explanation where needed;\n- translation and offline access;\n- a named human reviewer;\n- a trusted helper, navigator, advocate, family member, faith-community support, or community representative;\n- review before the same flag is treated as proof;\n- correction of erroneous data;\n- a written outcome;\n- escalation to the relevant Ombuds path.\n\nAppeal design must be tested with elderly, disabled, low-literacy, rural, undocumented, safety-shielded, caregiver, digitally fragile, and low-income users.\n\n---\n\n## Emergency Use\n\nEmergency monitoring may occur only to prevent immediate CSM harm, preserve essential delivery, contain active fraud causing direct survival harm, or respond to a live security incident.\n\nEmergency use is bounded by:\n\n- shortest feasible duration;\n- narrowest field set;\n- no unrelated enforcement use;\n- no public person-level output;\n- independent after-action review;\n- public post-mortem within the ordinary emergency-reporting window;\n- deletion or irreversible aggregation after the emergency window closes.\n\nEmergency monitoring may not become a standing feed. Renewal requires a new written finding and review.\n\n---\n\n## Dashboard Publication Limits\n\nDashboards exist to show institutional power and system health, not to expose ordinary people.\n\nDashboard publication must use:\n\n- aggregation-first reporting;\n- small-cell suppression;\n- delay where live data would expose people or help adversaries;\n- method publication;\n- threshold publication;\n- clear distinction between absence of evidence and clean status;\n- no ranking of ordinary persons;\n- no household, route, whistleblower, or vulnerable-cohort exposure;\n- no hidden raw-data access by the dashboard office.\n\nIf a dashboard cannot publish a metric safely, it must publish the reason the metric is suppressed rather than silently omitting the domain.\n\n---\n\n## Vendor And Tool Controls\n\nNo vendor, contractor, model provider, analytics tool, fraud tool, identity service, payment processor, dashboard host, or data warehouse may receive monitoring data unless the contract includes:\n\n- purpose limitation;\n- no secondary use;\n- no model training or product improvement from protected data without explicit public approval;\n- no sale, brokerage, enrichment, or external matching;\n- deletion and return obligations;\n- audit access;\n- breach notice;\n- subcontractor disclosure;\n- jurisdiction and remedy terms;\n- no claim that vendor policy overrides corpus protections.\n\nVendor convenience cannot justify expanding monitoring powers.\n\n---\n\n## Public-Reader Promise\n\nAn ordinary person should be able to read the public version of the Monitoring Purpose Register and know:\n\n- what is being watched;\n- why it is being watched;\n- whether people can be identified;\n- who can see it;\n- when it disappears;\n- what uses are forbidden;\n- how to challenge a flag;\n- who reviews the office doing the watching.\n\nIf a reader cannot understand that, the monitoring design has failed its public-comprehension gate.\n\n---\n\n## Required Evidence Artifacts\n\nBefore the project may claim that monitoring is bounded and non-surveillant, it must produce:\n\n1. complete Monitoring Purpose Register;\n2. lane-assignment table for every stream;\n3. raw-access log sample and review standard;\n4. retention and deletion proof;\n5. flag-lifecycle drill results;\n6. cleared-flag reuse test;\n7. small-cell and linkability test;\n8. purpose-creep red-team report;\n9. office-separation drill;\n10. emergency-use after-action sample;\n11. vendor contract standard;\n12. public-comprehension test with ordinary readers.\n\nUntil those artifacts exist, the honest claim is:\n\n> The corpus has designed administrative safety rules for monitoring, but it has not proven that monitoring can operate without surveillance or coercive reuse.\n\n---\n\n## Christ-Centered Dignity Test\n\nThis packet is a human-made guardrail. It does not baptize monitoring as righteous. It asks whether a necessary civil instrument remains subordinate to love of neighbor, care for the poor, truthful witness, and refusal to treat people as inventory.\n\nFor any monitoring stream, reviewers must ask:\n\n- Does this protect the person in need, or make them legible for control?\n- Does it expose the poor more than the powerful?\n- Does it make the watched person able to answer, appeal, and be heard?\n- Does it preserve mercy for error, disability, confusion, displacement, and hardship?\n- Would the same rule restrain the powerful office that wants the data?\n\nThe fruit test is not a cleaner dashboard. The fruit test is whether people are fed, housed, healed, heard, and protected without being watched, ranked, priced, or managed as objects.\n\n---\n\n## Residual Risk\n\nMonitoring always creates danger. The safest stream is the one never collected. When monitoring is necessary, it should be narrow, temporary, reviewable, and humble.\n\nThis packet reduces administrative danger. It does not eliminate it. If tests show that monitoring cannot protect people without building coercive infrastructure, the corpus must prefer less monitoring, slower enforcement, or redesigned protections over a system that sees everyone too well.\n", "headings": [ { "level": 1, @@ -4465,7 +4470,7 @@ "slug": "residual-risk" } ], - "wordCount": 3069, + "wordCount": 3261, "headingCount": 20 }, { @@ -7936,7 +7941,7 @@ "status": "Status: Tier 1 / Tier 2 mixed (per row). Published as single authoritative source.", "statusBucket": "reference", "summary": "FC-020 (PROTECTEDPAUSEFLOOR = 0.30). Sim Test 7 in docs/ADVERSARIALAUDIT.md established: - Caregiver-at-2%-contribution Voice equilibrium = 0.13 units. - Standard-at-10%-contribution Voice equilibrium = 0.67 units. - Protected Pause at 20% decay dampening = 4.44 units (exploitable if set there).", - "content": "# Founding Commitments \u2014 Numerical Lock File\n\n**Status:** Tier 1 / Tier 2 mixed (per row). Published as single authoritative source.\n**Purpose:** Every founding parameter referenced across the Humane Constitution, White Paper, Threat Register, Patch Log, and annexes is either bound to a value here or assigned a reserved FC identifier here until the activation gate that binds it.\n**Amendment:** Tier 1 commitments require H-3 refounding authority. Tier 2 commitments follow the ordinary amendment ladder with public redlines. Tier 3 commitments follow ordinary reasonableness review.\n\n---\n\n## Commitment Table\n\n| ID | Name | Tier | Value | Unit | Rationale | Affected docs |\n|:---|:---|:---:|:---|:---|:---|:---|\n| **FC-001** | `ACCEPTABLE_MEASUREMENT_ERROR_FOOD` | 1 | \u00b15% | confidence interval | Below this, capacity-based Essential Access issuance risks physical shortfall; above this, over-issuance risk dominates | Article III, Annex AL |\n| **FC-002** | `ACCEPTABLE_MEASUREMENT_ERROR_WATER` | 1 | \u00b13% | confidence interval | Water buffers are thinner than food; tighter error bound required | Article III, Annex AL |\n| **FC-003** | `ACCEPTABLE_MEASUREMENT_ERROR_SHELTER` | 2 | \u00b110% | confidence interval | Shelter capacity is structurally slower-moving; wider bound acceptable | Article III, Annex AL |\n| **FC-004** | `ACCEPTABLE_MEASUREMENT_ERROR_ENERGY` | 1 | \u00b15% | confidence interval | Energy shortfall cascades to other categories; same bound as food | Article III, Annex AL |\n| **FC-005** | `ACCEPTABLE_MEASUREMENT_ERROR_MEDICINE` | 1 | \u00b15% | confidence interval (supply days) | Medicine shortfall is non-substitutable; error bound tight | Article III, Annex AL, Annex Y |\n| **FC-010** | `ACCEPTABLE_LEAKAGE_THRESHOLD` | 2 | 3% / annum (routine); 7% / annum (systemic review trigger) | fraction of Essential Access allocations informally converted | T-001 P-001 requires an operational target; 3% is measurable and enforceable; 7% triggers systemic-architecture review | Annex AB2, Annex AJ, Threat Register T-001 |\n| **FC-020** | `PROTECTED_PAUSE_FLOOR` | 1 | 0.30 | Voice units | Sim Test 7 showed range (0.13, 0.67) required; 0.30 is mid-range providing protection without creating pause-as-exploit | Article VI, Patch P-009 |\n| **FC-030** | `ORACLE_N_MIN` | 1 | 5 | oracle nodes per cohort | BFT floor for f=1 Byzantine nodes; PRD-003 requirement | Article III, Annex AL, SPECIFICATIONS.md |\n| **FC-031** | `METHODOLOGY_CLASS_MIN` | 1 | 3 | distinct methodology classes per cohort | Finding 7 requirement for structural diversity | Annex AL, Patch P-017 |\n| **FC-032** | `ORACLE_PAIRWISE_CORRELATION_MAX` | 1 | 0.30 | correlation coefficient (Pearson, on historical error series) | Pairs above this threshold are not structurally independent regardless of formal classification | Annex AL |\n| **FC-033** | `ORACLE_ADVERSARIAL_SEATS_MIN` | 1 | 1 | per cohort | P-014 adversarial-panel analogue; structural requirement | Annex AL, Annex AI |\n| **FC-040** | `BRIBE_DETERRENCE_MULTIPLIER` | 2 | 5.0 | multiple of detected gain | At \u226585% detection, penalty = 5\u00d7 gain produces expected value \u2265 4.25\u00d7 gain \u2014 decisively deterrent | Annex AJ, Patch P-001 |\n| **FC-041** | `DETECTION_PROBABILITY_ASSUMED` | 2 | 0.85 | probability | Assumed detection rate for deterrence calculation; subject to pilot verification | Annex AJ |\n| **FC-050** | `FLOW_DEMURRAGE_RATE` | 2 | SUPERSEDED \u2014 dormant \u00a7D9 backstop parameter; no routine demurrage exists (ANNEX_D \u00a7D9.1). Former baseline 0.5%/month retained for the record; binds only if a \u00a7D9 revival patch passes its own evidence and amendment process | formerly: idle balance above exemption | The routine idle-balance demurrage model was replaced corpus-wide by Commons Return and Universal Stake (P-066, ANNEX_D). This ID is retained for numbering stability and would parametrize only the dormant \u00a7D9 backstop, which no interpretation may activate | ANNEX_D \u00a7D9 (dormant); formerly Article V, `docs/SPECIFICATIONS.md` |\n| **FC-051** | `FLOW_DEMURRAGE_REVIEW_CORRIDOR` | 3 | SUPERSEDED \u2014 dormant \u00a7D9 backstop parameter (see FC-050). Former corridor \u00b10.25%/mo retained for the record | formerly: post-first-year adjustment band | Calibration corridor for the superseded routine demurrage; dormant with FC-050 | ANNEX_D \u00a7D9 (dormant); formerly Article V, `docs/SPECIFICATIONS.md` |\n| **FC-052** | `FLOW_IDLE_THRESHOLD_DAYS` | 2 | SUPERSEDED \u2014 dormant \u00a7D9 backstop parameter (see FC-050). Former proposed value 30 days retained for the record | formerly: days | Idle-balance dwell time for the superseded routine demurrage; dormant with FC-050 | ANNEX_D \u00a7D9 (dormant); formerly Article V, `docs/SPECIFICATIONS.md` |\n| **FC-053** | `FLOW_RETIREMENT_EPSILON` | 2 | PROPOSED VALUE: 0.01 Flow \u2014 bind before activation | Flow | Minimum residual Flow balance below which balances retire from circulation. Balances below this threshold are functionally zero and should retire to prevent ledger bloat; 0.01 Flow is well below any meaningful purchasing power | Article V, `docs/SPECIFICATIONS.md` |\n| **FC-054** | `PFCR_DEMURRAGE_ROUTING_SHARE` | 2 | SUPERSEDED \u2014 dormant \u00a7D9 backstop parameter (see FC-050). Former proposed split 0.65/0.35 retained for the record; Commons Return receipts route per ANNEX_D \u00a7D5 lockbox rules instead | formerly: fraction of demurrage charge | Routing split for the superseded routine demurrage; public-finance routing now lives in ANNEX_D \u00a7D5 (Commons Return), not in a demurrage charge | ANNEX_D \u00a7D9 (dormant), ANNEX_D \u00a7D5; formerly Article V, `docs/SPECIFICATIONS.md` |\n| **FC-055** | `FLOW_ISSUANCE_CEILING_FUNCTION` | 1 | RESERVED \u2014 bind before public issuance beyond pilot | formula | Binds the multiplier function relating verified productive commitments to maximum Flow in circulation | Article V, `docs/SPECIFICATIONS.md` |\n| **FC-056** | `ESSENTIAL_ACCESS_ENHANCED_ALLOCATION_RULE` | 2 | PROPOSED VALUE: 1.5\u00d7 CSM floor for documented hardship; 2.0\u00d7 CSM floor for medical necessity; maximum 90 days per rolling year without CRP review \u2014 bind before activation | rule / multiplier | Defines the lawful path above the CSM floor for hardship, emergency, or exceptional basket access. 1.5\u00d7 covers enhanced dietary, mobility, or care needs; 2.0\u00d7 covers medically necessary requirements; 90-day rolling cap prevents enhanced allocation from becoming baseline without review | Article III, `docs/SPECIFICATIONS.md` |\n| **FC-057** | `ESSENTIAL_ACCESS_VALIDITY_WINDOW_HOURS` | 2 | 72 | hours | Locks the initial Essential Access expiry window to the current constitutional baseline | Article III, `docs/SPECIFICATIONS.md` |\n| **FC-058** | `CSM_BASKET_AND_REGIONAL_ADJUSTMENT_RULE` | 1 | RESERVED \u2014 bind before regional launch | basket definition + adjustment formula | Constitutional Survival Minimum must publish its basket composition and regional-variation rule before activation across heterogeneous localities | Article III, `docs/SPECIFICATIONS.md`, Annex Y |\n| **FC-060** | `VOICE_SECTOR_CEILING` | 1 | 0.20 | fraction of total Voice | Sim Test 4: 3-sector coalition at 25% ceiling achieves 75% supermajority; 20% ceiling caps 3-sector to 60%, below supermajority threshold | Article VI, Patch P-008 |\n| **FC-061** | `VOICE_CAP_PER_PERSON_PER_CYCLE` | 2 | 300 | raw Voice units | Preserves existing Humane Constitution \u00a7VIII baseline | Article VI |\n| **FC-062** | `VOICE_DECAY_RATE` | 2 | 0.15 / day | exponential decay | Existing `model_outline.py` parameter, preserved | Article VI |\n| **FC-063** | `SERVICE_RECORD_DECAY_RATE_NORMAL` | 2 | RESERVED \u2014 bind before Service Record activation | fraction per day | Normal slow-decay rate for Service Record outside Protected Pause or grace-period exceptions | Article VI, `docs/SPECIFICATIONS.md` |\n| **FC-070** | `RESERVE_WINDOW_DAYS` | 1 | 45 | days of supply \u00d7 population at CSM level | Resilience reserves (Article III) sized for CSM \u00d7 population \u00d7 45 days. Exceeds L3 Emergency trigger by 6\u00d7 to prevent reserve-exhaustion cascade | Article III, Annex Y |\n| **FC-071** | `ACCEPTABLE_CSM_FAILURE_THRESHOLD` | 1 | 3 failures per 10,000 residents per 30 days | cluster rate | Above this, cluster enters Scarcity L3 regardless of oracle status | Annex Y \u00a7Y4 |\n| **FC-072** | `SHARED_STOREHOUSE_SCARCITY_ACTIVATION_THRESHOLD_RULE` | 1 | PROPOSED VALUE: Activation when oracle-confirmed supply for any CSM category falls below 85% of the 45-day reserve floor (FC-070) for 3 consecutive measurement cycles, OR when physical sampling (Annex AL \u00a7AL-COST) shows supply below 90% of CSM floor for any single cycle \u2014 bind before activation | category threshold rule | Shared Storehouse may not activate on vague scarcity claims; each essential category must publish its activation threshold rule before emergency overlay becomes operative. 85% of the 45-day reserve provides a 38-day buffer before genuine scarcity; 3-cycle confirmation prevents single-measurement noise from triggering rationing; physical sampling override prevents oracle manipulation from blocking activation | Article III, `docs/SPECIFICATIONS.md`, Annex Y |\n| **FC-080** | `ATTESTATION_STAKE_RATIO` | 2 | 0.20 | fraction of attestor's own Voice and Service Record, proportional to claim size | Attestor risks 20% of their civic balance when attesting; calibrated for meaningful skin-in-the-game without destroying livelihoods on single errors | Article VI, Proposal 9 files |\n| **FC-081** | `ATTESTATION_AUDIT_WINDOW` | 2 | 365 | days | Attestation slashing window after false-claim finding; 1 year matches civic-cycle duration | Article VI |\n| **FC-082** | `ATTESTATION_GRAPH_DENSITY_THRESHOLD` | 2 | 0.40 | mutual cross-attestation ratio | Attestor networks above this density triggers automatic review; calibrated against null-model random-graph baseline | Article VI |\n| **FC-083** | `ATTESTATION_REPUTATION_CREDIT_CAP` | 2 | 2 | civic cycles of successful attestation reputation credit | Caps attestation-derived reputation so reliable attestors become legible civic resources without creating a new status-currency surface | Article VI, Annex AS |\n| **FC-090** | `OMBUDS_SUBCOUNT_MIN` | 1 | 5 | sub-Ombuds nodes | Federated Ombuds (Proposal 8) structural minimum; BFT-equivalent for institutional decisions | Annex AI |\n| **FC-091** | `OMBUDS_SUPERMAJORITY_THRESHOLD` | 1 | 4/5 | affirmative sub-Ombuds | Protocol-level decisions require \u22654 of 5 sub-Ombuds affirmative | Annex AI |\n| **FC-092** | `OMBUDS_TERM_DAYS` | 2 | 730 | days (2 years) | Sub-Ombuds term length; staggered across 5 seats | Annex AI |\n| **FC-100** | `ORACLE_QUORUM_LOSS_RESTORATION_WINDOW` | 1 | 14 | days of verification after quorum restoration | Proposal 6 crisis fallback \u2014 prevents flash-recovery from being exploited as normalization pathway | Article III fallback files |\n| **FC-110** | `TIER1_AMENDMENT_SIGNATURES_MIN` | 1 | 7 of 9 | cryptographic signatures from dispersed key-holders | M-of-N threshold for Tier 1 amendment per Proposal 1; 9 geographically distributed holders; 7 required; allows 2 captured/lost without breakage | `/architecture/amendment_protocol.md` |\n| **FC-111** | `TIER1_AMENDMENT_TIMELOCK_DAYS` | 1 | 180 | days | Minimum wall-clock delay between proposal and effect; survives political cycles | `/architecture/amendment_protocol.md` |\n| **FC-120** | `EXIT_SUPERMAJORITY_THRESHOLD` | 1 | 2/3 | fraction of resident personhood | Required to initiate jurisdictional exit under the Founding Order; prevents transient pluralities from triggering structural discontinuity | `/founding/order/exit_protocol.md` |\n| **FC-121** | `EXIT_UNWIND_DAYS` | 1 | 730 | days (2 years) | Graceful-exit unwind window; Essential Access continuity preserved for individuals during unwind | `/founding/order/exit_protocol.md` |\n| **FC-122** | `SUBSIDIARITY_SCALES` | 1 | household / neighborhood (\u2264500) / locality (\u22645,000) / region (\u2264500,000) / federation | personhood counts | Scale-tier definitions for subsidiarity routing | `/founding/order/jurisdictional_scales.md` |\n| **FC-140** | `AED_ESSENTIAL_ACCESS_FRAUD_BAND` | 2 | target \u22642% / upper bound \u22645% / trigger \u22653% per quarter | quarterly fraud tuple | Essential Access identity fraud consumes physical survival supply directly; its target, upper tolerance, and audit trigger must be public before scale-up. Target anchored below the SNAP program operational error rate (2\u20133% per USDA studies), the closest operational analogue; upper bound set at 5% to force systemic review before fraud reaches GAO-documented government-program false-acceptance range. | Annex AK, Threat_Register.md |\n| **FC-141** | `AED_VOICE_FRAUD_BAND` | 2 | target \u22643% / upper bound \u22647% / trigger \u22655% per quarter | quarterly fraud tuple | Voice fraud distorts agenda-setting and must publish its tolerated error band before activation. Somewhat looser than Essential Access (FC-140) because Voice fraud does not consume physical survival goods; consistent with democratic-participation error tolerances in comparable systems. | Annex AK, Threat_Register.md |\n| **FC-142** | `AED_SERVICE_RECORD_FRAUD_BAND` | 2 | target \u22645% / upper bound \u226410% / trigger \u22657% per quarter | quarterly fraud tuple | Service Record fraud distorts eligibility and role selection; requires a published tolerated-error band. Looser than Voice (FC-141) because Service Record fraud affects longer-cycle eligibility decisions rather than immediate agenda-setting; consistent with public-employment verification tolerances. | Annex AK, Threat_Register.md |\n| **FC-143** | `AED_EXCLUSION_BAND_DISPLACED` | 2 | target \u22643% / upper bound \u22646% / trigger \u22654% per quarter | quarterly exclusion tuple | Displaced persons are a first-order identity-access vulnerability class and require explicit exclusion commitments. UNHCR biometric exclusion monitoring targets <5% for displaced populations; tighter upper bound (6%) chosen because displaced persons have no alternative access route. | Annex AK, Threat_Register.md |\n| **FC-144** | `AED_EXCLUSION_BAND_UNDOCUMENTED` | 2 | target \u22645% / upper bound \u22648% / trigger \u22656% per quarter | quarterly exclusion tuple | Undocumented persons are a first-order identity-access vulnerability class and require explicit exclusion commitments. Documentation barriers produce a structurally higher baseline exclusion rate; trigger set at 6% to force institutional review before the rate reaches double digits. | Annex AK, Threat_Register.md |\n| **FC-145** | `AED_EXCLUSION_BAND_DIGITALLY_FRAGILE` | 2 | target \u22645% / upper bound \u22648% / trigger \u22656% per quarter | quarterly exclusion tuple | Digitally fragile persons require a separately published exclusion band so access failures are not hidden in aggregate success rates. Structural access barriers (no smartphone, limited literacy, disability) produce a higher baseline analogous to undocumented persons; 8% hard ceiling requires mandatory architecture review before that threshold is reached. | Annex AK, Threat_Register.md |\n| **FC-146** | `AED_EXCLUSION_BAND_RECOVERY_CRISIS` | 2 | RESERVED \u2014 bind target / upper bound / trigger before first scale-up gate | quarterly exclusion tuple | Crisis and recovery cases are structurally easy to exclude and require their own exclusion commitments | Annex AK |\n| **FC-147** | `AED_EXCLUSION_BAND_OVERALL_POPULATION` | 2 | RESERVED \u2014 bind target / upper bound / trigger before first scale-up gate | quarterly exclusion tuple | Aggregate exclusion remains a governing signal even when vulnerable-population bands are tracked separately | Annex AK |\n| **FC-148** | `AED_EXCLUSION_PRIORITY_MULTIPLIER` | 2 | PROPOSED VALUE: 1.5 \u2014 bind before activation | multiple of exclusion target | Governs when exclusion reduction takes priority over further fraud tightening in the AED trade-off rule. When exclusion reduction and fraud tightening trade off, reducing exclusion is weighted 1.5\u00d7 more important; reflects the asymmetric harm of wrongful exclusion (survival floor loss) vs. wrongful inclusion (resource dilution) | Annex AK |\n| **FC-149** | `AED_FRAUD_PRIORITY_BOUND` | 2 | PROPOSED VALUE: 5% (= FC-140 Essential Access upper bound) \u2014 bind before activation | fraud upper-bound reference | Governs when fraud reduction takes priority over further inclusion loosening in the AED trade-off rule. When Essential Access fraud is below its upper bound (5%), further fraud reduction yields diminishing returns and inclusion improvement should take priority; at or above 5%, fraud reduction takes priority | Annex AK |\n| **FC-150** | `AED_SIMULTANEOUS_BREACH_DEFAULT_PREFERENCE` | 2 | PROPOSED VALUE: exclusion-first \u2014 bind before activation | exclusion-first / fraud-first | Publicly locks the default preference when both fraud and exclusion exceed their upper bounds simultaneously. When both fraud and exclusion rates breach their upper bounds simultaneously, reducing exclusion takes priority \u2014 consistent with the survival floor principle that wrongful exclusion is the worse error | Annex AK |\n| **FC-160** | `CC_STANDARD_RELEASE_MAX` | 2 | RESERVED \u2014 bind before escrow launch | Flow | Upper bound for single-verifier milestone releases in contract-commitment architecture | Annex AR |\n| **FC-161** | `CC_ENHANCED_RELEASE_MAX` | 2 | RESERVED \u2014 bind before escrow launch | Flow | Upper bound for dual-verifier milestone releases; releases above this threshold enter Major tier | Annex AR |\n| **FC-162** | `CC_MAJOR_RELEASE_PERCENT_FLOOR` | 2 | RESERVED \u2014 bind before escrow launch | fraction of total project value | Anti-fragmentation rule that forces Major-tier verification above a published share of project value regardless of absolute Flow amount | Annex AR |\n| **FC-163** | `CC_ESSENTIAL_ACCESS_DEPLOYMENT_WINDOW` | 2 | RESERVED \u2014 bind before escrow launch | days | Maximum idle escrow hold for Essential Access delivery programmes before CRP review triggers | Annex AR |\n| **FC-164** | `CC_STANDARD_DEPLOYMENT_WINDOW` | 2 | RESERVED \u2014 bind before escrow launch | days | Maximum idle escrow hold for standard infrastructure before CRP review triggers | Annex AR |\n| **FC-165** | `CC_LARGE_PROJECT_VALUE_THRESHOLD` | 2 | RESERVED \u2014 bind before escrow launch | Flow contracted value | Published breakpoint above which projects count as large-scale or novel for deployment-window purposes | Annex AR |\n| **FC-166** | `CC_LARGE_SCALE_DEPLOYMENT_WINDOW` | 2 | RESERVED \u2014 bind before escrow launch | days | Maximum idle escrow hold for large-scale or first-of-type infrastructure before CRP review triggers | Annex AR |\n| **FC-167** | `CC_CRP_EXPLANATION_DEADLINE` | 2 | RESERVED \u2014 bind before escrow launch | days after trigger | Deadline for commissioning authorities to explain deployment-window overruns to CRP | Annex AR |\n| **FC-168** | `CC_CRP_DECISION_DEADLINE` | 2 | RESERVED \u2014 bind before escrow launch | days after trigger | Deadline for CRP to issue extension / support / escalation decisions on deployment-window review | Annex AR |\n| **FC-169** | `CC_CRP_EXTENSION_WINDOW` | 2 | RESERVED \u2014 bind before escrow launch | days | Additional time granted when CRP confirms legitimate procurement complexity | Annex AR |\n| **FC-170** | `CC_CRP_PUBLICATION_DEADLINE` | 2 | RESERVED \u2014 bind before escrow launch | days after decision | Deadline for publishing CRP deployment-window review outcomes | Annex AR |\n| **FC-171** | `CC_FORCE_MAJEURE_SELF_CERT_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | cumulative days per project | Maximum freeze duration available on contractor self-certification before higher verification tiers apply | Annex AR |\n| **FC-172** | `CC_FORCE_MAJEURE_THIRD_PARTY_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | cumulative days per project | Maximum freeze duration available on third-party certification before panel review applies | Annex AR |\n| **FC-173** | `CC_FORCE_MAJEURE_PANEL_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | cumulative days per project | Hard cap for force-majeure freeze duration before restructuring review replaces further freeze eligibility | Annex AR |\n| **FC-174** | `CC_ESSENTIAL_ACCESS_FORCE_MAJEURE_DURATION_CAP` | 2 | RESERVED \u2014 bind before escrow launch | fraction of contracted project duration | Prevents short Essential Access delivery projects from using an absolute freeze cap that functionally nullifies the deployment-delay consequence and Annex D source-base review | Annex AR |\n| **FC-175** | `CC_INSPECTOR_POOL_MIN_PILOT` | 2 | RESERVED \u2014 bind before escrow launch | qualified inspectors | Minimum inspector pool size for pilot / single-municipality deployment | Annex AR |\n| **FC-176** | `CC_INSPECTOR_POOL_MIN_REGIONAL` | 2 | RESERVED \u2014 bind before escrow launch | qualified inspectors | Minimum inspector pool size for regional deployment | Annex AR |\n| **FC-177** | `CC_INSPECTOR_POOL_MIN_NATIONAL_PER_REGION` | 2 | RESERVED \u2014 bind before escrow launch | qualified inspectors per region | Minimum inspector pool size for national / multi-regional deployment | Annex AR |\n| **FC-178** | `CC_STANDARD_ROTATION_MAX_CONSECUTIVE` | 2 | RESERVED \u2014 bind before escrow launch | consecutive milestones | Maximum repeated assignments of the same inspector on Standard-tier releases | Annex AR |\n| **FC-179** | `CC_STANDARD_ROTATION_COOLING_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | days | Cooling-off interval before an inspector may return to the same project at Standard tier | Annex AR |\n| **FC-180** | `CC_ENHANCED_ROTATION_MAX_CONSECUTIVE` | 2 | RESERVED \u2014 bind before escrow launch | consecutive milestones | Maximum repeated assignments of the same inspector on Enhanced-tier releases | Annex AR |\n| **FC-181** | `CC_ENHANCED_ROTATION_COOLING_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | days | Cooling-off interval before an inspector may return to the same project at Enhanced tier | Annex AR |\n| **FC-182** | `CC_MAJOR_ROTATION_MAX_CONSECUTIVE` | 2 | RESERVED \u2014 bind before escrow launch | consecutive milestones | Maximum repeated assignments of the same inspector on Major-tier releases | Annex AR |\n| **FC-183** | `CC_MAJOR_ROTATION_COOLING_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | days | Cooling-off interval before an inspector may return to the same project at Major tier | Annex AR |\n| **FC-184** | `CC_SINGLE_SECTOR_BACKGROUND_CAP` | 2 | RESERVED \u2014 bind before escrow launch | fraction of active pool | Caps prior-employment concentration from any single sector inside the active inspector pool | Annex AR |\n| **FC-185** | `AT_CALORIC_STAPLE_STRATEGIC_FLOOR` | 1 | RESERVED \u2014 bind by TSP + Article VI ratification before activation | days of supply | Caloric staple strategic reserve floor; draft value 180 days | Annex AT \u00a7AT1 |\n| **FC-186** | `AT_ENERGY_STRATEGIC_FLOOR` | 1 | RESERVED \u2014 bind by TSP + Article VI ratification before activation | days of supply (peak-demand period) | Energy strategic reserve floor; draft value 90 days | Annex AT \u00a7AT1 |\n| **FC-187** | `AT_ESSENTIAL_MEDICINES_STRATEGIC_FLOOR` | 1 | RESERVED \u2014 bind by TSP + Article VI ratification before activation | days of supply | Essential medicines strategic reserve floor; draft value 365 days | Annex AT \u00a7AT1 |\n| **FC-188** | `AT_SINGLE_SUPPLIER_WATCH_THRESHOLD` | 2 | RESERVED \u2014 bind by TSP before activation | % of category consumption | Single-supplier Watch trigger; draft value 25% | Annex AT \u00a7AT2 |\n| **FC-189** | `AT_SINGLE_SUPPLIER_CRITICAL_THRESHOLD` | 2 | RESERVED \u2014 bind by TSP before activation | % of category consumption | Single-supplier Critical trigger; draft value 60% | Annex AT \u00a7AT2 |\n| **FC-190** | `AT_FOREIGN_CAPITAL_INFLOW_LIMIT` | 2 | RESERVED \u2014 bind by TSP + Article V review before activation | % of annual Flow issuance | Foreign capital inflow concentration ceiling; draft value 15% | Annex AT \u00a7AT4 |\n| **FC-191** | `AT_FOREIGN_CAPITAL_CONVERSION_WINDOW` | 2 | RESERVED \u2014 bind by TSP + Article V review before activation | days before public-return review escalates | Foreign capital conversion window; draft value 30 days | Annex AT \u00a7AT4 |\n| **FC-192** | `AT_EXTRACTIVE_RECLASSIFICATION_WINDOW` | 2 | RESERVED \u2014 bind by TSP before activation | months | Observation window before extractive-pattern reclassification; draft value 12 months | Annex AT \u00a7AT5 |\n| **FC-193** | `AT_STAGE3_SUSPENSION_THRESHOLD` | 1 | RESERVED \u2014 bind by Article VI before activation | Article VI supermajority fraction | Stage 3 suspension ratification threshold; draft value two-thirds | Annex AT \u00a7AT5 |\n| **FC-194** | `AT_ESSENTIAL_FUEL_RESERVE_MIN` | 1 | RESERVED \u2014 bind before essential-sector activation | days by region and season | Essential fuel reserve minimum for refusal survivability; draft anchor 60-90 days | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-195** | `AT_ESSENTIAL_MEDICINE_STOCKPILE_MIN` | 1 | RESERVED \u2014 bind before medicine fallback activation | days by CSM medicine category | Essential medicine stockpile floor for refusal survivability; draft anchor 90-180 days pending clinical list and expiry model | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-196** | `AT_MAX_ESSENTIAL_SUPPLIER_CONCENTRATION` | 1 | RESERVED \u2014 bind before launch | % of regional essential throughput | Maximum supplier concentration before mandatory fallback/diversification review; draft anchor 25% | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-197** | `AT_PUBLIC_FALLBACK_ACTIVATION_DEADLINE` | 1 | RESERVED \u2014 bind before activation | hours / days | Deadline for public/cooperative/treaty fallback activation after essential-sector interruption; draft anchor 72h critical / 14d managed transition | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-198** | `AT_PROCUREMENT_CONCENTRATION_THRESHOLD` | 2 | RESERVED \u2014 bind before essential-sector procurement launch | % of essential category spend | Review/remediation thresholds for procurement concentration; draft anchor review >30%, mandatory remediation >40% | Annex AT; Capture Dashboard Specification |\n| **FC-199** | `AT_PBM_INTERMEDIARY_SEPARATION_THRESHOLD` | 1 | RESERVED \u2014 bind before medicine-access launch | % of cross-owned claims or dispensing volume | Separation/firewall trigger for PBM-style intermediaries; draft anchor review >10%, mandatory firewall >20% | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-200** | `AT_CRITICAL_LOGISTICS_REDUNDANCY_FLOOR` | 1 | RESERVED \u2014 bind before logistics-dependent launch | independent routes / operators | Minimum independent logistics redundancy for essential regions; draft anchor two independent routes and operators | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-201** | `AT_ESSENTIAL_DATA_CLAIMS_PORTABILITY_DEADLINE` | 2 | RESERVED \u2014 bind before medicine/logistics fallback activation | hours / days | Deadline for emergency and full transition export of essential records, claims, formularies, and routing data; draft anchor 24h emergency / 30d full package | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-202** | `COMMONS_RETURN_SOURCE_BASES` | 1 | RESERVED \u2014 bind before CRUS activation | source-base list | Defines the allowed Commons Return bases: land/location value, natural resources, spectrum/airspace, monopoly licenses, unavoidable platform/network rents, high-value public concessions, and large succession transfers. Ordinary labor income, survival access, basic household exchange, ordinary working balances, ordinary household tools, protected below-threshold homes, and protected community/tribal/church holdings are excluded unless used as avoidance shells. The list is closed (INV-008): extending a base downward onto ordinary life is a Tier-1 amendment, never an administrative decision | Annex D, INVARIANTS.md INV-008, Parameter Calibration Register, Commons Return and Universal Stake Evidence Test Package |\n| **FC-203** | `COMMONS_RETURN_ASSESSMENT_RATE` | 2 | RESERVED \u2014 Tier-3 calibrated by source base before activation | rate schedule | Sets the Commons Return assessment rate by source base without making ordinary labor or survival access the funding base. Must test incidence, valuation hiding, external-capital arbitrage, and productive-stewardship effects before binding | Annex D, Parameter Calibration Register |\n| **FC-204** | `COMMONS_RETURN_PROTECTED_THRESHOLDS` | 2 | RESERVED \u2014 bind before CRUS activation | threshold schedule | Protects ordinary homes, ordinary tools, working balances, small stewardship, protected associations, and household exchange from assessment while preventing elite shelter through threshold splitting or avoidance shells | Annex D, Fairness Vignette Library, Parameter Calibration Register |\n| **FC-205** | `UNIVERSAL_STAKE_DISTRIBUTION_CADENCE` | 2 | RESERVED \u2014 bind before first distribution | cadence | Sets distribution timing for Universal Stake so households can rely on it and operators cannot time distributions as political reward or punishment. A distribution may be authorized only after the floor and its reserves are funded (INV-014) | Annex D, INVARIANTS.md INV-014, Claims and Evidence Register |\n| **FC-206** | `UNIVERSAL_STAKE_ELIGIBILITY_RULE` | 1 | RESERVED \u2014 bind before first distribution | eligibility rule | Keeps Universal Stake universal for members while prohibiting sale, assignment, garnishment, pledge, inheritance, membership purchase, survival-priority purchase, legal-standing purchase, office purchase, or Voice purchase | Annex D, Annex AK, Commons Return and Universal Stake Evidence Test Package |\n| **FC-207** | `CRUS_ANTI_CAPTURE_GATES` | 1 | RESERVED \u2014 bind before CRUS activation | gate bundle | Requires public accounting, no patronage discretion, no targeted political reward or punishment, data minimization, auditability, appeal rights, and ordinary-reader source reporting | Annex D, Capture Dashboard Specification, Abuse Case Library |\n| **FC-208** | `CRUS_PUBLIC_LOCKBOX_RESERVE_RULE` | 2 | RESERVED \u2014 bind before fund routing | reserve/draw rule | Defines reserve, draw, passive fund, and public-accounting rules for any lockbox or social wealth fund receiving Commons Return. Prevents fund managers from becoming patronage allocators or political investors | Annex D, Parameter Calibration Register |\n| **FC-209** | `CRUS_APPEAL_PATH` | 1 | RESERVED \u2014 bind before assessment or distribution | appeal path | Gives assessed source holders and excluded stake claimants a human appeal without allowing high-value actors to stall assessment through procedural delay | Annex D, Federated Ombuds, Claims and Evidence Register |\n| **FC-210** | `CRUS_REVIEW_CADENCE` | 2 | RESERVED \u2014 bind before CRUS activation | review cadence | Sets scheduled review of incidence, eligibility, valuation, source bases, distribution, reserves, and capture metrics. Missed cadence or missing data is itself a review failure | Annex D, Capture Dashboard Specification, Pilot Evidence Roadmap |\n| **FC-YT1** | `CSM_FAILURE_COUNT_THRESHOLD` | 2 | 3 | verified delivery failures per jurisdictional cluster per 30-day window | Pattern-detection trigger for H-3 refounding review initiation. Applies as a raw cluster count independently of FC-071's per-population rate (3 per 10,000 residents per 30 days); both thresholds apply concurrently. \"Verified delivery failure\" requires confirmation by at least one Tier-3 physical-sampling oracle node per ANNEX_Y \u00a7Y1. Federated Ombuds verification of this value required before INV-LAUNCH-1 clears. Pre-launch blocking gate. | ANNEX_Y \u00a7Y4 |\n| **FC-YT2** | `CSM_SURVIVAL_RESERVE_DAYS` | 2 | 90 | days of CSM coverage per enrolled population, by jurisdiction and essential category | CSM-specific reserve gate. Complements the general resilience reserve FC-070 (45 days); both must be independently satisfied. This value is the binding survival-floor-specific pre-launch gate. Federated Ombuds verification of this value required before INV-LAUNCH-1 clears. Pre-launch blocking gate. | ANNEX_Y \u00a7Y7 |\n\n---\n\n## Derivation Notes\n\n**FC-020 (`PROTECTED_PAUSE_FLOOR = 0.30`).** Sim Test 7 in `docs/ADVERSARIAL_AUDIT.md` established:\n- Caregiver-at-2%-contribution Voice equilibrium = 0.13 units.\n- Standard-at-10%-contribution Voice equilibrium = 0.67 units.\n- Protected Pause at 20% decay dampening = 4.44 units (exploitable if set there).\n\nFloor value must satisfy: above the exposed-caregiver equilibrium (0.13) to provide real voice; below the standard-contributor equilibrium (0.67) to prevent pause-as-exploit. **0.30** sits \u224833% of the way up this band \u2014 meaningful protection without civic premium for pausing.\n\n**FC-060 (`VOICE_SECTOR_CEILING = 0.20`).** From Sim Test 4: for N=5 sectors with ceiling c, supermajority (\u22652/3) is achievable via k-sector coalition when k\u00b7c \u2265 2/3. Setting c = 0.20, maximum 3-sector coalition = 0.60 < 0.667 \u2014 no 3-sector supermajority possible. Preserves margin against measurement imprecision.\n\n**FC-030 / FC-031 (Oracle parameters).** BFT theorem: n \u2265 3f+1 for tolerance of f faulty nodes. At f = 1: n \u2265 4. **FC-030 = 5** provides margin of one node above the floor, tolerates single-node loss without immediately dropping below BFT. FC-031 = 3 methodology classes guarantees diversity even when one class is simultaneously compromised.\n\n**FC-040 (`BRIBE_DETERRENCE_MULTIPLIER = 5.0`).** Sim Test 5: at 85% detection, penalty = 0.18\u00d7 gain is break-even. Setting penalty = 5\u00d7 gain produces expected value = \u2212(0.85 \u00d7 5 \u2212 0.15 \u00d7 1) \u00d7 gain = \u22124.1\u00d7 gain. Margin of safety permits detection probability as low as 25% before deterrent fails.\n\n**FC-110 / FC-111 (Tier 1 amendment parameters).** Distributed key-holder count of 9 balances resilience against loss (can lose 2 without breakage) versus capture resistance (must capture \u22653 to prevent amendment, \u22657 to force amendment). Timelock of 180 days ensures any captured supermajority survives at least one political cycle before amendment effect \u2014 enables reversal proposal by uncaptured parties.\n\n---\n\n---\n\n## FC-YT1 and FC-YT2 \u2014 Survival Floor Activation Gate Parameters\n\n**FC-YT1 \u2014 CSM Delivery Failure Pattern-Detection Trigger**\n- **Value:** 3 verified delivery failures per jurisdictional cluster within any 30-day window\n- **Tier:** Tier 2 / pre-launch blocking gate\n- **Authority:** Required by INV-LAUNCH-1 and ANNEX_Y \u00a7Y4 before any operational phase enrolling real persons\n- **Ombuds verification required:** Yes \u2014 the Federated Ombuds must publish the confirmed numeric value before this gate clears\n- **Relationship to FC-071:** FC-071 defines the per-population rate (3 per 10,000 residents per 30 days) that triggers cluster-level review. FC-YT1 is the raw count threshold that triggers H-3 refounding review initiation regardless of per-population rate. Both apply independently.\n- **\"Verified delivery failure\"** means a failure confirmed by at least one Tier-3 (physical sampling) oracle node per ANNEX_Y \u00a7Y1.\n\n**FC-YT2 \u2014 90-Day CSM Reserve Requirement**\n- **Value:** 90 days \u00d7 CSM \u00d7 enrolled population, by jurisdiction and essential category\n- **Tier:** Tier 2 / pre-launch blocking gate\n- **Authority:** Required by INV-LAUNCH-1 and ANNEX_Y \u00a7Y7 before any operational phase enrolling real persons\n- **Ombuds verification required:** Yes \u2014 same requirement as FC-YT1\n- **Relationship to FC-070:** FC-070 binds the general resilience reserve window at 45 days. FC-YT2 binds the CSM-specific reserve at 90 days. These are complementary: the general reserve (45 days) is an operational floor; the CSM reserve (90 days) is the survival-floor-specific gate. Both must be met; FC-YT2 is the binding pre-launch gate.\n\n---\n\n## Hash Commitment\n\nAt founding, the SHA-256 hash of this file (computed with the canonical line-ending, UTF-8 encoding, and without trailing whitespace normalization) is committed to the ledger genesis block. Subsequent amendments produce new hash commitments with version-chained history per `/architecture/drift_chain.md`.\n\n**Genesis commitment:** TBD at founding event. Computed by the founding coalition's multi-signature process.\n\n---\n\n## Amendment Log\n\n| Version | Date | Change | Authority |\n|:---|:---|:---|:---|\n| 1.0 | 2026-04-18 | Initial publication of the founding numerical lock file | Founding release |\n\n**End of Founding Commitments.**\n", + "content": "# Founding Commitments \u2014 Numerical Lock File\n\n**Status:** Tier 1 / Tier 2 mixed (per row). Published as single authoritative source.\n**Purpose:** Every founding parameter referenced across the Humane Constitution, White Paper, Threat Register, Patch Log, and annexes is either bound to a value here or assigned a reserved FC identifier here until the activation gate that binds it.\n**Amendment:** Tier 1 commitments require H-3 refounding authority. Tier 2 commitments follow the ordinary amendment ladder with public redlines. Tier 3 commitments follow ordinary reasonableness review.\n\n---\n\n## Commitment Table\n\n| ID | Name | Tier | Value | Unit | Rationale | Affected docs |\n|:---|:---|:---:|:---|:---|:---|:---|\n| **FC-001** | `ACCEPTABLE_MEASUREMENT_ERROR_FOOD` | 1 | \u00b15% | confidence interval | Below this, capacity-based Essential Access issuance risks physical shortfall; above this, over-issuance risk dominates | Article III, Annex AL |\n| **FC-002** | `ACCEPTABLE_MEASUREMENT_ERROR_WATER` | 1 | \u00b13% | confidence interval | Water buffers are thinner than food; tighter error bound required | Article III, Annex AL |\n| **FC-003** | `ACCEPTABLE_MEASUREMENT_ERROR_SHELTER` | 2 | \u00b110% | confidence interval | Shelter capacity is structurally slower-moving; wider bound acceptable | Article III, Annex AL |\n| **FC-004** | `ACCEPTABLE_MEASUREMENT_ERROR_ENERGY` | 1 | \u00b15% | confidence interval | Energy shortfall cascades to other categories; same bound as food | Article III, Annex AL |\n| **FC-005** | `ACCEPTABLE_MEASUREMENT_ERROR_MEDICINE` | 1 | \u00b15% | confidence interval (supply days) | Medicine shortfall is non-substitutable; error bound tight | Article III, Annex AL, Annex Y |\n| **FC-010** | `ACCEPTABLE_LEAKAGE_THRESHOLD` | 2 | 3% / annum (routine); 7% / annum (systemic review trigger) | fraction of Essential Access allocations informally converted | T-001 P-001 requires an operational target; 3% is measurable and enforceable; 7% triggers systemic-architecture review | Annex AB2, Annex AJ, Threat Register T-001 |\n| **FC-020** | `PROTECTED_PAUSE_FLOOR` | 1 | 0.30 | Voice units | Sim Test 7 showed range (0.13, 0.67) required; 0.30 is mid-range providing protection without creating pause-as-exploit | Article VI, Patch P-009 |\n| **FC-030** | `ORACLE_N_MIN` | 1 | 5 | oracle nodes per cohort | BFT floor for f=1 Byzantine nodes; PRD-003 requirement | Article III, Annex AL, SPECIFICATIONS.md |\n| **FC-031** | `METHODOLOGY_CLASS_MIN` | 1 | 3 | distinct methodology classes per cohort | Finding 7 requirement for structural diversity | Annex AL, Patch P-017 |\n| **FC-032** | `ORACLE_PAIRWISE_CORRELATION_MAX` | 1 | 0.30 | correlation coefficient (Pearson, on historical error series) | Pairs above this threshold are not structurally independent regardless of formal classification | Annex AL |\n| **FC-033** | `ORACLE_ADVERSARIAL_SEATS_MIN` | 1 | 1 | per cohort | P-014 adversarial-panel analogue; structural requirement | Annex AL, Annex AI |\n| **FC-040** | `BRIBE_DETERRENCE_MULTIPLIER` | 2 | 5.0 | multiple of detected gain | At \u226585% detection, penalty = 5\u00d7 gain produces expected value \u2265 4.25\u00d7 gain \u2014 decisively deterrent | Annex AJ, Patch P-001 |\n| **FC-041** | `DETECTION_PROBABILITY_ASSUMED` | 2 | 0.85 | probability | Assumed detection rate for deterrence calculation; subject to pilot verification | Annex AJ |\n| **FC-050** | `FLOW_DEMURRAGE_RATE` | 2 | SUPERSEDED \u2014 dormant \u00a7D9 backstop parameter; no routine demurrage exists (ANNEX_D \u00a7D9.1). Former baseline 0.5%/month retained for the record; binds only if a \u00a7D9 revival patch passes its own evidence and amendment process | formerly: idle balance above exemption | The routine idle-balance demurrage model was replaced corpus-wide by Commons Return and Universal Stake (P-066, ANNEX_D). This ID is retained for numbering stability and would parametrize only the dormant \u00a7D9 backstop, which no interpretation may activate | ANNEX_D \u00a7D9 (dormant); formerly Article V, `docs/SPECIFICATIONS.md` |\n| **FC-051** | `FLOW_DEMURRAGE_REVIEW_CORRIDOR` | 3 | SUPERSEDED \u2014 dormant \u00a7D9 backstop parameter (see FC-050). Former corridor \u00b10.25%/mo retained for the record | formerly: post-first-year adjustment band | Calibration corridor for the superseded routine demurrage; dormant with FC-050 | ANNEX_D \u00a7D9 (dormant); formerly Article V, `docs/SPECIFICATIONS.md` |\n| **FC-052** | `FLOW_IDLE_THRESHOLD_DAYS` | 2 | SUPERSEDED \u2014 dormant \u00a7D9 backstop parameter (see FC-050). Former proposed value 30 days retained for the record | formerly: days | Idle-balance dwell time for the superseded routine demurrage; dormant with FC-050 | ANNEX_D \u00a7D9 (dormant); formerly Article V, `docs/SPECIFICATIONS.md` |\n| **FC-053** | `FLOW_RETIREMENT_EPSILON` | 2 | PROPOSED VALUE: 0.01 Flow \u2014 bind before activation | Flow | Minimum residual Flow balance below which balances retire from circulation. Balances below this threshold are functionally zero and should retire to prevent ledger bloat; 0.01 Flow is well below any meaningful purchasing power | Article V, `docs/SPECIFICATIONS.md` |\n| **FC-054** | `PFCR_DEMURRAGE_ROUTING_SHARE` | 2 | SUPERSEDED \u2014 dormant \u00a7D9 backstop parameter (see FC-050). Former proposed split 0.65/0.35 retained for the record; Commons Return receipts route per ANNEX_D \u00a7D5 lockbox rules instead | formerly: fraction of demurrage charge | Routing split for the superseded routine demurrage; public-finance routing now lives in ANNEX_D \u00a7D5 (Commons Return), not in a demurrage charge | ANNEX_D \u00a7D9 (dormant), ANNEX_D \u00a7D5; formerly Article V, `docs/SPECIFICATIONS.md` |\n| **FC-055** | `FLOW_ISSUANCE_CEILING_FUNCTION` | 1 | RESERVED \u2014 bind before public issuance beyond pilot | formula | Binds the multiplier function relating verified productive commitments to maximum Flow in circulation | Article V, `docs/SPECIFICATIONS.md` |\n| **FC-056** | `ESSENTIAL_ACCESS_ENHANCED_ALLOCATION_RULE` | 2 | PROPOSED VALUE: 1.5\u00d7 CSM floor for documented hardship; 2.0\u00d7 CSM floor for medical necessity; maximum 90 days per rolling year without CRP review \u2014 bind before activation | rule / multiplier | Defines the lawful path above the CSM floor for hardship, emergency, or exceptional basket access. 1.5\u00d7 covers enhanced dietary, mobility, or care needs; 2.0\u00d7 covers medically necessary requirements; 90-day rolling cap prevents enhanced allocation from becoming baseline without review | Article III, `docs/SPECIFICATIONS.md` |\n| **FC-057** | `ESSENTIAL_ACCESS_VALIDITY_WINDOW_HOURS` | 2 | 72 | hours | Locks the initial Essential Access expiry window to the current constitutional baseline | Article III, `docs/SPECIFICATIONS.md` |\n| **FC-058** | `CSM_BASKET_AND_REGIONAL_ADJUSTMENT_RULE` | 1 | RESERVED \u2014 bind before regional launch | basket definition + adjustment formula | Constitutional Survival Minimum must publish its basket composition and regional-variation rule before activation across heterogeneous localities | Article III, `docs/SPECIFICATIONS.md`, Annex Y |\n| **FC-060** | `VOICE_SECTOR_CEILING` | 1 | 0.20 | fraction of total Voice | Sim Test 4: 3-sector coalition at 25% ceiling achieves 75% supermajority; 20% ceiling caps 3-sector to 60%, below supermajority threshold | Article VI, Patch P-008 |\n| **FC-061** | `VOICE_CAP_PER_PERSON_PER_CYCLE` | 2 | 300 | raw Voice units | Preserves existing Humane Constitution \u00a7VIII baseline | Article VI |\n| **FC-062** | `VOICE_DECAY_RATE` | 2 | 0.15 / day | exponential decay | Existing `model_outline.py` parameter, preserved | Article VI |\n| **FC-063** | `SERVICE_RECORD_DECAY_RATE_NORMAL` | 2 | RESERVED \u2014 bind before Service Record activation | fraction per day | Normal slow-decay rate for Service Record outside Protected Pause or grace-period exceptions | Article VI, `docs/SPECIFICATIONS.md` |\n| **FC-070** | `RESERVE_WINDOW_DAYS` | 1 | 45 | days of supply \u00d7 population at CSM level | Resilience reserves (Article III) sized for CSM \u00d7 population \u00d7 45 days. Exceeds L3 Emergency trigger by 6\u00d7 to prevent reserve-exhaustion cascade | Article III, Annex Y |\n| **FC-071** | `ACCEPTABLE_CSM_FAILURE_THRESHOLD` | 1 | 3 failures per 10,000 residents per 30 days | cluster rate | Above this, cluster enters Scarcity L3 regardless of oracle status | Annex Y \u00a7Y4 |\n| **FC-072** | `SHARED_STOREHOUSE_SCARCITY_ACTIVATION_THRESHOLD_RULE` | 1 | PROPOSED VALUE: Activation when oracle-confirmed supply for any CSM category falls below 85% of the 45-day reserve floor (FC-070) for 3 consecutive measurement cycles, OR when physical sampling (Annex AL \u00a7AL-COST) shows supply below 90% of CSM floor for any single cycle \u2014 bind before activation | category threshold rule | Shared Storehouse may not activate on vague scarcity claims; each essential category must publish its activation threshold rule before emergency overlay becomes operative. 85% of the 45-day reserve provides a 38-day buffer before genuine scarcity; 3-cycle confirmation prevents single-measurement noise from triggering rationing; physical sampling override prevents oracle manipulation from blocking activation | Article III, `docs/SPECIFICATIONS.md`, Annex Y |\n| **FC-080** | `ATTESTATION_STAKE_RATIO` | 2 | 0.20 | fraction of attestor's own Voice and Service Record, proportional to claim size | Attestor risks 20% of their civic balance when attesting; calibrated for meaningful skin-in-the-game without destroying livelihoods on single errors | Article VI, Proposal 9 files |\n| **FC-081** | `ATTESTATION_AUDIT_WINDOW` | 2 | 365 | days | Attestation slashing window after false-claim finding; 1 year matches civic-cycle duration | Article VI |\n| **FC-082** | `ATTESTATION_GRAPH_DENSITY_THRESHOLD` | 2 | 0.40 | mutual cross-attestation ratio | Attestor networks above this density triggers automatic review; calibrated against null-model random-graph baseline | Article VI |\n| **FC-083** | `ATTESTATION_REPUTATION_CREDIT_CAP` | 2 | 2 | civic cycles of successful attestation reputation credit | Caps attestation-derived reputation so reliable attestors become legible civic resources without creating a new status-currency surface | Article VI, Annex AS |\n| **FC-090** | `OMBUDS_SUBCOUNT_MIN` | 1 | 5 | sub-Ombuds nodes | Federated Ombuds (Proposal 8) structural minimum; BFT-equivalent for institutional decisions | Annex AI |\n| **FC-091** | `OMBUDS_SUPERMAJORITY_THRESHOLD` | 1 | 4/5 | affirmative sub-Ombuds | Protocol-level decisions require \u22654 of 5 sub-Ombuds affirmative | Annex AI |\n| **FC-092** | `OMBUDS_TERM_DAYS` | 2 | 730 | days (2 years) | Sub-Ombuds term length; staggered across 5 seats | Annex AI |\n| **FC-100** | `ORACLE_QUORUM_LOSS_RESTORATION_WINDOW` | 1 | 14 | days of verification after quorum restoration | Proposal 6 crisis fallback \u2014 prevents flash-recovery from being exploited as normalization pathway | Article III fallback files |\n| **FC-110** | `TIER1_AMENDMENT_SIGNATURES_MIN` | 1 | 7 of 9 | cryptographic signatures from dispersed key-holders | M-of-N threshold for Tier 1 amendment per Proposal 1; 9 geographically distributed holders; 7 required; allows 2 captured/lost without breakage | `/architecture/amendment_protocol.md` |\n| **FC-111** | `TIER1_AMENDMENT_TIMELOCK_DAYS` | 1 | 180 | days | Minimum wall-clock delay between proposal and effect; survives political cycles | `/architecture/amendment_protocol.md` |\n| **FC-120** | `EXIT_SUPERMAJORITY_THRESHOLD` | 1 | 2/3 | fraction of resident personhood | Required to initiate jurisdictional exit under the Founding Order; prevents transient pluralities from triggering structural discontinuity | `/founding/order/exit_protocol.md` |\n| **FC-121** | `EXIT_UNWIND_DAYS` | 1 | 730 | days (2 years) | Graceful-exit unwind window; Essential Access continuity preserved for individuals during unwind | `/founding/order/exit_protocol.md` |\n| **FC-122** | `SUBSIDIARITY_SCALES` | 1 | household / neighborhood (\u2264500) / locality (\u22645,000) / region (\u2264500,000) / federation | personhood counts | Scale-tier definitions for subsidiarity routing | `/founding/order/jurisdictional_scales.md` |\n| **FC-140** | `AED_ESSENTIAL_ACCESS_FRAUD_BAND` | 2 | target \u22642% / upper bound \u22645% / trigger \u22653% per quarter | quarterly fraud tuple | Essential Access identity fraud consumes physical survival supply directly; its target, upper tolerance, and audit trigger must be public before scale-up. Target anchored below the SNAP program operational error rate (2\u20133% per USDA studies), the closest operational analogue; upper bound set at 5% to force systemic review before fraud reaches GAO-documented government-program false-acceptance range. | Annex AK, Threat_Register.md |\n| **FC-141** | `AED_VOICE_FRAUD_BAND` | 2 | target \u22643% / upper bound \u22647% / trigger \u22655% per quarter | quarterly fraud tuple | Voice fraud distorts agenda-setting and must publish its tolerated error band before activation. Somewhat looser than Essential Access (FC-140) because Voice fraud does not consume physical survival goods; consistent with democratic-participation error tolerances in comparable systems. | Annex AK, Threat_Register.md |\n| **FC-142** | `AED_SERVICE_RECORD_FRAUD_BAND` | 2 | target \u22645% / upper bound \u226410% / trigger \u22657% per quarter | quarterly fraud tuple | Service Record fraud distorts eligibility and role selection; requires a published tolerated-error band. Looser than Voice (FC-141) because Service Record fraud affects longer-cycle eligibility decisions rather than immediate agenda-setting; consistent with public-employment verification tolerances. | Annex AK, Threat_Register.md |\n| **FC-143** | `AED_EXCLUSION_BAND_DISPLACED` | 2 | target \u22643% / upper bound \u22646% / trigger \u22654% per quarter | quarterly exclusion tuple | Displaced persons are a first-order identity-access vulnerability class and require explicit exclusion commitments. UNHCR biometric exclusion monitoring targets <5% for displaced populations; tighter upper bound (6%) chosen because displaced persons have no alternative access route. | Annex AK, Threat_Register.md |\n| **FC-144** | `AED_EXCLUSION_BAND_UNDOCUMENTED` | 2 | target \u22645% / upper bound \u22648% / trigger \u22656% per quarter | quarterly exclusion tuple | Undocumented persons are a first-order identity-access vulnerability class and require explicit exclusion commitments. Documentation barriers produce a structurally higher baseline exclusion rate; trigger set at 6% to force institutional review before the rate reaches double digits. | Annex AK, Threat_Register.md |\n| **FC-145** | `AED_EXCLUSION_BAND_DIGITALLY_FRAGILE` | 2 | target \u22645% / upper bound \u22648% / trigger \u22656% per quarter | quarterly exclusion tuple | Digitally fragile persons require a separately published exclusion band so access failures are not hidden in aggregate success rates. Structural access barriers (no smartphone, limited literacy, disability) produce a higher baseline analogous to undocumented persons; 8% hard ceiling requires mandatory architecture review before that threshold is reached. | Annex AK, Threat_Register.md |\n| **FC-146** | `AED_EXCLUSION_BAND_RECOVERY_CRISIS` | 2 | RESERVED \u2014 bind target / upper bound / trigger before first scale-up gate | quarterly exclusion tuple | Crisis and recovery cases are structurally easy to exclude and require their own exclusion commitments | Annex AK |\n| **FC-147** | `AED_EXCLUSION_BAND_OVERALL_POPULATION` | 2 | RESERVED \u2014 bind target / upper bound / trigger before first scale-up gate | quarterly exclusion tuple | Aggregate exclusion remains a governing signal even when vulnerable-population bands are tracked separately | Annex AK |\n| **FC-148** | `AED_EXCLUSION_PRIORITY_MULTIPLIER` | 2 | PROPOSED VALUE: 1.5 \u2014 bind before activation | multiple of exclusion target | Governs when exclusion reduction takes priority over further fraud tightening in the AED trade-off rule. When exclusion reduction and fraud tightening trade off, reducing exclusion is weighted 1.5\u00d7 more important; reflects the asymmetric harm of wrongful exclusion (survival floor loss) vs. wrongful inclusion (resource dilution) | Annex AK |\n| **FC-149** | `AED_FRAUD_PRIORITY_BOUND` | 2 | PROPOSED VALUE: 5% (= FC-140 Essential Access upper bound) \u2014 bind before activation | fraud upper-bound reference | Governs when fraud reduction takes priority over further inclusion loosening in the AED trade-off rule. When Essential Access fraud is below its upper bound (5%), further fraud reduction yields diminishing returns and inclusion improvement should take priority; at or above 5%, fraud reduction takes priority | Annex AK |\n| **FC-150** | `AED_SIMULTANEOUS_BREACH_DEFAULT_PREFERENCE` | 2 | PROPOSED VALUE: exclusion-first \u2014 bind before activation | exclusion-first / fraud-first | Publicly locks the default preference when both fraud and exclusion exceed their upper bounds simultaneously. When both fraud and exclusion rates breach their upper bounds simultaneously, reducing exclusion takes priority \u2014 consistent with the survival floor principle that wrongful exclusion is the worse error | Annex AK |\n| **FC-160** | `CC_STANDARD_RELEASE_MAX` | 2 | RESERVED \u2014 bind before escrow launch | Flow | Upper bound for single-verifier milestone releases in contract-commitment architecture | Annex AR |\n| **FC-161** | `CC_ENHANCED_RELEASE_MAX` | 2 | RESERVED \u2014 bind before escrow launch | Flow | Upper bound for dual-verifier milestone releases; releases above this threshold enter Major tier | Annex AR |\n| **FC-162** | `CC_MAJOR_RELEASE_PERCENT_FLOOR` | 2 | RESERVED \u2014 bind before escrow launch | fraction of total project value | Anti-fragmentation rule that forces Major-tier verification above a published share of project value regardless of absolute Flow amount | Annex AR |\n| **FC-163** | `CC_ESSENTIAL_ACCESS_DEPLOYMENT_WINDOW` | 2 | RESERVED \u2014 bind before escrow launch | days | Maximum idle escrow hold for Essential Access delivery programmes before CRP review triggers | Annex AR |\n| **FC-164** | `CC_STANDARD_DEPLOYMENT_WINDOW` | 2 | RESERVED \u2014 bind before escrow launch | days | Maximum idle escrow hold for standard infrastructure before CRP review triggers | Annex AR |\n| **FC-165** | `CC_LARGE_PROJECT_VALUE_THRESHOLD` | 2 | RESERVED \u2014 bind before escrow launch | Flow contracted value | Published breakpoint above which projects count as large-scale or novel for deployment-window purposes | Annex AR |\n| **FC-166** | `CC_LARGE_SCALE_DEPLOYMENT_WINDOW` | 2 | RESERVED \u2014 bind before escrow launch | days | Maximum idle escrow hold for large-scale or first-of-type infrastructure before CRP review triggers | Annex AR |\n| **FC-167** | `CC_CRP_EXPLANATION_DEADLINE` | 2 | RESERVED \u2014 bind before escrow launch | days after trigger | Deadline for commissioning authorities to explain deployment-window overruns to CRP | Annex AR |\n| **FC-168** | `CC_CRP_DECISION_DEADLINE` | 2 | RESERVED \u2014 bind before escrow launch | days after trigger | Deadline for CRP to issue extension / support / escalation decisions on deployment-window review | Annex AR |\n| **FC-169** | `CC_CRP_EXTENSION_WINDOW` | 2 | RESERVED \u2014 bind before escrow launch | days | Additional time granted when CRP confirms legitimate procurement complexity | Annex AR |\n| **FC-170** | `CC_CRP_PUBLICATION_DEADLINE` | 2 | RESERVED \u2014 bind before escrow launch | days after decision | Deadline for publishing CRP deployment-window review outcomes | Annex AR |\n| **FC-171** | `CC_FORCE_MAJEURE_SELF_CERT_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | cumulative days per project | Maximum freeze duration available on contractor self-certification before higher verification tiers apply | Annex AR |\n| **FC-172** | `CC_FORCE_MAJEURE_THIRD_PARTY_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | cumulative days per project | Maximum freeze duration available on third-party certification before panel review applies | Annex AR |\n| **FC-173** | `CC_FORCE_MAJEURE_PANEL_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | cumulative days per project | Hard cap for force-majeure freeze duration before restructuring review replaces further freeze eligibility | Annex AR |\n| **FC-174** | `CC_ESSENTIAL_ACCESS_FORCE_MAJEURE_DURATION_CAP` | 2 | RESERVED \u2014 bind before escrow launch | fraction of contracted project duration | Prevents short Essential Access delivery projects from using an absolute freeze cap that functionally nullifies the deployment-delay consequence and Annex D source-base review | Annex AR |\n| **FC-175** | `CC_INSPECTOR_POOL_MIN_PILOT` | 2 | RESERVED \u2014 bind before escrow launch | qualified inspectors | Minimum inspector pool size for pilot / single-municipality deployment | Annex AR |\n| **FC-176** | `CC_INSPECTOR_POOL_MIN_REGIONAL` | 2 | RESERVED \u2014 bind before escrow launch | qualified inspectors | Minimum inspector pool size for regional deployment | Annex AR |\n| **FC-177** | `CC_INSPECTOR_POOL_MIN_NATIONAL_PER_REGION` | 2 | RESERVED \u2014 bind before escrow launch | qualified inspectors per region | Minimum inspector pool size for national / multi-regional deployment | Annex AR |\n| **FC-178** | `CC_STANDARD_ROTATION_MAX_CONSECUTIVE` | 2 | RESERVED \u2014 bind before escrow launch | consecutive milestones | Maximum repeated assignments of the same inspector on Standard-tier releases | Annex AR |\n| **FC-179** | `CC_STANDARD_ROTATION_COOLING_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | days | Cooling-off interval before an inspector may return to the same project at Standard tier | Annex AR |\n| **FC-180** | `CC_ENHANCED_ROTATION_MAX_CONSECUTIVE` | 2 | RESERVED \u2014 bind before escrow launch | consecutive milestones | Maximum repeated assignments of the same inspector on Enhanced-tier releases | Annex AR |\n| **FC-181** | `CC_ENHANCED_ROTATION_COOLING_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | days | Cooling-off interval before an inspector may return to the same project at Enhanced tier | Annex AR |\n| **FC-182** | `CC_MAJOR_ROTATION_MAX_CONSECUTIVE` | 2 | RESERVED \u2014 bind before escrow launch | consecutive milestones | Maximum repeated assignments of the same inspector on Major-tier releases | Annex AR |\n| **FC-183** | `CC_MAJOR_ROTATION_COOLING_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | days | Cooling-off interval before an inspector may return to the same project at Major tier | Annex AR |\n| **FC-184** | `CC_SINGLE_SECTOR_BACKGROUND_CAP` | 2 | RESERVED \u2014 bind before escrow launch | fraction of active pool | Caps prior-employment concentration from any single sector inside the active inspector pool | Annex AR |\n| **FC-185** | `AT_CALORIC_STAPLE_STRATEGIC_FLOOR` | 1 | RESERVED \u2014 bind by TSP + Article VI ratification before activation | days of supply | Caloric staple strategic reserve floor; draft value 180 days | Annex AT \u00a7AT1 |\n| **FC-186** | `AT_ENERGY_STRATEGIC_FLOOR` | 1 | RESERVED \u2014 bind by TSP + Article VI ratification before activation | days of supply (peak-demand period) | Energy strategic reserve floor; draft value 90 days | Annex AT \u00a7AT1 |\n| **FC-187** | `AT_ESSENTIAL_MEDICINES_STRATEGIC_FLOOR` | 1 | RESERVED \u2014 bind by TSP + Article VI ratification before activation | days of supply | Essential medicines strategic reserve floor; draft value 365 days | Annex AT \u00a7AT1 |\n| **FC-188** | `AT_SINGLE_SUPPLIER_WATCH_THRESHOLD` | 2 | RESERVED \u2014 bind by TSP before activation | % of category consumption | Single-supplier Watch trigger; draft value 25% | Annex AT \u00a7AT2 |\n| **FC-189** | `AT_SINGLE_SUPPLIER_CRITICAL_THRESHOLD` | 2 | RESERVED \u2014 bind by TSP before activation | % of category consumption | Single-supplier Critical trigger; draft value 60% | Annex AT \u00a7AT2 |\n| **FC-190** | `AT_FOREIGN_CAPITAL_INFLOW_LIMIT` | 2 | RESERVED \u2014 bind by TSP + Article V review before activation | % of annual Flow issuance | Foreign capital inflow concentration ceiling; draft value 15% | Annex AT \u00a7AT4 |\n| **FC-191** | `AT_FOREIGN_CAPITAL_CONVERSION_WINDOW` | 2 | RESERVED \u2014 bind by TSP + Article V review before activation | days before public-return review escalates | Foreign capital conversion window; draft value 30 days | Annex AT \u00a7AT4 |\n| **FC-192** | `AT_EXTRACTIVE_RECLASSIFICATION_WINDOW` | 2 | RESERVED \u2014 bind by TSP before activation | months | Observation window before extractive-pattern reclassification; draft value 12 months | Annex AT \u00a7AT5 |\n| **FC-193** | `AT_STAGE3_SUSPENSION_THRESHOLD` | 1 | RESERVED \u2014 bind by Article VI before activation | Article VI supermajority fraction | Stage 3 suspension ratification threshold; draft value two-thirds | Annex AT \u00a7AT5 |\n| **FC-194** | `AT_ESSENTIAL_FUEL_RESERVE_MIN` | 1 | RESERVED \u2014 bind before essential-sector activation | days by region and season | Essential fuel reserve minimum for refusal survivability; draft anchor 60-90 days | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-195** | `AT_ESSENTIAL_MEDICINE_STOCKPILE_MIN` | 1 | RESERVED \u2014 bind before medicine fallback activation | days by CSM medicine category | Essential medicine stockpile floor for refusal survivability; draft anchor 90-180 days pending clinical list and expiry model | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-196** | `AT_MAX_ESSENTIAL_SUPPLIER_CONCENTRATION` | 1 | RESERVED \u2014 bind before launch | % of regional essential throughput | Maximum supplier concentration before mandatory fallback/diversification review; draft anchor 25% | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-197** | `AT_PUBLIC_FALLBACK_ACTIVATION_DEADLINE` | 1 | RESERVED \u2014 bind before activation | hours / days | Deadline for public/cooperative/treaty fallback activation after essential-sector interruption; draft anchor 72h critical / 14d managed transition | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-198** | `AT_PROCUREMENT_CONCENTRATION_THRESHOLD` | 2 | RESERVED \u2014 bind before essential-sector procurement launch | % of essential category spend | Review/remediation thresholds for procurement concentration; draft anchor review >30%, mandatory remediation >40% | Annex AT; Capture Dashboard Specification |\n| **FC-199** | `AT_PBM_INTERMEDIARY_SEPARATION_THRESHOLD` | 1 | RESERVED \u2014 bind before medicine-access launch | % of cross-owned claims or dispensing volume | Separation/firewall trigger for PBM-style intermediaries; draft anchor review >10%, mandatory firewall >20% | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-200** | `AT_CRITICAL_LOGISTICS_REDUNDANCY_FLOOR` | 1 | RESERVED \u2014 bind before logistics-dependent launch | independent routes / operators | Minimum independent logistics redundancy for essential regions; draft anchor two independent routes and operators | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-201** | `AT_ESSENTIAL_DATA_CLAIMS_PORTABILITY_DEADLINE` | 2 | RESERVED \u2014 bind before medicine/logistics fallback activation | hours / days | Deadline for emergency and full transition export of essential records, claims, formularies, and routing data; draft anchor 24h emergency / 30d full package | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-202** | `COMMONS_RETURN_SOURCE_BASES` | 1 | RESERVED \u2014 bind before CRUS activation | source-base list | Defines the allowed Commons Return bases: land/location value, natural resources, spectrum/airspace, monopoly licenses, unavoidable platform/network rents, high-value public concessions, and large succession transfers. Ordinary labor income, survival access, basic household exchange, ordinary working balances, ordinary household tools, protected below-threshold homes, and protected community/tribal/church holdings are excluded unless used as avoidance shells. The list is closed (INV-008): extending a base downward onto ordinary life is a Tier-1 amendment, never an administrative decision | Annex D, INVARIANTS.md INV-008, Parameter Calibration Register, Commons Return and Universal Stake Evidence Test Package |\n| **FC-203** | `COMMONS_RETURN_ASSESSMENT_RATE` | 2 | RESERVED \u2014 Tier-3 calibrated by source base before activation | rate schedule | Sets the Commons Return assessment rate by source base without making ordinary labor or survival access the funding base. Must test incidence, valuation hiding, external-capital arbitrage, and productive-stewardship effects before binding | Annex D, Parameter Calibration Register |\n| **FC-204** | `COMMONS_RETURN_PROTECTED_THRESHOLDS` | 2 | RESERVED \u2014 bind before CRUS activation | threshold schedule | Protects ordinary homes, ordinary tools, working balances, small stewardship, protected associations, and household exchange from assessment while preventing elite shelter through threshold splitting or avoidance shells | Annex D, Fairness Vignette Library, Parameter Calibration Register |\n| **FC-205** | `UNIVERSAL_STAKE_DISTRIBUTION_CADENCE` | 2 | RESERVED \u2014 bind before first distribution | cadence | Sets distribution timing for Universal Stake so households can rely on it and operators cannot time distributions as political reward or punishment. A distribution may be authorized only after the floor and its reserves are funded (INV-014) | Annex D, INVARIANTS.md INV-014, Claims and Evidence Register |\n| **FC-206** | `UNIVERSAL_STAKE_ELIGIBILITY_RULE` | 1 | RESERVED \u2014 bind before first distribution | eligibility rule | Keeps Universal Stake universal for members while prohibiting sale, assignment, garnishment, pledge, inheritance, membership purchase, survival-priority purchase, legal-standing purchase, office purchase, or Voice purchase | Annex D, Annex AK, Commons Return and Universal Stake Evidence Test Package |\n| **FC-207** | `CRUS_ANTI_CAPTURE_GATES` | 1 | RESERVED \u2014 bind before CRUS activation | gate bundle | Requires public accounting, no patronage discretion, no targeted political reward or punishment, data minimization, auditability, appeal rights, and ordinary-reader source reporting | Annex D, Capture Dashboard Specification, Abuse Case Library |\n| **FC-208** | `CRUS_PUBLIC_LOCKBOX_RESERVE_RULE` | 2 | RESERVED \u2014 bind before fund routing | reserve/draw rule | Defines reserve, draw, passive fund, and public-accounting rules for any lockbox or social wealth fund receiving Commons Return. Prevents fund managers from becoming patronage allocators or political investors | Annex D, Parameter Calibration Register |\n| **FC-209** | `CRUS_APPEAL_PATH` | 1 | RESERVED \u2014 bind before assessment or distribution | appeal path | Gives assessed source holders and excluded stake claimants a human appeal without allowing high-value actors to stall assessment through procedural delay | Annex D, Federated Ombuds, Claims and Evidence Register |\n| **FC-210** | `CRUS_REVIEW_CADENCE` | 2 | RESERVED \u2014 bind before CRUS activation | review cadence | Sets scheduled review of incidence, eligibility, valuation, source bases, distribution, reserves, and capture metrics. Missed cadence or missing data is itself a review failure | Annex D, Capture Dashboard Specification, Pilot Evidence Roadmap |\n| **FC-211** | `AJ_BYPASS_DETECTION_RETENTION_CEILING` | 2 | RESERVED \u2014 bind before AJ detection infrastructure activates | retention schedule (days) | Bounds how long identifiable bypass-detection records may be held: draft anchor 90 days post enforcement-matter finality, 180-day ceiling on identifiable hold while no case has formed, 365-day absolute hard cap from collection (then aggregate or deleted); PII-strip point unchanged (earliest point consistent with detection, Annex AM \u00a7AM7). The 365-day \"from collection\" cap is anchored per underlying record at first ingestion of that person's data and is never reset by re-derivation, feature re-extraction, or opening a new pattern-build; a pattern-build that has run 180 days without a formed case strips to aggregate regardless of build status. Where enforcement-matter finality + 90 days would exceed 365 days from collection, the 365-day absolute cap governs: identifiable data strips to aggregate at 365 days regardless of whether finality has been reached, and a matter unresolved at 365 days continues on aggregate or case-pseudonym data only. Closes G-1; bound by the Enforcement Panel and Federated Ombuds; thresholds may be Restricted-Register (P-021) | Annex AJ, Monitoring Administrative Safety Packet, Parameter Calibration Register, Annex L \u00a7L7 |\n| **FC-212** | `AF_ATTESTATION_GRAPH_RETENTION_RULE` | 2 | RESERVED \u2014 bind before AF3 collusion-detection activates | retention/stripping schedule (days) | Bounds the hardship attestation graph: stripped to a case-pseudonym at intake, fully purged once the review and its appeal-spine (Annex L \u00a7L7) window close + 30 days, 180-day ceiling past appeal-window close; safe-harbor/innocent-explanation cases purged at closure. Closes G-2; bound by the Annex AF reviewing body and Federated Ombuds | Annex AF \u00a7AF3, Monitoring Administrative Safety Packet, Parameter Calibration Register, Annex L \u00a7L7 |\n| **FC-213** | `CRUS_ASSESSMENT_RETENTION_RULE` | 2 | RESERVED \u2014 bind before CRUS assessment streams operate | retention/stripping schedule (days/months) | Bounds Commons Return assessment data: PII-stripped to aggregate at assessment finality (D6.5 household-linkable records stripped first), retained no later than the Annex L \u00a7L7 appeal window close + 30 days, 18-month total identifiable hard cap; ties to the \u00a7D6.1 Monitoring Purpose Register retention-clock gate (FC-207 anti-capture family). Closes G-3 | Annex D \u00a7D6, Monitoring Administrative Safety Packet, Parameter Calibration Register, Annex L \u00a7L7 |\n| **FC-214** | `MONITORED_PERSON_FLAG_EXPIRY` | 2 | RESERVED \u2014 bind before any individual-flag stream operates | flag expiry (days) | A flag expires (cannot trigger action, cannot be reused) at the earlier of resolution + 30 days or 180-day max age if never resolved; expiry is an irreversible unlink, not a soft-delete, and is non-extendable; 365-day absolute cap on flag age; one rule governs all flag streams. Closes G-4; bound by this packet's owner and the Annex C reviewer | Monitoring Administrative Safety Packet, Annex C, Parameter Calibration Register, Annex L \u00a7L7 |\n| **FC-YT1** | `CSM_FAILURE_COUNT_THRESHOLD` | 2 | 3 | verified delivery failures per jurisdictional cluster per 30-day window | Pattern-detection trigger for H-3 refounding review initiation. Applies as a raw cluster count independently of FC-071's per-population rate (3 per 10,000 residents per 30 days); both thresholds apply concurrently. \"Verified delivery failure\" requires confirmation by at least one Tier-3 physical-sampling oracle node per ANNEX_Y \u00a7Y1. Federated Ombuds verification of this value required before INV-LAUNCH-1 clears. Pre-launch blocking gate. | ANNEX_Y \u00a7Y4 |\n| **FC-YT2** | `CSM_SURVIVAL_RESERVE_DAYS` | 2 | 90 | days of CSM coverage per enrolled population, by jurisdiction and essential category | CSM-specific reserve gate. Complements the general resilience reserve FC-070 (45 days); both must be independently satisfied. This value is the binding survival-floor-specific pre-launch gate. Federated Ombuds verification of this value required before INV-LAUNCH-1 clears. Pre-launch blocking gate. | ANNEX_Y \u00a7Y7 |\n\n---\n\n## Derivation Notes\n\n**FC-020 (`PROTECTED_PAUSE_FLOOR = 0.30`).** Sim Test 7 in `docs/ADVERSARIAL_AUDIT.md` established:\n- Caregiver-at-2%-contribution Voice equilibrium = 0.13 units.\n- Standard-at-10%-contribution Voice equilibrium = 0.67 units.\n- Protected Pause at 20% decay dampening = 4.44 units (exploitable if set there).\n\nFloor value must satisfy: above the exposed-caregiver equilibrium (0.13) to provide real voice; below the standard-contributor equilibrium (0.67) to prevent pause-as-exploit. **0.30** sits \u224833% of the way up this band \u2014 meaningful protection without civic premium for pausing.\n\n**FC-060 (`VOICE_SECTOR_CEILING = 0.20`).** From Sim Test 4: for N=5 sectors with ceiling c, supermajority (\u22652/3) is achievable via k-sector coalition when k\u00b7c \u2265 2/3. Setting c = 0.20, maximum 3-sector coalition = 0.60 < 0.667 \u2014 no 3-sector supermajority possible. Preserves margin against measurement imprecision.\n\n**FC-030 / FC-031 (Oracle parameters).** BFT theorem: n \u2265 3f+1 for tolerance of f faulty nodes. At f = 1: n \u2265 4. **FC-030 = 5** provides margin of one node above the floor, tolerates single-node loss without immediately dropping below BFT. FC-031 = 3 methodology classes guarantees diversity even when one class is simultaneously compromised.\n\n**FC-040 (`BRIBE_DETERRENCE_MULTIPLIER = 5.0`).** Sim Test 5: at 85% detection, penalty = 0.18\u00d7 gain is break-even. Setting penalty = 5\u00d7 gain produces expected value = \u2212(0.85 \u00d7 5 \u2212 0.15 \u00d7 1) \u00d7 gain = \u22124.1\u00d7 gain. Margin of safety permits detection probability as low as 25% before deterrent fails.\n\n**FC-110 / FC-111 (Tier 1 amendment parameters).** Distributed key-holder count of 9 balances resilience against loss (can lose 2 without breakage) versus capture resistance (must capture \u22653 to prevent amendment, \u22657 to force amendment). Timelock of 180 days ensures any captured supermajority survives at least one political cycle before amendment effect \u2014 enables reversal proposal by uncaptured parties.\n\n---\n\n---\n\n## FC-YT1 and FC-YT2 \u2014 Survival Floor Activation Gate Parameters\n\n**FC-YT1 \u2014 CSM Delivery Failure Pattern-Detection Trigger**\n- **Value:** 3 verified delivery failures per jurisdictional cluster within any 30-day window\n- **Tier:** Tier 2 / pre-launch blocking gate\n- **Authority:** Required by INV-LAUNCH-1 and ANNEX_Y \u00a7Y4 before any operational phase enrolling real persons\n- **Ombuds verification required:** Yes \u2014 the Federated Ombuds must publish the confirmed numeric value before this gate clears\n- **Relationship to FC-071:** FC-071 defines the per-population rate (3 per 10,000 residents per 30 days) that triggers cluster-level review. FC-YT1 is the raw count threshold that triggers H-3 refounding review initiation regardless of per-population rate. Both apply independently.\n- **\"Verified delivery failure\"** means a failure confirmed by at least one Tier-3 (physical sampling) oracle node per ANNEX_Y \u00a7Y1.\n\n**FC-YT2 \u2014 90-Day CSM Reserve Requirement**\n- **Value:** 90 days \u00d7 CSM \u00d7 enrolled population, by jurisdiction and essential category\n- **Tier:** Tier 2 / pre-launch blocking gate\n- **Authority:** Required by INV-LAUNCH-1 and ANNEX_Y \u00a7Y7 before any operational phase enrolling real persons\n- **Ombuds verification required:** Yes \u2014 same requirement as FC-YT1\n- **Relationship to FC-070:** FC-070 binds the general resilience reserve window at 45 days. FC-YT2 binds the CSM-specific reserve at 90 days. These are complementary: the general reserve (45 days) is an operational floor; the CSM reserve (90 days) is the survival-floor-specific gate. Both must be met; FC-YT2 is the binding pre-launch gate.\n\n---\n\n## Hash Commitment\n\nAt founding, the SHA-256 hash of this file (computed with the canonical line-ending, UTF-8 encoding, and without trailing whitespace normalization) is committed to the ledger genesis block. Subsequent amendments produce new hash commitments with version-chained history per `/architecture/drift_chain.md`.\n\n**Genesis commitment:** TBD at founding event. Computed by the founding coalition's multi-signature process.\n\n---\n\n## Amendment Log\n\n| Version | Date | Change | Authority |\n|:---|:---|:---|:---|\n| 1.0 | 2026-04-18 | Initial publication of the founding numerical lock file | Founding release |\n\n**End of Founding Commitments.**\n", "headings": [ { "level": 1, @@ -7969,7 +7974,7 @@ "slug": "amendment-log" } ], - "wordCount": 4640, + "wordCount": 5099, "headingCount": 6 }, { @@ -8918,7 +8923,7 @@ "status": "", "statusBucket": "reference", "summary": "Genuine long-term hardship (severe disability, permanent caregiving responsibility, chronic illness) qualifies under the high-intensity standard. Graduated intensity targets exploitation detection at the renewal stage, not access deterrence at initiation. Any qualifying hardship is approved under any review standard.", - "content": "# ANNEX AF \u2014 Grace Period Exploitation Clauses\n\n> **Provenance:** Implements [P-009 \u2014 Grace Exploitation Loop Hardening] \u00b7 Addresses T-009 \u00b7 Status: see Patch Log\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Addresses the grace period exploitation loop at design level: adds graduated renewal intensity, cross-quarter pause history review, collusion detection in hardship attestation networks, and slow Service Record decay during extended pauses. |\n> | **Who it protects** | Genuine long-term hardship users who need the Protected Pause Window without penalty; the contribution and civic pools from coordinated exploitation that rotates fake hardship claims to preserve elite governance eligibility. |\n> | **Failure risk** | A coordinated network uses mutual attestation and category-switching to maintain permanent pause status, preserving Service Record and civic eligibility indefinitely without genuine contribution; grace mechanisms created for the vulnerable are captured by sophisticated actors. |\n> | **Evidence status** | Active \u2014 unproven |\n> | **Linked risks** | T-009 / P-009 (grace exploitation loop); T-008 / P-008 (elite formation bypass); Annex K4 (Protected Pause Window); AC3.5 (cooling-off cohort rule) |\n\n**Purpose.** This annex introduces operative clauses for P-009 (T-009 Grace Exploitation Loop). It amends Annex K4 (Protected Pause), extends P-002 collusion analytics to hardship attestation, and addresses the T-009 \u00d7 T-008 bypass route at design level. Status: ACTIVE in the Patch Log; evidence remains Active \u2014 unproven until the Service Record Misuse Evidence Test Package is run.\n\n### AF1. Graduated Renewal Intensity (Annex K4 Amendment)\nThe Protected Pause Window renewal review must apply graduated evidence standards based on cumulative pause history. Initial activation and each renewal are governed by the following standards:\n\n| Pause Instance | Evidence Standard | Review Body | SLA |\n| :--- | :--- | :--- | :--- |\n| **First activation** | Lightweight \u2014 one qualifying condition, self-declaration with supporting evidence | Local Review Office | 3 days |\n| **First renewal (Q5)** | Structured \u2014 same category evidence plus brief status update confirming ongoing hardship | Local RO + case file review | 5 days |\n| **Second renewal (Q9)** | Mid-intensity \u2014 full evidence bundle; confirmation that appropriate support services were offered or declined | Regional review + Local RO | 7 days |\n| **Third+ renewal (Q13+)** | High-intensity \u2014 independent assessment, same standard as high-impact Service Record claim; published aggregate statistics | Independent panel | 14 days |\n\nGenuine long-term hardship (severe disability, permanent caregiving responsibility, chronic illness) qualifies under the high-intensity standard. Graduated intensity targets exploitation detection at the renewal stage, not access deterrence at initiation. Any qualifying hardship is approved under any review standard.\n\n**Permanent-condition exemption.** Once an independent panel has confirmed at a high-intensity renewal that the qualifying hardship is genuinely permanent or chronic \u2014 permanent disability, lifelong caregiving responsibility, or an irreversible chronic illness \u2014 subsequent renewals drop to a lightweight attestation-of-continuation: a confirmation that the unchanged condition persists, processed by the Local Review Office within 3 days. The high-intensity gauntlet is not repeated on a recurring clock for a condition the panel has already found unchanging. The exemption is recorded in the cross-quarter history and may be revisited only if specific evidence indicates the condition has materially changed; it is never reopened merely because a renewal interval has elapsed.\n\nCategory switching between renewals \u2014 activating a new qualifying category to restart the renewal clock \u2014 is flagged in the cross-quarter history and reviewed with elevated scrutiny at the next renewal. It does not automatically deny the new activation.\n\n### AF2. Cross-Quarter History Review\nEvery renewal review must include a full summary of the person's Protected Pause history \u2014 not only the current qualifying event. The reviewer must assess the pattern across the full history and document their assessment. A pattern of repeated renewals with category switching constitutes a review flag; it does not constitute grounds for automatic denial absent other evidence of fraud.\n\n### AF3. Hardship Attestation Collusion Detection\nThe collusion-graph analytics established in P-002 are extended to hardship attestation networks. The following graph patterns trigger elevated scrutiny review:\n- **Mutual attestation pairs:** Person A attests to Person B's hardship AND Person B attests to Person A's hardship within the same 4-quarter window.\n- **Star attestation clusters:** 4 or more people whose hardship is attested exclusively by the same small group of active contributors.\n- **Temporal clustering:** 4 or more pause activations within the same social network \u2014 defined by attestation relationships \u2014 within a 2-quarter window.\n\nDetection triggers elevated scrutiny review, not automatic denial. The review must assess whether an innocent explanation exists \u2014 a community disaster, a workplace closure, or a shared housing crisis may legitimately produce these patterns.\n\n**Community-disaster safe harbor:** When a declared emergency (oracle-verified) affects the attestation network's region, collusion patterns among affected persons are exempt from elevated scrutiny for 2 quarters. Safe harbor is applied by the reviewing body automatically upon confirming regional emergency status.\n\n**Slow-burn shared-hardship safe harbor:** Genuine co-located or co-affiliated hardship frequently arrives without a formal emergency declaration \u2014 a single plant closing before any oracle declaration, an extended-kinship network in deep poverty, the failure of a single-employer town. Where the reviewing body finds documented evidence of such a cluster \u2014 a shared employer, a shared locality, or a shared kinship or housing network experiencing genuine concurrent hardship \u2014 the affected persons receive the same presumption of an innocent explanation that the community-disaster safe harbor grants. The reviewer documents the shared-hardship basis, and the flagged collusion pattern is treated as explained rather than suspect. This pathway requires no declared emergency; it requires only credible documentation of co-located or co-affiliated hardship, and like the declared-disaster safe harbor it suspends elevated scrutiny for the affected cluster for 2 quarters.\n\n**Attestation-graph data minimization.** The hardship attestation graph maps the support networks of people in hardship and must never become a reusable surveillance asset. Access to the attestation graph is purpose-limited to exploitation review under this annex: only the reviewing bodies and independent panels conducting an active collusion-detection review may view it, and only the subgraph relevant to the case under review. The graph is retained only as long as needed for active and appealable reviews and is purged on a fixed retention schedule once a review and its appeal window have closed; confirmed safe-harbor or innocent-explanation cases are purged at closure. The attestation graph may not be repurposed for eligibility scoring, civic-standing assessment, law-enforcement referral, or any use beyond exploitation review, and may not be exported, sold, or shared outside the reviewing function. Every access is logged and auditable. The graph's regime is recorded in the per-domain calibration table of the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md) (P-075); its unspecified retention-schedule length is registered there as an open gap.\n\n### AF4. Service Record Slow-Decay During Extended Pause (Annex K4 Amendment)\nDuring a Protected Pause Window, Service Record decays at 20% of the normal quarterly rate rather than being fully frozen. Voice decay freeze is unchanged \u2014 Voice cliff-effect protection is preserved in full. The Service Record slow-decay applies only during quarters in which a Protected Pause Window is active.\n\n| Scenario | Service Record After 4 Quarters | Service Record After 8 Quarters | Service Record After 12 Quarters |\n| :--- | :--- | :--- | :--- |\n| No pause (normal decay at 10%/quarter) | 65.6 | 43.0 | 28.2 |\n| Full freeze (current design) | 100.0 | 100.0 | 100.0 |\n| **Slow-decay at 20% of normal (P-009)** | 92.2 | 85.1 | 78.5 |\n\n**Calibration rationale:** a 4-quarter pause (one typical hardship cycle) produces approximately 8% Service Record reduction \u2014 negligible for genuine users who will rebuild through resumed contribution. A 12-quarter rotation exploit produces approximately 22% reduction, draining high-impact service eligibility thresholds over time. The slow-decay must be clearly communicated: it is not punitive, and Service Record can be fully rebuilt through resumed verified contribution after the pause ends.\n\n### AF5. Service Pool Pause-Saturation Monitoring\nPublished quarterly in the Article VII concentration dashboard (extending AC3.7): the percentage of each Service Record-governed service pool simultaneously in Protected Pause. When any pool exceeds 20% simultaneously paused, a pool-health alert fires. The alert triggers: (a) review of whether paused members' service eligibility should be temporarily suspended pending return to active status; (b) assessment of whether the pool requires emergency replenishment from the next eligible cohort. Pool saturation monitoring triggers review only \u2014 it never automatically bars any individual's Protected Pause activation.\n\n**Published false-positive rate.** Extending the aggregate-statistics publication required at the high-intensity renewal standard (AF1), the program publishes as a standing quarterly metric its false-positive rate: the share of elevated-scrutiny and high-intensity reviews that resolve as genuine hardship rather than confirmed exploitation. A persistently high false-positive rate is treated as evidence that the scrutiny thresholds are over-burdening genuine claimants and is grounds to recalibrate the triggers in AF1 and AF3 toward lighter-touch review. The metric is published in aggregate only and never identifies individuals.\n\n### AF6. Capability Development Pathway During Pause [Ambitious]\nDuring a Protected Pause Window, a person may earn up to 15% of their normal quarterly Service Record through verified pause-appropriate stewardship. Qualifying activities: peer support for other hardship-affected persons; verified self-directed learning with completion evidence; community care activities that do not require the person's primary capacity. 'Pause-appropriate stewardship' is a protected term under P-004. The 15% cap is absolute; the pathway cannot be used to accumulate Service Record beyond the person's pre-pause baseline.\n\n### AF7. T-009 \u00d7 P-008 Explicit Bypass Control [Ambitious]\nP-008 Annex AC3.5 (Cooling-Off Cohort Rule) is amended as follows. For the purpose of the cohort concurrent maximum (2 members of the same co-service cohort sharing review authority simultaneously), a person is considered effectively serving if their Service Record is maintained above the service eligibility threshold through Protected Pause rather than ongoing contribution. Paused cohort members count toward the 2-member concurrent maximum. When a paused cohort member's count causes the maximum to be exceeded, the active serving members must accommodate \u2014 not the paused person. The paused person is never required to exit pause due to this rule.\n\n---\n\n### AF8. Complete Threat/Patch Linkage \u2014 All Sessions\n\n| Threat | Patch | Status | Annex | Session |\n| :--- | :--- | :--- | :--- | :--- |\n| T-001 | P-001 | ACTIVE | AB | S1 |\n| T-002 | P-003 | ACTIVE | AB | S1 |\n| T-004 | P-002 | ACTIVE | AB | S1 |\n| T-007 | P-004 | ACTIVE | AB | S1 |\n| T-005 | P-005 | ACTIVE | AC1 | S2 |\n| T-006 | P-006 | ACTIVE | AC2 | S2 |\n| T-008 | P-008 | ACTIVE | AC3; operative authority superseded by P-025 | S2 |\n| T-011 | P-011 | ACTIVE | AD | S2 |\n| T-012 | P-012 | ACTIVE | AE2.1 | S3 |\n| T-013 | P-012 | ACTIVE | AE2.2 | S3 |\n| T-014 | P-012 | ACTIVE | AE2.3 | S3 |\n| T-015 | P-012 | ACTIVE | AE2.4 | S3 |\n| T-009 | P-009 | ACTIVE | AF | S4 |\n\n*T-009 is addressed at design level via P-009. All threats named through this annex have mitigation designs, not evidence-backed closure. Outstanding pre-launch items include Service Record misuse testing, hardship attestation red-team review, public comprehension review, and residual-risk update before any stronger claim.*\n\n---\n", + "content": "# ANNEX AF \u2014 Grace Period Exploitation Clauses\n\n> **Provenance:** Implements [P-009 \u2014 Grace Exploitation Loop Hardening] \u00b7 Addresses T-009 \u00b7 Status: see Patch Log\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Addresses the grace period exploitation loop at design level: adds graduated renewal intensity, cross-quarter pause history review, collusion detection in hardship attestation networks, and slow Service Record decay during extended pauses. |\n> | **Who it protects** | Genuine long-term hardship users who need the Protected Pause Window without penalty; the contribution and civic pools from coordinated exploitation that rotates fake hardship claims to preserve elite governance eligibility. |\n> | **Failure risk** | A coordinated network uses mutual attestation and category-switching to maintain permanent pause status, preserving Service Record and civic eligibility indefinitely without genuine contribution; grace mechanisms created for the vulnerable are captured by sophisticated actors. |\n> | **Evidence status** | Active \u2014 unproven |\n> | **Linked risks** | T-009 / P-009 (grace exploitation loop); T-008 / P-008 (elite formation bypass); Annex K4 (Protected Pause Window); AC3.5 (cooling-off cohort rule) |\n\n**Purpose.** This annex introduces operative clauses for P-009 (T-009 Grace Exploitation Loop). It amends Annex K4 (Protected Pause), extends P-002 collusion analytics to hardship attestation, and addresses the T-009 \u00d7 T-008 bypass route at design level. Status: ACTIVE in the Patch Log; evidence remains Active \u2014 unproven until the Service Record Misuse Evidence Test Package is run.\n\n### AF1. Graduated Renewal Intensity (Annex K4 Amendment)\nThe Protected Pause Window renewal review must apply graduated evidence standards based on cumulative pause history. Initial activation and each renewal are governed by the following standards:\n\n| Pause Instance | Evidence Standard | Review Body | SLA |\n| :--- | :--- | :--- | :--- |\n| **First activation** | Lightweight \u2014 one qualifying condition, self-declaration with supporting evidence | Local Review Office | 3 days |\n| **First renewal (Q5)** | Structured \u2014 same category evidence plus brief status update confirming ongoing hardship | Local RO + case file review | 5 days |\n| **Second renewal (Q9)** | Mid-intensity \u2014 full evidence bundle; confirmation that appropriate support services were offered or declined | Regional review + Local RO | 7 days |\n| **Third+ renewal (Q13+)** | High-intensity \u2014 independent assessment, same standard as high-impact Service Record claim; published aggregate statistics | Independent panel | 14 days |\n\nGenuine long-term hardship (severe disability, permanent caregiving responsibility, chronic illness) qualifies under the high-intensity standard. Graduated intensity targets exploitation detection at the renewal stage, not access deterrence at initiation. Any qualifying hardship is approved under any review standard.\n\n**Permanent-condition exemption.** Once an independent panel has confirmed at a high-intensity renewal that the qualifying hardship is genuinely permanent or chronic \u2014 permanent disability, lifelong caregiving responsibility, or an irreversible chronic illness \u2014 subsequent renewals drop to a lightweight attestation-of-continuation: a confirmation that the unchanged condition persists, processed by the Local Review Office within 3 days. The high-intensity gauntlet is not repeated on a recurring clock for a condition the panel has already found unchanging. The exemption is recorded in the cross-quarter history and may be revisited only if specific evidence indicates the condition has materially changed; it is never reopened merely because a renewal interval has elapsed.\n\nCategory switching between renewals \u2014 activating a new qualifying category to restart the renewal clock \u2014 is flagged in the cross-quarter history and reviewed with elevated scrutiny at the next renewal. It does not automatically deny the new activation.\n\n### AF2. Cross-Quarter History Review\nEvery renewal review must include a full summary of the person's Protected Pause history \u2014 not only the current qualifying event. The reviewer must assess the pattern across the full history and document their assessment. A pattern of repeated renewals with category switching constitutes a review flag; it does not constitute grounds for automatic denial absent other evidence of fraud.\n\n### AF3. Hardship Attestation Collusion Detection\nThe collusion-graph analytics established in P-002 are extended to hardship attestation networks. The following graph patterns trigger elevated scrutiny review:\n- **Mutual attestation pairs:** Person A attests to Person B's hardship AND Person B attests to Person A's hardship within the same 4-quarter window.\n- **Star attestation clusters:** 4 or more people whose hardship is attested exclusively by the same small group of active contributors.\n- **Temporal clustering:** 4 or more pause activations within the same social network \u2014 defined by attestation relationships \u2014 within a 2-quarter window.\n\nDetection triggers elevated scrutiny review, not automatic denial. The review must assess whether an innocent explanation exists \u2014 a community disaster, a workplace closure, or a shared housing crisis may legitimately produce these patterns.\n\n**Community-disaster safe harbor:** When a declared emergency (oracle-verified) affects the attestation network's region, collusion patterns among affected persons are exempt from elevated scrutiny for 2 quarters. Safe harbor is applied by the reviewing body automatically upon confirming regional emergency status.\n\n**Slow-burn shared-hardship safe harbor:** Genuine co-located or co-affiliated hardship frequently arrives without a formal emergency declaration \u2014 a single plant closing before any oracle declaration, an extended-kinship network in deep poverty, the failure of a single-employer town. Where the reviewing body finds documented evidence of such a cluster \u2014 a shared employer, a shared locality, or a shared kinship or housing network experiencing genuine concurrent hardship \u2014 the affected persons receive the same presumption of an innocent explanation that the community-disaster safe harbor grants. The reviewer documents the shared-hardship basis, and the flagged collusion pattern is treated as explained rather than suspect. This pathway requires no declared emergency; it requires only credible documentation of co-located or co-affiliated hardship, and like the declared-disaster safe harbor it suspends elevated scrutiny for the affected cluster for 2 quarters.\n\n**Attestation-graph data minimization.** The hardship attestation graph maps the support networks of people in hardship and must never become a reusable surveillance asset. Access to the attestation graph is purpose-limited to exploitation review under this annex: only the reviewing bodies and independent panels conducting an active collusion-detection review may view it, and only the subgraph relevant to the case under review. The graph is retained only as long as needed for active and appealable reviews and is purged on a fixed retention schedule once a review and its appeal window have closed; confirmed safe-harbor or innocent-explanation cases are purged at closure. The attestation graph may not be repurposed for eligibility scoring, civic-standing assessment, law-enforcement referral, or any use beyond exploitation review, and may not be exported, sold, or shared outside the reviewing function. Every access is logged and auditable. The graph's regime is recorded in the per-domain calibration table of the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md) (P-075); its retention schedule is calibrated there. The fixed schedule is: stripped to a case-pseudonym at intake, fully purged once the review and its appeal-spine (ANNEX_L \u00a7L7) window close + 30 days, with a 180-day ceiling past appeal-window close (FC-212, RESERVED; this retention ceiling is distinct from the \u00a7AF3 two-quarter scrutiny-suspension safe harbor).\n\n### AF4. Service Record Slow-Decay During Extended Pause (Annex K4 Amendment)\nDuring a Protected Pause Window, Service Record decays at 20% of the normal quarterly rate rather than being fully frozen. Voice decay freeze is unchanged \u2014 Voice cliff-effect protection is preserved in full. The Service Record slow-decay applies only during quarters in which a Protected Pause Window is active.\n\n| Scenario | Service Record After 4 Quarters | Service Record After 8 Quarters | Service Record After 12 Quarters |\n| :--- | :--- | :--- | :--- |\n| No pause (normal decay at 10%/quarter) | 65.6 | 43.0 | 28.2 |\n| Full freeze (current design) | 100.0 | 100.0 | 100.0 |\n| **Slow-decay at 20% of normal (P-009)** | 92.2 | 85.1 | 78.5 |\n\n**Calibration rationale:** a 4-quarter pause (one typical hardship cycle) produces approximately 8% Service Record reduction \u2014 negligible for genuine users who will rebuild through resumed contribution. A 12-quarter rotation exploit produces approximately 22% reduction, draining high-impact service eligibility thresholds over time. The slow-decay must be clearly communicated: it is not punitive, and Service Record can be fully rebuilt through resumed verified contribution after the pause ends.\n\n### AF5. Service Pool Pause-Saturation Monitoring\nPublished quarterly in the Article VII concentration dashboard (extending AC3.7): the percentage of each Service Record-governed service pool simultaneously in Protected Pause. When any pool exceeds 20% simultaneously paused, a pool-health alert fires. The alert triggers: (a) review of whether paused members' service eligibility should be temporarily suspended pending return to active status; (b) assessment of whether the pool requires emergency replenishment from the next eligible cohort. Pool saturation monitoring triggers review only \u2014 it never automatically bars any individual's Protected Pause activation.\n\n**Published false-positive rate.** Extending the aggregate-statistics publication required at the high-intensity renewal standard (AF1), the program publishes as a standing quarterly metric its false-positive rate: the share of elevated-scrutiny and high-intensity reviews that resolve as genuine hardship rather than confirmed exploitation. A persistently high false-positive rate is treated as evidence that the scrutiny thresholds are over-burdening genuine claimants and is grounds to recalibrate the triggers in AF1 and AF3 toward lighter-touch review. The metric is published in aggregate only and never identifies individuals.\n\n### AF6. Capability Development Pathway During Pause [Ambitious]\nDuring a Protected Pause Window, a person may earn up to 15% of their normal quarterly Service Record through verified pause-appropriate stewardship. Qualifying activities: peer support for other hardship-affected persons; verified self-directed learning with completion evidence; community care activities that do not require the person's primary capacity. 'Pause-appropriate stewardship' is a protected term under P-004. The 15% cap is absolute; the pathway cannot be used to accumulate Service Record beyond the person's pre-pause baseline.\n\n### AF7. T-009 \u00d7 P-008 Explicit Bypass Control [Ambitious]\nP-008 Annex AC3.5 (Cooling-Off Cohort Rule) is amended as follows. For the purpose of the cohort concurrent maximum (2 members of the same co-service cohort sharing review authority simultaneously), a person is considered effectively serving if their Service Record is maintained above the service eligibility threshold through Protected Pause rather than ongoing contribution. Paused cohort members count toward the 2-member concurrent maximum. When a paused cohort member's count causes the maximum to be exceeded, the active serving members must accommodate \u2014 not the paused person. The paused person is never required to exit pause due to this rule.\n\n---\n\n### AF8. Complete Threat/Patch Linkage \u2014 All Sessions\n\n| Threat | Patch | Status | Annex | Session |\n| :--- | :--- | :--- | :--- | :--- |\n| T-001 | P-001 | ACTIVE | AB | S1 |\n| T-002 | P-003 | ACTIVE | AB | S1 |\n| T-004 | P-002 | ACTIVE | AB | S1 |\n| T-007 | P-004 | ACTIVE | AB | S1 |\n| T-005 | P-005 | ACTIVE | AC1 | S2 |\n| T-006 | P-006 | ACTIVE | AC2 | S2 |\n| T-008 | P-008 | ACTIVE | AC3; operative authority superseded by P-025 | S2 |\n| T-011 | P-011 | ACTIVE | AD | S2 |\n| T-012 | P-012 | ACTIVE | AE2.1 | S3 |\n| T-013 | P-012 | ACTIVE | AE2.2 | S3 |\n| T-014 | P-012 | ACTIVE | AE2.3 | S3 |\n| T-015 | P-012 | ACTIVE | AE2.4 | S3 |\n| T-009 | P-009 | ACTIVE | AF | S4 |\n\n*T-009 is addressed at design level via P-009. All threats named through this annex have mitigation designs, not evidence-backed closure. Outstanding pre-launch items include Service Record misuse testing, hardship attestation red-team review, public comprehension review, and residual-risk update before any stronger claim.*\n\n---\n", "headings": [ { "level": 1, @@ -8966,7 +8971,7 @@ "slug": "af8-complete-threatpatch-linkage-all-sessions" } ], - "wordCount": 1820, + "wordCount": 1866, "headingCount": 9 }, { @@ -9334,7 +9339,7 @@ "status": "Status: ACTIVE \u2014 penalty schedule bound to Founding Commitments FC-010, FC-040, FC-041 (Proposal 7 close-out, 2026-04-18)", "statusBucket": "active", "summary": "Pre-launch gate: required before system deployment \u00b7 Governed as P-004 protected specification Status: ACTIVE \u2014 penalty schedule bound to Founding Commitments FC-010, FC-040, FC-041 (Proposal 7 close-out, 2026-04-18)", - "content": "# ANNEX AJ \u2014 Above-Ledger Bypass Worked Examples\n\n> **Provenance:** Implements [P-001 \u2014 Shadow Convertibility Containment] above-ledger worked examples \u00b7 Addresses T-001 \u00b7 Status: **ACTIVE**\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Extends the convertibility prohibition above the ledger: enumerates specific prohibited patterns for each instrument boundary (Essential Access/Flow, Voice/Service Record, Shared Storehouse/Flow) so that social-layer workarounds are named, detectable, and subject to a graduated penalty schedule. |\n> | **Who it protects** | Genuine Essential Access recipients from preferential treatment schemes that invert the survival floor into a status currency; people rationed during Shared Storehouse periods from Flow-wealthy actors who exit or hoard; contributors without institutional backing from civic standing being purchased through Flow resources. |\n> | **Failure risk** | On-ledger detection leaves the social layer unguarded; sophisticated actors use employer-sponsored contribution accumulation, side queues, or anticipatory hoarding to reproduce the convertibility relationship without touching the ledger. |\n> | **Evidence status** | Active \u2014 unproven |\n> | **Linked risks** | T-001 / P-001 (shadow convertibility); FC-010 (leakage thresholds); FC-040 (deterrence multiplier); FC-041 (detection probability); Annex AI (Enforcement Panel appeals) |\n\n**Pre-launch gate: required before system deployment \u00b7 Governed as P-004 protected specification**\n**Status: ACTIVE \u2014 penalty schedule bound to Founding Commitments FC-010, FC-040, FC-041 (Proposal 7 close-out, 2026-04-18)**\n\n---\n\n## Purpose\n\nT-001 (Shadow Convertibility) and its mitigation P-001 address on-ledger arbitrage: direct trades of Essential Access for Flow, proxy redemption, and broker-mediated exchanges that touch the ledger. P-001's detection infrastructure monitors these channels.\n\nThis annex addresses the gap identified during adversarial review: **above-ledger bypass** \u2014 convertibility attacks that do not touch the ledger at all and therefore evade P-001 detection entirely. In above-ledger bypass, the boundary between Flow, Essential Access, Voice and Service Record, and Shared Storehouse is not breached on the ledger; it is circumvented through arrangements made entirely in the social and economic layer above it.\n\nThe purpose of this annex is to enumerate specific prohibited patterns per instrument boundary so that:\n1. The legal and enforcement definition of \"convertibility violation\" extends above the ledger.\n2. Operators, vendors, and participants have clear notice of what is prohibited.\n3. Detection can be designed for social-layer patterns, not just ledger-layer patterns.\n4. The protected-term definitions in P-004 include concrete examples that resist definitional drift.\n\n**Governing rule:** Any arrangement that produces the *functional effect* of instrument conversion \u2014 regardless of whether it involves a ledger transaction \u2014 is a convertibility violation. The test is effect, not mechanism.\n\n**Anti-enumeration clause (governing):** The worked examples in Sections 1\u20133 are illustrations of the effect test, not an exhaustive catalogue of what is forbidden. Absence of a pattern from this annex does **not** imply that the pattern is permitted. Any arrangement whose economic effect is to let wealth purchase preferential survival access, civic standing, or exemption from scarcity rationing is a convertibility violation regardless of its mechanism, its novelty, or whether it resembles any example listed here. New mechanisms that achieve a prohibited effect are prohibited the moment their effect is established, without waiting for a worked example to be added. No actor may rely on the absence of a named pattern as a defence; the only defence is that the arrangement's effect is not instrument conversion. This clause governs the interpretation of every section below and prevails over any narrower reading of an individual example.\n\n---\n\n## Plain-Language Guide\n\nThis annex explains banned workarounds.\n\nThe main rule is simple: people cannot turn one instrument into another by using side deals, informal networks, special queues, employers, vendors, or civic positions.\n\nExamples of banned behavior:\n\n- using Essential Access status to get special treatment above the survival floor\n- charging Flow for faster access to the same essential service\n- using money to buy easier Service Record or Voice accumulation\n- using a civic role to get contracts or private economic advantage\n- using money to escape Shared Storehouse rationing during a shortage\n\nThe system looks at the real effect, not the excuse. If a side deal acts like conversion, it is treated as conversion.\n\n---\n\n## Boundary 1 \u2014 Essential Access / Flow Boundary\n\n*The prohibited direction: Essential Access entitlements being used to confer Flow-equivalent benefit, or Flow being used to secure preferential Essential Access access.*\n\n### AJ-1.1 | Preferential Allocation Based on Essential Access Status\n\n**Pattern:** A housing provider, food distributor, or healthcare service allocates better-quality units, priority queue positions, or enhanced service tiers exclusively or preferentially to individuals who hold or actively use Essential Access entitlements \u2014 creating a status differential based on Essential Access utilisation.\n\n**Why it is prohibited:** Essential Access is a survival floor, not a status signal. If Essential Access-active individuals receive preferential access to goods or services above the floor, Essential Access entitlements have effectively been converted into a preference currency. This recreates the leverage relationship that the instrument separation was designed to prevent \u2014 now with the state-maintained floor as the leverage instrument.\n\n**Concrete examples:**\n- A private landlord who accepts Essential Access for baseline housing but allocates larger or better-located units to Essential Access-active tenants as a retention mechanism.\n- A grocery vendor who offers Essential Access-active customers early access to limited-stock items before Flow-paying customers.\n- A healthcare provider who reduces wait times for Essential Access-active patients beyond what is required for baseline delivery.\n\n**Permitted:** Providers may offer Flow-priced upgrades above the Essential Access basket floor to any customer regardless of Essential Access status. What is prohibited is using Essential Access status itself as the selection criterion for preferential treatment.\n\n**Detection signal:** Correlation between Essential Access utilisation and allocation outcomes above the baseline level across a vendor's customer population.\n\n---\n\n### AJ-1.2 | Flow Premium for Essential Access-Equivalent Access\n\n**Pattern:** A vendor or service provider charges an Flow premium \u2014 either explicitly or through differential pricing \u2014 that functions as a fee to avoid the Essential Access-mediated queue, obtain goods above the Essential Access-rationed allocation, or access the same goods through a \"non-Essential Access\" channel perceived as higher status.\n\n**Why it is prohibited:** If Flow can purchase faster or superior access to goods that are simultaneously available through Essential Access, the separation between the instruments is functional only for those who cannot pay the Flow premium. This recreates price-based exclusion within the formal basket \u2014 the survival floor becomes a low-status track.\n\n**Concrete examples:**\n- A clinic that offers the same consultation via Essential Access delivery with a 2-week wait or via Flow payment with a same-day appointment.\n- A transit operator that sells Flow-priced \"priority boarding\" that consistently results in a better journey than the Essential Access-covered standard service.\n- A food vendor that sells Essential Access-basket items at one counter and \"premium\" versions of the identical item at an Flow counter, where the practical difference is queue length.\n\n**Permitted:** Genuine product or service differentiation \u2014 Flow-priced items that are substantively different in quality, variety, or features from Essential Access-basket items \u2014 is allowed. Markets may serve above-basket preferences. What is prohibited is structuring delivery so that Flow payment provides faster or superior access to the *same* Essential Access-basket entitlement.\n\n**Detection signal:** Systematic wait-time or quality differentials between Essential Access and Flow delivery channels for the same essential basket item at the same vendor.\n\n---\n\n### AJ-1.3 | Social Brokerage Networks\n\n**Pattern:** An informal network of individuals pools Essential Access entitlements through non-ledger social arrangements \u2014 households agreeing to share, community groups concentrating entitlements, or individual brokers who coordinate Essential Access use across a network of participants \u2014 to achieve the functional effect of a pooled Flow fund.\n\n**Why it is prohibited:** At sufficient scale, coordinated Essential Access pooling allows the network to redeem Essential Access at a rate that exceeds any individual's basket allocation, creating liquidity and substitutability properties that Essential Access is specifically designed not to have. This converts the aggregate Essential Access flow into Flow-like purchasing power for the network's coordinators.\n\n**Permitted:** Household sharing of Essential Access basket goods after redemption is not prohibited \u2014 individuals living together may share their food, for example. What is prohibited is coordinated pre-redemption pooling that is designed to achieve above-individual-basket access or to create a tradeable pool. The test is coordination for arbitrage purpose, not ordinary household life.\n\n**Detection signal:** Synchronized redemption patterns across non-cohabiting individuals; redemption rates significantly above typical single-household use per Essential Access account; network topology suggesting coordination.\n\n---\n\n## Boundary 2 \u2014 Voice and Service Record / Resource Access Boundary\n\n*The prohibited direction: civic standing being used to gain preferential access to goods, services, or opportunities; or resource/Flow advantage being used to accumulate Voice and Service Record.*\n\n### AJ-2.1 | Civic Standing as Allocation Preference\n\n**Pattern:** An institution, vendor, service provider, or programme uses Voice balance, Service Record score, or civic participation history as an explicit or implicit criterion for preferential allocation of goods, services, employment, housing, or any resource that is not a formal civic function.\n\n**Why it is prohibited:** Voice and Service Record are scoped exclusively to civic agenda-setting and service eligibility within the civic instruments. If Voice and Service Record balance produces preferential outcomes in markets, housing, employment, or services, it has effectively become a general status currency \u2014 which is the social credit failure mode the instrument separation is designed to prevent.\n\n**Concrete examples:**\n- An employer who uses Service Record records as a positive factor in hiring decisions for non-civic roles.\n- A housing authority that gives Voice-active applicants priority in allocation of units above the Essential Access baseline.\n- A university that offers admissions preference to applicants with high Service Record records on the grounds that they are \"engaged citizens.\"\n- A vendor loyalty programme that grants discounts or perks based on civic participation history.\n\n**Permitted:** Civic functions \u2014 jury selection pools, audit panels, deliberation bodies, and oversight roles \u2014 may and should use Service Record eligibility criteria. These are the defined uses of the civic instruments. What is prohibited is any use of Voice and Service Record as a criterion in decisions that are not formal civic functions.\n\n**Detection signal:** Correlation between Voice and Service Record balance and outcomes in non-civic domains (employment rates, housing allocation rates, service quality) across a population.\n\n---\n\n### AJ-2.2 | Flow-Funded Civic Standing Accumulation\n\n**Pattern:** An individual or organisation uses Flow resources \u2014 paid time, staff, facilities, or services \u2014 to systematically enable a group of individuals to accumulate Voice and Service Record at rates not available to those without equivalent Flow resources. This converts Flow advantage into civic advantage through the mechanism of contribution verification.\n\n**Why it is prohibited:** Voice and Service Record is intended to represent genuine stewardship contribution. If Flow can buy the conditions that make contribution easy, verifiable, and legible \u2014 while those without Flow must contribute under harder conditions with less verification infrastructure \u2014 then Flow has purchased civic standing indirectly.\n\n**Concrete examples:**\n- A corporation that pays employees to perform verifiable \"stewardship\" activities during work hours, systematically accumulating Service Record for its workforce at rates unavailable to informal workers.\n- A civic consultancy that charges Flow fees to prepare contribution documentation that passes verification more reliably than self-submitted records.\n- An organisation that funds community activities specifically designed to generate contribution-verification events, channelling Service Record accumulation toward its affiliated networks.\n\n**Permitted:** Employers may encourage genuine community stewardship. Organisations may support community activities with genuine civic benefit. What is prohibited is structuring these activities specifically as Service Record accumulation mechanisms for affiliated populations, particularly where the Flow resource advantage produces a systematic Service Record gap between affiliated and non-affiliated participants.\n\n**Detection signal:** Service Record accumulation rates systematically higher for economically affiliated groups than for non-affiliated groups with similar activity levels.\n\n---\n\n### AJ-2.3 | Civic Position as Economic Leverage\n\n**Pattern:** An individual uses their formal position in a civic body \u2014 an audit panel, oversight committee, CRP seat, or deliberation body \u2014 to advance Flow-beneficial decisions, direct contracts, or signal preferences to market actors in ways that translate civic position into economic advantage.\n\n**Why it is prohibited:** Civic positions carry real decision-making authority. If that authority can be converted into Flow advantage \u2014 through directed contracts, information asymmetry, or signalled preferences \u2014 then the civic instruments have become an economic power instrument, inverting the separation the protocol is designed to maintain.\n\n**Concrete examples:**\n- A CRP member who votes on procurement priorities in ways that systematically benefit businesses they have personal Flow relationships with.\n- An audit panel member who signals audit focus areas to connected market participants before the audit begins, allowing them to prepare preferentially.\n- An oversight committee member who leverages their position to obtain speaking engagements, consulting arrangements, or advisory roles from organisations they oversee.\n\n**Permitted:** Civic participants may have ordinary economic lives. What is prohibited is using the information, authority, or influence of a civic position to secure Flow advantage \u2014 standard conflict-of-interest doctrine applied to Voice and Service Record.\n\n**Detection signal:** Correlation between civic position and Flow outcomes for the individual and their connected networks; post-position employment in sectors they previously oversaw.\n\n---\n\n## Boundary 3 \u2014 Shared Storehouse / Flow Boundary\n\n*The prohibited direction: scarcity rationing being used to confer Flow-equivalent advantage; or Flow being used to circumvent Shared Storehouse rationing.*\n\n### AJ-3.1 | Shared Storehouse Allocation as Premium Service\n\n**Pattern:** During an active Shared Storehouse period, an entity with allocation authority \u2014 a vendor, distributor, or regional operator \u2014 provides Shared Storehouse-rationed goods to some individuals faster, in better condition, or in greater variety than the Shared Storehouse allocation technically requires, in exchange for Flow payment or economic relationship.\n\n**Why it is prohibited:** Shared Storehouse rationing is designed to ensure equitable distribution during genuine shortage. If Shared Storehouse allocations can be enhanced by Flow payment, rationing reproduces price-based exclusion under a different name. The Shared Storehouse period is precisely when the separation between Flow and survival access must be most robust, because it is the period of highest vulnerability.\n\n**Concrete examples:**\n- A food distributor who, during an Shared Storehouse activation for a specific food category, offers \"priority delivery\" of that category's Shared Storehouse allocation for an Flow fee.\n- A regional operator who fulfils Shared Storehouse allocations faster for businesses that maintain ongoing Flow contracts with the operator.\n- A vendor who, during Shared Storehouse rationing, offers the Shared Storehouse-rationed item alongside a \"premium bundle\" where the Shared Storehouse item is included \u2014 effectively tying Shared Storehouse access to Flow purchase.\n\n**Permitted:** Markets for goods outside the Shared Storehouse-rationed category continue unaffected. Flow sales of non-rationed items continue normally. What is prohibited is conditioning the delivery, quality, timing, or access to Shared Storehouse-rationed allocations on Flow payment or relationship.\n\n**Detection signal:** Systematic differences in Shared Storehouse allocation delivery outcomes correlated with Flow-relationship status; complaints from non-Flow-affiliated Shared Storehouse recipients about delayed or inferior delivery.\n\n---\n\n### AJ-3.2 | Flow Exit from Shared Storehouse Scope\n\n**Pattern:** A market actor \u2014 an individual, household, or firm \u2014 uses Flow resources to obtain goods in the same category as the Shared Storehouse-rationed essential from sources outside the Shared Storehouse system, in quantities that effectively exempt them from the rationing regime while drawing down the shared supply pool that the Shared Storehouse system was designed to manage.\n\n**Why it is prohibited:** Shared Storehouse is activated because the overall supply of a category is constrained. If Flow-wealthy actors can simply purchase from outside the Shared Storehouse system, the shortage is not actually shared \u2014 it is concentrated among those without Flow resources to exit. The Shared Storehouse system manages a shared resource; actors who exit via Flow while drawing on the same physical supply undermine the entire rationing purpose.\n\n**Concrete examples:**\n- During a regional water-intensive food Shared Storehouse, an individual purchases large quantities of the rationed category from an import source not yet captured by the Shared Storehouse boundary.\n- A wealthy household stockpiles Shared Storehouse-rationed goods using Flow in advance of an anticipated Shared Storehouse activation, before the activation formally begins.\n- A firm with Flow resources contracts directly with producers outside the Shared Storehouse-designated supply chain, bypassing rationing while competing for the same underlying physical supply.\n\n**Permitted:** Genuine product substitution \u2014 purchasing a different product from outside the Shared Storehouse-rationed category \u2014 is permitted; the Shared Storehouse is category-specific. What is prohibited is using Flow to obtain the same category of good at scale while the rationing system is designed to manage overall supply of that category.\n\n**Detection signal:** Category consumption in Shared Storehouse-affected regions correlated with Flow wealth levels; import flows of Shared Storehouse-rationed categories increasing during Shared Storehouse periods.\n\n---\n\n### AJ-3.3 | Anticipatory Hoarding via Flow\n\n**Pattern:** A market actor uses Flow resources to accumulate large quantities of goods in a category where Shared Storehouse activation is anticipated, before the activation formally begins \u2014 creating a personal reserve that exempts them from the rationing period while contributing to the supply shortfall that triggers it.\n\n**Why it is prohibited:** Anticipatory hoarding is a self-fulfilling attack on the Shared Storehouse system: the hoarding behaviour accelerates the supply shortfall that triggers Shared Storehouse activation, while exempting the hoarder from its effects. It is both a cause of the shortage and a circumvention of the rationing response.\n\n**Concrete examples:**\n- A firm that monitors RCS sentinel indicators and purchases months of supply of a flagged category before PCRP activation, making the shortfall worse while ensuring their own supply.\n- An individual who, upon hearing about drought conditions, purchases large quantities of water-intensive foods before the Shared Storehouse is announced.\n\n**Permitted:** Normal inventory management and ordinary household provisioning. What is prohibited is large-scale anticipatory accumulation that is scaled to the anticipated Shared Storehouse period and timed to sentinel indicator movements.\n\n**Detection signal:** Spikes in category purchasing correlated with sentinel indicator movements, particularly by actors with the information access to monitor oracle signals.\n\n---\n\n## Section 4 \u2014 Penalty Schedule (Proposal 7 close-out)\n\nThe worked examples in Sections 1\u20133 state what is prohibited. Without a published penalty schedule, \"prohibited\" is a word without teeth \u2014 detection produces cases that have to be adjudicated ex post with no pre-committed sanction, which is itself a drift surface. This section binds each boundary-class pattern to a graduated penalty schedule calibrated on the Founding Commitments.\n\n### 4.1 \u2014 Deterrence Calibration (FC-040, FC-041)\n\n**Deterrence identity:** expected value to the violator of a detected-and-sanctioned attempt must be strictly negative. Given detection probability *p* and penalty-to-gain multiplier *k*:\n\n> EV(violation) = (1 \u2212 *p*) \u00b7 gain \u2212 *p* \u00b7 *k* \u00b7 gain = gain \u00b7 (1 \u2212 *p* \u2212 *p*\u00b7*k*)\n\nFor EV \u2264 0: *k* \u2265 (1 \u2212 *p*) / *p*. At the assumed detection probability **FC-041 `DETECTION_PROBABILITY_ASSUMED` = 0.85**, break-even is *k* \u2248 0.18. The protocol commits to **FC-040 `BRIBE_DETERRENCE_MULTIPLIER` = 5.0** \u2014 meaning the base penalty for any detected above-ledger violation is **5\u00d7 the detected functional gain**. This produces EV(violation) = gain \u00b7 (1 \u2212 0.85 \u2212 4.25) = gain \u00b7 (\u22124.10), a decisive deterrent. The 5\u00d7 multiplier also survives a detection-rate collapse to \u22480.17 before EV turns positive, so the schedule is not fragile to realistic detection shortfalls.\n\n**Gain definition.** The \"functional gain\" is the Flow-equivalent value the violator captured through the violation, measured as:\n- For individual/household violations: the Flow-market price of the preferential access, goods, or standing secured above the Essential Access/Shared Storehouse baseline or civic floor.\n- For operator/vendor violations: the incremental revenue or margin attributable to the violating pattern, measured against a non-violating baseline cohort.\n- For institutional violations (employer-sponsored Service Record accumulation, directed civic positions): the Flow-equivalent value of the civic-standing advantage conferred, valued at the cost of securing equivalent standing through non-violating means.\n\nGain is measured by the enforcement body at the time of adjudication and is documented on the public Enforcement Ledger under Article VII (without PII).\n\n### 4.2 \u2014 Graduated Penalty Matrix\n\nPenalties are calibrated per-actor-scale and per-boundary-severity. The scheduled penalty is the base multiplier (5\u00d7) times the severity factor in the matrix below, applied to the functional gain and capped or floored at the per-actor amounts shown.\n\n| Pattern | Severity | Actor: Individual | Actor: Operator / Firm | Actor: Institution / Sponsor |\n| :--- | :---: | :--- | :--- | :--- |\n| **AJ-1.1** Essential Access status as allocation preference | 1.0\u00d7 | 5\u00d7 gain; Service Record \u22120.1 for cycle | 5\u00d7 gain; 90-day vendor license probation; 2nd offense = vendor ban in essential category | 5\u00d7 gain; 180-day exclusion from Essential Access-redemption network; public Enforcement Ledger notice |\n| **AJ-1.2** Flow premium for Essential Access-equivalent access | 1.2\u00d7 | 6\u00d7 gain; Service Record \u22120.2 for cycle | 6\u00d7 gain; 180-day vendor license probation; operator-license review | 6\u00d7 gain; 365-day exclusion from essential-category redemption; mandatory divestment of Essential Access redemption operations |\n| **AJ-1.3** Social brokerage networks (coordinators) | 1.5\u00d7 | 7.5\u00d7 gain against coordinator; network participants liable only on knowing participation | 7.5\u00d7 gain; operator license revoked for essential-category brokerage | 7.5\u00d7 gain; criminal referral under convertibility-violation statute where coordination is organised |\n| **AJ-2.1** Civic standing as allocation preference | 1.2\u00d7 | 6\u00d7 gain (rare as individual pattern); Service Record \u22120.2 | 6\u00d7 gain; 180-day probation from civic-eligibility data access; vendor loyalty program disqualification | 6\u00d7 gain; 365-day exclusion from Service Record-conditioned hiring pools or allocation queues; mandatory audit of prior-period decisions |\n| **AJ-2.2** Flow-funded civic standing accumulation | 1.5\u00d7 | \u2014 | 7.5\u00d7 gain; Service Record accrued under the pattern is voided for affected accounts; employer barred 365 days from Service Record-attestation sponsorship | 7.5\u00d7 gain; all attributable Service Record accruals voided; 365-day exclusion; mandatory restitution of civic-sponsorship Flow flows |\n| **AJ-2.3** Civic position as economic leverage | 2.0\u00d7 | 10\u00d7 gain; **civic position vacated; 5-year Service Record-eligibility suspension; criminal referral** | 10\u00d7 gain against contracted entity; 365-day procurement exclusion; contract voidance | 10\u00d7 gain; 5-year exclusion from civic-procurement relationships |\n| **AJ-3.1** Shared Storehouse allocation as premium service | 1.5\u00d7 | 7.5\u00d7 gain; Service Record \u22120.3 | 7.5\u00d7 gain; operator license suspended for duration of Shared Storehouse period and 180 days post-restoration; 2nd offense = operator license revoked | 7.5\u00d7 gain; 365-day exclusion from Shared Storehouse-rationed supply chain; mandatory restitution to underserved recipients |\n| **AJ-3.2** Flow exit from Shared Storehouse scope (during active Shared Storehouse) | 1.8\u00d7 | 9\u00d7 gain; excess quantity returned to Shared Storehouse pool or forfeit | 9\u00d7 gain; import/supply license suspended for Shared Storehouse duration; operator subject to per-unit excise recouping the Shared Storehouse-pool draw | 9\u00d7 gain; mandatory contribution to Shared Storehouse buffer equal to 2\u00d7 goods acquired |\n| **AJ-3.3** Anticipatory hoarding via Flow | 1.5\u00d7 pre-activation; 2.0\u00d7 post-activation timing | 7.5\u00d7\u201310\u00d7 gain; excess inventory forfeit to Shared Storehouse pool at activation | 7.5\u00d7\u201310\u00d7 gain; license suspension; mandatory release of hoarded inventory at Shared Storehouse-activation basket prices | 7.5\u00d7\u201310\u00d7 gain; 365-day exclusion; mandatory audit of trading activity during the 90 days preceding activation |\n\n**Notes on the matrix:**\n- Severity factor is applied to the FC-040 base multiplier (5\u00d7), so AJ-1.1 = 5.0\u00d7 gain, AJ-1.2 = 6.0\u00d7 gain, AJ-2.3 = 10.0\u00d7 gain, etc.\n- \"Service Record \u22120.X for cycle\" is a deduction from the violator's civic record balance proportional to severity; Service Record deduction is independent of the gain-multiplier and is not netted against it.\n- Vendor/operator license actions are administered by the licensing authority named in the Article VII enforcement architecture; suspension and revocation are appealable only through the Ombuds process per Annex AI.\n- \"Criminal referral\" indicates a finding that meets the threshold for separate prosecution under the convertibility-violation statute (out of scope of this annex); the civil/administrative penalty in this matrix applies regardless of prosecution outcome.\n\n### 4.3 \u2014 Escalation Ladder for Repeat and Systemic Violations\n\n**Repeat offense:** a second adjudicated violation of any AJ pattern by the same actor within 24 months triggers automatic escalation to the next severity band, plus:\n- Individuals: Service Record deduction doubles; civic-position eligibility suspended for 2 cycles.\n- Operators: license revocation in essential category; 5-year prohibition from operating in Essential Access or Shared Storehouse supply chains.\n- Institutions: public Enforcement Ledger notice with named leadership; mandatory independent governance audit at institution's cost.\n\n**Systemic violation:** when enforcement data shows AJ-pattern incidence across a vendor class, sector, or region exceeds **FC-010 systemic-review trigger of 7% / annum of Essential Access allocations in the affected scope**, the Ombuds triggers a **sector-level systemic review** under Annex AI. Individual enforcement continues in parallel. The systemic review assesses whether the architecture itself requires hardening (new detection signal, new prohibited pattern) or whether the breach is an enforcement-capacity failure.\n\nThe **routine leakage ceiling of 3% / annum (FC-010)** is the operational target. Between 3% and 7%, the Ombuds prioritises detection investment and enforcement acceleration but does not trigger systemic review. Below 3%, the regime is considered in normal operating state.\n\n### 4.4 \u2014 Enforcement Body and Process\n\nPenalty adjudication is administered by the **Enforcement Panel** (a sub-body of the authority named in the Article VII enforcement architecture). Process:\n\n1. **Finding.** Detection signal triggers investigation; investigation produces a factual finding with documented evidence.\n2. **Gain quantification.** The enforcement body quantifies the functional gain per \u00a74.1. Quantification methodology is documented and subject to the P-017 oracle-independence standards (Annex AL) where gain estimation requires measurement of market prices or cohort comparisons.\n3. **Notice and response.** The accused actor receives notice with the factual finding, the gain quantification, and the scheduled penalty. Actor has 30 days to contest findings or accept.\n4. **Adjudication.** Contested cases proceed to the Enforcement Panel. Panel composition: 3 seats drawn from the Article VII enforcement staff, 2 seats drawn from the Ombuds roster per Annex AI, 1 seat drawn from the affected-party advocacy roster. No Enforcement Panel member may have a prior relationship with the accused actor within 3 years.\n5. **Appeal.** Adjudicated penalties are appealable once, on the appeal spine ([ANNEX_L \u00a7L7](./ANNEX_L.md)) via the federated Ombuds process per Annex AI \u00a74.8 (Enforcement Panel Appeals) \u2014 the Plenum, not the CRP ladder, is the final instance (ANNEX_L \u00a7L7.3). Appeal pauses license actions but not gain-recoupment: recoupment proceeds during appeal **into escrow**, refunded with accrued return if the appeal succeeds (ANNEX_L \u00a7L7.2) \u2014 so appeal never becomes a window to dissipate gains, and a successful appellant is made whole.\n6. **Publication.** Final findings are published on the Enforcement Ledger (Article VII) in aggregate form, with individual findings published only where necessary for statutory notice or where the actor has consented. PII is stripped per Annex AM.\n\n### 4.5 \u2014 Deterrence Audit\n\nThe Enforcement Panel publishes an **Annual Deterrence Audit** (parallel to the Ombuds annual audit, Annex AI \u00a7AI-8) with:\n- Estimated total functional gain attempted across each AJ pattern (from detection plus estimation of undetected).\n- Actual penalties assessed and collected.\n- Realised penalty-to-gain ratio by pattern.\n- Realised detection probability by pattern.\n- Whether the FC-040 (5.0\u00d7) and FC-041 (0.85) assumptions are holding; if detection probability slips below the level at which the 5.0\u00d7 multiplier yields negative EV, the Panel issues a formal recalibration recommendation to the Founding Coalition for consideration under the Tier 2 amendment ladder.\n\nThe Annual Deterrence Audit is the feedback loop that keeps the penalty schedule calibrated. If either the multiplier or the detection assumption drifts, the deterrence identity in \u00a74.1 tells the Coalition exactly how much headroom remains before the regime becomes EV-positive for violators.\n\n---\n\n## Governance of This Annex\n\nThis annex is a **P-004 protected specification**. The worked examples above cannot be removed, narrowed, or recharacterised through ordinary operational updates. Changes to these examples require the same process as changes to core protected terms: semantic effect test, upward classification default, and public definition registry update.\n\nThe numerical values of FC-040 (5.0\u00d7 multiplier) and FC-041 (0.85 detection probability assumption) are **Tier 2 commitments in `/founding/commitments.md`**. Changes require the Tier 2 amendment ladder with public redlines. FC-010 leakage thresholds (3% / 7%) are likewise Tier 2.\n\nNew worked examples may be added through the standard P-004 amendment process as new above-ledger bypass patterns are identified in operation. The annex should be reviewed annually and updated with patterns identified through enforcement activity. Penalty schedule matrix updates for new patterns must maintain deterrence identity (\u00a74.1) and are subject to Tier 2 amendment authority.\n\n**Detection infrastructure requirement:** Article VII monitoring must extend to the social-layer detection signals identified in each worked example above. These signals are not ledger-based; they require vendor-level data collection, population-level outcome analysis, and complaint-pattern monitoring. The specific detection thresholds are maintained in the Restricted Register Annex per P-021 (Annex AO).\n\n**Public scope of monitoring:** What is monitored is public even where specific numeric thresholds are restricted. The categories and scope of social-layer monitoring \u2014 which outcomes are observed, which correlations are tested, which vendor-level and population-level signals are collected, and for which boundary patterns \u2014 are published in plain language so that operators, vendors, and participants retain the clear notice of what is prohibited that this annex requires (Purpose, item 2). Only the calibrated numeric trigger values may be withheld in the Restricted Register per P-021 (Annex AO), and only to prevent gaming of the exact thresholds. Each restricted item carries a published, specific justification for why that value \u2014 and no broader category of information \u2014 is held restricted. The Restricted Register may narrow the precision of notice; it may not erode the notice itself. Any monitoring scope not published in this register is not authorised.\n\n**Data purpose-limitation:** The vendor-level and population-level data collected to detect above-ledger bypass is purpose-limited to bypass-detection and the enforcement process in Section 4, and to nothing else. This data is PII-stripped at the earliest point consistent with detection (per Annex AM), is retained only for the bounded period necessary to establish patterns and adjudicate findings and is then deleted, is access-limited to the Enforcement Panel and detection staff acting under that mandate, and is never repurposed for general population surveillance, civic scoring, eligibility determination, commercial use, or any objective outside bypass-detection. The remedy against wealth purchasing the survival floor must not itself become a general-purpose surveillance asset; a monitoring programme that exceeds these limits is itself a Babel-risk failure of this annex and is subject to Ombuds review under Annex AI. These constraints are P-004 protected and may not be relaxed through ordinary operational updates. This clause is recorded, unmodified, in the per-domain calibration table of the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md) (P-075); cross-domain joins follow the linkage rule there.\n\n---\n\n*This document is Annex AJ of the Humane Constitution. Operative as an ACTIVE specification as of Proposal 7 close-out. Penalty schedule (\u00a74) and Founding Commitments FC-010, FC-040, FC-041 are binding on the Enforcement Panel through the Article VII enforcement architecture.*\n", + "content": "# ANNEX AJ \u2014 Above-Ledger Bypass Worked Examples\n\n> **Provenance:** Implements [P-001 \u2014 Shadow Convertibility Containment] above-ledger worked examples \u00b7 Addresses T-001 \u00b7 Status: **ACTIVE**\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Extends the convertibility prohibition above the ledger: enumerates specific prohibited patterns for each instrument boundary (Essential Access/Flow, Voice/Service Record, Shared Storehouse/Flow) so that social-layer workarounds are named, detectable, and subject to a graduated penalty schedule. |\n> | **Who it protects** | Genuine Essential Access recipients from preferential treatment schemes that invert the survival floor into a status currency; people rationed during Shared Storehouse periods from Flow-wealthy actors who exit or hoard; contributors without institutional backing from civic standing being purchased through Flow resources. |\n> | **Failure risk** | On-ledger detection leaves the social layer unguarded; sophisticated actors use employer-sponsored contribution accumulation, side queues, or anticipatory hoarding to reproduce the convertibility relationship without touching the ledger. |\n> | **Evidence status** | Active \u2014 unproven |\n> | **Linked risks** | T-001 / P-001 (shadow convertibility); FC-010 (leakage thresholds); FC-040 (deterrence multiplier); FC-041 (detection probability); Annex AI (Enforcement Panel appeals) |\n\n**Pre-launch gate: required before system deployment \u00b7 Governed as P-004 protected specification**\n**Status: ACTIVE \u2014 penalty schedule bound to Founding Commitments FC-010, FC-040, FC-041 (Proposal 7 close-out, 2026-04-18)**\n\n---\n\n## Purpose\n\nT-001 (Shadow Convertibility) and its mitigation P-001 address on-ledger arbitrage: direct trades of Essential Access for Flow, proxy redemption, and broker-mediated exchanges that touch the ledger. P-001's detection infrastructure monitors these channels.\n\nThis annex addresses the gap identified during adversarial review: **above-ledger bypass** \u2014 convertibility attacks that do not touch the ledger at all and therefore evade P-001 detection entirely. In above-ledger bypass, the boundary between Flow, Essential Access, Voice and Service Record, and Shared Storehouse is not breached on the ledger; it is circumvented through arrangements made entirely in the social and economic layer above it.\n\nThe purpose of this annex is to enumerate specific prohibited patterns per instrument boundary so that:\n1. The legal and enforcement definition of \"convertibility violation\" extends above the ledger.\n2. Operators, vendors, and participants have clear notice of what is prohibited.\n3. Detection can be designed for social-layer patterns, not just ledger-layer patterns.\n4. The protected-term definitions in P-004 include concrete examples that resist definitional drift.\n\n**Governing rule:** Any arrangement that produces the *functional effect* of instrument conversion \u2014 regardless of whether it involves a ledger transaction \u2014 is a convertibility violation. The test is effect, not mechanism.\n\n**Anti-enumeration clause (governing):** The worked examples in Sections 1\u20133 are illustrations of the effect test, not an exhaustive catalogue of what is forbidden. Absence of a pattern from this annex does **not** imply that the pattern is permitted. Any arrangement whose economic effect is to let wealth purchase preferential survival access, civic standing, or exemption from scarcity rationing is a convertibility violation regardless of its mechanism, its novelty, or whether it resembles any example listed here. New mechanisms that achieve a prohibited effect are prohibited the moment their effect is established, without waiting for a worked example to be added. No actor may rely on the absence of a named pattern as a defence; the only defence is that the arrangement's effect is not instrument conversion. This clause governs the interpretation of every section below and prevails over any narrower reading of an individual example.\n\n---\n\n## Plain-Language Guide\n\nThis annex explains banned workarounds.\n\nThe main rule is simple: people cannot turn one instrument into another by using side deals, informal networks, special queues, employers, vendors, or civic positions.\n\nExamples of banned behavior:\n\n- using Essential Access status to get special treatment above the survival floor\n- charging Flow for faster access to the same essential service\n- using money to buy easier Service Record or Voice accumulation\n- using a civic role to get contracts or private economic advantage\n- using money to escape Shared Storehouse rationing during a shortage\n\nThe system looks at the real effect, not the excuse. If a side deal acts like conversion, it is treated as conversion.\n\n---\n\n## Boundary 1 \u2014 Essential Access / Flow Boundary\n\n*The prohibited direction: Essential Access entitlements being used to confer Flow-equivalent benefit, or Flow being used to secure preferential Essential Access access.*\n\n### AJ-1.1 | Preferential Allocation Based on Essential Access Status\n\n**Pattern:** A housing provider, food distributor, or healthcare service allocates better-quality units, priority queue positions, or enhanced service tiers exclusively or preferentially to individuals who hold or actively use Essential Access entitlements \u2014 creating a status differential based on Essential Access utilisation.\n\n**Why it is prohibited:** Essential Access is a survival floor, not a status signal. If Essential Access-active individuals receive preferential access to goods or services above the floor, Essential Access entitlements have effectively been converted into a preference currency. This recreates the leverage relationship that the instrument separation was designed to prevent \u2014 now with the state-maintained floor as the leverage instrument.\n\n**Concrete examples:**\n- A private landlord who accepts Essential Access for baseline housing but allocates larger or better-located units to Essential Access-active tenants as a retention mechanism.\n- A grocery vendor who offers Essential Access-active customers early access to limited-stock items before Flow-paying customers.\n- A healthcare provider who reduces wait times for Essential Access-active patients beyond what is required for baseline delivery.\n\n**Permitted:** Providers may offer Flow-priced upgrades above the Essential Access basket floor to any customer regardless of Essential Access status. What is prohibited is using Essential Access status itself as the selection criterion for preferential treatment.\n\n**Detection signal:** Correlation between Essential Access utilisation and allocation outcomes above the baseline level across a vendor's customer population.\n\n---\n\n### AJ-1.2 | Flow Premium for Essential Access-Equivalent Access\n\n**Pattern:** A vendor or service provider charges an Flow premium \u2014 either explicitly or through differential pricing \u2014 that functions as a fee to avoid the Essential Access-mediated queue, obtain goods above the Essential Access-rationed allocation, or access the same goods through a \"non-Essential Access\" channel perceived as higher status.\n\n**Why it is prohibited:** If Flow can purchase faster or superior access to goods that are simultaneously available through Essential Access, the separation between the instruments is functional only for those who cannot pay the Flow premium. This recreates price-based exclusion within the formal basket \u2014 the survival floor becomes a low-status track.\n\n**Concrete examples:**\n- A clinic that offers the same consultation via Essential Access delivery with a 2-week wait or via Flow payment with a same-day appointment.\n- A transit operator that sells Flow-priced \"priority boarding\" that consistently results in a better journey than the Essential Access-covered standard service.\n- A food vendor that sells Essential Access-basket items at one counter and \"premium\" versions of the identical item at an Flow counter, where the practical difference is queue length.\n\n**Permitted:** Genuine product or service differentiation \u2014 Flow-priced items that are substantively different in quality, variety, or features from Essential Access-basket items \u2014 is allowed. Markets may serve above-basket preferences. What is prohibited is structuring delivery so that Flow payment provides faster or superior access to the *same* Essential Access-basket entitlement.\n\n**Detection signal:** Systematic wait-time or quality differentials between Essential Access and Flow delivery channels for the same essential basket item at the same vendor.\n\n---\n\n### AJ-1.3 | Social Brokerage Networks\n\n**Pattern:** An informal network of individuals pools Essential Access entitlements through non-ledger social arrangements \u2014 households agreeing to share, community groups concentrating entitlements, or individual brokers who coordinate Essential Access use across a network of participants \u2014 to achieve the functional effect of a pooled Flow fund.\n\n**Why it is prohibited:** At sufficient scale, coordinated Essential Access pooling allows the network to redeem Essential Access at a rate that exceeds any individual's basket allocation, creating liquidity and substitutability properties that Essential Access is specifically designed not to have. This converts the aggregate Essential Access flow into Flow-like purchasing power for the network's coordinators.\n\n**Permitted:** Household sharing of Essential Access basket goods after redemption is not prohibited \u2014 individuals living together may share their food, for example. What is prohibited is coordinated pre-redemption pooling that is designed to achieve above-individual-basket access or to create a tradeable pool. The test is coordination for arbitrage purpose, not ordinary household life.\n\n**Detection signal:** Synchronized redemption patterns across non-cohabiting individuals; redemption rates significantly above typical single-household use per Essential Access account; network topology suggesting coordination.\n\n---\n\n## Boundary 2 \u2014 Voice and Service Record / Resource Access Boundary\n\n*The prohibited direction: civic standing being used to gain preferential access to goods, services, or opportunities; or resource/Flow advantage being used to accumulate Voice and Service Record.*\n\n### AJ-2.1 | Civic Standing as Allocation Preference\n\n**Pattern:** An institution, vendor, service provider, or programme uses Voice balance, Service Record score, or civic participation history as an explicit or implicit criterion for preferential allocation of goods, services, employment, housing, or any resource that is not a formal civic function.\n\n**Why it is prohibited:** Voice and Service Record are scoped exclusively to civic agenda-setting and service eligibility within the civic instruments. If Voice and Service Record balance produces preferential outcomes in markets, housing, employment, or services, it has effectively become a general status currency \u2014 which is the social credit failure mode the instrument separation is designed to prevent.\n\n**Concrete examples:**\n- An employer who uses Service Record records as a positive factor in hiring decisions for non-civic roles.\n- A housing authority that gives Voice-active applicants priority in allocation of units above the Essential Access baseline.\n- A university that offers admissions preference to applicants with high Service Record records on the grounds that they are \"engaged citizens.\"\n- A vendor loyalty programme that grants discounts or perks based on civic participation history.\n\n**Permitted:** Civic functions \u2014 jury selection pools, audit panels, deliberation bodies, and oversight roles \u2014 may and should use Service Record eligibility criteria. These are the defined uses of the civic instruments. What is prohibited is any use of Voice and Service Record as a criterion in decisions that are not formal civic functions.\n\n**Detection signal:** Correlation between Voice and Service Record balance and outcomes in non-civic domains (employment rates, housing allocation rates, service quality) across a population.\n\n---\n\n### AJ-2.2 | Flow-Funded Civic Standing Accumulation\n\n**Pattern:** An individual or organisation uses Flow resources \u2014 paid time, staff, facilities, or services \u2014 to systematically enable a group of individuals to accumulate Voice and Service Record at rates not available to those without equivalent Flow resources. This converts Flow advantage into civic advantage through the mechanism of contribution verification.\n\n**Why it is prohibited:** Voice and Service Record is intended to represent genuine stewardship contribution. If Flow can buy the conditions that make contribution easy, verifiable, and legible \u2014 while those without Flow must contribute under harder conditions with less verification infrastructure \u2014 then Flow has purchased civic standing indirectly.\n\n**Concrete examples:**\n- A corporation that pays employees to perform verifiable \"stewardship\" activities during work hours, systematically accumulating Service Record for its workforce at rates unavailable to informal workers.\n- A civic consultancy that charges Flow fees to prepare contribution documentation that passes verification more reliably than self-submitted records.\n- An organisation that funds community activities specifically designed to generate contribution-verification events, channelling Service Record accumulation toward its affiliated networks.\n\n**Permitted:** Employers may encourage genuine community stewardship. Organisations may support community activities with genuine civic benefit. What is prohibited is structuring these activities specifically as Service Record accumulation mechanisms for affiliated populations, particularly where the Flow resource advantage produces a systematic Service Record gap between affiliated and non-affiliated participants.\n\n**Detection signal:** Service Record accumulation rates systematically higher for economically affiliated groups than for non-affiliated groups with similar activity levels.\n\n---\n\n### AJ-2.3 | Civic Position as Economic Leverage\n\n**Pattern:** An individual uses their formal position in a civic body \u2014 an audit panel, oversight committee, CRP seat, or deliberation body \u2014 to advance Flow-beneficial decisions, direct contracts, or signal preferences to market actors in ways that translate civic position into economic advantage.\n\n**Why it is prohibited:** Civic positions carry real decision-making authority. If that authority can be converted into Flow advantage \u2014 through directed contracts, information asymmetry, or signalled preferences \u2014 then the civic instruments have become an economic power instrument, inverting the separation the protocol is designed to maintain.\n\n**Concrete examples:**\n- A CRP member who votes on procurement priorities in ways that systematically benefit businesses they have personal Flow relationships with.\n- An audit panel member who signals audit focus areas to connected market participants before the audit begins, allowing them to prepare preferentially.\n- An oversight committee member who leverages their position to obtain speaking engagements, consulting arrangements, or advisory roles from organisations they oversee.\n\n**Permitted:** Civic participants may have ordinary economic lives. What is prohibited is using the information, authority, or influence of a civic position to secure Flow advantage \u2014 standard conflict-of-interest doctrine applied to Voice and Service Record.\n\n**Detection signal:** Correlation between civic position and Flow outcomes for the individual and their connected networks; post-position employment in sectors they previously oversaw.\n\n---\n\n## Boundary 3 \u2014 Shared Storehouse / Flow Boundary\n\n*The prohibited direction: scarcity rationing being used to confer Flow-equivalent advantage; or Flow being used to circumvent Shared Storehouse rationing.*\n\n### AJ-3.1 | Shared Storehouse Allocation as Premium Service\n\n**Pattern:** During an active Shared Storehouse period, an entity with allocation authority \u2014 a vendor, distributor, or regional operator \u2014 provides Shared Storehouse-rationed goods to some individuals faster, in better condition, or in greater variety than the Shared Storehouse allocation technically requires, in exchange for Flow payment or economic relationship.\n\n**Why it is prohibited:** Shared Storehouse rationing is designed to ensure equitable distribution during genuine shortage. If Shared Storehouse allocations can be enhanced by Flow payment, rationing reproduces price-based exclusion under a different name. The Shared Storehouse period is precisely when the separation between Flow and survival access must be most robust, because it is the period of highest vulnerability.\n\n**Concrete examples:**\n- A food distributor who, during an Shared Storehouse activation for a specific food category, offers \"priority delivery\" of that category's Shared Storehouse allocation for an Flow fee.\n- A regional operator who fulfils Shared Storehouse allocations faster for businesses that maintain ongoing Flow contracts with the operator.\n- A vendor who, during Shared Storehouse rationing, offers the Shared Storehouse-rationed item alongside a \"premium bundle\" where the Shared Storehouse item is included \u2014 effectively tying Shared Storehouse access to Flow purchase.\n\n**Permitted:** Markets for goods outside the Shared Storehouse-rationed category continue unaffected. Flow sales of non-rationed items continue normally. What is prohibited is conditioning the delivery, quality, timing, or access to Shared Storehouse-rationed allocations on Flow payment or relationship.\n\n**Detection signal:** Systematic differences in Shared Storehouse allocation delivery outcomes correlated with Flow-relationship status; complaints from non-Flow-affiliated Shared Storehouse recipients about delayed or inferior delivery.\n\n---\n\n### AJ-3.2 | Flow Exit from Shared Storehouse Scope\n\n**Pattern:** A market actor \u2014 an individual, household, or firm \u2014 uses Flow resources to obtain goods in the same category as the Shared Storehouse-rationed essential from sources outside the Shared Storehouse system, in quantities that effectively exempt them from the rationing regime while drawing down the shared supply pool that the Shared Storehouse system was designed to manage.\n\n**Why it is prohibited:** Shared Storehouse is activated because the overall supply of a category is constrained. If Flow-wealthy actors can simply purchase from outside the Shared Storehouse system, the shortage is not actually shared \u2014 it is concentrated among those without Flow resources to exit. The Shared Storehouse system manages a shared resource; actors who exit via Flow while drawing on the same physical supply undermine the entire rationing purpose.\n\n**Concrete examples:**\n- During a regional water-intensive food Shared Storehouse, an individual purchases large quantities of the rationed category from an import source not yet captured by the Shared Storehouse boundary.\n- A wealthy household stockpiles Shared Storehouse-rationed goods using Flow in advance of an anticipated Shared Storehouse activation, before the activation formally begins.\n- A firm with Flow resources contracts directly with producers outside the Shared Storehouse-designated supply chain, bypassing rationing while competing for the same underlying physical supply.\n\n**Permitted:** Genuine product substitution \u2014 purchasing a different product from outside the Shared Storehouse-rationed category \u2014 is permitted; the Shared Storehouse is category-specific. What is prohibited is using Flow to obtain the same category of good at scale while the rationing system is designed to manage overall supply of that category.\n\n**Detection signal:** Category consumption in Shared Storehouse-affected regions correlated with Flow wealth levels; import flows of Shared Storehouse-rationed categories increasing during Shared Storehouse periods.\n\n---\n\n### AJ-3.3 | Anticipatory Hoarding via Flow\n\n**Pattern:** A market actor uses Flow resources to accumulate large quantities of goods in a category where Shared Storehouse activation is anticipated, before the activation formally begins \u2014 creating a personal reserve that exempts them from the rationing period while contributing to the supply shortfall that triggers it.\n\n**Why it is prohibited:** Anticipatory hoarding is a self-fulfilling attack on the Shared Storehouse system: the hoarding behaviour accelerates the supply shortfall that triggers Shared Storehouse activation, while exempting the hoarder from its effects. It is both a cause of the shortage and a circumvention of the rationing response.\n\n**Concrete examples:**\n- A firm that monitors RCS sentinel indicators and purchases months of supply of a flagged category before PCRP activation, making the shortfall worse while ensuring their own supply.\n- An individual who, upon hearing about drought conditions, purchases large quantities of water-intensive foods before the Shared Storehouse is announced.\n\n**Permitted:** Normal inventory management and ordinary household provisioning. What is prohibited is large-scale anticipatory accumulation that is scaled to the anticipated Shared Storehouse period and timed to sentinel indicator movements.\n\n**Detection signal:** Spikes in category purchasing correlated with sentinel indicator movements, particularly by actors with the information access to monitor oracle signals.\n\n---\n\n## Section 4 \u2014 Penalty Schedule (Proposal 7 close-out)\n\nThe worked examples in Sections 1\u20133 state what is prohibited. Without a published penalty schedule, \"prohibited\" is a word without teeth \u2014 detection produces cases that have to be adjudicated ex post with no pre-committed sanction, which is itself a drift surface. This section binds each boundary-class pattern to a graduated penalty schedule calibrated on the Founding Commitments.\n\n### 4.1 \u2014 Deterrence Calibration (FC-040, FC-041)\n\n**Deterrence identity:** expected value to the violator of a detected-and-sanctioned attempt must be strictly negative. Given detection probability *p* and penalty-to-gain multiplier *k*:\n\n> EV(violation) = (1 \u2212 *p*) \u00b7 gain \u2212 *p* \u00b7 *k* \u00b7 gain = gain \u00b7 (1 \u2212 *p* \u2212 *p*\u00b7*k*)\n\nFor EV \u2264 0: *k* \u2265 (1 \u2212 *p*) / *p*. At the assumed detection probability **FC-041 `DETECTION_PROBABILITY_ASSUMED` = 0.85**, break-even is *k* \u2248 0.18. The protocol commits to **FC-040 `BRIBE_DETERRENCE_MULTIPLIER` = 5.0** \u2014 meaning the base penalty for any detected above-ledger violation is **5\u00d7 the detected functional gain**. This produces EV(violation) = gain \u00b7 (1 \u2212 0.85 \u2212 4.25) = gain \u00b7 (\u22124.10), a decisive deterrent. The 5\u00d7 multiplier also survives a detection-rate collapse to \u22480.17 before EV turns positive, so the schedule is not fragile to realistic detection shortfalls.\n\n**Gain definition.** The \"functional gain\" is the Flow-equivalent value the violator captured through the violation, measured as:\n- For individual/household violations: the Flow-market price of the preferential access, goods, or standing secured above the Essential Access/Shared Storehouse baseline or civic floor.\n- For operator/vendor violations: the incremental revenue or margin attributable to the violating pattern, measured against a non-violating baseline cohort.\n- For institutional violations (employer-sponsored Service Record accumulation, directed civic positions): the Flow-equivalent value of the civic-standing advantage conferred, valued at the cost of securing equivalent standing through non-violating means.\n\nGain is measured by the enforcement body at the time of adjudication and is documented on the public Enforcement Ledger under Article VII (without PII).\n\n### 4.2 \u2014 Graduated Penalty Matrix\n\nPenalties are calibrated per-actor-scale and per-boundary-severity. The scheduled penalty is the base multiplier (5\u00d7) times the severity factor in the matrix below, applied to the functional gain and capped or floored at the per-actor amounts shown.\n\n| Pattern | Severity | Actor: Individual | Actor: Operator / Firm | Actor: Institution / Sponsor |\n| :--- | :---: | :--- | :--- | :--- |\n| **AJ-1.1** Essential Access status as allocation preference | 1.0\u00d7 | 5\u00d7 gain; Service Record \u22120.1 for cycle | 5\u00d7 gain; 90-day vendor license probation; 2nd offense = vendor ban in essential category | 5\u00d7 gain; 180-day exclusion from Essential Access-redemption network; public Enforcement Ledger notice |\n| **AJ-1.2** Flow premium for Essential Access-equivalent access | 1.2\u00d7 | 6\u00d7 gain; Service Record \u22120.2 for cycle | 6\u00d7 gain; 180-day vendor license probation; operator-license review | 6\u00d7 gain; 365-day exclusion from essential-category redemption; mandatory divestment of Essential Access redemption operations |\n| **AJ-1.3** Social brokerage networks (coordinators) | 1.5\u00d7 | 7.5\u00d7 gain against coordinator; network participants liable only on knowing participation | 7.5\u00d7 gain; operator license revoked for essential-category brokerage | 7.5\u00d7 gain; criminal referral under convertibility-violation statute where coordination is organised |\n| **AJ-2.1** Civic standing as allocation preference | 1.2\u00d7 | 6\u00d7 gain (rare as individual pattern); Service Record \u22120.2 | 6\u00d7 gain; 180-day probation from civic-eligibility data access; vendor loyalty program disqualification | 6\u00d7 gain; 365-day exclusion from Service Record-conditioned hiring pools or allocation queues; mandatory audit of prior-period decisions |\n| **AJ-2.2** Flow-funded civic standing accumulation | 1.5\u00d7 | \u2014 | 7.5\u00d7 gain; Service Record accrued under the pattern is voided for affected accounts; employer barred 365 days from Service Record-attestation sponsorship | 7.5\u00d7 gain; all attributable Service Record accruals voided; 365-day exclusion; mandatory restitution of civic-sponsorship Flow flows |\n| **AJ-2.3** Civic position as economic leverage | 2.0\u00d7 | 10\u00d7 gain; **civic position vacated; 5-year Service Record-eligibility suspension; criminal referral** | 10\u00d7 gain against contracted entity; 365-day procurement exclusion; contract voidance | 10\u00d7 gain; 5-year exclusion from civic-procurement relationships |\n| **AJ-3.1** Shared Storehouse allocation as premium service | 1.5\u00d7 | 7.5\u00d7 gain; Service Record \u22120.3 | 7.5\u00d7 gain; operator license suspended for duration of Shared Storehouse period and 180 days post-restoration; 2nd offense = operator license revoked | 7.5\u00d7 gain; 365-day exclusion from Shared Storehouse-rationed supply chain; mandatory restitution to underserved recipients |\n| **AJ-3.2** Flow exit from Shared Storehouse scope (during active Shared Storehouse) | 1.8\u00d7 | 9\u00d7 gain; excess quantity returned to Shared Storehouse pool or forfeit | 9\u00d7 gain; import/supply license suspended for Shared Storehouse duration; operator subject to per-unit excise recouping the Shared Storehouse-pool draw | 9\u00d7 gain; mandatory contribution to Shared Storehouse buffer equal to 2\u00d7 goods acquired |\n| **AJ-3.3** Anticipatory hoarding via Flow | 1.5\u00d7 pre-activation; 2.0\u00d7 post-activation timing | 7.5\u00d7\u201310\u00d7 gain; excess inventory forfeit to Shared Storehouse pool at activation | 7.5\u00d7\u201310\u00d7 gain; license suspension; mandatory release of hoarded inventory at Shared Storehouse-activation basket prices | 7.5\u00d7\u201310\u00d7 gain; 365-day exclusion; mandatory audit of trading activity during the 90 days preceding activation |\n\n**Notes on the matrix:**\n- Severity factor is applied to the FC-040 base multiplier (5\u00d7), so AJ-1.1 = 5.0\u00d7 gain, AJ-1.2 = 6.0\u00d7 gain, AJ-2.3 = 10.0\u00d7 gain, etc.\n- \"Service Record \u22120.X for cycle\" is a deduction from the violator's civic record balance proportional to severity; Service Record deduction is independent of the gain-multiplier and is not netted against it.\n- Vendor/operator license actions are administered by the licensing authority named in the Article VII enforcement architecture; suspension and revocation are appealable only through the Ombuds process per Annex AI.\n- \"Criminal referral\" indicates a finding that meets the threshold for separate prosecution under the convertibility-violation statute (out of scope of this annex); the civil/administrative penalty in this matrix applies regardless of prosecution outcome.\n\n### 4.3 \u2014 Escalation Ladder for Repeat and Systemic Violations\n\n**Repeat offense:** a second adjudicated violation of any AJ pattern by the same actor within 24 months triggers automatic escalation to the next severity band, plus:\n- Individuals: Service Record deduction doubles; civic-position eligibility suspended for 2 cycles.\n- Operators: license revocation in essential category; 5-year prohibition from operating in Essential Access or Shared Storehouse supply chains.\n- Institutions: public Enforcement Ledger notice with named leadership; mandatory independent governance audit at institution's cost.\n\n**Systemic violation:** when enforcement data shows AJ-pattern incidence across a vendor class, sector, or region exceeds **FC-010 systemic-review trigger of 7% / annum of Essential Access allocations in the affected scope**, the Ombuds triggers a **sector-level systemic review** under Annex AI. Individual enforcement continues in parallel. The systemic review assesses whether the architecture itself requires hardening (new detection signal, new prohibited pattern) or whether the breach is an enforcement-capacity failure.\n\nThe **routine leakage ceiling of 3% / annum (FC-010)** is the operational target. Between 3% and 7%, the Ombuds prioritises detection investment and enforcement acceleration but does not trigger systemic review. Below 3%, the regime is considered in normal operating state.\n\n### 4.4 \u2014 Enforcement Body and Process\n\nPenalty adjudication is administered by the **Enforcement Panel** (a sub-body of the authority named in the Article VII enforcement architecture). Process:\n\n1. **Finding.** Detection signal triggers investigation; investigation produces a factual finding with documented evidence.\n2. **Gain quantification.** The enforcement body quantifies the functional gain per \u00a74.1. Quantification methodology is documented and subject to the P-017 oracle-independence standards (Annex AL) where gain estimation requires measurement of market prices or cohort comparisons.\n3. **Notice and response.** The accused actor receives notice with the factual finding, the gain quantification, and the scheduled penalty. Actor has 30 days to contest findings or accept.\n4. **Adjudication.** Contested cases proceed to the Enforcement Panel. Panel composition: 3 seats drawn from the Article VII enforcement staff, 2 seats drawn from the Ombuds roster per Annex AI, 1 seat drawn from the affected-party advocacy roster. No Enforcement Panel member may have a prior relationship with the accused actor within 3 years.\n5. **Appeal.** Adjudicated penalties are appealable once, on the appeal spine ([ANNEX_L \u00a7L7](./ANNEX_L.md)) via the federated Ombuds process per Annex AI \u00a74.8 (Enforcement Panel Appeals) \u2014 the Plenum, not the CRP ladder, is the final instance (ANNEX_L \u00a7L7.3). Appeal pauses license actions but not gain-recoupment: recoupment proceeds during appeal **into escrow**, refunded with accrued return if the appeal succeeds (ANNEX_L \u00a7L7.2) \u2014 so appeal never becomes a window to dissipate gains, and a successful appellant is made whole.\n6. **Publication.** Final findings are published on the Enforcement Ledger (Article VII) in aggregate form, with individual findings published only where necessary for statutory notice or where the actor has consented. PII is stripped per Annex AM.\n\n### 4.5 \u2014 Deterrence Audit\n\nThe Enforcement Panel publishes an **Annual Deterrence Audit** (parallel to the Ombuds annual audit, Annex AI \u00a7AI-8) with:\n- Estimated total functional gain attempted across each AJ pattern (from detection plus estimation of undetected).\n- Actual penalties assessed and collected.\n- Realised penalty-to-gain ratio by pattern.\n- Realised detection probability by pattern.\n- Whether the FC-040 (5.0\u00d7) and FC-041 (0.85) assumptions are holding; if detection probability slips below the level at which the 5.0\u00d7 multiplier yields negative EV, the Panel issues a formal recalibration recommendation to the Founding Coalition for consideration under the Tier 2 amendment ladder.\n\nThe Annual Deterrence Audit is the feedback loop that keeps the penalty schedule calibrated. If either the multiplier or the detection assumption drifts, the deterrence identity in \u00a74.1 tells the Coalition exactly how much headroom remains before the regime becomes EV-positive for violators.\n\n---\n\n## Governance of This Annex\n\nThis annex is a **P-004 protected specification**. The worked examples above cannot be removed, narrowed, or recharacterised through ordinary operational updates. Changes to these examples require the same process as changes to core protected terms: semantic effect test, upward classification default, and public definition registry update.\n\nThe numerical values of FC-040 (5.0\u00d7 multiplier) and FC-041 (0.85 detection probability assumption) are **Tier 2 commitments in `/founding/commitments.md`**. Changes require the Tier 2 amendment ladder with public redlines. FC-010 leakage thresholds (3% / 7%) are likewise Tier 2.\n\nNew worked examples may be added through the standard P-004 amendment process as new above-ledger bypass patterns are identified in operation. The annex should be reviewed annually and updated with patterns identified through enforcement activity. Penalty schedule matrix updates for new patterns must maintain deterrence identity (\u00a74.1) and are subject to Tier 2 amendment authority.\n\n**Detection infrastructure requirement:** Article VII monitoring must extend to the social-layer detection signals identified in each worked example above. These signals are not ledger-based; they require vendor-level data collection, population-level outcome analysis, and complaint-pattern monitoring. The specific detection thresholds are maintained in the Restricted Register Annex per P-021 (Annex AO).\n\n**Public scope of monitoring:** What is monitored is public even where specific numeric thresholds are restricted. The categories and scope of social-layer monitoring \u2014 which outcomes are observed, which correlations are tested, which vendor-level and population-level signals are collected, and for which boundary patterns \u2014 are published in plain language so that operators, vendors, and participants retain the clear notice of what is prohibited that this annex requires (Purpose, item 2). Only the calibrated numeric trigger values may be withheld in the Restricted Register per P-021 (Annex AO), and only to prevent gaming of the exact thresholds. Each restricted item carries a published, specific justification for why that value \u2014 and no broader category of information \u2014 is held restricted. The Restricted Register may narrow the precision of notice; it may not erode the notice itself. Any monitoring scope not published in this register is not authorised.\n\n**Data purpose-limitation:** The vendor-level and population-level data collected to detect above-ledger bypass is purpose-limited to bypass-detection and the enforcement process in Section 4, and to nothing else. This data is PII-stripped at the earliest point consistent with detection (per Annex AM), is retained only for the bounded period necessary to establish patterns and adjudicate findings and is then deleted, is access-limited to the Enforcement Panel and detection staff acting under that mandate, and is never repurposed for general population surveillance, civic scoring, eligibility determination, commercial use, or any objective outside bypass-detection. The remedy against wealth purchasing the survival floor must not itself become a general-purpose surveillance asset; a monitoring programme that exceeds these limits is itself a Babel-risk failure of this annex and is subject to Ombuds review under Annex AI. These constraints are P-004 protected and may not be relaxed through ordinary operational updates. This clause is recorded, unmodified, in the per-domain calibration table of the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md) (P-075); cross-domain joins follow the linkage rule there. Identifiable bypass-detection records are retained no longer than the related enforcement matter requires \u2014 draft anchor 90 days post enforcement-matter finality, with a 180-day ceiling on identifiable hold while no case has formed and a 365-day absolute cap from collection (FC-211, RESERVED; bound by the Enforcement Panel and Federated Ombuds before detection activates). The 365-day \"from collection\" cap is anchored per underlying record at first ingestion of that person's data and is never reset by re-derivation, feature re-extraction, or opening a new pattern-build; a pattern-build that has run 180 days without a formed case strips to aggregate regardless of build status. Where enforcement-matter finality + 90 days would exceed 365 days from collection, the 365-day absolute cap governs.\n\n---\n\n*This document is Annex AJ of the Humane Constitution. Operative as an ACTIVE specification as of Proposal 7 close-out. Penalty schedule (\u00a74) and Founding Commitments FC-010, FC-040, FC-041 are binding on the Enforcement Panel through the Article VII enforcement architecture.*\n", "headings": [ { "level": 1, @@ -9447,7 +9452,7 @@ "slug": "governance-of-this-annex" } ], - "wordCount": 5174, + "wordCount": 5303, "headingCount": 22 }, { @@ -11127,7 +11132,7 @@ "status": "", "statusBucket": "reference", "summary": "No accountability role may sit empty. A vacated Threat Owner role must be reassigned to a named successor within 10 business days. While the role is vacant, accountability defaults upward to Independent Oversight, which holds it as interim Threat Owner and records the vacancy. If the role remains unfilled past the deadline, every threat under it reverts to a degraded status (per C-4) until a successor is named, and the lapse is escalated to oversight and logged. The same time-to-reassign and default-escalation rule applies to Control Owner and Test/Monitoring Owner roles.", - "content": "# ANNEX C \u2014 Threat Register Operations (Workflow and Evidence)\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Converts the Threat Register from a static table into a living operational control system \u2014 defining intake, triage, ownership, evidence requirements, review cadence, change control, and scale readiness gates. |\n> | **Who it protects** | Anyone who relies on system controls actually being maintained and tested rather than existing only on paper. |\n> | **Failure risk** | Without an operational workflow, the Threat Register degrades into compliance theater \u2014 entries accumulate, ownership drifts, tests go stale, and real vulnerabilities are missed until they cause harm. |\n> | **Evidence status** | Designed |\n> | **Linked risks** | All TR-01 through TR-13 entries in Annex B; pilot gate and scale gate criteria; Annex A \u00a7A3\u2013A4. |\n\n> **Provenance:** Foundational constitutional annex \u00b7 Defines threat-register workflow and evidence discipline \u00b7 Status: **ACTIVE**\nThis annex defines how the Threat Register is maintained, tested, audited, and patched over time. It converts the register from a static table into an operational control system.\n\n### C-1. Purpose\n- Ensure every named threat has a clear owner, active controls, and passing tests.\n- Make failures detectable quickly and reversible with minimal collateral harm.\n- Prevent silent scope creep (especially civic-layer scope creep) by tying changes to approvals and evidence.\n- Create audit-ready artifacts for independent oversight and public trust (at appropriate aggregation levels).\n\n### C-2. Roles and ownership model\nEach Threat ID must have a named Owner accountable for controls and test evidence. Owners may delegate implementation, but not accountability.\n\nNo accountability role may sit empty. A vacated Threat Owner role must be reassigned to a named successor within 10 business days. While the role is vacant, accountability defaults upward to Independent Oversight, which holds it as interim Threat Owner and records the vacancy. If the role remains unfilled past the deadline, every threat under it reverts to a degraded status (per C-4) until a successor is named, and the lapse is escalated to oversight and logged. The same time-to-reassign and default-escalation rule applies to Control Owner and Test/Monitoring Owner roles.\n\n| Role | Accountability | Required artifacts (minimum) |\n| :--- | :--- | :--- |\n| **Threat Owner** | Keeps entry current; ensures controls exist; ensures tests/monitoring pass; drives remediation. | Control spec; test plan; monitoring plan; quarterly review note; residual-risk statement. |\n| **Control Owner** | Implements and maintains specific controls (policy, software, ops). | Control implementation record; change log; rollback plan. |\n| **Test/Monitoring Owner** | Maintains automated tests, dashboards, anomaly detection, alert routing. | Automated test cases; alert thresholds; incident runbook; on-call rota. |\n| **Independent Oversight/Audit** | Verifies evidence, sampling, and data integrity; publishes audit summaries. | Audit reports; sampling methodology; findings and required patches. |\n| **Emergency Authority (Narrow)** | Can trigger limited emergency pause or throttles under defined conditions. | Emergency activation record; scope/time limit; post-mortem within 7 days. |\n\n### C-3. Threat lifecycle (intake to closure)\n1. **Intake:** log new threat, exploit report, or incident as a candidate Threat ID.\n2. **Triage:** assign initial Impact/Likelihood/Detectability (I/L/D) and decide whether to merge with an existing entry.\n3. **Assign ownership:** name Threat Owner + Control Owner(s) + Test/Monitoring Owner.\n4. **Specify controls:** document controls that reduce incentive, increase detection, increase cost, and limit blast radius.\n5. **Specify abuse cases and tests:** cite relevant patterns from the [Abuse Case Library](../governance/Abuse_Case_Library.md), then define automated tests and monitoring signals that prove controls are active and effective.\n6. **Implement + verify:** deploy controls behind staged rollout; require test pass + evidence package.\n7. **Operate:** monitor continuously; patch quickly; update residual risk; close only when root causes are addressed or risk is explicitly accepted by oversight.\n\n### C-4. Review Cadence\nQuarterly cycles reduce governance noise while keeping the system responsive. Monitoring and audits remain more frequent than the decision cycle.\n\n| Frequency | Activities | Outputs |\n| :--- | :--- | :--- |\n| **Continuous** | Telemetry collection; anomaly detection; alerting; fraud/coercion flags. | Alerts; incident tickets; dashboards. |\n| **Weekly** | Operational review of anomalies; Essential Access coercion/hoarding monitoring review; backlog grooming. | Weekly ops note; escalations; patch queue. |\n| **Monthly** | Control health review; test flakiness review; oracle volatility sampling; threshold tuning proposals. | Control health report; tuning proposals. |\n| **Quarterly** | Full Threat Register review; re-score I/L/D; verify evidence packages; Voice and Service Record decision cycle execution (bounded scope). | Quarterly register sign-off; updated scores; public summary (aggregated). |\n| **Annually** | System-wide red-team exercise; privacy/security audit; constitutional constraint review. | Annual red-team report; audit report; constraint reaffirmation. |\n\n**Breach of cadence is not advisory.** When a required cadence event is missed or its outputs are not produced by the scheduled date, the lapse triggers automatic escalation to Independent Oversight and is recorded in an audit-visible lapse log. Every threat that depended on the missed event reverts to a degraded, unverified status \u2014 its prior evidence is no longer treated as current \u2014 until the event is completed and fresh evidence is filed. A threat may not be reported as having passing controls while any of its cadence obligations are overdue. This makes compliance theater costly and visible rather than silent.\n\n**Recourse for the monitored person.** Continuous monitoring includes anomaly detection and fraud/coercion flags applied to identifiable people. Any person flagged by such monitoring receives notice of the flag in plain language and an accessible path to appeal it, including human review and correction of erroneous data. Adverse action that rests on a contested flag is paused or made reversible while the appeal is pending, except where a narrow, time-limited emergency action under C-6 is justified. The dignity of the monitored is protected alongside the integrity of the monitoring; see also Annex A \u00a7A3\u2013A4.\n\n**Purpose limitation and secondary-use challenge.** Monitoring data may be used only for the control purpose named in the Monitoring Purpose Register required by [P-069](../governance/Patch_Log.md) and by the Minimization and Purpose-Limitation Doctrine (P-075) in the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md). Any secondary use, cross-dashboard join (per the cross-domain linkage rule there), raw-data access expansion, retention extension, or individual-level linkage requires published review before use. A monitored person, affected cohort, trusted intermediary, or Federated Ombuds reviewer may challenge a monitoring stream on purpose-creep, re-identification, excessive retention, inadequate appeal, or operator self-certification grounds. A challenged secondary use is paused unless an independently published emergency finding states why delay would create immediate CSM harm.\n\n### C-5. Evidence requirements (audit-ready)\n- **Control Specification:** what the control does, who it affects, and why it reduces risk.\n- **Abuse Case Mapping:** actor incentive, attack path, affected collapse state, false reassurance, and failure criterion.\n- **Test Evidence:** automated tests + manual checks (where required) with pass/fail status and dates.\n- **Monitoring Evidence:** dashboards, alert thresholds, and mean-time-to-detect (MTTD) targets.\n- **Change Log:** what changed, when, who approved, and how rollback works.\n- **Incident Records:** for any triggered alert or exploit, include timeline, root cause, and patch verification.\n\nEach evidence package carries an explicit validity date. When a package lapses that date without being refreshed, the controls it backs are no longer treated as verified: the affected threat reverts to a degraded, unverified status, the lapse is escalated to oversight and recorded in the lapse log, and the package must be renewed before the threat may be reported as passing again. Stale evidence counts as no evidence.\n\n### C-6. Change control and emergency patching\nAll material changes to Essential Access basket, scarcity triggers, Commons Return and Universal Stake, Flow issuance, Voice scope, Service Record service eligibility rules, or identity/oracle mechanisms must use a controlled change process.\n1. **Change Proposal (CP)** created with: intent, affected invariants, threat impact, migration plan, and rollback plan.\n2. **Two-layer review:** (1) technical/security review, then (2) oversight review for rights/survival impacts.\n3. **Staged rollout with kill-switch:** deploy to a pilot region/segment; expand only after evidence passes.\n4. **Emergency actions** are narrow and time-limited: pause/throttle only the affected subsystem; never global freeze without due process.\n5. **Post-mortem required** within 7 days for any emergency activation; patches become permanent only after oversight sign-off.\n\n### C-7. Readiness gates (pilot and scale)\n- **Pilot gate:** top 10 risks have controls implemented and passing tests; emergency processes rehearsed; oracle quorum operational; identity recovery tested against the published evidence package.\n- **Scale gate:** demonstrated MTTD/MTTR targets; independent audit passed; coercion/fraud false-positive rates within tolerance; public transparency reports live.\n\nNo gate may be silently waived under launch pressure. Any exception to a pilot or scale-readiness gate requires a named approver with authority to grant it, a written justification, an explicit time limit after which the exception expires, and an audit-visible record of the waiver \u2014 mirroring the emergency discipline in C-6. An unrecorded or anonymous waiver is void, and a gate it purported to clear is treated as unmet.\n\n---\n", + "content": "# ANNEX C \u2014 Threat Register Operations (Workflow and Evidence)\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Converts the Threat Register from a static table into a living operational control system \u2014 defining intake, triage, ownership, evidence requirements, review cadence, change control, and scale readiness gates. |\n> | **Who it protects** | Anyone who relies on system controls actually being maintained and tested rather than existing only on paper. |\n> | **Failure risk** | Without an operational workflow, the Threat Register degrades into compliance theater \u2014 entries accumulate, ownership drifts, tests go stale, and real vulnerabilities are missed until they cause harm. |\n> | **Evidence status** | Designed |\n> | **Linked risks** | All TR-01 through TR-13 entries in Annex B; pilot gate and scale gate criteria; Annex A \u00a7A3\u2013A4. |\n\n> **Provenance:** Foundational constitutional annex \u00b7 Defines threat-register workflow and evidence discipline \u00b7 Status: **ACTIVE**\nThis annex defines how the Threat Register is maintained, tested, audited, and patched over time. It converts the register from a static table into an operational control system.\n\n### C-1. Purpose\n- Ensure every named threat has a clear owner, active controls, and passing tests.\n- Make failures detectable quickly and reversible with minimal collateral harm.\n- Prevent silent scope creep (especially civic-layer scope creep) by tying changes to approvals and evidence.\n- Create audit-ready artifacts for independent oversight and public trust (at appropriate aggregation levels).\n\n### C-2. Roles and ownership model\nEach Threat ID must have a named Owner accountable for controls and test evidence. Owners may delegate implementation, but not accountability.\n\nNo accountability role may sit empty. A vacated Threat Owner role must be reassigned to a named successor within 10 business days. While the role is vacant, accountability defaults upward to Independent Oversight, which holds it as interim Threat Owner and records the vacancy. If the role remains unfilled past the deadline, every threat under it reverts to a degraded status (per C-4) until a successor is named, and the lapse is escalated to oversight and logged. The same time-to-reassign and default-escalation rule applies to Control Owner and Test/Monitoring Owner roles.\n\n| Role | Accountability | Required artifacts (minimum) |\n| :--- | :--- | :--- |\n| **Threat Owner** | Keeps entry current; ensures controls exist; ensures tests/monitoring pass; drives remediation. | Control spec; test plan; monitoring plan; quarterly review note; residual-risk statement. |\n| **Control Owner** | Implements and maintains specific controls (policy, software, ops). | Control implementation record; change log; rollback plan. |\n| **Test/Monitoring Owner** | Maintains automated tests, dashboards, anomaly detection, alert routing. | Automated test cases; alert thresholds; incident runbook; on-call rota. |\n| **Independent Oversight/Audit** | Verifies evidence, sampling, and data integrity; publishes audit summaries. | Audit reports; sampling methodology; findings and required patches. |\n| **Emergency Authority (Narrow)** | Can trigger limited emergency pause or throttles under defined conditions. | Emergency activation record; scope/time limit; post-mortem within 7 days. |\n\n### C-3. Threat lifecycle (intake to closure)\n1. **Intake:** log new threat, exploit report, or incident as a candidate Threat ID.\n2. **Triage:** assign initial Impact/Likelihood/Detectability (I/L/D) and decide whether to merge with an existing entry.\n3. **Assign ownership:** name Threat Owner + Control Owner(s) + Test/Monitoring Owner.\n4. **Specify controls:** document controls that reduce incentive, increase detection, increase cost, and limit blast radius.\n5. **Specify abuse cases and tests:** cite relevant patterns from the [Abuse Case Library](../governance/Abuse_Case_Library.md), then define automated tests and monitoring signals that prove controls are active and effective.\n6. **Implement + verify:** deploy controls behind staged rollout; require test pass + evidence package.\n7. **Operate:** monitor continuously; patch quickly; update residual risk; close only when root causes are addressed or risk is explicitly accepted by oversight.\n\n### C-4. Review Cadence\nQuarterly cycles reduce governance noise while keeping the system responsive. Monitoring and audits remain more frequent than the decision cycle.\n\n| Frequency | Activities | Outputs |\n| :--- | :--- | :--- |\n| **Continuous** | Telemetry collection; anomaly detection; alerting; fraud/coercion flags. | Alerts; incident tickets; dashboards. |\n| **Weekly** | Operational review of anomalies; Essential Access coercion/hoarding monitoring review; backlog grooming. | Weekly ops note; escalations; patch queue. |\n| **Monthly** | Control health review; test flakiness review; oracle volatility sampling; threshold tuning proposals. | Control health report; tuning proposals. |\n| **Quarterly** | Full Threat Register review; re-score I/L/D; verify evidence packages; Voice and Service Record decision cycle execution (bounded scope). | Quarterly register sign-off; updated scores; public summary (aggregated). |\n| **Annually** | System-wide red-team exercise; privacy/security audit; constitutional constraint review. | Annual red-team report; audit report; constraint reaffirmation. |\n\n**Breach of cadence is not advisory.** When a required cadence event is missed or its outputs are not produced by the scheduled date, the lapse triggers automatic escalation to Independent Oversight and is recorded in an audit-visible lapse log. Every threat that depended on the missed event reverts to a degraded, unverified status \u2014 its prior evidence is no longer treated as current \u2014 until the event is completed and fresh evidence is filed. A threat may not be reported as having passing controls while any of its cadence obligations are overdue. This makes compliance theater costly and visible rather than silent.\n\n**Recourse for the monitored person.** Continuous monitoring includes anomaly detection and fraud/coercion flags applied to identifiable people. Any person flagged by such monitoring receives notice of the flag in plain language and an accessible path to appeal it, including human review and correction of erroneous data. Adverse action that rests on a contested flag is paused or made reversible while the appeal is pending, except where a narrow, time-limited emergency action under C-6 is justified. The dignity of the monitored is protected alongside the integrity of the monitoring; see also Annex A \u00a7A3\u2013A4; flag expiry follows FC-214 (resolution + 30 days, 180-day max age).\n\n**Purpose limitation and secondary-use challenge.** Monitoring data may be used only for the control purpose named in the Monitoring Purpose Register required by [P-069](../governance/Patch_Log.md) and by the Minimization and Purpose-Limitation Doctrine (P-075) in the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md). Any secondary use, cross-dashboard join (per the cross-domain linkage rule there), raw-data access expansion, retention extension, or individual-level linkage requires published review before use. A monitored person, affected cohort, trusted intermediary, or Federated Ombuds reviewer may challenge a monitoring stream on purpose-creep, re-identification, excessive retention, inadequate appeal, or operator self-certification grounds. A challenged secondary use is paused unless an independently published emergency finding states why delay would create immediate CSM harm.\n\n### C-5. Evidence requirements (audit-ready)\n- **Control Specification:** what the control does, who it affects, and why it reduces risk.\n- **Abuse Case Mapping:** actor incentive, attack path, affected collapse state, false reassurance, and failure criterion.\n- **Test Evidence:** automated tests + manual checks (where required) with pass/fail status and dates.\n- **Monitoring Evidence:** dashboards, alert thresholds, and mean-time-to-detect (MTTD) targets.\n- **Change Log:** what changed, when, who approved, and how rollback works.\n- **Incident Records:** for any triggered alert or exploit, include timeline, root cause, and patch verification.\n\nEach evidence package carries an explicit validity date. When a package lapses that date without being refreshed, the controls it backs are no longer treated as verified: the affected threat reverts to a degraded, unverified status, the lapse is escalated to oversight and recorded in the lapse log, and the package must be renewed before the threat may be reported as passing again. Stale evidence counts as no evidence.\n\n### C-6. Change control and emergency patching\nAll material changes to Essential Access basket, scarcity triggers, Commons Return and Universal Stake, Flow issuance, Voice scope, Service Record service eligibility rules, or identity/oracle mechanisms must use a controlled change process.\n1. **Change Proposal (CP)** created with: intent, affected invariants, threat impact, migration plan, and rollback plan.\n2. **Two-layer review:** (1) technical/security review, then (2) oversight review for rights/survival impacts.\n3. **Staged rollout with kill-switch:** deploy to a pilot region/segment; expand only after evidence passes.\n4. **Emergency actions** are narrow and time-limited: pause/throttle only the affected subsystem; never global freeze without due process.\n5. **Post-mortem required** within 7 days for any emergency activation; patches become permanent only after oversight sign-off.\n\n### C-7. Readiness gates (pilot and scale)\n- **Pilot gate:** top 10 risks have controls implemented and passing tests; emergency processes rehearsed; oracle quorum operational; identity recovery tested against the published evidence package.\n- **Scale gate:** demonstrated MTTD/MTTR targets; independent audit passed; coercion/fraud false-positive rates within tolerance; public transparency reports live.\n\nNo gate may be silently waived under launch pressure. Any exception to a pilot or scale-readiness gate requires a named approver with authority to grant it, a written justification, an explicit time limit after which the exception expires, and an audit-visible record of the waiver \u2014 mirroring the emergency discipline in C-6. An unrecorded or anonymous waiver is void, and a gate it purported to clear is treated as unmet.\n\n---\n", "headings": [ { "level": 1, @@ -11170,7 +11175,7 @@ "slug": "c-7-readiness-gates-pilot-and-scale" } ], - "wordCount": 1442, + "wordCount": 1454, "headingCount": 8 }, { @@ -11181,7 +11186,7 @@ "status": "", "statusBucket": "reference", "summary": "This annex governs the project's replacement wealth-and-public-finance architecture.", - "content": "# ANNEX D \u2014 Commons Return and Universal Stake\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Replaces the former progressive net-worth demurrage spine with a public-return system that collects value created by common inheritance, scarcity, legal privilege, and public infrastructure, then routes it through a protected Universal Stake and public commons lockbox. |\n> | **Who it protects** | Ordinary households, workers, caregivers, small operators, and vulnerable persons who need survival and dignity without having their income, savings, home, tools, or private life turned into the funding base. |\n> | **Failure risk** | A public-return system can become a hidden tax, a political dividend machine, a valuation bureaucracy, a surveillance surface, or a capture channel for asset holders who understate value and shift burden downward. |\n> | **Evidence status** | Active \u2014 unproven |\n> | **Linked risks** | T-025; T-029; P-023; P-029; Annexes X, J, AR, AT; Commons Return and Universal Stake Evidence Test Package. |\n\n---\n\n## Plain-language summary\n\nThis annex governs the project's replacement wealth-and-public-finance architecture.\n\nThe former active proposal used progressive net-worth demurrage: a continuous carrying cost on accumulated wealth above a participation floor. That model is superseded. It is no longer the load-bearing wealth instrument, no longer the ordinary funding source for Essential Access, and no longer a routine decay rule on personal balances.\n\nThe replacement is **Commons Return and Universal Stake**:\n\n- **Commons Return** collects public value from sources no person created alone: land/location value, natural resources, spectrum, monopoly licenses, unavoidable platform or network rents, public infrastructure uplift, and large succession transfers.\n- **Universal Stake** distributes a protected share of Commons Return to people as a civic inheritance, without converting survival into a political favor.\n- **Public Commons Lockbox** funds Essential Access, public infrastructure, basic payment rails, resilience reserves, and productive-asset restoration through published source-by-source accounting.\n- **Anti-capture gates** prevent ordinary labor, survival access, basic household exchange, ordinary savings, primary homes, working tools, and small operating reserves from becoming the routine revenue base.\n\nDemurrage may appear only as a dormant, pilot-gated backstop under \u00a7D9. It is not active routine policy.\n\n![Commons Return and Universal Stake](/images/V-015.svg)\n\n---\n\n## D1 \u2014 Supersession and Constitutional Posture\n\n**D1.1 Supersession.** This annex supersedes all active claims that Annex D imposes a routine progressive net-worth demurrage, a liquid-balance decay fee, or a continuous carrying cost on ordinary personal wealth. Older demurrage material may remain in audits, plans, or historical discussion only when it is clearly marked as superseded, historical, or dormant.\n\n**D1.2 Why the replacement was made.** The former demurrage spine overloaded one instrument. It tried to fund public operations, deter hoarding, prevent dynastic control, discipline idle balances, and force productive deployment through one valuation-heavy mechanism. That created avoidable risks: ordinary-wealth burden, illiquid-asset coercion, valuation bureaucracy, privacy exposure, capital flight, and confused public legitimacy.\n\n**D1.3 Replacement principle.** The public claim should fall first on value produced by the commons or by legally protected scarcity, not on ordinary labor, basic household exchange, modest savings, primary residence continuity, tools of work, caregiving, or survival access.\n\n**D1.4 Christ-centered dignity lens.** This annex is human-made and corrigible. Its moral test is whether it protects persons from domination, refuses to measure human worth by wealth, and keeps public provision from becoming a tower of pride or a coercive dependency. The system may collect public return from privilege and scarcity; it may not treat people as inventory, revenue targets, or instruments of policy.\n\n---\n\n## D2 \u2014 Source Bases for Commons Return\n\nCommons Return may be assessed only on named source bases. No unnamed revenue base may be implied from this annex.\n\n| Source base | Plain meaning | Core control |\n|---|---|---|\n| **Land and location value** | Value arising from site location, zoning, infrastructure, public services, and community presence rather than the holder's own labor. | Assess land/location value separately from primary dwelling continuity and working improvements. |\n| **Natural resources** | Extraction, depletion, or exclusive control of minerals, water, forests, fisheries, energy resources, and similar inherited commons. | Charge extraction or exclusive-use value; reserve restoration obligations before distribution. |\n| **Spectrum, airspace, and scarce licenses** | Publicly created or naturally scarce permission to use a limited channel, corridor, license, or franchise. | Auction, lease, or public-return share with renewal review and anti-monopoly limits. |\n| **Public infrastructure uplift** | Private gain created by public transit, utilities, roads, clinics, schools, safety systems, or remediation. | Capture a bounded share of uplift without punishing resident continuity or repair. |\n| **Network and platform rents** | Returns from unavoidable network position, gatekeeping, interoperability control, data lock-in, or monopoly access. | Treat gatekeeping rents as public-return eligible when users cannot realistically bypass the network. |\n| **Large succession transfers** | Dynastic transfer of concentrated control across generations. | Protect modest family continuity while charging large control transfers that reproduce permanent class position. |\n| **External-capital access to protected commons** | Foreign or external capital using protected local commons, essential sectors, or public rails. | Require reciprocity, public-return share, and no survival-leverage concessions. |\n\n**D2.1 No general wealth drag.** Commons Return is source-specific. It is not a blanket tax on all net worth.\n\n**D2.2 No ordinary-income base.** Ordinary labor income, small household exchange, survival access, and basic consumption are not routine Commons Return bases.\n\n**D2.3 No survival access charge.** Essential Access may not be taxed, clawed back, diminished, or conditioned to fund the system.\n\n---\n\n## D3 \u2014 Protected Ordinary Use\n\nCommons Return must distinguish extractive control from ordinary life.\n\n**Ordinary household guarantee.** Until the evidence package has passed, protected ordinary use is a design promise, not a proven funding system. The system may not shift the proof burden onto ordinary households by treating uncertainty itself as evidence of evasion.\n\nProtected ordinary use includes:\n\n- primary residence continuity, including modest family continuity in a home;\n- tools, equipment, land, inventory, and working assets in active productive use;\n- ordinary household savings and emergency reserves;\n- caregiver, disability, elder, family, mutual-aid, and faith-community support that is not a disguised commercial rent;\n- small-operator working capital needed for payroll, inventory, repair, seasonal volatility, and business continuity;\n- retirement, disability, and hardship reserves below published dignity thresholds.\n- customary, indigenous, subsistence, religious, and traditional stewardship use, unless there is evidence of rent extraction, hidden beneficial control, or artificial fragmentation of a source base.\n\n**D3.1 Burden of proof.** The system bears the burden of proving that a source base is public-return eligible. Ambiguity near ordinary household use resolves toward protection unless there is evidence of structured evasion, rent extraction, or concentrated control.\n\n**D3.2 No home-as-hostage rule.** A person may not lose primary shelter because a public-return assessment treats an illiquid home as spendable wealth. Where land/location value is assessed, payment design must preserve resident continuity through deferral, circuit breaker, community land trust conversion, or other non-displacement mechanism.\n\n**D3.3 Working-tools rule.** Productive tools are not treated as idle wealth merely because they have resale value. The question is whether the asset is being used for real work, service, production, repair, care, or community benefit.\n\n---\n\n## D4 \u2014 Universal Stake\n\nUniversal Stake is the people's protected share of Commons Return. It is a civic inheritance from shared resources and public-created value, not a wage, charity, welfare status, or reward for compliance.\n\n**D4.1 Distribution rule.** A published share of net Commons Return receipts must be routed to Universal Stake after restoration obligations, Essential Access lockbox minimums, and resilience reserves are funded.\n\n**D4.2 Non-convertibility limits.** Universal Stake may not buy Voice, Service Record standing, public office, identity priority, Essential Access priority, or review-body eligibility. It is an economic instrument only.\n\n**D4.2a Anti-assignment and private-capture limit.** Universal Stake may not be pledged, garnished, wage-offset, collateralized, lender-captured, employer-captured, landlord-captured, pre-sold, assigned to a third party, or treated as rent, credit underwriting, employment compensation, or compliance reward. Any contract that attempts to capture a person's Universal Stake in advance is void as against this annex. The purpose is to keep the public share from becoming private leverage over future need.\n\n**D4.3 Eligibility floor.** Universal Stake must not exclude people through digital fragility, documentation barriers, disability, safety-shielded enrollment, migration status disputes, or lack of conventional banking. Where identity is unresolved, the system must provide a bounded custodial or analog path that protects against duplicate capture without denying the person.\n\n**D4.4 Political capture limit.** Universal Stake may not become an election-cycle dividend controlled by incumbents. Formula, reserve rule, distribution cadence, and suspension criteria must be pre-published and governed by evidence gates rather than discretionary political timing.\n\n---\n\n## D5 \u2014 Public Commons Lockbox\n\nCommons Return receipts route through a public lockbox with source-by-source accounting.\n\nMinimum lockbox functions:\n\n1. Essential Access commons support.\n2. Public infrastructure maintenance and resilience.\n3. Basic public payment rails and fraud recovery.\n4. Productive-asset restoration for households near the floor.\n5. Resource restoration where extraction or depletion created the return.\n6. Reserves for downturns, disasters, and transition shocks.\n7. Universal Stake distribution after the above obligations are protected.\n\n**D5.1 No hidden deficit rule.** The lockbox may not hide future obligations off-ledger, borrow through shell entities, or shift costs to ordinary labor, survival access, or household exchange.\n\n**D5.2 Source disclosure.** Every settlement period must publish aggregate receipts by source base, exemptions, appeals, administrative cost, distribution, reserve movement, and lockbox balance.\n\n**D5.3 Fiscal adequacy gate.** The system may not claim scale readiness until the lockbox has a costed model showing Essential Access, delivery, resilience, payment rails, and governance operations can be funded without inflation, debasement, hidden debt, or prohibited tax-base migration beyond published tolerance.\n\n---\n\n## D6 \u2014 Assessment, Appeals, and Anti-Surveillance\n\nAssessment must be narrow, explainable, contestable, and purpose-limited.\n\n**D6.1 Minimum necessary data.** Assessors may collect only the data needed to determine the named source base, protected ordinary use, and beneficial control. Data collected for Commons Return may not be reused for policing, immigration enforcement, employment screening, credit scoring, marketing, political targeting, or social ranking. Commons Return data practice is calibrated in the master minimization standard ([Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md), P-075); its unspecified stripping point and retention period are registered there as open gaps, and dataset joining follows the cross-domain linkage rule there (which generalizes \u00a7D6.5).\n\nCommons Return assessment data is a monitoring stream for purposes of [P-069](../governance/Patch_Log.md) and the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md). Before any assessment stream operates, the Monitoring Purpose Register must name its source base, fields, lane, raw-access rule, retention clock, independent reviewer, join limits, forbidden uses, and appeal path.\n\n**D6.2 Public formulas, private details.** Public dashboards show aggregate receipts and burden distribution. Individual household and business details remain protected unless disclosure is required for a specific adjudicated enforcement action.\n\n**D6.3 Appeal right.** Every assessment must include a plain-language basis, evidence source, appeal path, hardship route, and non-displacement protection where applicable. Appeals follow the appeal spine ([ANNEX_L \u00a7L7](./ANNEX_L.md)).\n\n**D6.4 Independent review.** Valuation methods, source-base definitions, and exemption decisions require recurring review by independent methodology classes under Annex AL-style independence rules.\n\n**D6.5 Investigation escalation.** Source-base review must proceed by escalation: public and aggregate records first; entity-level records second; personal or household-linkable records only after an independent written finding of source-base relevance, proportionality, and no less-intrusive alternative. Record compulsion, dataset joining, or privacy-piercing review without that finding is void.\n\n**D6.6 Plain notice and right to helper.** Every assessment or quarantine notice must be written in plain language, orally explainable, translated where needed, available offline, and paired with a named human reviewer. Elderly, disabled, low-literacy, rural, undocumented, safety-shielded, caregiver, and digitally fragile persons have a right to a trusted helper or community navigator without losing appeal rights.\n\n---\n\n## D7 \u2014 Anti-Avoidance and Beneficial Control\n\nCommons Return follows functional control, not labels.\n\nAvoidance routes include trusts, shell entities, nominee ownership, related-party debt, perpetual foundations, license relabeling, platform restructuring, foreign holding chains, and artificial fragmentation of land, resource, or network rights.\n\n**D7.1 Functional-effect test.** If an arrangement gives a person or coordinated group durable control over a public-return source base, the assessment follows that control even if legal title is dispersed.\n\n**D7.2 No ordinary association penalty.** Mutual aid, churches, worker cooperatives, family households, disability supports, and small community associations are not avoidance structures merely because they coordinate resources. The avoidance test requires durable rent extraction, hidden beneficial control, or artificial fragmentation of a source base.\n\n**D7.3 External-capital membrane.** External capital may participate in productive work, but may not use protected commons, essential-sector access, or public rails to extract unreturned scarcity rents or obtain survival-leverage concessions.\n\n---\n\n## D8 \u2014 Fiscal Sustainability Threat Gate\n\nCommons Return is not automatically sufficient. It must be costed.\n\nBefore any scale claim, the project must publish a fiscal sustainability dossier covering:\n\n- Essential Access basket cost by region and category;\n- delivery cost for hard-to-serve populations;\n- expected Commons Return receipts by source base;\n- Universal Stake distribution formula and reserve rule;\n- administrative and governance operating costs;\n- inflation/debasement risk from Flow issuance;\n- transition costs and legacy-law interface;\n- downside scenario where one or more major source bases underperform;\n- burden incidence by wealth band, income band, region, household type, disability status, age, and small-operator status;\n- tax or fee bases that remain necessary, if any, with explicit prohibited-base screening.\n\n**D8.1 Honest tax posture.** This annex does not declare that taxes are unnecessary. It narrows the preferred public-revenue base toward commons-created value and away from ordinary labor and survival. Residual taxes, fees, or charges may remain necessary during transition or at scale, but only if they are named, costed, screened against prohibited bases, and reviewed for dignity and incidence.\n\n**D8.2 Scale block.** If no costed model exists, if the model depends on inflation or debasement beyond published tolerance, or if burden shifts downward onto ordinary households, the project must block scale claims and downgrade public language.\n\n---\n\n## D9 \u2014 Dormant Backstops\n\nThe following instruments are not active routine policy. They may be studied, piloted, or activated only under the stated limits.\n\n| Backstop | Permitted use | Guardrail |\n|---|---|---|\n| **Harberger / COST-style self-assessment** | Hard-to-price illiquid assets where valuation hiding is a serious exploit. | Pilot-gated, asset-class specific, appealable, and never applied to primary shelter in a way that forces displacement. |\n| **Low-rate net-worth backstop** | Last-resort anti-avoidance when source-base rules fail against concentrated hidden control. | Non-load-bearing, low-rate, published incidence test, ordinary-household exemption, no survival-floor funding dependence. |\n| **Flow deflation circuit breaker** | Emergency monetary stabilization if issuance abuse threatens purchasing power. | Temporary, system-wide, independently triggered, and not a routine demurrage or public-finance tool. |\n\n**D9.1 No demurrage by default.** No routine balance decay, idle-money demurrage, progressive net-worth demurrage, or equivalent carrying cost may be introduced by interpretation. Any revival requires a new patch, fiscal/dignity evidence, public review, and the applicable amendment process.\n\n---\n\n## D10 \u2014 Evidence Package\n\nThe controlling evidence gate for this annex is the [Commons Return and Universal Stake Evidence Test Package](../governance/Commons_Return_Universal_Stake_Evidence_Test_Package.md).\n\nThe minimum tests are:\n\n- fiscal adequacy and downside revenue modeling;\n- incidence and dignity burden review;\n- source-base valuation red team;\n- legal-wrapper and beneficial-control avoidance review;\n- Universal Stake capture and election-timing simulation;\n- Essential Access lockbox sufficiency test;\n- small-operator, caregiver, elder, disability, and rural impact review;\n- privacy and surveillance-risk audit;\n- external-capital arbitrage test;\n- public comprehension test.\n\nNo stronger status may be claimed until these tests exist and residual risk is updated in the Claims and Evidence Register.\n", + "content": "# ANNEX D \u2014 Commons Return and Universal Stake\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Replaces the former progressive net-worth demurrage spine with a public-return system that collects value created by common inheritance, scarcity, legal privilege, and public infrastructure, then routes it through a protected Universal Stake and public commons lockbox. |\n> | **Who it protects** | Ordinary households, workers, caregivers, small operators, and vulnerable persons who need survival and dignity without having their income, savings, home, tools, or private life turned into the funding base. |\n> | **Failure risk** | A public-return system can become a hidden tax, a political dividend machine, a valuation bureaucracy, a surveillance surface, or a capture channel for asset holders who understate value and shift burden downward. |\n> | **Evidence status** | Active \u2014 unproven |\n> | **Linked risks** | T-025; T-029; P-023; P-029; Annexes X, J, AR, AT; Commons Return and Universal Stake Evidence Test Package. |\n\n---\n\n## Plain-language summary\n\nThis annex governs the project's replacement wealth-and-public-finance architecture.\n\nThe former active proposal used progressive net-worth demurrage: a continuous carrying cost on accumulated wealth above a participation floor. That model is superseded. It is no longer the load-bearing wealth instrument, no longer the ordinary funding source for Essential Access, and no longer a routine decay rule on personal balances.\n\nThe replacement is **Commons Return and Universal Stake**:\n\n- **Commons Return** collects public value from sources no person created alone: land/location value, natural resources, spectrum, monopoly licenses, unavoidable platform or network rents, public infrastructure uplift, and large succession transfers.\n- **Universal Stake** distributes a protected share of Commons Return to people as a civic inheritance, without converting survival into a political favor.\n- **Public Commons Lockbox** funds Essential Access, public infrastructure, basic payment rails, resilience reserves, and productive-asset restoration through published source-by-source accounting.\n- **Anti-capture gates** prevent ordinary labor, survival access, basic household exchange, ordinary savings, primary homes, working tools, and small operating reserves from becoming the routine revenue base.\n\nDemurrage may appear only as a dormant, pilot-gated backstop under \u00a7D9. It is not active routine policy.\n\n![Commons Return and Universal Stake](/images/V-015.svg)\n\n---\n\n## D1 \u2014 Supersession and Constitutional Posture\n\n**D1.1 Supersession.** This annex supersedes all active claims that Annex D imposes a routine progressive net-worth demurrage, a liquid-balance decay fee, or a continuous carrying cost on ordinary personal wealth. Older demurrage material may remain in audits, plans, or historical discussion only when it is clearly marked as superseded, historical, or dormant.\n\n**D1.2 Why the replacement was made.** The former demurrage spine overloaded one instrument. It tried to fund public operations, deter hoarding, prevent dynastic control, discipline idle balances, and force productive deployment through one valuation-heavy mechanism. That created avoidable risks: ordinary-wealth burden, illiquid-asset coercion, valuation bureaucracy, privacy exposure, capital flight, and confused public legitimacy.\n\n**D1.3 Replacement principle.** The public claim should fall first on value produced by the commons or by legally protected scarcity, not on ordinary labor, basic household exchange, modest savings, primary residence continuity, tools of work, caregiving, or survival access.\n\n**D1.4 Christ-centered dignity lens.** This annex is human-made and corrigible. Its moral test is whether it protects persons from domination, refuses to measure human worth by wealth, and keeps public provision from becoming a tower of pride or a coercive dependency. The system may collect public return from privilege and scarcity; it may not treat people as inventory, revenue targets, or instruments of policy.\n\n---\n\n## D2 \u2014 Source Bases for Commons Return\n\nCommons Return may be assessed only on named source bases. No unnamed revenue base may be implied from this annex.\n\n| Source base | Plain meaning | Core control |\n|---|---|---|\n| **Land and location value** | Value arising from site location, zoning, infrastructure, public services, and community presence rather than the holder's own labor. | Assess land/location value separately from primary dwelling continuity and working improvements. |\n| **Natural resources** | Extraction, depletion, or exclusive control of minerals, water, forests, fisheries, energy resources, and similar inherited commons. | Charge extraction or exclusive-use value; reserve restoration obligations before distribution. |\n| **Spectrum, airspace, and scarce licenses** | Publicly created or naturally scarce permission to use a limited channel, corridor, license, or franchise. | Auction, lease, or public-return share with renewal review and anti-monopoly limits. |\n| **Public infrastructure uplift** | Private gain created by public transit, utilities, roads, clinics, schools, safety systems, or remediation. | Capture a bounded share of uplift without punishing resident continuity or repair. |\n| **Network and platform rents** | Returns from unavoidable network position, gatekeeping, interoperability control, data lock-in, or monopoly access. | Treat gatekeeping rents as public-return eligible when users cannot realistically bypass the network. |\n| **Large succession transfers** | Dynastic transfer of concentrated control across generations. | Protect modest family continuity while charging large control transfers that reproduce permanent class position. |\n| **External-capital access to protected commons** | Foreign or external capital using protected local commons, essential sectors, or public rails. | Require reciprocity, public-return share, and no survival-leverage concessions. |\n\n**D2.1 No general wealth drag.** Commons Return is source-specific. It is not a blanket tax on all net worth.\n\n**D2.2 No ordinary-income base.** Ordinary labor income, small household exchange, survival access, and basic consumption are not routine Commons Return bases.\n\n**D2.3 No survival access charge.** Essential Access may not be taxed, clawed back, diminished, or conditioned to fund the system.\n\n---\n\n## D3 \u2014 Protected Ordinary Use\n\nCommons Return must distinguish extractive control from ordinary life.\n\n**Ordinary household guarantee.** Until the evidence package has passed, protected ordinary use is a design promise, not a proven funding system. The system may not shift the proof burden onto ordinary households by treating uncertainty itself as evidence of evasion.\n\nProtected ordinary use includes:\n\n- primary residence continuity, including modest family continuity in a home;\n- tools, equipment, land, inventory, and working assets in active productive use;\n- ordinary household savings and emergency reserves;\n- caregiver, disability, elder, family, mutual-aid, and faith-community support that is not a disguised commercial rent;\n- small-operator working capital needed for payroll, inventory, repair, seasonal volatility, and business continuity;\n- retirement, disability, and hardship reserves below published dignity thresholds.\n- customary, indigenous, subsistence, religious, and traditional stewardship use, unless there is evidence of rent extraction, hidden beneficial control, or artificial fragmentation of a source base.\n\n**D3.1 Burden of proof.** The system bears the burden of proving that a source base is public-return eligible. Ambiguity near ordinary household use resolves toward protection unless there is evidence of structured evasion, rent extraction, or concentrated control.\n\n**D3.2 No home-as-hostage rule.** A person may not lose primary shelter because a public-return assessment treats an illiquid home as spendable wealth. Where land/location value is assessed, payment design must preserve resident continuity through deferral, circuit breaker, community land trust conversion, or other non-displacement mechanism.\n\n**D3.3 Working-tools rule.** Productive tools are not treated as idle wealth merely because they have resale value. The question is whether the asset is being used for real work, service, production, repair, care, or community benefit.\n\n---\n\n## D4 \u2014 Universal Stake\n\nUniversal Stake is the people's protected share of Commons Return. It is a civic inheritance from shared resources and public-created value, not a wage, charity, welfare status, or reward for compliance.\n\n**D4.1 Distribution rule.** A published share of net Commons Return receipts must be routed to Universal Stake after restoration obligations, Essential Access lockbox minimums, and resilience reserves are funded.\n\n**D4.2 Non-convertibility limits.** Universal Stake may not buy Voice, Service Record standing, public office, identity priority, Essential Access priority, or review-body eligibility. It is an economic instrument only.\n\n**D4.2a Anti-assignment and private-capture limit.** Universal Stake may not be pledged, garnished, wage-offset, collateralized, lender-captured, employer-captured, landlord-captured, pre-sold, assigned to a third party, or treated as rent, credit underwriting, employment compensation, or compliance reward. Any contract that attempts to capture a person's Universal Stake in advance is void as against this annex. The purpose is to keep the public share from becoming private leverage over future need.\n\n**D4.3 Eligibility floor.** Universal Stake must not exclude people through digital fragility, documentation barriers, disability, safety-shielded enrollment, migration status disputes, or lack of conventional banking. Where identity is unresolved, the system must provide a bounded custodial or analog path that protects against duplicate capture without denying the person.\n\n**D4.4 Political capture limit.** Universal Stake may not become an election-cycle dividend controlled by incumbents. Formula, reserve rule, distribution cadence, and suspension criteria must be pre-published and governed by evidence gates rather than discretionary political timing.\n\n---\n\n## D5 \u2014 Public Commons Lockbox\n\nCommons Return receipts route through a public lockbox with source-by-source accounting.\n\nMinimum lockbox functions:\n\n1. Essential Access commons support.\n2. Public infrastructure maintenance and resilience.\n3. Basic public payment rails and fraud recovery.\n4. Productive-asset restoration for households near the floor.\n5. Resource restoration where extraction or depletion created the return.\n6. Reserves for downturns, disasters, and transition shocks.\n7. Universal Stake distribution after the above obligations are protected.\n\n**D5.1 No hidden deficit rule.** The lockbox may not hide future obligations off-ledger, borrow through shell entities, or shift costs to ordinary labor, survival access, or household exchange.\n\n**D5.2 Source disclosure.** Every settlement period must publish aggregate receipts by source base, exemptions, appeals, administrative cost, distribution, reserve movement, and lockbox balance.\n\n**D5.3 Fiscal adequacy gate.** The system may not claim scale readiness until the lockbox has a costed model showing Essential Access, delivery, resilience, payment rails, and governance operations can be funded without inflation, debasement, hidden debt, or prohibited tax-base migration beyond published tolerance.\n\n---\n\n## D6 \u2014 Assessment, Appeals, and Anti-Surveillance\n\nAssessment must be narrow, explainable, contestable, and purpose-limited.\n\n**D6.1 Minimum necessary data.** Assessors may collect only the data needed to determine the named source base, protected ordinary use, and beneficial control. Data collected for Commons Return may not be reused for policing, immigration enforcement, employment screening, credit scoring, marketing, political targeting, or social ranking. Commons Return data practice is calibrated in the master minimization standard ([Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md), P-075); its stripping point and retention period are calibrated there, and dataset joining follows the cross-domain linkage rule there (which generalizes \u00a7D6.5). Assessment data is PII-stripped to aggregate at assessment finality and retained no later than the appeal-spine window close + 30 days, with an 18-month identifiable cap (FC-213, RESERVED).\n\nCommons Return assessment data is a monitoring stream for purposes of [P-069](../governance/Patch_Log.md) and the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md). Before any assessment stream operates, the Monitoring Purpose Register must name its source base, fields, lane, raw-access rule, retention clock, independent reviewer, join limits, forbidden uses, and appeal path.\n\n**D6.2 Public formulas, private details.** Public dashboards show aggregate receipts and burden distribution. Individual household and business details remain protected unless disclosure is required for a specific adjudicated enforcement action.\n\n**D6.3 Appeal right.** Every assessment must include a plain-language basis, evidence source, appeal path, hardship route, and non-displacement protection where applicable. Appeals follow the appeal spine ([ANNEX_L \u00a7L7](./ANNEX_L.md)).\n\n**D6.4 Independent review.** Valuation methods, source-base definitions, and exemption decisions require recurring review by independent methodology classes under Annex AL-style independence rules.\n\n**D6.5 Investigation escalation.** Source-base review must proceed by escalation: public and aggregate records first; entity-level records second; personal or household-linkable records only after an independent written finding of source-base relevance, proportionality, and no less-intrusive alternative. Record compulsion, dataset joining, or privacy-piercing review without that finding is void.\n\n**D6.6 Plain notice and right to helper.** Every assessment or quarantine notice must be written in plain language, orally explainable, translated where needed, available offline, and paired with a named human reviewer. Elderly, disabled, low-literacy, rural, undocumented, safety-shielded, caregiver, and digitally fragile persons have a right to a trusted helper or community navigator without losing appeal rights.\n\n---\n\n## D7 \u2014 Anti-Avoidance and Beneficial Control\n\nCommons Return follows functional control, not labels.\n\nAvoidance routes include trusts, shell entities, nominee ownership, related-party debt, perpetual foundations, license relabeling, platform restructuring, foreign holding chains, and artificial fragmentation of land, resource, or network rights.\n\n**D7.1 Functional-effect test.** If an arrangement gives a person or coordinated group durable control over a public-return source base, the assessment follows that control even if legal title is dispersed.\n\n**D7.2 No ordinary association penalty.** Mutual aid, churches, worker cooperatives, family households, disability supports, and small community associations are not avoidance structures merely because they coordinate resources. The avoidance test requires durable rent extraction, hidden beneficial control, or artificial fragmentation of a source base.\n\n**D7.3 External-capital membrane.** External capital may participate in productive work, but may not use protected commons, essential-sector access, or public rails to extract unreturned scarcity rents or obtain survival-leverage concessions.\n\n---\n\n## D8 \u2014 Fiscal Sustainability Threat Gate\n\nCommons Return is not automatically sufficient. It must be costed.\n\nBefore any scale claim, the project must publish a fiscal sustainability dossier covering:\n\n- Essential Access basket cost by region and category;\n- delivery cost for hard-to-serve populations;\n- expected Commons Return receipts by source base;\n- Universal Stake distribution formula and reserve rule;\n- administrative and governance operating costs;\n- inflation/debasement risk from Flow issuance;\n- transition costs and legacy-law interface;\n- downside scenario where one or more major source bases underperform;\n- burden incidence by wealth band, income band, region, household type, disability status, age, and small-operator status;\n- tax or fee bases that remain necessary, if any, with explicit prohibited-base screening.\n\n**D8.1 Honest tax posture.** This annex does not declare that taxes are unnecessary. It narrows the preferred public-revenue base toward commons-created value and away from ordinary labor and survival. Residual taxes, fees, or charges may remain necessary during transition or at scale, but only if they are named, costed, screened against prohibited bases, and reviewed for dignity and incidence.\n\n**D8.2 Scale block.** If no costed model exists, if the model depends on inflation or debasement beyond published tolerance, or if burden shifts downward onto ordinary households, the project must block scale claims and downgrade public language.\n\n---\n\n## D9 \u2014 Dormant Backstops\n\nThe following instruments are not active routine policy. They may be studied, piloted, or activated only under the stated limits.\n\n| Backstop | Permitted use | Guardrail |\n|---|---|---|\n| **Harberger / COST-style self-assessment** | Hard-to-price illiquid assets where valuation hiding is a serious exploit. | Pilot-gated, asset-class specific, appealable, and never applied to primary shelter in a way that forces displacement. |\n| **Low-rate net-worth backstop** | Last-resort anti-avoidance when source-base rules fail against concentrated hidden control. | Non-load-bearing, low-rate, published incidence test, ordinary-household exemption, no survival-floor funding dependence. |\n| **Flow deflation circuit breaker** | Emergency monetary stabilization if issuance abuse threatens purchasing power. | Temporary, system-wide, independently triggered, and not a routine demurrage or public-finance tool. |\n\n**D9.1 No demurrage by default.** No routine balance decay, idle-money demurrage, progressive net-worth demurrage, or equivalent carrying cost may be introduced by interpretation. Any revival requires a new patch, fiscal/dignity evidence, public review, and the applicable amendment process.\n\n---\n\n## D10 \u2014 Evidence Package\n\nThe controlling evidence gate for this annex is the [Commons Return and Universal Stake Evidence Test Package](../governance/Commons_Return_Universal_Stake_Evidence_Test_Package.md).\n\nThe minimum tests are:\n\n- fiscal adequacy and downside revenue modeling;\n- incidence and dignity burden review;\n- source-base valuation red team;\n- legal-wrapper and beneficial-control avoidance review;\n- Universal Stake capture and election-timing simulation;\n- Essential Access lockbox sufficiency test;\n- small-operator, caregiver, elder, disability, and rural impact review;\n- privacy and surveillance-risk audit;\n- external-capital arbitrage test;\n- public comprehension test.\n\nNo stronger status may be claimed until these tests exist and residual risk is updated in the Claims and Evidence Register.\n", "headings": [ { "level": 1, @@ -11244,7 +11249,7 @@ "slug": "d10-evidence-package" } ], - "wordCount": 2600, + "wordCount": 2627, "headingCount": 12 }, { diff --git a/docs/annexes/ANNEX_AF.md b/docs/annexes/ANNEX_AF.md index 41032c9..775ea4c 100644 --- a/docs/annexes/ANNEX_AF.md +++ b/docs/annexes/ANNEX_AF.md @@ -44,7 +44,7 @@ Detection triggers elevated scrutiny review, not automatic denial. The review mu **Slow-burn shared-hardship safe harbor:** Genuine co-located or co-affiliated hardship frequently arrives without a formal emergency declaration — a single plant closing before any oracle declaration, an extended-kinship network in deep poverty, the failure of a single-employer town. Where the reviewing body finds documented evidence of such a cluster — a shared employer, a shared locality, or a shared kinship or housing network experiencing genuine concurrent hardship — the affected persons receive the same presumption of an innocent explanation that the community-disaster safe harbor grants. The reviewer documents the shared-hardship basis, and the flagged collusion pattern is treated as explained rather than suspect. This pathway requires no declared emergency; it requires only credible documentation of co-located or co-affiliated hardship, and like the declared-disaster safe harbor it suspends elevated scrutiny for the affected cluster for 2 quarters. -**Attestation-graph data minimization.** The hardship attestation graph maps the support networks of people in hardship and must never become a reusable surveillance asset. Access to the attestation graph is purpose-limited to exploitation review under this annex: only the reviewing bodies and independent panels conducting an active collusion-detection review may view it, and only the subgraph relevant to the case under review. The graph is retained only as long as needed for active and appealable reviews and is purged on a fixed retention schedule once a review and its appeal window have closed; confirmed safe-harbor or innocent-explanation cases are purged at closure. The attestation graph may not be repurposed for eligibility scoring, civic-standing assessment, law-enforcement referral, or any use beyond exploitation review, and may not be exported, sold, or shared outside the reviewing function. Every access is logged and auditable. The graph's regime is recorded in the per-domain calibration table of the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md) (P-075); its unspecified retention-schedule length is registered there as an open gap. +**Attestation-graph data minimization.** The hardship attestation graph maps the support networks of people in hardship and must never become a reusable surveillance asset. Access to the attestation graph is purpose-limited to exploitation review under this annex: only the reviewing bodies and independent panels conducting an active collusion-detection review may view it, and only the subgraph relevant to the case under review. The graph is retained only as long as needed for active and appealable reviews and is purged on a fixed retention schedule once a review and its appeal window have closed; confirmed safe-harbor or innocent-explanation cases are purged at closure. The attestation graph may not be repurposed for eligibility scoring, civic-standing assessment, law-enforcement referral, or any use beyond exploitation review, and may not be exported, sold, or shared outside the reviewing function. Every access is logged and auditable. The graph's regime is recorded in the per-domain calibration table of the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md) (P-075); its retention schedule is calibrated there. The fixed schedule is: stripped to a case-pseudonym at intake, fully purged once the review and its appeal-spine (ANNEX_L §L7) window close + 30 days, with a 180-day ceiling past appeal-window close (FC-212, RESERVED; this retention ceiling is distinct from the §AF3 two-quarter scrutiny-suspension safe harbor). ### AF4. Service Record Slow-Decay During Extended Pause (Annex K4 Amendment) During a Protected Pause Window, Service Record decays at 20% of the normal quarterly rate rather than being fully frozen. Voice decay freeze is unchanged — Voice cliff-effect protection is preserved in full. The Service Record slow-decay applies only during quarters in which a Protected Pause Window is active. diff --git a/docs/annexes/ANNEX_AJ.md b/docs/annexes/ANNEX_AJ.md index 242339d..642190a 100644 --- a/docs/annexes/ANNEX_AJ.md +++ b/docs/annexes/ANNEX_AJ.md @@ -300,7 +300,7 @@ New worked examples may be added through the standard P-004 amendment process as **Public scope of monitoring:** What is monitored is public even where specific numeric thresholds are restricted. The categories and scope of social-layer monitoring — which outcomes are observed, which correlations are tested, which vendor-level and population-level signals are collected, and for which boundary patterns — are published in plain language so that operators, vendors, and participants retain the clear notice of what is prohibited that this annex requires (Purpose, item 2). Only the calibrated numeric trigger values may be withheld in the Restricted Register per P-021 (Annex AO), and only to prevent gaming of the exact thresholds. Each restricted item carries a published, specific justification for why that value — and no broader category of information — is held restricted. The Restricted Register may narrow the precision of notice; it may not erode the notice itself. Any monitoring scope not published in this register is not authorised. -**Data purpose-limitation:** The vendor-level and population-level data collected to detect above-ledger bypass is purpose-limited to bypass-detection and the enforcement process in Section 4, and to nothing else. This data is PII-stripped at the earliest point consistent with detection (per Annex AM), is retained only for the bounded period necessary to establish patterns and adjudicate findings and is then deleted, is access-limited to the Enforcement Panel and detection staff acting under that mandate, and is never repurposed for general population surveillance, civic scoring, eligibility determination, commercial use, or any objective outside bypass-detection. The remedy against wealth purchasing the survival floor must not itself become a general-purpose surveillance asset; a monitoring programme that exceeds these limits is itself a Babel-risk failure of this annex and is subject to Ombuds review under Annex AI. These constraints are P-004 protected and may not be relaxed through ordinary operational updates. This clause is recorded, unmodified, in the per-domain calibration table of the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md) (P-075); cross-domain joins follow the linkage rule there. +**Data purpose-limitation:** The vendor-level and population-level data collected to detect above-ledger bypass is purpose-limited to bypass-detection and the enforcement process in Section 4, and to nothing else. This data is PII-stripped at the earliest point consistent with detection (per Annex AM), is retained only for the bounded period necessary to establish patterns and adjudicate findings and is then deleted, is access-limited to the Enforcement Panel and detection staff acting under that mandate, and is never repurposed for general population surveillance, civic scoring, eligibility determination, commercial use, or any objective outside bypass-detection. The remedy against wealth purchasing the survival floor must not itself become a general-purpose surveillance asset; a monitoring programme that exceeds these limits is itself a Babel-risk failure of this annex and is subject to Ombuds review under Annex AI. These constraints are P-004 protected and may not be relaxed through ordinary operational updates. This clause is recorded, unmodified, in the per-domain calibration table of the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md) (P-075); cross-domain joins follow the linkage rule there. Identifiable bypass-detection records are retained no longer than the related enforcement matter requires — draft anchor 90 days post enforcement-matter finality, with a 180-day ceiling on identifiable hold while no case has formed and a 365-day absolute cap from collection (FC-211, RESERVED; bound by the Enforcement Panel and Federated Ombuds before detection activates). The 365-day "from collection" cap is anchored per underlying record at first ingestion of that person's data and is never reset by re-derivation, feature re-extraction, or opening a new pattern-build; a pattern-build that has run 180 days without a formed case strips to aggregate regardless of build status. Where enforcement-matter finality + 90 days would exceed 365 days from collection, the 365-day absolute cap governs. --- diff --git a/docs/annexes/ANNEX_C.md b/docs/annexes/ANNEX_C.md index 7789d3c..2b5b217 100644 --- a/docs/annexes/ANNEX_C.md +++ b/docs/annexes/ANNEX_C.md @@ -53,7 +53,7 @@ Quarterly cycles reduce governance noise while keeping the system responsive. Mo **Breach of cadence is not advisory.** When a required cadence event is missed or its outputs are not produced by the scheduled date, the lapse triggers automatic escalation to Independent Oversight and is recorded in an audit-visible lapse log. Every threat that depended on the missed event reverts to a degraded, unverified status — its prior evidence is no longer treated as current — until the event is completed and fresh evidence is filed. A threat may not be reported as having passing controls while any of its cadence obligations are overdue. This makes compliance theater costly and visible rather than silent. -**Recourse for the monitored person.** Continuous monitoring includes anomaly detection and fraud/coercion flags applied to identifiable people. Any person flagged by such monitoring receives notice of the flag in plain language and an accessible path to appeal it, including human review and correction of erroneous data. Adverse action that rests on a contested flag is paused or made reversible while the appeal is pending, except where a narrow, time-limited emergency action under C-6 is justified. The dignity of the monitored is protected alongside the integrity of the monitoring; see also Annex A §A3–A4. +**Recourse for the monitored person.** Continuous monitoring includes anomaly detection and fraud/coercion flags applied to identifiable people. Any person flagged by such monitoring receives notice of the flag in plain language and an accessible path to appeal it, including human review and correction of erroneous data. Adverse action that rests on a contested flag is paused or made reversible while the appeal is pending, except where a narrow, time-limited emergency action under C-6 is justified. The dignity of the monitored is protected alongside the integrity of the monitoring; see also Annex A §A3–A4; flag expiry follows FC-214 (resolution + 30 days, 180-day max age). **Purpose limitation and secondary-use challenge.** Monitoring data may be used only for the control purpose named in the Monitoring Purpose Register required by [P-069](../governance/Patch_Log.md) and by the Minimization and Purpose-Limitation Doctrine (P-075) in the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md). Any secondary use, cross-dashboard join (per the cross-domain linkage rule there), raw-data access expansion, retention extension, or individual-level linkage requires published review before use. A monitored person, affected cohort, trusted intermediary, or Federated Ombuds reviewer may challenge a monitoring stream on purpose-creep, re-identification, excessive retention, inadequate appeal, or operator self-certification grounds. A challenged secondary use is paused unless an independently published emergency finding states why delay would create immediate CSM harm. diff --git a/docs/annexes/ANNEX_D.md b/docs/annexes/ANNEX_D.md index 79ea1eb..58d1b76 100644 --- a/docs/annexes/ANNEX_D.md +++ b/docs/annexes/ANNEX_D.md @@ -130,7 +130,7 @@ Minimum lockbox functions: Assessment must be narrow, explainable, contestable, and purpose-limited. -**D6.1 Minimum necessary data.** Assessors may collect only the data needed to determine the named source base, protected ordinary use, and beneficial control. Data collected for Commons Return may not be reused for policing, immigration enforcement, employment screening, credit scoring, marketing, political targeting, or social ranking. Commons Return data practice is calibrated in the master minimization standard ([Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md), P-075); its unspecified stripping point and retention period are registered there as open gaps, and dataset joining follows the cross-domain linkage rule there (which generalizes §D6.5). +**D6.1 Minimum necessary data.** Assessors may collect only the data needed to determine the named source base, protected ordinary use, and beneficial control. Data collected for Commons Return may not be reused for policing, immigration enforcement, employment screening, credit scoring, marketing, political targeting, or social ranking. Commons Return data practice is calibrated in the master minimization standard ([Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md), P-075); its stripping point and retention period are calibrated there, and dataset joining follows the cross-domain linkage rule there (which generalizes §D6.5). Assessment data is PII-stripped to aggregate at assessment finality and retained no later than the appeal-spine window close + 30 days, with an 18-month identifiable cap (FC-213, RESERVED). Commons Return assessment data is a monitoring stream for purposes of [P-069](../governance/Patch_Log.md) and the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md). Before any assessment stream operates, the Monitoring Purpose Register must name its source base, fields, lane, raw-access rule, retention clock, independent reviewer, join limits, forbidden uses, and appeal path. diff --git a/docs/governance/Monitoring_Administrative_Safety_Packet.md b/docs/governance/Monitoring_Administrative_Safety_Packet.md index d31714f..c346548 100644 --- a/docs/governance/Monitoring_Administrative_Safety_Packet.md +++ b/docs/governance/Monitoring_Administrative_Safety_Packet.md @@ -118,7 +118,7 @@ Any collection of data about persons, households, providers, or support networks 3. **Aggregation-first:** population, route, office, provider, and category metrics are preferred over individual tracking. 4. **Office-separated:** the body that operates a service may not be the sole body that interprets its monitoring performance. 5. **Appealable:** any person affected by an individual-level flag receives notice, plain-language reasons, and a path to human review ([ANNEX_C](../annexes/ANNEX_C.md); appeal spine, [ANNEX_L §L7](../annexes/ANNEX_L.md)). -6. **Deletion-bound:** raw monitoring data expires or is transformed into non-identifying aggregate records on a published schedule. Where publication is involved, PII stripping follows the [ANNEX_AM §AM7](../annexes/ANNEX_AM.md) standard. +6. **Deletion-bound:** raw monitoring data expires or is transformed into non-identifying aggregate records on a published schedule. Where publication is involved, PII stripping follows the [ANNEX_AM §AM7](../annexes/ANNEX_AM.md) standard. The default retention spine is: identifiable data is deleted at appeal-window-close + 30 days, with a hard cap and no collection absent a published schedule; FC-211–FC-214 are the per-domain deviations from this spine (bypass-detection retains longest, vulnerable-person datasets least). A tool that cannot satisfy these conditions must be redesigned, narrowed, or explicitly recorded as a residual risk before it is used. @@ -126,16 +126,16 @@ A tool that cannot satisfy these conditions must be redesigned, narrowed, or exp ## Per-Domain Calibration Table (P-075) -This table records each domain's actual current rule from live text. Where a domain is stricter than the doctrine, the stricter rule governs — calibration never averages a protection down. "Unspecified — gap" is an honest gap, not permission. A domain operating inside a gap cell is governed by the doctrine's defaults until the gap is closed: no published retention schedule means no collection of identifiable data, and unnamed reuse is forbidden. A gap cell may be cited only as a reason to close the gap, never as authority to act within it. +This table records each domain's actual current rule from live text. Where a domain is stricter than the doctrine, the stricter rule governs — calibration never averages a protection down. "Unspecified — gap" is an honest gap, not permission. A domain operating inside a gap cell is governed by the doctrine's defaults until the gap is closed: no published retention schedule means no collection of identifiable data, and unnamed reuse is forbidden. A gap cell may be cited only as a reason to close the gap, never as authority to act within it. Where no appeal is filed, the L7 appeal window is deemed closed for retention-clock purposes 30 days after constructive receipt of the adverse or closure notice ([ANNEX_L §L7.1](../annexes/ANNEX_L.md)); the L7.1 defective-notice extension tolls the re-opening of an appeal but does not suspend the retention clock, and a later-revived appeal triggers re-collection from the source rather than retention of the stripped record. | Domain | Data | PII-stripping point | Retention | Access role | Purpose boundary | |---|---|---|---|---|---| | Monitoring streams generally (this packet) | Per-stream register field list | Set per register row; no global point — unspecified — gap pending register | "Deletion, aggregation, or unlinking schedule" per row; "No retention clock means no collection" | Per data lane (Lanes 0–4) and register row | Named control purpose; forbidden-use list; unnamed reuse forbidden by default | -| Bypass detection ([ANNEX_AJ](../annexes/ANNEX_AJ.md), P-004 protected) | Vendor-level and population-level bypass-pattern data | "PII-stripped at the earliest point consistent with detection (per Annex AM)" | "Retained only for the bounded period necessary to establish patterns and adjudicate findings and is then deleted"; fixed period unspecified — gap | Enforcement Panel and mandated detection staff (ANNEX_AJ) | Bypass-detection and AJ §4 enforcement only; "never repurposed for general population surveillance, civic scoring, eligibility determination, commercial use" (P-004-protected clause, quoted unmodified) | -| Hardship attestation graph ([ANNEX_AF §AF3](../annexes/ANNEX_AF.md)) | Support-network attestation graph | Inherently identifying in use; access narrowed to "only the subgraph relevant to the case under review"; stripping point unspecified — gap | "Purged on a fixed retention schedule once a review and its appeal window have closed"; safe-harbor and innocent-explanation cases "purged at closure"; schedule length unspecified — gap | Reviewing bodies in active review only; access logged (ANNEX_AF §AF3) | Exploitation review only; no export, sale, or sharing (ANNEX_AF §AF3) | +| Bypass detection ([ANNEX_AJ](../annexes/ANNEX_AJ.md), P-004 protected) | Vendor-level and population-level bypass-pattern data | "PII-stripped at the earliest point consistent with detection (per Annex AM)" | "Retained only for the bounded period necessary to establish patterns and adjudicate findings and is then deleted"; Reserved (FC-211): finality + 90d; 180d open-build ceiling; 365d hard cap | Enforcement Panel and mandated detection staff (ANNEX_AJ) | Bypass-detection and AJ §4 enforcement only; "never repurposed for general population surveillance, civic scoring, eligibility determination, commercial use" (P-004-protected clause, quoted unmodified) | +| Hardship attestation graph ([ANNEX_AF §AF3](../annexes/ANNEX_AF.md)) | Support-network attestation graph | Inherently identifying in use; access narrowed to "only the subgraph relevant to the case under review"; Reserved (FC-212): case-pseudonym at intake; full purge at appeal-close + 30d (per AM7) | "Purged on a fixed retention schedule once a review and its appeal window have closed"; safe-harbor and innocent-explanation cases "purged at closure"; Reserved (FC-212): appeal-close + 30d; 180d ceiling | Reviewing bodies in active review only; access logged (ANNEX_AF §AF3) | Exploitation review only; no export, sale, or sharing (ANNEX_AF §AF3) | | Tier-0 identity ([ANNEX_AK §AK8.1](../annexes/ANNEX_AK.md)) | Single-session pseudonymous token; allocation count | By construction: "No persistent identifier is created"; node records consumption "not by whom" | None beyond session; "infrastructure cannot reconstruct session linkage after the session closes" | Issuing node; Federated Ombuds aggregate-only after 30+ days of anomaly (ANNEX_AK §AK8.1) | Tier-0 allocation accounting; individual-level investigation prohibited (ANNEX_AK §AK8.1) | -| Commons Return assessment ([ANNEX_D §D6](../annexes/ANNEX_D.md)) | "Only the data needed to determine the named source base, protected ordinary use, and beneficial control" | Unspecified — gap | Unspecified — gap | Assessors; household-linkable escalation only via D6.5 independent finding | Named source-base determination; forbidden-reuse list (ANNEX_D §D6.1) | -| Monitored-person flags ([ANNEX_C](../annexes/ANNEX_C.md) + flag lifecycle above) | Anomaly, fraud, and coercion flags on identifiable people | Unspecified — gap | "Unresolved or cleared flags expire and cannot be reused"; expiry period unspecified — gap | Named human reviewer; Federated Ombuds escalation | Register-named control purpose; secondary use requires published review (ANNEX_C) | +| Commons Return assessment ([ANNEX_D §D6](../annexes/ANNEX_D.md)) | "Only the data needed to determine the named source base, protected ordinary use, and beneficial control" | Reserved (FC-213): at assessment finality (D6.5 records first) | Reserved (FC-213): appeal-close + 30d to strip; 18-month cap | Assessors; household-linkable escalation only via D6.5 independent finding | Named source-base determination; forbidden-reuse list (ANNEX_D §D6.1) | +| Monitored-person flags ([ANNEX_C](../annexes/ANNEX_C.md) + flag lifecycle above) | Anomaly, fraud, and coercion flags on identifiable people | Unspecified — gap | "Unresolved or cleared flags expire and cannot be reused"; Reserved (FC-214): resolution + 30d; 180d max age; 365d cap | Named human reviewer; Federated Ombuds escalation | Register-named control purpose; secondary use requires published review (ANNEX_C) | | Capture Dashboard ([Capture Dashboard Specification](./Capture_Dashboard_Specification.md)) | Aggregate capture metrics from register-cited streams only | Before publication: "aggregation, small-cell suppression, delay, and privacy-preserving methods" | Per the cited register row | Dashboard office with no hidden raw-data access (this packet's dashboard rules); dashboard method auditor | Public accountability metrics only; every metric cites a register row before publication (Capture Dashboard Specification) | --- @@ -181,7 +181,7 @@ Every flag must move through this lifecycle: 5. **Review:** the affected party may challenge the flag with a human reviewer and trusted helper. 6. **Decision:** the reviewer records the evidence, rule, remedy, and appeal result. 7. **Correction:** wrong data is corrected at the source and propagated to every dependent record. -8. **Expiration:** unresolved or cleared flags expire and cannot be reused. +8. **Expiration:** unresolved or cleared flags expire and cannot be reused. A flag expires — irreversibly unlinked, not archived — at the earlier of resolution + 30 days or a 180-day max age, with a 365-day absolute cap (FC-214, RESERVED). Cleared flags may not become hidden suspicion. They cannot be used later for civic standing, housing, employment, lending, vendor access, provider exclusion, ranking, immigration action, policing, or unrelated enforcement. diff --git a/docs/governance/Parameter_Calibration_Register.md b/docs/governance/Parameter_Calibration_Register.md index ccdfa25..cd8a0d8 100644 --- a/docs/governance/Parameter_Calibration_Register.md +++ b/docs/governance/Parameter_Calibration_Register.md @@ -44,6 +44,10 @@ Every high-risk parameter should eventually have: | FC-208 PFCR / lockbox reserve and routing rule (formerly registered here as FC-054) | Reserved | Tier 2 / pre-launch gate | Splits Commons Return receipts between Essential Access support, public rails, restoration, resilience reserves, infrastructure, and Universal Stake. | Too much to one channel creates fiscal dependency; too little weakens commons funding or turns Universal Stake into political dividend timing. | Fiscal adequacy model, source-base revenue model, lockbox sufficiency test, and burden-incidence review. | PFCR becomes dependent on inflation, hidden debt, or prohibited tax bases; or cannot fund baseline commons. | ANNEX_D; Article V; SPECIFICATIONS; founding/commitments.md FC-208. | | FC-209 CRUS appeal path | Bound to the appeal spine (ANNEX_L §L7): first instance Commons Return assessment review per ANNEX_D §D6, escalation per the spine — appeal-path drill still required pre-launch | Tier 1 / pre-launch gate | Human appeal for assessed holders and excluded claimants without letting high-value actors stall assessment. | Procedural delay as avoidance; appeal priced out of reach of the poor claimant. | Appeal-path drill (both directions). | Appeals stall assessment or exclude the unrepresented. | ANNEX_L §L7; ANNEX_D §D6; Federated Ombuds. | | FC-210 CRUS review cadence | Reserved — bind before CRUS activation | Tier 2 / pre-launch gate | Scheduled review of incidence, eligibility, valuation, bases, distribution, reserves, capture metrics; a missed cadence is itself a failure. | Review quietly skipped in good years. | Cadence compliance audit. | Missed cadence or missing data. | ANNEX_D; Capture Dashboard Specification; Pilot Evidence Roadmap. | +| FC-211 ANNEX_AJ bypass-detection retention ceiling | RESERVED — bind before AJ detection infrastructure activates; draft anchor 90 days post enforcement-matter finality; 180-day ceiling on identifiable hold while no case has formed (open pattern-build); 365-day absolute hard cap from collection, beyond which data must be aggregate or deleted (PII-stripping point unchanged: earliest point consistent with detection per ANNEX_AM §AM7). The 365-day "from collection" cap is anchored per underlying record at first ingestion of that person's data and is never reset by re-derivation, feature re-extraction, or opening a new pattern-build; a pattern-build that has run 180 days without a formed case strips to aggregate regardless of build status. Where enforcement-matter finality + 90 days would exceed 365 days from collection, the 365-day absolute cap governs: identifiable data strips to aggregate at 365 days regardless of whether finality has been reached, and a matter unresolved at 365 days continues on aggregate or case-pseudonym data only. Numeric thresholds may be Restricted-Register (P-021). | Tier 2 / data-practice calibration, pre-launch gate | Closes G-1: the data doctrine requires a published deletion schedule for bypass-detection records; this supplies it without letting a detection asset become open-ended surveillance. Bypass detection earns the longest band because patterns form across cases and time. Bound by the Enforcement Panel + Federated Ombuds. | Identifiable detection data held past need and quietly repurposed into a general-population surveillance asset (the Babel-risk AJ names against itself). | Retention-clock compliance audit; PII-strip-point audit (AM7). | Identifiable hold exceeds the ceiling/cap, or stripping slips past the earliest detection-consistent point. | ANNEX_AJ; Monitoring Administrative Safety Packet; ANNEX_L §L7; ANNEX_AM §AM7. | +| FC-212 ANNEX_AF §AF3 attestation-graph retention/stripping | RESERVED — bind before AF3 collusion-detection activates; subgraph purged once the review AND its appeal-spine (ANNEX_L §L7) window have closed + 30 days; safe-harbor / innocent-explanation cases purged at closure; 180-day ceiling past appeal-window close. PII-stripping point: stripped to a case-pseudonym at intake into the review subgraph, full purge at window-close + 30 days (the graph is inherently identifying in use, so stripping = scope-narrowing + purge per AM7). | Tier 2 / data-practice calibration, pre-launch gate | Closes G-2: supplies the fixed retention schedule and stripping point the AF3 minimization clause and the data doctrine both require, for the most sensitive dataset (the support networks of people in hardship). The vulnerable-person graph retains the least: tied to the appeal-spine close, not to a standing clock. Bound by the ANNEX_AF reviewing body + Federated Ombuds. | A hardship support-network graph kept past the review that justified it, becoming a reusable surveillance asset. | Purge-on-schedule audit; case-pseudonym-at-intake audit. | Graph retained past appeal-close + 30 days or stripping deferred past intake. | ANNEX_AF §AF3; Monitoring Administrative Safety Packet; ANNEX_L §L7; ANNEX_AM §AM7. | +| FC-213 ANNEX_D §D6 Commons Return assessment retention/stripping | RESERVED — bind before CRUS assessment streams operate; assessment data retained until the assessment is final and its ANNEX_L §L7 appeal window closes + 30 days, then PII-stripped to aggregate; 18-month total identifiable hard cap from collection. PII-stripping point: at assessment finality (the §D6.5 escalation-tier household-linkable records stripped first; raw household-linkable records never retained past finality + 30 days). Ties to the §D6.1 Monitoring Purpose Register retention-clock gate (FC-207 anti-capture family). | Tier 2 / data-practice calibration, pre-launch gate | Closes G-3: supplies the stripping point and retention schedule the §D6.1 minimization clause and the data doctrine both leave open, for household-linkable assessment data. The vulnerable-person dataset retains the least identifiable form: aggregate at finality, household-linkable records stripped first. Bound via the §D6.1 register gate (FC-207 family). | Household-linkable Commons Return data held past assessment finality and reused for policing, immigration, credit, or social ranking (the §D6.1 forbidden-reuse list). | Retention-clock audit against the §D6.1 register; strip-at-finality audit. | Household-linkable records survive past finality + 30 days, or identifiable hold exceeds 18 months. | ANNEX_D §D6; Monitoring Administrative Safety Packet; ANNEX_L §L7; ANNEX_AM §AM7. | +| FC-214 monitored-person flag expiry | RESERVED — bind before any individual-flag stream operates; a flag expires (cannot trigger action, cannot be reused) at the earlier of resolution + 30 days, or 180-day max age if never resolved; expiry is an irreversible unlink, not a soft-delete, and is non-extendable (an expired flag is gone, not archived); 365-day absolute cap on flag age. One rule governs all flag streams. | Tier 2 / data-practice calibration, pre-launch gate | Closes G-4: the flag lifecycle says cleared flags expire but never bounds the period; this binds it. Expiry as irreversible unlink — not archive — keeps a cleared flag from becoming hidden suspicion. Bound by this packet's owner + the ANNEX_C reviewer. | An "expired" flag that is really archived, resurfacing later as civic-standing, employment, lending, or policing leverage against a person already cleared. | Flag-age audit; unlink-irreversibility test. | Any flag persists past 180-day max age (365-day cap), or expiry is reversible/soft. | Monitoring Administrative Safety Packet; ANNEX_C; ANNEX_L §L7. | | Dormant §D9 backstop schedule (no live FC ID; a revival patch would assign one) | Superseded as an active parameter; no routine balance or net-worth decay schedule is operative unless a new patch, fiscal/dignity evidence, public review, and applicable amendment process revive a narrow dormant backstop. | Dormant / not operative | Preserves historical traceability for the retired demurrage designs without letting old rates govern by accident. The retired idle-balance parameters are tombstoned in founding/commitments.md FC-050–FC-052, FC-054. | If treated as active, it can burden ordinary households, illiquid owners, or working savers while bypassing the Commons Return source-base test. | Dormant-backstop incidence model, dignity review, household burden model, and explicit amendment activation record before any use. | Any document or implementation treats old rates or λ brackets as active, funds Essential Access from them, or applies routine balance/net-worth decay by interpretation. | ANNEX_D §D1 and §D9; SPECIFICATIONS. | | FC-055 issuance ceiling function | Reserved | Tier 1 / pre-launch gate | Links Flow supply to verified productive commitments. | Too loose inflates claims; too tight starves production. | Flow issuance simulation and productive-commitment audit. | Circulation detaches from real production or needed projects cannot clear. | Article V; SPECIFICATIONS. | | FC-058 CSM basket/regional adjustment | Reserved | Tier 1 / regional launch gate | Prevents one abstract basket from ignoring local climate, food, medicine, and shelter needs. | Under-adjustment harms high-need regions; over-adjustment invites political inflation. | Regional CSM pilot and capacity review. | Regional needs are mismeasured or adjustment becomes patronage. | Article III; Annex Y; SPECIFICATIONS. | diff --git a/docs/governance/Patch_Log.md b/docs/governance/Patch_Log.md index d3fd96b..fa96fe6 100644 --- a/docs/governance/Patch_Log.md +++ b/docs/governance/Patch_Log.md @@ -1,6 +1,6 @@ # Patch Log -**Running change ledger aligned to the Humane Constitution · Current through P-077 (P-071 reserved)** +**Running change ledger aligned to the Humane Constitution · Current through P-078 (P-071 reserved)** --- @@ -94,6 +94,7 @@ | P-075 | structural — no threat row | **ACTIVE** | High | Evidence-test framework + data stewardship standard: Evidence Ladder gains the canonical Test Package Template (drift rule; four package follow-ups named); the Monitoring Administrative Safety Packet gains the master Minimization and Purpose-Limitation Doctrine, a quote-sourced per-domain calibration table (open gaps marked honestly), a cross-domain linkage rule generalizing ANNEX_D §D6.5, and a drift rule; the Monitoring Repurposing ETP's duplicated six-condition baseline becomes a pointer. | | P-076 | structural — no threat row | **ACTIVE** | Medium | Institution merger audit: Conservative Hold declaring authority bound to the existing RCS accreditation body (dangling ANNEX_AL §3 pointer resolved); phantom "Measurement Oversight Body" deleted, escalation bound to the ANNEX_AL §4.1 methodology-review panel; "oracle council" unified to "oracle cohort" (FC-033's own unit). Two proposed mergers examined and REJECTED with reasons: register-adjudicator vs contribution verification are different functions protecting different people (merging would weaken INV-006), and the "Temporal Continuity Review Panel" exists nowhere in the corpus. No operating institution merged; no check removed. | | P-077 | structural — no threat row | **ACTIVE** | Medium | Canonical-home (anti-drift) discipline: the four near-identical drift rules (status spine, appeal spine, evidence template, data doctrine) collapse into one doctrine in the P-073 gate (Acceptance_Protocol) — domains cite their canonical home and keep only domain substance; a divergent restatement yields to the home, except where domain text is strictly more protective of the person (never for uniform procedural rules). The four local rules shrink to home-declaration + specific enforcement + citation. Constitution change; Christ-centered Session 27. | +| P-078 | structural — no threat row | **ACTIVE** | Medium | Data-retention gap closure (G-1..G-4 from P-075): the four "unspecified — gap" retention/stripping cells in the data-stewardship calibration table are specified as FC-211..214 — retention tied to appeal-spine window close, the corpus 30/90/180/365-day grid, protective hard caps, and pre-activation binding gates. Balanced posture (owner-approved): bypass-detection earns the longest band, the vulnerable-person datasets retain the least. Closes the confessed gaps; supplies the data doctrine's required deletion schedule (not a new mechanism). | --- @@ -702,7 +703,7 @@ The following terms are added to the P-004 protected vocabulary: *milestone*, *p ## Current Threat/Patch Linkage -This table is the single source of truth for threat→patch traceability. It covers every patch in the current inventory through P-077. Reserved IDs (P-007, P-010, P-028, P-071) and the draft-only P-063 review packet are listed in the Reserved / Never-Assigned Patch IDs table above. "Multiple" has been replaced with enumerated threat (or PRD-/IC-/INV-/ACL-) references throughout; patches with no standalone threat row are marked "structural — no threat row." +This table is the single source of truth for threat→patch traceability. It covers every patch in the current inventory through P-078. Reserved IDs (P-007, P-010, P-028, P-071) and the draft-only P-063 review packet are listed in the Reserved / Never-Assigned Patch IDs table above. "Multiple" has been replaced with enumerated threat (or PRD-/IC-/INV-/ACL-) references throughout; patches with no standalone threat row are marked "structural — no threat row." | Threat ID | Patch ID | Status | Master Reference | | :--- | :--- | :--- | :--- | @@ -778,6 +779,7 @@ This table is the single source of truth for threat→patch traceability. It cov | structural — no threat row (evidence framework + data stewardship) | P-075 | **ACTIVE** | Evidence_Ladder.md Test Package Template · Monitoring Administrative Safety Packet | | structural — no threat row (institution merger audit) | P-076 | **ACTIVE** | ANNEX_AQ · ANNEX_AL · ANNEX_AM · Capacity Measurement Evidence Test Package · SPECIFICATIONS | | structural — no threat row (canonical-home discipline) | P-077 | **ACTIVE** | Acceptance_Protocol.md P-073 gate · Claims_Evidence_Register · ANNEX_L §L7 · Evidence_Ladder · Monitoring Administrative Safety Packet | +| structural — no threat row (data-retention gap closure) | P-078 | **ACTIVE** | Parameter_Calibration_Register FC-211..214 · Monitoring Administrative Safety Packet · ANNEX_AJ · ANNEX_AF · ANNEX_D · ANNEX_C | --- @@ -1582,7 +1584,7 @@ A full-corpus simplification audit (2026-06-12, three independent single-role re **Panel process:** four independent single-role reviewers (adversarial systems designer, Christ-centered, corpus-fit, minimalist) reviewed the applied diff in parallel; all four returned APPROVE WITH FIXES and every required fix was incorporated (return-record discipline, anti-laundering tier rule, independence-count bound, protected-person clause, corrigibility clause, functional test replacing a closed family list, P-073 provenance). Christ-centered review recorded as Session 25 in `Christ_Centered_Evaluation.md`. -**Consolidation program landings (running record):** 2026-06-12 — the status spine landed (first program step under this gate): `Status_Model.md` deleted, its vocabulary and edge rules absorbed into the Claims and Evidence Register's Status methodology section (now the canonical status spine); the Hardening Queue stripped of duplicated status tracking (worklist only, references owners); Threat Register restated patch-statuses converted to pointers. Net ~−95 lines; vocabulary-definition sites reduced from five to one. Evidence Ladder deliberately retained standalone (it defines evidence *levels*, a different axis, and its level numbers are cited by app code and seven documents). Named follow-ups: Patch Log single-row mini-tables (same-file restatement, checker-covered) and a single convention for Threat Register per-entry Status lines. 2026-06-12 — the appeal spine landed (P-074, ANNEX_L §L7): seven appeal procedures → one spine + a domain intake table (the ANNEX_AW §AW3.3 orphan appeal window, RRE-011, is a named follow-up); FC-209's reserved appeal path closed by binding it to the spine. 2026-06-12 — the evidence framework and data stewardship standard landed (P-075): one test-package template in the Evidence Ladder (ten packages surveyed; four structural follow-ups named), one minimization doctrine + calibration table + linkage rule in the Monitoring Administrative Safety Packet; one restatement site deleted (the ETP baseline) and six domain clauses retained with pointers; the ANNEX_AJ P-004-protected clause recorded unmodified. 2026-06-12 — the institution merger audit landed (P-076): two phantom bodies resolved to existing ones, oracle council/cohort terminology unified; the two headline merger candidates were honestly rejected (different functions; nonexistent body) — a wrong merger is worse than none. 2026-06-13 — follow-up F-5 landed (P-077): the four drift rules the program itself created (status, appeal, evidence, data) collapse into one canonical-home discipline in the P-073 gate; the drift principle now has one definition site instead of four, each home keeping only its own enforcement. The named next target remains this very record's pattern — the Patch Log's triple-entry restatement. +**Consolidation program landings (running record):** 2026-06-12 — the status spine landed (first program step under this gate): `Status_Model.md` deleted, its vocabulary and edge rules absorbed into the Claims and Evidence Register's Status methodology section (now the canonical status spine); the Hardening Queue stripped of duplicated status tracking (worklist only, references owners); Threat Register restated patch-statuses converted to pointers. Net ~−95 lines; vocabulary-definition sites reduced from five to one. Evidence Ladder deliberately retained standalone (it defines evidence *levels*, a different axis, and its level numbers are cited by app code and seven documents). Named follow-ups: Patch Log single-row mini-tables (same-file restatement, checker-covered) and a single convention for Threat Register per-entry Status lines. 2026-06-12 — the appeal spine landed (P-074, ANNEX_L §L7): seven appeal procedures → one spine + a domain intake table (the ANNEX_AW §AW3.3 orphan appeal window, RRE-011, is a named follow-up); FC-209's reserved appeal path closed by binding it to the spine. 2026-06-12 — the evidence framework and data stewardship standard landed (P-075): one test-package template in the Evidence Ladder (ten packages surveyed; four structural follow-ups named), one minimization doctrine + calibration table + linkage rule in the Monitoring Administrative Safety Packet; one restatement site deleted (the ETP baseline) and six domain clauses retained with pointers; the ANNEX_AJ P-004-protected clause recorded unmodified. 2026-06-12 — the institution merger audit landed (P-076): two phantom bodies resolved to existing ones, oracle council/cohort terminology unified; the two headline merger candidates were honestly rejected (different functions; nonexistent body) — a wrong merger is worse than none. 2026-06-13 — follow-up F-5 landed (P-077): the four drift rules the program itself created (status, appeal, evidence, data) collapse into one canonical-home discipline in the P-073 gate; the drift principle now has one definition site instead of four, each home keeping only its own enforcement. The named next target remains this very record's pattern — the Patch Log's triple-entry restatement. 2026-06-13 — the G-1..G-4 data-retention gaps closed (P-078): the four confessed "unspecified — gap" cells specified as FC-211..214 (owner-approved Balanced posture), retention tied to the appeal-spine window + the corpus day-grid with hard caps — the data doctrine's required deletion schedule supplied. --- @@ -1613,7 +1615,7 @@ The consolidation program's survey of the corpus's ten evidence test packages an - **Introduced design:** The Evidence Ladder gains the canonical Test Package Template (P-075): six required structural elements (claim under test, abuse model, required tests with pre-stated failure criteria, adverse-finding protocol, affected-documents update order, residual risk) plus a drift rule under which the template governs over any package restatement, a non-conforming package gates nothing, and new structural patterns require framework-first justification under the Acceptance Protocol's anti-accretion rule (P-073). The Monitoring Administrative Safety Packet gains the master Minimization and Purpose-Limitation Doctrine — carrying the six-condition baseline formerly stated in the Monitoring Repurposing Evidence Test Package (conditions verbatim, with two declared strengthenings: scope broadened from monitoring to any collection of data about persons, and conditions 5–6 bound to the appeal spine and the ANNEX_AM §AM7 stripping standard), which now tests the doctrine rather than restating it — plus a quote-sourced per-domain calibration table (seven domains; open gaps marked honestly as "unspecified — gap"), a cross-domain linkage rule generalizing the ANNEX_D §D6.5 independent-finding standard, and a drift rule under which stricter domain text always governs. One restatement site was deleted (the ETP baseline); the six domain clauses (ANNEX_AJ, ANNEX_AF §AF3, ANNEX_AK §AK8.1, ANNEX_D §D6.1, ANNEX_C, and the Capture Dashboard Specification) were retained as domain substance and gained pointers; ANNEX_K §K6 and ANNEX_I §I8's generic restatements now defer to the doctrine; the ANNEX_AJ P-004-protected purpose-limitation clause is recorded in the calibration table unmodified. - **Claim discipline:** This consolidates restatements; it proves nothing about practice — the doctrine's fruit is unproven until tested and the four named calibration gaps remain gaps. - **New risks introduced:** A single doctrine is a single drafting-error blast radius (bounded by the stricter-text-governs rule); the calibration table could be misread as licensing the gaps it names (bounded by "gap is not permission"). -- **Residual risk:** The unspecified stripping/retention rules in four domains are now visible but still unspecified. Named calibration gaps: G-1 ANNEX_AJ bypass-detection fixed retention period unspecified (owner: ANNEX_AJ); G-2 ANNEX_AF attestation-graph retention-schedule length and stripping point unspecified (owner: ANNEX_AF §AF3); G-3 ANNEX_D Commons Return stripping point and retention unspecified (owner: ANNEX_D §D6); G-4 flag-expiry period unspecified (owner: this packet's flag lifecycle + ANNEX_C). Named follow-ups F-1–F-7: prose status normalization in the Anti_Rent, Identity_Recovery, and Service_Record packages (F-1); an affected-documents section for the Capacity_Measurement package (F-2); an abuse model and affected-documents section for the Commons_Return package (F-3); a standalone residual-risk statement for the Cyber_Resilience package (F-4); unify the four drift rules into one doctrine in the P-073 gate — a constitution change, separate reviewed patch (F-5); checker coverage for the calibration table's quoted text (F-6); ANNEX_A §A20 cites the doctrine instead of restating it (F-7). +- **Residual risk:** The unspecified stripping/retention rules in four domains are now visible but still unspecified. Named calibration gaps [SPECIFIED by P-078 — values RESERVED, FC-211..214]: G-1 ANNEX_AJ bypass-detection fixed retention period specified as FC-211 by P-078 (owner: ANNEX_AJ); G-2 ANNEX_AF attestation-graph retention-schedule length and stripping point specified as FC-212 by P-078 (owner: ANNEX_AF §AF3); G-3 ANNEX_D Commons Return stripping point and retention specified as FC-213 by P-078 (owner: ANNEX_D §D6); G-4 flag-expiry period specified as FC-214 by P-078 (owner: this packet's flag lifecycle + ANNEX_C). Named follow-ups F-1–F-7: prose status normalization in the Anti_Rent, Identity_Recovery, and Service_Record packages (F-1); an affected-documents section for the Capacity_Measurement package (F-2); an abuse model and affected-documents section for the Commons_Return package (F-3); a standalone residual-risk statement for the Cyber_Resilience package (F-4); unify the four drift rules into one doctrine in the P-073 gate — a constitution change, separate reviewed patch (F-5); checker coverage for the calibration table's quoted text (F-6); ANNEX_A §A20 cites the doctrine instead of restating it (F-7). --- @@ -1629,7 +1631,7 @@ The consolidation program's 47-institution inventory proposed merger candidates; - **New risks introduced:** Binding Conservative Hold declaration to the RCS accreditation body concentrates one more declaratory act in an existing verifier-side body (accepted: it replaces a pointer to nowhere — zero effective checks — with one real, already-audited check; the body gains no allocative power). The same body also controls the quorum denominator through accreditation, so de-accreditation is a theoretical Conservative Hold trigger lever — bounded by the ANNEX_AM accreditation-count automatic review, the FC-100 14-day restoration ceiling, the operative-without-confirmation rule, and L7 appealability of both wrongful declaration and refusal to confirm. - **Residual risk:** The ANNEX_AB "capacity certifier shall be named" placeholder remains a named follow-up (substantive designation, not a rename); the institutional inventory itself is unverified beyond the candidates examined. Two proposed mergers were examined and REJECTED with reasons: the register-adjudicator and contribution-verification functions are different functions protecting different people (merging would weaken INV-006), and the "Temporal Continuity Review Panel" exists nowhere in the corpus. -**Numbering note:** the held Voice/Service-Record redline takes the next free patch number above P-077 at intake. +**Numbering note:** the held Voice/Service-Record redline takes the next free patch number above P-078 at intake. --- @@ -1646,3 +1648,17 @@ The status spine (P-074 era), the appeal spine (P-074), the evidence template, a - **Residual risk:** The discipline is enforced by review and by each home's named mechanism, not by a single script; a domain that restates a home's rule without diverging (harmless redundancy) is not build-caught, only review-caught. The minimalist's named next target — the Patch Log's own triple-entry pattern (inventory row, detail section, running record) — remains the largest same-file restatement mass and is not addressed here. **Panel process:** four independent single-role reviewers (adversarial systems designer, Christ-centered, corpus-fit, minimalist) reviewed the applied diff in parallel. Incorporated fixes: the adversarial burden-and-appealability clause on the stricter-text exception (closing self-certified "more protective" divergence); the minimalist reduction of the four leaves from principle-restatements to pure pointers (the first draft had grown them, making the honest count 5 definition sites, not 1) and the corrected claim line; the index marked non-constitutive per the adversarial staleness catch. Corpus-fit and Christ-centered approved without required fixes. Christ-centered review recorded as Session 27 in `Christ_Centered_Evaluation.md` (constitution change to `Acceptance_Protocol.md`). + +### P-078 — Data-Retention Gap Closure (G-1..G-4) + +**Threat addressed:** structural — no threat row (the P-075 consolidation's own confessed output: four "unspecified — gap" retention/stripping cells) +**Status:** ACTIVE | **Priority:** Medium + +The P-075 data-stewardship consolidation confessed four unspecified retention/stripping rules — bypass detection (G-1), the hardship attestation graph (G-2), Commons Return assessment (G-3), and monitored-person flag expiry (G-4) — and the Christ-centered reviewer called them "confession without repentance." This is the repentance: the four gap cells are specified, supplying the deletion schedule the data doctrine's "deletion-bound… published schedule" condition already required. + +- **Introduced design:** Four calibration parameters in the Parameter Calibration Register, owner-approved at the Balanced posture: FC-211 bypass-detection (enforcement-matter finality + 90d, 180d open-build ceiling, 365d cap); FC-212 attestation graph (appeal-close + 30d, 180d ceiling, case-pseudonym at intake); FC-213 Commons Return assessment (appeal-close + 30d strip, 18-month cap); FC-214 person-flags (resolution + 30d, 180d max age, irreversible unlink) — full rules in the Parameter Calibration Register and founding/commitments.md. Each gate is RESERVED — bound before the relevant infrastructure activates. +- **Claim discipline:** These specify the data doctrine's already-required deletion schedule — they do not bind final operational numbers (RESERVED, bound before activation) and create no new mechanism (P-073-conformant: calibrating the canonical home, not inventing one). +- **New risks introduced:** Concrete anchors could be mistaken for bound values — bounded by the explicit RESERVED / bind-before-activation gate on every parameter. The longer bands (G-1's 90d/180d) are a detection-vs-surveillance tradeoff, capped hard at 365d per AJ's own anti-Babel clause; the vulnerable-person datasets (G-2 hardship graph, G-3 household-linkable assessment) retain the least, tied to appeal-window close rather than a standing clock. +- **Residual risk:** Final values await founding binding by the named owners; the appeal-window-tie assumes the L7 spine's clocks hold. + +**Numbering note:** the held Voice/Service-Record redline takes the next free patch number above P-078 at intake. diff --git a/founding/commitments.md b/founding/commitments.md index 03cdd5f..dead884 100644 --- a/founding/commitments.md +++ b/founding/commitments.md @@ -114,6 +114,10 @@ | **FC-208** | `CRUS_PUBLIC_LOCKBOX_RESERVE_RULE` | 2 | RESERVED — bind before fund routing | reserve/draw rule | Defines reserve, draw, passive fund, and public-accounting rules for any lockbox or social wealth fund receiving Commons Return. Prevents fund managers from becoming patronage allocators or political investors | Annex D, Parameter Calibration Register | | **FC-209** | `CRUS_APPEAL_PATH` | 1 | RESERVED — bind before assessment or distribution | appeal path | Gives assessed source holders and excluded stake claimants a human appeal without allowing high-value actors to stall assessment through procedural delay | Annex D, Federated Ombuds, Claims and Evidence Register | | **FC-210** | `CRUS_REVIEW_CADENCE` | 2 | RESERVED — bind before CRUS activation | review cadence | Sets scheduled review of incidence, eligibility, valuation, source bases, distribution, reserves, and capture metrics. Missed cadence or missing data is itself a review failure | Annex D, Capture Dashboard Specification, Pilot Evidence Roadmap | +| **FC-211** | `AJ_BYPASS_DETECTION_RETENTION_CEILING` | 2 | RESERVED — bind before AJ detection infrastructure activates | retention schedule (days) | Bounds how long identifiable bypass-detection records may be held: draft anchor 90 days post enforcement-matter finality, 180-day ceiling on identifiable hold while no case has formed, 365-day absolute hard cap from collection (then aggregate or deleted); PII-strip point unchanged (earliest point consistent with detection, Annex AM §AM7). The 365-day "from collection" cap is anchored per underlying record at first ingestion of that person's data and is never reset by re-derivation, feature re-extraction, or opening a new pattern-build; a pattern-build that has run 180 days without a formed case strips to aggregate regardless of build status. Where enforcement-matter finality + 90 days would exceed 365 days from collection, the 365-day absolute cap governs: identifiable data strips to aggregate at 365 days regardless of whether finality has been reached, and a matter unresolved at 365 days continues on aggregate or case-pseudonym data only. Closes G-1; bound by the Enforcement Panel and Federated Ombuds; thresholds may be Restricted-Register (P-021) | Annex AJ, Monitoring Administrative Safety Packet, Parameter Calibration Register, Annex L §L7 | +| **FC-212** | `AF_ATTESTATION_GRAPH_RETENTION_RULE` | 2 | RESERVED — bind before AF3 collusion-detection activates | retention/stripping schedule (days) | Bounds the hardship attestation graph: stripped to a case-pseudonym at intake, fully purged once the review and its appeal-spine (Annex L §L7) window close + 30 days, 180-day ceiling past appeal-window close; safe-harbor/innocent-explanation cases purged at closure. Closes G-2; bound by the Annex AF reviewing body and Federated Ombuds | Annex AF §AF3, Monitoring Administrative Safety Packet, Parameter Calibration Register, Annex L §L7 | +| **FC-213** | `CRUS_ASSESSMENT_RETENTION_RULE` | 2 | RESERVED — bind before CRUS assessment streams operate | retention/stripping schedule (days/months) | Bounds Commons Return assessment data: PII-stripped to aggregate at assessment finality (D6.5 household-linkable records stripped first), retained no later than the Annex L §L7 appeal window close + 30 days, 18-month total identifiable hard cap; ties to the §D6.1 Monitoring Purpose Register retention-clock gate (FC-207 anti-capture family). Closes G-3 | Annex D §D6, Monitoring Administrative Safety Packet, Parameter Calibration Register, Annex L §L7 | +| **FC-214** | `MONITORED_PERSON_FLAG_EXPIRY` | 2 | RESERVED — bind before any individual-flag stream operates | flag expiry (days) | A flag expires (cannot trigger action, cannot be reused) at the earlier of resolution + 30 days or 180-day max age if never resolved; expiry is an irreversible unlink, not a soft-delete, and is non-extendable; 365-day absolute cap on flag age; one rule governs all flag streams. Closes G-4; bound by this packet's owner and the Annex C reviewer | Monitoring Administrative Safety Packet, Annex C, Parameter Calibration Register, Annex L §L7 | | **FC-YT1** | `CSM_FAILURE_COUNT_THRESHOLD` | 2 | 3 | verified delivery failures per jurisdictional cluster per 30-day window | Pattern-detection trigger for H-3 refounding review initiation. Applies as a raw cluster count independently of FC-071's per-population rate (3 per 10,000 residents per 30 days); both thresholds apply concurrently. "Verified delivery failure" requires confirmation by at least one Tier-3 physical-sampling oracle node per ANNEX_Y §Y1. Federated Ombuds verification of this value required before INV-LAUNCH-1 clears. Pre-launch blocking gate. | ANNEX_Y §Y4 | | **FC-YT2** | `CSM_SURVIVAL_RESERVE_DAYS` | 2 | 90 | days of CSM coverage per enrolled population, by jurisdiction and essential category | CSM-specific reserve gate. Complements the general resilience reserve FC-070 (45 days); both must be independently satisfied. This value is the binding survival-floor-specific pre-launch gate. Federated Ombuds verification of this value required before INV-LAUNCH-1 clears. Pre-launch blocking gate. | ANNEX_Y §Y7 |