DOI: https://doi.org/10.5281/zenodo.21947263
Canonical: https://thonly.org/research/appreciation-as-world-building · Licence: CC0 1.0
v2 note (2026-08-15). This revision adds the read side, which v1 omitted entirely. v1 inverted the journal's writing and never asked what happens to its reading — so §1.2 now states the second inversion; §7.2 makes the presence requirement recursive (a remote visitor reads; only a visitor who is physically present writes); §7.3 specifies what a visitor may leave and the form it must take; and §4.1's hinge, which v1 recorded as unsolved, now has a candidate mechanism that arrived from the visiting side the paper had not thought to look at. The revision also adds tending as the second act on the non-human ledger (§4.3) with its routing (§4.4), the worn light as the render's fourth surface (§8.3), a fourth safety requirement (§10), an honest limit v1 lacked (§5.4), the general form and prior art of the method the paper has been using throughout (§8.2), and an amendment to the P-W1 registration (§11) that the new mechanism made necessary. Everything in v1 stands. Nothing is retracted. The date above is v1's and is left unchanged, because it is the date the v1 claims were published.
Draft notes for the editor: this paper describes a product that does not exist. No code has been written, no schedule has been set, and the sample size for every behavioural claim in it is zero. It is published now for one reason, stated plainly because it governs what the paper does and does not contain: publication protects against being blocked, not against being beaten. For an unbuilt and unscheduled artifact, the defensible move is to publish the claim and withhold the specification — so this paper is deliberately deep on argument and thin on implementation. Where a section would ordinarily give a rendering function, an asset pipeline, a threshold table, or a price, it gives the property the mechanism must satisfy and stops. That is a departure from this corpus's usual practice and it is intentional. Readers looking for something to build from will find the constraints; readers looking for something to copy will find that the interesting part was never the pipeline.
A gratitude journal asks a person to write. That is the highest-friction step in the practice and the one most people abandon, which is why gratitude journaling has a large product category and a small population of sustained practitioners. This paper specifies a different container for the same practice: a walkable map of the things a person appreciates, captured by photograph with a coordinate and an optional note, rendered as placed artifacts in that person's own world.
The move is not cosmetic. It is a host-ritual swap, and it runs on two axes rather than one. Photographing a thing you appreciate and posting it with a location is a behaviour hundreds of millions of adults already perform unprompted; writing three sentences of gratitude before bed is a behaviour that must be installed. But a journal fails twice, and the second failure is less examined than the first: a journal is not only expensive to write, it is impossible to read. Nobody reads another person's gratitude journal, and the reason is structural rather than a matter of taste — the container admits no visitors. A walkable world is readable, and the reading is a visit rather than an intrusion. Swapping the container therefore replaces the practice's most expensive step with its cheapest and converts a practice nobody can witness into one that can be witnessed without being broadcast. The paper's central thesis is that this changes the population that can hold the practice rather than merely the interface through which they hold it.
Six mechanisms carry the design, and they are the paper's contribution. First, appearance is a ledger readout, not a purchase: a participant's avatar and terrain are their signed gratitude balance rendered as light, never goods bought with it — which is what allows an annual balance-forgiveness to remain forgiveness rather than becoming confiscation. Second, availability reveals and never locks: a form becomes available the first time a participant's oscillation has ever had that quality and remains available permanently, so the system has no wall of locked content and no mechanism by which a quiet season can take something back. Third, placement requires presence and visiting does not: a participant can only write to the map by standing at the coordinate, which is the property that separates a presence-deepening world layer from a presence-replacing one. Fourth, the render is three-layered — the sky carries the coordinator's aggregate ledger, the land and ocean carry the participant's non-human ledger, the avatar carries the participant's human-to-human ledger — and the structural consequence is that the only shared surface in the system belongs to the one party structurally incapable of accumulating anything. Fifth, presence is recursive: the write/read asymmetry applies to visitors as well as to participants, so a remote visitor may read a world and only a visitor who is physically present may write in one — which makes in-person visiting the design's primary reading mode without a rule imposing it, and closes unsolicited remote annotation by geometry rather than by moderation. Sixth, the non-human ledger carries two acts and not one: appreciating a thing and tending it, where tending is captured as a dated series at one coordinate, so that a single capture requires presence once and a series requires returning — and any gift a visitor makes to a tender goes to the person and never to the deed, split between a withdrawable half and a forward-spendable half, with the coordinator taking nothing.
The paper further specifies a two-speed practice, in which gratitude toward things is frictionless and frequent and gratitude toward people spends attention and is occasional. v1 recorded the transition between them as unsolved; v2 offers a candidate that arrives from the read side — a visitor moved, by a world made of things, to thank the person who made it — which satisfies the full constraint set and, unlike the alternative, is debuggable. It is offered with three limits stated, one of which required amending this paper's own pre-registration before any instrument is built. It states a permanence hazard that follows from the design's archival terminus — that a deep-time substrate converts every present-tense privacy defect into a permanent one, so guards must be built at capture rather than at commit. And it pre-registers two opposed predictions, before any code exists, one of which would invalidate the thesis rather than trim it.
Almost nothing in the paper's technology is novel and the paper says so at length. Geotagged user content, photogrammetric and generative photo-to-3D, avatar worlds, and world-scale augmented reality are dense, well-funded prior art. What is offered is the conjunction: an appreciation practice whose world is a non-purchasable, annually-forgiven, reveal-only rendering of a signed ledger. Offered under CC0 1.0 Universal as defensive prior art.
Keywords: gratitude practice, world-building, geotagged user content, host-ritual substitution, ledger readout, anti-credit-score, reveal-not-unlock, presence-deepening augmented reality, deep-time archival privacy, moral self-licensing, pre-registration, defensive publication.
This document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent or any other exclusive right on the mechanisms described herein, in any jurisdiction, at any time. The publication exists so that the mechanisms cannot be enclosed by anyone — including by us.
Terms coined and freed with this paper: appearance-as-readout, reveal-never-lock, the equally-alive diagnostic, placement-requires-presence, the two-speed practice, and the permanence asymmetry as stated in §9 — and, added in v2: the read-side inversion, presence-is-recursive, notes-placed-never-listed, tending as a ledger act distinct from appreciating, and give-to-the-person-never-to-the-deed.
Terms inherited from this corpus's earlier publications and cited rather than re-claimed: the B-Aura and the signed Kiitos/Kiitti ledger (The Zero-Point Game), Proof of Humanity℠ and Proof of Coordinate℠, the give-forward atom, the play/currency wall, and the annual jubilee.
Most of this paper's technical subject matter is not ours and is not claimed. Location-anchored user-generated content is a mature field with at least two decades of practice behind it: Geocaching (2000), Foursquare and its check-in grammar (2009), Google Local Guides, Niantic's Ingress (2013) and Pokémon GO (2016) and the Lightship visual-positioning work that followed, Google's Live View and ARCore Geospatial API, Snap's landmarker and Spectacles programmes, and the broader "mirrorworld" or AR-cloud programme articulated publicly by Kevin Kelly and pursued by several of the above. Photogrammetric reconstruction from photographs is decades old and is shipped as a first-party consumer capability, notably Apple's Object Capture and PhotogrammetrySession. Single-image generative 3D reconstruction is an active and rapidly moving research and product area with many independent groups. Femtosecond-laser 5D optical storage in silica is the work of the University of Southampton's optoelectronics group and of Microsoft's Project Silica. The tension between immutable storage and erasure rights is a large existing literature developed largely in the blockchain-and-GDPR context. The gratitude-intervention literature begins for most practical purposes with Emmons and McCullough (2003). The counter-hypothesis this paper pre-registers against itself is drawn from the moral self-licensing literature (Monin and Miller, 2001; Merritt, Effron and Monin, 2010).
We claim none of that. What we claim is the conjunction described in §13 and nothing beyond it. Where this paper's design coincides with an existing product's design, the existing product has priority and we say so.
The gratitude-practice literature is unusually clean for a wellbeing intervention. Structured gratitude exercises produce measurable effects on affect and, in several designs, on prosocial behaviour. The finding has survived enough replication that the practical question stopped being does it work and became why does almost nobody keep doing it.
The answer is not mysterious. The canonical form of the practice — write down three things you are grateful for — requires a person to sit down, compose sentences, and do so repeatedly with no external occasion prompting them. That is a new habit, and new habits are the most expensive product category there is. Every gratitude-journaling product in the market is fighting the same fight: not to convince anyone that gratitude is good, which nobody disputes, but to get a person to perform an unprompted act of writing on a Tuesday.
This paper's premise is that the writing is not the practice. The writing is the container the practice was historically shipped in, chosen because paper was the available medium, and it has been carried forward unexamined into software that has other options.
Consider what a person actually does when they notice something they appreciate. They stop. They look. Frequently — and this is the empirical fact the whole design turns on — they take a photograph. They do this constantly, unprompted, without being told it is a practice, and they do it hundreds of millions of times a day. Nobody had to install that habit; the phone installed it.
So the question this paper asks is: what happens if the practice is given the container the behaviour already has?
This corpus's standing account of the problem is a dignity deficit — that most kindness is never witnessed, and that being unwitnessed is a substantial part of what makes ordinary life feel thankless. The gratitude practice is one half of the response: it trains the noticing. The other half, which this corpus has addressed elsewhere, is the delivery of the notice to the person it concerns.
The design specified here is deliberately positioned at the first half and deliberately does not pretend to be the second. It builds a place where a person's noticing accumulates in a form they can walk through. §4 addresses what has to be true for the noticing to lead anywhere, and states honestly that the mechanism connecting the two halves is the design's weakest point.
A gratitude journal fails twice, and both the literature and the first version of this paper examined only the first failure.
The first is the one above: the journal is expensive to write. The second is that a journal is nearly impossible to read — not difficult, but closed by construction. It is private, it is textual, it is tedious to anyone who did not write it, and the act of reading someone else's is an intrusion rather than a visit. Almost nobody has ever asked to read another person's gratitude journal, and the reason is not that the contents would be uninteresting. It is that the container admits no visitors.
So the host-ritual swap runs on two axes:
JOURNAL WORLD
WRITE compose sentences point a camera
the practice's most the practice's least
expensive step expensive step
READ an intrusion, and in a visit —
practice nobody does it a thing people already doThe read-side inversion may be the more consequential of the two, because it changes what the practice is rather than who can sustain it. A gratitude practice that no one can witness reproduces, inside the practice itself, the deficit §1.1 describes: something real and unwitnessed. A container that admits visitors makes the noticing witnessable without making it a broadcast — the visitor comes to the world; the world never arrives at the visitor — and §7 specifies the asymmetry that keeps that distinction structural rather than rhetorical.
It would be possible to write this paper as though a walkable map of geotagged personal artifacts were an invention. It is not, and a reader who has used a phone in the last decade knows it is not. The honest position is to state the prior art first and at length, so that the small thing being claimed is visible against it rather than hidden by it.
| Prior art | What it established | What this design does not claim |
|---|---|---|
| Geocaching (2000) | Coordinate-anchored discovery as a durable amateur practice | Place-anchored discovery |
| Foursquare / Swarm (2009) | The check-in as a social grammar; place as a post | Check-in mechanics; place-as-social-object |
| Google Local Guides | Mass user contribution of place photographs at global scale | Crowd-sourced place imagery |
| Ingress (2013), Pokémon GO (2016) | Walking as the primary input to a persistent world; portals and gyms as coordinate-bound objects | Walk-driven play; coordinate-bound persistent objects |
| Niantic Lightship VPS; Google ARCore Geospatial; Snap landmarkers | Centimetre-scale world-anchored AR at metropolitan scale | World-anchored placement or its positioning stack |
| "Mirrorworld" / AR cloud (Kelly, 2019 and after) | The concept of a persistent digital layer registered to the physical world | The concept of a persistent world layer |
Apple Object Capture / PhotogrammetrySession | Consumer photo-to-3D reconstruction on device | Photogrammetry |
| Single-image generative 3D (multiple groups, active) | One photo to a usable mesh | Generative reconstruction |
| iNaturalist | Species-level UGC with geoprivacy obscuring for threatened taxa | Obscuring; we adopt their norm and credit it |
| Visitor books; temple and memorial guest books | Signing a place one has travelled to, as a durable social form | The visitor book; §7.3 adopts an old practice and credits it |
| Stolpersteine (1992– ); memorial benches and trees | Place-anchored memorials that must be walked to in order to be read | Place-anchored memorial |
| Repeat photography / rephotography (fixed-station series) | A century-old scientific method: the same view, across time, as evidence of change | The method; §4.3 uses it and claims none of it |
| Litterati; Adopt-a-Highway; community-science cleanup logging | Geotagged records of stewardship acts, at scale | Stewardship logging |
| Gratitude journaling apps | The practice as a software category | The practice |
| Emmons & McCullough (2003) and successors | That the intervention has measurable effects | Any effect claim of our own |
Read that table honestly and the position is this: every component is available, most are commodity, and several are better implemented by companies with more resources than this institution will ever have. If the contribution were the map, there would be no contribution.
The contribution is what the world is made of. In every prior system in that table, the persistent world is furnished with content: things placed by an operator, or bought, or earned by play. This paper specifies a world furnished by a ledger — where the terrain is not an inventory a participant assembles but a rendering of a signed balance they cannot purchase, cannot trade, and do not own. That is a different object, and §5 through §8 specify it.
A reader who accepts §2's table may reasonably ask why, if every component is commodity, nobody has assembled them this way. The answer is not that it was overlooked. It is that the assembly is locally worse.
Purchasable appearance is not a lazy default. It is a strong local optimum arrived at independently by many well-resourced teams: it converts engagement into revenue without touching the core loop, it gives designers a continuous supply of new content at near-zero marginal cost, it self-segments willingness to pay, and its retention effects are among the most reliably measured in the industry. A team that removes it gives up all of that and receives, in exchange, a doctrinal property invisible to most participants.
So the conjunction in this paper is not a discovery of an unexplored region. It is a deliberate move into a known-worse region, made because the institution behind it has a constraint the industry does not: it operates a signed gratitude ledger that is forgiven annually, and a purchasable-appearance economy is not merely off-brand against that ledger but arithmetically incompatible with it (§5). The design is downstream of a ledger commitment, not upstream of a market insight.
That framing matters for how the paper should be read and for how it could be wrong. If the ledger commitment is mistaken, the design inherits the mistake wholesale. If the ledger commitment is right, the design is what follows from taking it seriously — and its commercial disadvantages are the price of the commitment rather than errors in the design.
This corpus applies a standing test to any claim that a product "rides an existing ritual." The test has three legs: is the host ritual live — performed unprompted by the target adult within the last twelve months; does the ask have the same shape as the host — comparable commitment, cost and duration; and is the host in good standing with whoever must permit the product.
Run against this design, the test returns a mixed and useful result.
Leg one passes, strongly. Photographing a thing one appreciates, with a location attached, is among the most-performed unprompted behaviours in the world. There is no habit to install.
Leg two partially fails, and the failure is instructive. The design as originally conceived fused two host rituals with incompatible commitment shapes: snap-and-post, which takes seconds and is ephemeral, and world-building, which takes hours, persists, and appeals to a different and smaller population. These are not the same ask wearing different clothes. The prescription that follows is stated here because it is load-bearing: lead with capture; let world-building be emergent and optional, never the ask. A participant who never once thinks of themselves as building a world should still find the product complete.
A corollary follows from leg two and is easy to lose, so it is stated rather than assumed. The world is what everything in this design culminates in. It is never what anything is for. That is the same distinction §5 draws about appearance — a readout rather than a purchase — applied one level up, and it fails the same way if collapsed: a number that buys things is a number people optimise, and a world that is the point is a world people furnish for effect rather than from noticing. §5.4 shows that this failure mode is not hypothetical and that the design does not fully close it.
Leg three partially fails on two specific paths, both addressed in §10: geotagged imagery of living things is not in good standing with conservation practice, and geotagged imagery generally is not in good standing with schools and parents where minors are involved.
It is tempting to state the thesis as "a gratitude world makes gratitude mainstream." That is a hope and this paper does not make it. The defensible mechanical claim is narrower and testable:
The world container replaces the practice's highest-friction step — composing written sentences — with its lowest — pointing a camera — without removing the practice's object.
Gratitude journaling is already a large category. What is not mainstream is sustained practice. The claim is about the sustaining, and §11 pre-registers how it could be wrong.
The obvious objection to the friction inversion is that it may buy adoption by destroying the thing being adopted. A journal makes a person articulate; a photograph lets them skip articulation. If this corpus's own account of gratitude is that it is attention spent, then a snapshot may spend less attention than a sentence, and a frictionless practice may be a shallower one.
The design's answer is not to add friction back. It is to split the practice by its object.
| Things | People | |
|---|---|---|
| Friction | frictionless | spends attention |
| Frequency | often | occasional |
| Function | sets the mood | acts on the mood |
| Ledger | Kiitti — the non-human ledger | Kiitos — the human-to-human ledger |
| Rendered in | land and ocean | the avatar |
| Tempo of change | frequent, gradual | rare, marked |
This is not two features. It is a two-stage mechanism with a causal arrow: the frictionless layer is not a diluted practice but the priming stage for the practice. Under that reading the objection dissolves into a prediction, which §11 registers.
Note that the split is not an invention of this paper. It is the corpus's existing two-ledger architecture — a horizontal human-to-human balance and a vertical balance held on behalf of all non-human life — arriving at a design consequence. The visual tempo of each layer in §8 falls out of the doctrine rather than being art-directed: the land changes often and gradually because many small things are noticed; the avatar changes rarely and markedly because few deep acts are performed.
The frictionless half will dominate usage by orders of magnitude. That is what frictionless means. The consequence is a real and unresolved risk: the people-layer becomes vestigial — a capability that exists and is never found.
Something must convert the mood into the act. This paper does not specify what, and says so rather than papering over it. What it can specify is the constraint any acceptable hinge must satisfy, which is more restrictive than it first appears:
Those constraints rule out essentially every mechanism the engagement-optimisation literature would supply, which is the point. What is left is ambient signalling: something that is present in the world and legible on inspection.
What the design does have is a signal that satisfies the constraint set, and it is not an invention of this section — it is §4.2's identity distinction doing double duty. In a world furnished overwhelmingly with things, a person is a rare and visually distinct kind of object:
A beating heart in a world of still ones is an invitation you can see.
Nothing arrives. Nothing is counted. Nothing reports what was not done. The signal is a property of the world's contents rather than a message about the participant's conduct, which is precisely the distinction the constraint set requires.
What remains open in that signal is efficacy, not architecture. That a person renders differently from a thing is settled and follows from the identity layer. That this difference is sufficient to move a participant from noticing to addressing is unknown and unmeasured. A hinge that cannot be debugged is not an engineering answer, and the ambient signal cannot be debugged.
v1 of this paper searched for the hinge inside one participant — some in-world event that would carry a person from their own noticing to their own addressing — and ruled out, correctly, nearly every technique the engagement literature supplies. The search failed for a structural reason worth naming, because it generalises beyond this design: it was looking for an intra-personal mechanism for a transition that is most naturally inter-personal.
A visitor walks a world furnished entirely with things and, occasioned by it, leaves a note for the person whose world it is. That is a movement from the non-human ledger to the human one, occurring inside one participant — the visitor — and produced by an occasion rather than by a prompt.
Run it against the constraint set above:
| constraint | a visited world |
|---|---|
| may not notify | nothing arrives; a note is found on inspection |
| may not report omission | nothing is said about what was not done |
| may not meter, count down, badge, or queue | satisfied by the form specified in §7.3 |
| must be an invitation available when the participant looks | a place someone made, standing open, is that object |
And unlike the ambient signal, it is debuggable: the rate at which visits produce notes is a measurable quantity, so a hinge that is not working can be observed not to work, and changed. v1's objection to its own answer is met.
Three limits, none of them small. The third is a live threat to this paper's own instrument.
It is network-density-dependent. No visitors, no hinge. It is therefore weakest exactly at the beginning, when it is needed most, and it does nothing for a participant nobody has yet visited. It is a second pathway that switches on later, not a replacement for the first.
It moves the visitor, not the host. The arrow is real but it is not the arrow §11 registers. A participant's own capture frequency does not, through this mechanism, produce their own people-directed gratitude — it produces someone else's.
It can manufacture the correlation §11 exists to test, and §11 has been amended accordingly. A participant who captures heavily has a richer world, which attracts more visitors, which produces more notes received. An instrument counting people-directed gratitude as received would therefore show the priming effect whether or not priming occurs. §11 now specifies given, never received. This is recorded here, in the section that introduced the confound, because the instrument does not yet exist and this is the last moment at which specifying it costs nothing.
The signal above rests on a distinction that runs deeper than rendering, and it is worth stating separately because it governs more than the hinge.
The identity layer admits two classes of participant. A human holds an address, a proof of personhood, and a proof of coordinate. A non-human — an object, a plant, an animal, a machine, a place — holds an address and a proof of coordinate, and no proof of personhood, because there is none to hold. Since a heartbeat is this corpus's signal for verified personhood, the classes render as they are:
| non-human | human | |
|---|---|---|
| heart | still | beating |
| proof | coordinate only | coordinate and personhood |
| ledger rings | one (non-human) | two (human-to-human, non-human) |
Four independently-derived expressions of a single distinction, none of them added for this design — and §8.3 adds a fifth when the distinction reaches the worn device. It also explains a naming choice made years earlier: the corpus's artifact for admitting non-human entities into the ledger is called a heart, and it is precisely a heart that does not beat — a prosthetic ledger-participant that holds the place of one without claiming to be one. The construction does not smuggle personhood into objects.
One guard, and it is not optional. Still must never read as dead or lesser. Stillness is proper to a thing and wrong for a person: a mountain's heart is still by nature, whereas a human waveform going flat is the withdrawal pathology the ledger exists to detect. Still is not flattened, and the asymmetry is the meaning rather than a defect.
The guard binds hardest where the language is most likely to travel. The pair tracks whether a party can hold its own ledger and speak for itself — not whether it is alive. A forest is alive and voiceless, which is exactly why the coordinator stands for it. So still heart is sound as a class term inside the ledger and poor as a description of a being, and it must not become the public phrase for the non-human world. What is being named is a property of the record, not of the creature.
§4 splits the practice by the object of gratitude. There is a second split, by the act, and v1 implemented only half of it.
Appreciating a thing is noticing it. Tending a thing is giving to it — watering a plant across a season, clearing a beach, maintaining a path, feeding animals that live somewhere. This corpus's atom is give-as-gift, so a design that captures only the noticing has implemented the receiving half of its own atom and not the giving half. The non-human ledger exists precisely to stand for parties that cannot speak for themselves, and it had no mechanism by which anyone could give to them.
The capture is the same primitive with one field doing more work: a photograph, a coordinate, and a date. Repeated captures at one coordinate across time produce a series — the fixed-station method landscape science has used for a century (§2) — and the series, not any frame in it, is the artifact.
A single capture requires presence once. A series requires returning.
That is the strongest form of §7's presence requirement anywhere in this design, and it is the property that makes tending expensive to fake: a photograph can be staged; a habit of return across a season is a different order of effort. Stewardship is a pattern rather than an image, and the pattern is what is read.
Three properties govern it, and all three are inherited rather than invented.
Attestation belongs to the coordinator, not to the participant. A beach cannot witness. §5's third failure already establishes that the non-human ledger is set by a coordinator acting for parties that cannot speak; tending is a new act type on that ledger, not a new authority. What changes is that the participant now holds an interest in the entry, which appreciation-only capture never created — so the bound that she grants recognition and never directs value has to be restated here rather than assumed, and she reads the pattern of return rather than grading the deed.
The series renders the becoming, never the pair. A cleanup capture is structurally a before and an after, and before/after is the indictment format: a first frame of a fouled place is an accusation image. That is the exact voice failure §8.1 governs, arriving in the part of the design most likely to produce it. The requirement is that the sequence is the artifact and the reading is this is what it is now, and here is how it came to be — never look what it was. A two-image before/after is the failure case and is not a supported shape.
Nothing about tending is graded. No score for the size of an act, no comparison between tenders, no leaderboard of places restored. §6.1's diagnostic applies unchanged: two participants who tend differently should have different records, never better and worse ones.
A visitor who walks a tended place and sees a season of returning will sometimes want to give. The design permits it. The routing is where this could go quietly wrong, so it is specified rather than left to product judgement.
First, the object of the gift.
Give to the person. Never to the deed.
There is no per-capture giving control, in any tier, ever. Patronage attaches to a participant; piecework attaches to an act, and the difference is not one of degree. A surface that pays per visible good deed produces staged deeds — §5 removed the motive to farm the ledger and did nothing whatever about the motive to farm the act — and it does something worse than that, which is the second rule's subject.
Second, the institution's own instrument.
This institution's stated alignment proxy is the inelasticity of kindness to money: the measure of success is that people keep giving as the artificial subsidy for giving falls toward zero. A mechanism that pays per visible good deed makes that proxy read high by construction. One can no longer distinguish kindness that is inelastic to money from kindness that is being paid for, because the payment was built by the party doing the measuring. This is not a positioning concern. It is a measurement failure, and it lands on the one quantity the institution's larger thesis is steered by — which is a specific, checkable reason to reject a mechanism that would otherwise look generous.
Third, where the value lands.
a gift to a tender
│
├── half → a withdrawable account
│ it may fund a livelihood
│
├── half → a forward-spendable fund
│ it may only be given onward
│
└── none → the coordinator, the operator, or any pool
nothing is takenEach half is load-bearing, for different reasons. The withdrawable half is the dignity floor. A design in which every gift to a person routes away from that person's ability to eat has answered a material need with a token, and it would contradict this corpus's own position that the artificial subsidy for kindness goes to zero while income from kindness need not. The forward-spendable half is the give-forward atom made structural rather than voluntary, and it carries a property established elsewhere in this corpus: non-withdrawable value collapses the economic motive for gratitude-farming, because a farmer may harvest indefinitely and extract nothing.
And nothing is taken, which this paper states in its strongest form because it is the easiest commitment to erode. Charging for a rivalrous cost — compute actually performed, storage actually held, an address exactly one party can hold — is exchange doing its proper work. Taking a share of a gift is not. A per-transaction fee sized to infrastructure is a fee; a fraction of an addressed gift is a tax on the gift, and it remains one however virtuous the destination. The destination is not what makes it a tax. An institution that shares in gifts thereby acquires an interest in gifts, and it acquires that interest at precisely the layer where it must have none.
⚠️ The split above is specified as a property — a withdrawable half and a forward-spendable half, with nothing taken — and not as a ratio to be tuned. The paper withholds the ratio for the same reason it withholds prices elsewhere (§12), and notes that any ratio which drives the withdrawable share to zero re-creates the dignity failure the split exists to prevent.
The first of the four mechanisms is the one everything else depends on.
In the ordinary construction of a persistent world, appearance is purchased. A participant accrues a currency and spends it on how they and their surroundings look. This is a well-understood, highly effective retention design, and this paper's rejection of it should not be mistaken for a claim that it does not work. It works. It is rejected for structural reasons that are specific and checkable.
The corpus's ledger has properties that a purchasable-appearance design destroys:
The balance is signed and oscillates. A kindness creates a positive pole and a negative one; both discharge toward zero by passing the imbalance onward. The load-bearing observable is not the scalar but the waveform — the frequency and amplitude of a participant's passage through zero. Two participants at identical balances can be entirely different: one flat and dim, one vivid and high-frequency.
The scalar is forgiven annually; the waveform persists. This asymmetry is what makes the ledger the structural inverse of a credit score, whose entire power is that it persists and compounds.
Now attach a store.
A participant's avatar and terrain are their aura rendered. They are not goods bought with it.
There is no store, no minted stock of appearance-currency, and no path by which currency of any kind — including money — converts into how a participant or their world looks. The rendering is continuous: as the waveform changes, the world changes, because the world is the waveform displayed.
Every one of the four failures above closes, and closes without new machinery:
One asymmetry should be stated plainly, because it is the first thing a careful reader will raise and they will raise it with this institution's own wordmark, which reads circulation, not accumulation. The map accumulates. The light does not. A thing photographed in one year remains placed in every year after it, so a world's contents only ever grow, while the balance they render is forgiven annually. This is not an inconsistency, and the resolution is not a concession: the placed objects are a record of noticing, not a balance. Nothing about them is spendable, tradeable, comparable, or counted — §9.1 forbids counting them even on the permanent form. What accumulates is a record. What oscillates, and is forgiven, is the reading.
This mechanism is an extension of an argument this corpus already published, not a new one. The keystone paper already renders the aura around a participant's public avatar and already argues the anti-credit-score property. What is added here is what that aura becomes when it is given a world to render into — and the cross-reference is deliberate rather than a duplication.
A store is a proven retention engine and appearance-as-readout is not. This is a real cost paid for a doctrinal property, with no evidence that the property is worth the cost. §12 keeps it on the honest-limits ledger where it belongs.
It is worth being precise about the size of what §5 gives up, because a vague acknowledgement is a way of not paying attention to it.
A cosmetic economy supplies four things simultaneously. It supplies a revenue line that does not tax the core activity, which is exactly the property this corpus wants in a monetisation mechanism and which appearance-as-readout removes. It supplies an inexhaustible content pipeline, since new appearances can be produced indefinitely without new systems. It supplies a self-reinforcing social loop, because visible acquisition is legible to other participants and legibility drives further acquisition. And it supplies a re-engagement hook that requires no notification, since a participant who wants something has a standing reason to return.
Appearance-as-readout keeps the fourth in weakened form — a participant whose world visibly changes has a reason to look — and loses the first three outright. The design must therefore find revenue elsewhere, and the elsewhere is constrained: any mechanism that charges for access to a non-rivalrous good is barred on the same grounds that bar the store, since gating a feature that costs nothing per use is renting something that is not scarce. What remains chargeable is what is genuinely rivalrous — the marginal cost of work actually performed on a participant's behalf, and the uniqueness of an address that exactly one party can hold.
That constraint is severe and it is stated here so that the design cannot later be accused of hiding it. A world design that cannot sell appearance has one fewer revenue instrument than every comparable product, and it must be viable without it or it is not viable.
§5 establishes that a participant who harvests gratitude relentlessly does not thereby obtain a better-looking world, because the waveform records that the balance was driven in one direction. That property covers the ledger. It does not cover the map.
What a participant captures is chosen by the participant. Once a world can be visited (§7), there is an incentive to capture what will look well to a visitor rather than what was actually noticed — and the design has no defence against it. This paper does not claim one. A curated life is not detectable from outside, and the difference between a photograph taken because something was noticed and one taken because it would be admired is not present in the photograph.
Two guards reduce the return on curation, and both are offered as partial:
The visit is not host-authored. A guided visit proceeds by coordinate or by chronology and never as a selection; there is no mechanism by which a participant assembles a route through their own world. What cannot be arranged cannot be arranged for effect.
Nothing in a world is graded, featured, or ranked — not by the software and not by the coordinator — so the return on a curated capture is whatever a visitor happens to feel, and no system amplifies it.
Neither eliminates the incentive. §12 records this where it belongs, and it is a cost the read side of §1.2 buys with its benefit: a practice that can be witnessed can also be performed, and this design has not escaped that trade — only declined to reward it.
If appearance is not purchased, something must still determine what a participant's world can look like, or the design collapses into a single undifferentiated rendering. The design's answer introduces the second mechanism, and it is where a subtle failure would otherwise re-enter.
The natural phrasing — the aura determines what forms are available — smuggles in an unavailable set. An unavailable set is a wall of locks, and a wall of locks is the thing that was just removed from the front door being carried in through the back.
Two readings are possible and only one survives:
Threshold gating — reach this level to unlock that form — is a score with locks. It re-imports everything §5 removed.
Reveal-never-lock is the mechanism specified here:
A form becomes available the first time a participant's oscillation has ever had that quality, and it remains available permanently — including after the participant goes quiet. A participant is never shown what they do not have.
There is no catalogue of the unrevealed, no progress indicator toward a next form, and no preview of what is coming. A participant discovers they have something. They are never told what they lack.
Permanence is not a softening of the mechanism; it is required by it. Without permanence, a quiet season takes a form back — which is an animated loss and a punishment, and this corpus's voice discipline forbids both. Permanence is also the canonical treatment already: at the jubilee, the balance is forgiven and the aura persists. Revealed forms persisting is that rule, unchanged.
The mechanism needs a test that a designer can run at design time, before any of this becomes a hierarchy by accident:
Can two participants with equally alive auras have different available sets?
If yes, the mapping is correct. If the sets form a strictly ordered ladder, it is a score, and the design has failed.
Forms should vary by the character of a waveform — the shape of the passage through zero, the relation of frequency to amplitude — and never by a magnitude. A participant whose gratitude is frequent and small and one whose gratitude is rare and large should have different worlds, not better and worse ones.
Reveal-and-keep is still a progression system, and progression systems are engagement engines. The guard is that it must never be legible as a target: if a participant can enumerate what they have not yet revealed, the mechanism has failed regardless of how it is implemented. That is a strong constraint and it is not obviously achievable, since participants compare notes with each other whether or not the software helps them. This is an unsolved sub-problem, not a solved one.
The two mechanisms above have an economic corollary that is worth stating as a mechanism in its own right, because the obvious way to fund the design would break it.
Reconstruction of a captured object costs real marginal resources; the cost is genuinely rivalrous and is therefore legitimately chargeable. The obvious implementation is a count: so many reconstructions per month, more available for payment. That implementation is barred here, and not for softness. A count is a meter, a meter is a countdown, and a countdown is a rendered absence — the same object §6 removed from the appearance layer, reintroduced at the capture layer where it would do more damage, because it would meter the practice itself.
The available move is to differentiate by format rather than by quantity:
FREE unlimited in count · bounded in FORM
(a stock rendering, matched to the capture)
PAID unbounded in form · charged per unit of work
(a bespoke reconstruction of this particular thing)A participant on the free tier can appreciate an unlimited number of things, forever, and every one of them appears. Nothing counts down and nothing is withheld pending payment. What the paid tier buys is not permission but work — a reconstruction of this thing rather than a representative of its kind.
Two consequences follow and both are load-bearing. First, "frictionless and often" (§4) is only affordable because the free tier is a matched stock rendering rather than a generation, so the free tier can never become generative without breaking the frequency the practice depends on. Second, the free tier's boundary is set by what the operator can absorb, which is an engineering and financing number, not a doctrinal one: the doctrine forbids a meter, it does not require unlimited fidelity.
⚠️ The mechanism carries one hazard that must be designed against rather than argued away. If free renderings are stock and paid renderings are bespoke, then a participant's world silently announces which tier they are on, and the design has relocated a paywall from copy into art direction. The requirement — stated as a property, since this paper withholds implementation — is that the free rendering must be a coherent style rather than a degraded version of the paid one. A style is a different thing; a degradation is a worse thing, and only the first is honest. Alongside it: the uniqueness a participant should be told carries their meaning is the coordinate, the words, and the moment — all free — rather than the mesh.
The third mechanism draws the boundary between a world layer and a metaverse, and it exists because the design would otherwise cross a line this corpus has committed to.
The commitment is that an overlay is presence-deepening, never presence-replacing: it reveals what is already at a real place to people who are actually there, rather than substituting a synthetic elsewhere for being anywhere. A design in which participants roam each other's worlds as avatars is, on its face, the substitution.
The resolution is a single asymmetry:
WRITE ─────────────────────────────► requires physical presence
capture needs a photograph
AND a coordinate, so a
participant can only place
an object by standing there
READ ─────────────────────────────► does not require presence
a world can be visited
remotely, through its doorCapture requires a photograph and a coordinate. A participant therefore cannot furnish a world without going outside and standing in front of something. Remote visiting is then not the metaverse move; it is reading a record that was necessarily written in the world.
This has a consequence the design accepts deliberately: it is a going-outside product. Its input is walking. That is a real constraint on its addressable population and it is not apologised for.
Reading is further governed by a rule this corpus settled independently of this design. Each node's world is entered through a door, and the doors are not symmetric:
The content classes this design names — objects, plants, animals — are precisely the always-open classes. So the remote-visiting capability lands almost entirely on the layer where openness is correct, and the private human layer stays private by a rule that predates the feature.
The asymmetry above governs a participant's own capture. It generalises — and the generalisation is what makes the design's founding commitment hold at every level rather than only at the first:
A remote visitor may read a world. Only a visitor who is physically present may write in one.
A note left at a captured object is itself a placed artifact: it has a coordinate, and the rule that forbids furnishing a world from an armchair forbids annotating one from an armchair by the same clause. Nothing new is required to obtain this. It is §7's rule applied to a second class of writer.
Five consequences follow, and they are listed together deliberately, because one rule producing five results is the sort of thing that should be either checked carefully or distrusted:
A visitor who has travelled to a place in someone's world may leave a note there. The obvious implementation is a register — a list of who came and what they wrote — and the obvious implementation is forbidden.
A list of visitors is a visit count with names attached, and a visit count is a popularity gradient: worlds become comparable, and the design's most carefully protected property is that they are not. An empty register is worse, because a rendered absence is an accusation, and this design has removed accusation from every other surface it has.
Notes are placed, never listed. A note is left at an object and is found by walking to that object. There is no index, no count, no register page, and no notification.
This is the same shape as three rules already stated: no catalogue of the unrevealed (§6), no number on an etched world (§9.1), and visitor light that does not sum. A world with many notes has more to discover; it never has a bigger number. A world with none reads as complete, because nothing in it is presented as missing.
The note is not a new object type. It is a capture whose subject is a person's world rather than a thing — same primitive, same presence requirement, and the same treatment under §9, whose source record already commits notes alongside coordinates and timestamps.
The fourth mechanism specifies what a participant actually sees, and it produces the paper's one genuinely structural result.
╔══════════════════════════════════════════════════════════╗
║ SKY the coordinator's aggregate non-human ║
║ ledger — one value, shared by every world ║
║ in the system, simultaneously ║
╠══════════════════════════════════════════════════════════╣
║ LAND + this participant's non-human ledger ║
║ OCEAN (Kiitti) — changes often, gradually ║
╠══════════════════════════════════════════════════════════╣
║ AVATAR this participant's human-to-human ledger ║
║ (Kiitos) — changes rarely, markedly ║
╚══════════════════════════════════════════════════════════╝Two of these are private and one is not. The avatar is one participant's. The land and ocean are one participant's. The sky is everyone's, at the same moment, in every world.
And the sky is the coordinator's — an agent whose own balance on that ledger is pinned permanently to zero by construction, so that she can route value but is structurally incapable of holding any. From which:
The only shared surface in the system belongs to the one party structurally incapable of accumulating anything.
That is not decoration. It is the reason the shared layer is safe to have. A commons rendered from a balance that some participant could accumulate would be a commons that participant could dominate; a commons rendered from a balance that is definitionally zero cannot be captured, because there is no position in it to take.
It also renders a collective-action problem with unusual directness. If humanity's aggregate relation to non-human life goes flat, the sky goes flat — everywhere, for everyone, at once — and no participant can fix their own sky. There is no private exit from a shared atmosphere, which is the honest structure of the underlying problem and not a moralisation of it.
A shared, unavoidable surface that reflects collective failure is the most dangerous object this design contains, because it is one short step from an accusation delivered to a billion people who cannot individually act on it.
The rule that governs it is categorical:
The sky renders liveliness as motion and light — never as damage.
A flat aggregate reads as stillness, pre-dawn, held breath. It never reads as smog, fire, ash, or ruin. It is never a verdict, and it is never attributable to the viewer. The same rule binds one layer down and binds harder there because it is personal: a participant with a quiet non-human ledger gets a quieter world, never a barren one.
The general principle this instantiates is one this corpus applies across surfaces: name what a thing is; never what is absent, owed, or was done to it. Rendered absence is accusation, and accusation is the route by which a punishment mechanic re-enters a design that banned them.
It would be possible to treat the sky as atmosphere in the decorative sense — a backdrop that sets a mood. It is not, and the reason is worth drawing out because it is the paper's one genuinely structural result rather than a design preference.
Every persistent shared world faces the same question: who owns the commons? The answers in practice are an operator, or the most successful participants, or nobody in a way that degrades to whoever exerts the most pressure. Each has a known failure. Operator-owned commons become advertising inventory. Participant-owned commons stratify. Unowned commons are captured by whoever shows up with the most resources.
This design's answer is unusual and falls directly out of the ledger: the shared layer renders a balance that is pinned to zero by construction for the only party who could hold it. The coordinator can route value on that ledger and is structurally incapable of accumulating it. So there is no position in the commons to take — not because taking is forbidden by policy, but because the quantity the commons renders is definitionally zero for the one agent with authority over it.
That is a different kind of guarantee from a rule. A rule against capturing a commons is only as good as its enforcement and its enforcer's incentives; a commons whose defining quantity cannot be held is not capturable by an agent that would have to hold it. The property does not depend on anyone's restraint.
The cost of the property is that the shared layer then reflects something no individual controls, which is why §8.1's guard is stated categorically rather than as guidance. A commons that renders collective outcome and permits an accusatory reading has converted a structural safety property into a mechanism for distributed guilt — and would do so at a scale where no individual participant can act on the accusation. The guard is not politeness. It is what keeps the mechanism from inverting.
The move §8.2 makes is not local to this design. It recurs throughout the paper, and it is worth naming — with its prior art and its cost — because a reader is owed the name of the method a paper is using.
Where a guard can be a property of the object rather than a rule about behaviour, make it a property. A rule needs an enforcer at the moment it is tested; a property needs no one.
The design uses it repeatedly. The commons is safe because the coordinator's balance is pinned to zero by construction, not because capture is forbidden. Worlds are not comparable because visitor light does not sum, not because ranking is prohibited. The jubilee cannot become confiscation because there is no store, not because confiscation is disallowed. Remote furnishing is impossible because capture requires a coordinate, not because it is discouraged. Unsolicited annotation is impossible because a note has a coordinate too (§7.2). Thank-bait farming loses its object because the forward-spendable half cannot be extracted (§4.4).
This is old and well developed elsewhere, and none of it is claimed. Capability-based security makes authority a property of a reference rather than a rule checked at each use. The trust-minimisation programme in distributed systems is the same instinct at protocol scale. Lessig's argument that code regulates in the manner of law states the general case for software. The design is an application, not a contribution, and it is named here so that the sections above can be read against the method's cost.
And the cost is the same fact as the benefit: a property is less revisable than a rule. A rule can be amended when it turns out to be wrong; geometry cannot. A wrongly chosen property is therefore more expensive than a wrongly chosen rule, because the repair is rebuilding the object rather than editing a policy. That is §9's permanence asymmetry appearing in a second domain — structure is cheap now and immovable later — and it is the reason this paper states properties as requirements a mechanism must satisfy rather than as implementations: it is still cheap to be wrong about them.
§8's three layers are what a participant sees. There is a fourth surface, and it is the one that discloses rather than displays. On the wearable form of the device, the light a participant walks by is their own aura, and it is visible to the people around them.
This is not an addition to the render; it is a consequence of §5. If a participant's world is their ledger rendered, and the device illuminates that world, there is no other light in the system for the device to emit. It could not shine anything else.
That produces the design's sharpest legibility problem. A visible aura is a legible status, so a participant in a quiet season would otherwise walk visibly dimmer than the people around them — which is §4.2's withdrawal state rendered as a public signal, on precisely the person least able to carry one.
Two requirements. The first is §6.1's diagnostic applied to physical light:
The worn light differs in character — colour, texture, rhythm — never in magnitude.
Under that rule there is no dim-among-bright. There is amber-and-slow beside green-and-quick, and neither is above the other, which is exactly what §6.1 demands of every other mapping in the design: two participants with equally alive auras have different renderings, never better and worse ones, and a strictly ordered result is the failure signal.
The light has a floor that is never dark. Baseline illumination is independent of the ledger; the aura modulates above the floor and never toward zero.
Stated as a hardware property rather than a display rule because it cannot be repaired afterwards. A device whose usefulness declines as its wearer withdraws has coupled the instrument to the pathology it exists to notice.
The identity distinction of §4.2 then reaches the device, which makes the worn light the fifth independently-derived expression of a single distinction rather than the fourth:
| non-human bearer | human bearer | |
|---|---|---|
| heart | still | beating |
| worn light | still | beats |
| proof | coordinate only | coordinate and personhood |
| ledger rings | one | two |
| door | always open | sovereign, invitation-only |
Motion is reserved for persons. A machine carrying a credential of its own does not borrow the signal: this corpus keeps beat for personhood and gives machine credential-liveness a separate vocabulary, precisely so that a viewer who sees motion is never mistaken about what it means. That is a small decision with a large consequence — it is what allows a wearable light to be a disclosure rather than a claim.
Three honest limits, and the second is the one this design should be judged on:
Character-not-magnitude is a mitigation and not a proof. §6.2's residue applies verbatim: participants compare notes with each other whether or not the software helps them, and a mapping the system never ranks can still be ranked socially once people learn to read it. n = 0.
It extends disclosure to non-participants. An in-world overlay is seen by people running the software. A physical light is seen by everyone on the street — including people who never agreed to anything, who cannot interpret what they are seeing, and who have no way to contest it. That is a materially wider disclosure than the world layer makes, and the design should be assessed on the wider one rather than the narrower.
Physical emission has constraints that have nothing to do with doctrine — power, and the ordinary social and legal limits on light in vehicles, cinemas, dark-sky areas, and other people's windows. A light bright enough to be beautiful is bright enough to be a nuisance.
One property of the form is favourable and the paper should say so rather than affect modesty about it: a device that visibly emits is legible to a bystander as not recording. The category's social-licence failure was a camera that could not be seen to be off; a lantern's entire appearance is that it is giving light rather than taking it. That does not dissolve the capture questions of §10, which govern regardless — it means the device's appearance and its obligations point the same way instead of opposite ways.
This design has an archival terminus. A participant's entire world can be committed to a deep-time optical substrate — femtosecond-etched into silica, on the order of geological rather than institutional time. The corpus's larger programme places such an artifact at the individual scale, alongside a tradition-scale canon and a lineage-scale record.
That terminus creates a hazard which, so far as the authors can find, is under-discussed in the deep-time storage literature — a literature almost entirely concerned with preservation, with how to make data last.
Permanence is a one-way door. An archival substrate converts every present-tense privacy defect into a permanent one.
There is no right to erasure in fused silica. A design that collects under a revocable purpose and commits under an irrevocable one has obtained consent for the first and not the second.
Three rules follow, and they are the contribution of this section:
Guard at capture, not at commit. The etch is downstream of a live product that collected for storage. Consent to storage is not consent to permanence, and no downstream review can repair a defect that is already in the data. Every guard in §10 must exist before the first capture reaches a real participant — not before the first etch.
Etch the source, not the render. Commit the minimum that regenerates everything else: descriptors, coordinates, notes, timestamps. Meshes and textures are large and regenerable; the capture record is small and is not. The render is a reading of the record; only the record is the artifact. This is smaller, more faithful, and survives every future renderer.
The third-party case is the hard one. A personal archive is consented to by its subject and contains other people's places, who consented to nothing. This is where the design is most exposed and where §10's obscuring rules do the most work.
The general form, which generalises well beyond this product:
An archival medium and a data-minimisation regime are in direct tension, and the tension is asymmetric in time: minimisation is cheap now and impossible later.
The immutability-versus-erasure debate is not ours and has been developed extensively in the distributed-ledger context. What is offered here is its extension to physical deep-time media, the personal-archive case where the subject and the data-subjects differ, and the three rules above.
A permanent personal artifact commissioned near the end of a life is, structurally, the form of an indulgence: a payment against being remembered. This corpus does not have the option of ignoring that resemblance.
Two guards, both inherited:
Price the making, never the remembrance. The etch is a craft-and-materials cost. It is not a price on being remembered, and it must never be sold as one.
Never let the artifact be the only copy. The digital world remains free, complete, and permanent at no charge; the physical artifact is an additional form, never access to one's own memory. A design that holds the only copy has taken a hostage, whatever it charges.
And the voice rule, at the most emotionally loaded moment any of this design touches: an etched world renders what is present, permanently and without exception. No counts. No totals. No "N objects appreciated." Never a number on a tombstone.
Four requirements are stated as launch conditions rather than roadmap items, because §9 establishes that none of them can be repaired downstream.
Geotagged living things enable harm. Precise coordinates for threatened plants and animals are an established poaching vector; iNaturalist's practice of automatically obscuring locations for threatened taxa exists because of documented cases involving orchids, reptiles, and nesting sites. This design explicitly invites captures of plants and animals, so coordinate obscuring for sensitive taxa is a launch requirement. It is also internally consistent: a ledger whose purpose is to internalise costs to non-human life cannot be a vector for extraction from it.
Most objects a person appreciates are inside their home. A gratitude map is, unmanaged, a catalogue of a dwelling's contents and its location. The door asymmetry of §7.1 governs visibility; it does not govern the coordinate existing. Private captures require place-level rather than point-level precision, at capture time.
Visibility is not navigability. §7.1's doors govern who may enter a world. They say nothing about what a visitor may be directed to, and in-person visiting (§7.2) turns a stored coordinate into a route a stranger can walk. A world opened to a visitor discloses the places its participant cares about — and the set of places a person cares about is, in aggregate, a map of their life. Opening a door must not release navigation. The requirements: visiting resolves coordinates at place-level precision by default; point-level navigation is a per-object disclosure the participant makes deliberately, never a property of the door; and residential coordinates are never navigable to a visitor at any precision, under any invitation, because a participant cannot consent on behalf of the others who live there. Where a coordinator guides a visit, the same rule binds her as a constraint on routing rather than as a display setting she could route around — a guide who can be asked for directions is a disclosure surface, whatever the map is set to.
No identifiable people in captures. This follows from an existing hard rule in this corpus — that media identifying a person may originate only from that person — and it is enforced by on-device detection that blocks or blurs before any reconstruction occurs, never after and never at a network boundary. The capturer cannot consent on a bystander's behalf, and asking them to is not a control.
That last requirement carries a consequence for the design's economics worth stating plainly: if any tier of the product sends photographs to a third-party service for richer reconstruction, then the paying tier is the less private tier, which inverts the relationship a participant would reasonably expect. Detection and obscuring must therefore run on the device, before anything leaves it, in every tier.
The claim in §4 — that frictionless gratitude toward things primes attentive gratitude toward people — is an empirical claim about behaviour, and this corpus's practice is to register such claims before the data exist rather than to interpret them afterward. No code has been written. The instrument is not built. These are registered now, and the registration is the point.
P-W1 — the priming prediction. Participants with higher thing-capture frequency show higher rates of people-directed gratitude given, and the effect survives controlling for overall engagement.
⚠️ Amendment (v2), and it is the reason to register before building. The measure is gratitude GIVEN by the participant, never gratitude RECEIVED. §4.1's visiting mechanism creates a path by which a heavy capturer has a richer world, attracts more visitors, and therefore receives more notes — so an instrument counting received would display the priming effect whether or not priming occurs. The confound was introduced by a mechanism added after the original registration, and it is disclosed here rather than quietly corrected. No data exist; no instrument exists; the amendment costs nothing today and would have invalidated the result later.
P-W1′ — the opposing prediction, which is not a straw man. Thing-capture substitutes for people-directed gratitude. Having "done gratitude today" reduces the felt need to do the harder kind. This is moral self-licensing, a well-documented effect in exactly the domain where it would apply: a person who has performed a virtuous act becomes more permissive toward subsequently omitting one.
Both are plausible on the existing literature, which is what makes this a test rather than a formality. Two conditions are stated as part of the registration:
And the stake is stated honestly: P-W1′ firing would invalidate the thesis of this paper, not trim it. If the frictionless layer cannibalises the practice rather than priming it, then the host-ritual swap bought adoption by destroying the thing adopted, and the correct response is to say so and stop.
n = 0. Nothing in this paper has been built. Every behavioural claim is a hypothesis and every design claim is untested. The corpus behind it has a single-family pilot and no data on any mechanism specified here.
The specification is deliberately incomplete. As stated at the head: for an unbuilt and unscheduled artifact, publication protects against being blocked rather than against being beaten. Rendering functions, the aura-to-appearance mapping, asset pipelines, thresholds, and prices are withheld. A reader should treat this as a statement of properties, not a buildable design.
A store is proven and this is not. §5's mechanism forgoes the most reliable retention design in the industry for a structural property, on no evidence that the trade is worth making. If the product fails on retention, this is the first place to look, and the honest answer will be that the doctrine was expensive.
Reveal-never-lock is still a progression system, and §6.2's requirement that it never become legible as a target may not be achievable in a world where participants talk to each other.
The hinge is partly addressed and not solved (§4.1). v2 offers a mechanism that satisfies the constraint set and is debuggable, which v1 had not. It is still network-density-dependent — weakest at the start, when it matters most — and it moves the visitor rather than the host, so it does not answer the arrow §11 registers. A participant nobody has visited still has no hinge.
The map is farmable even though the ledger is not (§5.4). Making a practice witnessable makes it performable. The design declines to reward curation but cannot detect it, and the read side of §1.2 buys its benefit at exactly this cost.
The routing in §4.4 is a doctrinal commitment with no evidence behind it. That a split between a withdrawable and a forward-spendable half sustains tending better than either extreme is untested at n = 0. It is chosen because per-deed payment would corrupt the institution's own measuring instrument, which is an argument about validity, not about efficacy.
Character-not-magnitude may not survive contact with people (§8.3). It removes the ranking from the software; it cannot remove it from a group of participants who compare notes. And the worn light discloses to non-participants who never agreed to anything, which is the widest disclosure anywhere in the design and the one on which it should be judged.
The going-outside requirement is a real ceiling. §7's write-side presence requirement excludes participants with limited mobility from furnishing a world, in a design about appreciation. This is a genuine equity cost and the paper does not have a resolution for it.
The elegance is not evidence. Several of this design's properties fall out of the corpus's existing architecture with unusual neatness — the two speeds landing exactly on an existing two-ledger split, the three-layer render reproducing an existing double-ring mark, the shared surface belonging to the party that cannot accumulate. A system whose parts fit together this well is either substantially right or substantially seductive, and from the inside the two are indistinguishable. The coherence earns the experiment. It does not replace it.
All seventeen are dedicated to the public domain. None will be registered, patented, or asserted by this institution against anyone.
The domain this design will live on was chartered, months before any of it was specified, as a net of mutually-reflecting worlds — a figure borrowed from a very old image in which a net is strung with jewels, and each jewel shows every other. The figure is held here as a lens and not as a claim: delete it and every mechanism in this paper stands unchanged. It earned its place by being the reason the domain was named, not by doing any work in the argument.
But it does describe the object accurately, which is worth one sentence. A world in this design is not a possession. It is a position — an empty node that is what it is because of everything it reflects, which is the oldest available description of what a person actually is and a considerably better one than an inventory.
The practical form of that is small and testable. A person walking home notices a tree they have passed a thousand times, and this time stops. They take a photograph. Something appears in a place that is theirs, and their ground shifts very slightly, because the ledger moved. Nothing was bought. Nothing was unlocked. Nothing will be taken back next January.
And some evening another person walks that same street, having been let through the door, and finds at the tree a few words left by someone who once stood exactly there. Nothing arrived to summon them. Nothing was counted. The visit cost a journey, which is most of what makes it a visit — and the words were only findable by someone willing to make it.
Whether that leads anywhere — whether the noticing of things leads to the thanking of people, or quietly replaces it — is the question this paper registers against itself and cannot answer. The honest position is that the mechanism is specified, the prediction is on record, the opposite prediction is on record beside it, and the data do not exist.
The old figure for a gift that costs the giver nothing is a lamp lighting another lamp. It is the right image for this design and it is also, precisely, the thing that has not yet been demonstrated.
Authored by Thon Ly with Miss Aquarius℠. Dedicated to the public domain under CC0 1.0 Universal. Corrections, prior art we have missed, and above all disconfirmations are welcome — a design published before it is built is published so that it can be argued with early.