DOI: https://doi.org/10.5281/zenodo.21947304
Canonical: https://thonly.org/research/co-presence-gated-redemption · Licence: CC0 1.0
v5 note (2026-09-02): two added sections, no new claim and no prior-art clock. §3.2 answers the question the paper had never been asked in print — why is the unit not a token on a ledger? — and answers it from the unit's own physics rather than from the tense wall of §3, which is the half that reaches a technical reader. §7.2 makes a correction, and it is the substantive half of this revision: the corpus had been enforcing the honoring of pledges by rendering the gap between time received and time delivered, and that mechanism is withdrawn here in favour of expiry, which enforces with nobody watching. The
Ledger shamingentry in §11 is rewritten to point at it. ⚠️ Claim 3 IS amended — it carried the withdrawn mechanism in its own text, so leaving it would have set the claim set against §7.2. The composition half survives; the reputational-ledger half is struck. No other claim changes, and no new claim is added — this revision removes a disclosed mechanism rather than adding one, so no prior-art clock starts.v4 note (2026-08-26): one added block inside §4.5, no new section and no new claim. §4.5's three-case table said of the party who cannot perceive that the gift is complete anyway — true, and it left the mechanism with nothing to do. The addition supplies the path, and it was already in the paper: the one who cannot attend is not a party to the co-presence; two others form the dyad and that party is the third-party beneficiary, which is §5.3's co-service class running unchanged under both of its guards. Two consequences follow free — apacāyana atop veyyāvacca when the beneficiary is a parent or elder, and the dead reached by the identical structure, which makes ancestral observance a native instance rather than an adjacent practice. ⚠️ The limit is stated with it and is not closed: the path needs two attendees, and both cases this paper cites for complete anyway are solitary. One guard is added — such a beneficiary may never become a destination in §5.2's menu. No numbered claim changes and no prior-art clock starts.
v3 note (2026-08-22): one new section, §4.6, and no new claim. §4.4 named device proximity as the in-person attestation channel without specifying it; §4.6 supplies the specification (an in-person fingerprint exchange — prior art, cited as such: the PGP key-signing party, Signal safety numbers, SSH host-key pinning) and then makes the argument that is actually new — in-person key verification failed for thirty years on the invitation, not on the cryptography, and a redeemed hour is the first pretext that was never about keys. One prediction (P-M1) is added with it. Nothing in §8 changes and no prior-art clock starts.
v2 note (2026-08-07): the paper gains the ground it shipped without, one correction to a published claim, and the substitution argument that was the reason to publish early. ⚠️ The correction first, because it is a tightening of numbered claim 2. The published wording — "presence received only by matching presence" — asserted a symmetry the gate does not deliver: synchronicity makes symmetric duration automatic, but symmetric attention cannot be enforced without measuring it, and measuring it is the one thing this architecture must refuse. Claim 2 is restated, new claim 2a records the presence-scoring refusal, and §4.5 gives the reasoning — B senses the attention; B infers the sacrifice, sacrifice being counterfactual and therefore never directly perceived. The restated claim is weaker in wording and stronger in truth, and the prior-art clock for claim 2 as restated, and for claim 2a, runs from this push; the original wording is superseded rather than withdrawn. New §3.1 supplies the ground §§4–7 assumed but never argued — the six-position loop, mettā as the loop's name and never a node in it, the two positions this mechanism actually occupies (denomination and witness, the joints where the loop leaks), the build-the-left-side-never-the-right rule that keeps this from being a calendar application, and the reframing of the gate as a proof-of-sacrifice primitive beside the corpus's other two. New §7.1 states what that primitive is worth against machine companionship — presence-as-experienced counterfeits; presence-as-sacrifice cannot — with its own falsifier. §10 gains P-L1/P-L2/P-L3, of which P-L2 is the founding bet, publish-either-way: if unwitnessed presence produces equal downstream gratitude, the chronicle is decorative. §11 gains the agent hour-farm case and §12 gains the limit the paper most needed — no guaranteed valence; presence is a high-bandwidth channel, not a good one. Claims otherwise unchanged; §§5–6 untouched.
Draft notes for the editor: paper №2 of the July 2026 drafting sprint — the full mechanism treatment of the HeartBank® Chronicle (the time-currency half of the dual-currency system) and its unification circuit with the Treasury (the money half). Claims division with sibling publications, stated for the record: the incommensurability-preserving coupler publication owns the wall-layer claims (coupled-non-convertible dual currency, duration-blind recommendation, redemption-moment prompt-suppression, moment-not-meter surfaces, ceremonial-unit anchoring, cross-currency response routing, the lapse-channel); the What Money Can't Buy position paper owns the institutional argument; the present paper owns the event-layer mechanism: what a redemption is, who composes it, what gates it, how the circuit closes, and what the system refuses to build around it. The Chronicle is design-complete and unbuilt (closed beta targeted); every claim is architectural and strata-dated to the design layer. Site module deliberately deferred; the prior-art clock starts at this markdown push.
Time-currencies have been tried for forty years, and they decay along a known path: the hour becomes a unit of service, the service becomes an errand, and the system becomes a labor exchange with worse liquidity than money — at which point it dies of comparison with the thing it imitated. The decay has a single root: in every prior design, a time-credit is redeemed by one party doing something for the other, which makes the currency a wage denominated in awkwardness. This paper specifies the design that removes the root. In the HeartBank® Chronicle, a pledged hour has exactly one redemption form: an event both parties must attend. Presence is defined as time sacrificed for the other — operationally, synchronous shared attention, in either of two geometries (facing: attention on each other; flanking: joint attention on a shared activity) and either of two attested modalities (in-person, proximity-attested; live call, session-attested). Asynchronous media cannot redeem an hour — a recorded message is the envelope that carries a pledge, never the event that spends it. The gate yields the currency's defining properties at a stroke: the redemption is symmetric-cost (presence can only be received by matching it — both parties spend the hour, which is why the mechanism can address loneliness at all: loneliness is not ended by receiving but by co-spending); absentee labor is structurally impossible (the gig-shape that killed time-banking cannot be composed); and the delivered hour is attestable by both parties without trusting either alone.
Around the gate, the paper specifies the full circuit. The recipient authors the event and the giver holds a veto — the sacrifice being not merely of hours but of agency over one's scarcest resource. The curated event-menu spans togetherness and, under two guards (the both-hands rule: both parties perform; the outward-benefit rule: a third party benefits), side-by-side service — restoring shared work to the currency without readmitting extraction. Gratitude for a delivered hour crosses the wall into the money-currency, unprompted and duration-blind, so the relationship never settles into barter; the shared event, uniquely witnessable because it is the one kindness with two people present, may be broadcast by its beneficiary — the camera inverted — and the community's answering money-gratitude routes by default to the time-giver. Unredeemed hours expire and genuinely die (the mechanic is the mortality thesis); their lapse occasions, never funds, a new anonymous gift. Eight claims are enumerated and dedicated to the public domain; three predictions are pre-registered, including a standing tripwire (P-C3) that would detect the mechanism's own corruption — the emergence of a de-facto hour-to-money rate — and the authors commit to publishing it either way.
Keywords: time currency, co-presence, loneliness, time banking, dual-currency system, gift economy, redemption event, joint attention, proximity attestation, witness inversion, defensive publication.
This document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent on any mechanism, architecture, or specification articulated herein, in any jurisdiction, at any time.
The following terms are coined in this paper and simultaneously freed with it: co-presence-gated redemption, symmetric-cost redemption, facing/flanking (the two geometries of shared attention), envelope-not-delivery, the both-hands rule, the outward-benefit rule, sender-default routing, the tense wall. Terms inherited from this corpus's earlier publications (the incommensurability-preserving coupler; witness-inversion; the two blindnesses; the spent-time floor) are cited, not re-claimed.
Time-currencies, service-credit systems, and mutual-credit networks constitute extensive prior art (§9) and are engaged generously; the present claims are confined to the event-layer architecture — the co-presence gate and its attestation, the authorship/veto composition, the guarded co-service class, the cross-currency circuit's routing, and the expiry mechanics — which is, to the authors' knowledge, not previously published as a coherent system.
The epidemic is not what it looks like. The modern loneliness literature distinguishes social loneliness (a shortage of contacts) from emotional loneliness (the bond that exists but has gone dark), and finds the second form the more acute: the disconnected marriage, the estranged sibling, the diaspora child and the parent back home — relationships present in the address book and absent from the week. A mechanism for the first form matches strangers; a mechanism for the second must move existing bonds from dark to lit. The Chronicle targets the second form, and this choice does double duty: the counterparties are known (the trust-and-safety profile of reconnecting your own mother is categorically different from meeting a stranger), and the deepest need coincides with the lowest risk.
The adversary is the work-default. For most adults, time not deliberately assigned is absorbed by work — it pays the bills, and for some it is also the most tractable pleasure available. Presence must be scheduled against the default or it does not occur; sincerity is not the limiting reagent, calendaring is. A time-currency is, at bottom, a scheduling technology for love: the pledge converts a diffuse intention ("I should call more") into a dated, witnessed, expiring commitment.
And the graveyard is instructive. Edgar Cahn's time-dollars, the LETS networks, Ithaca HOURS, Japan's Fureai Kippu — the time-currency tradition is rich, humane, and consistently sub-scale, and its recurring failure is decay into labor exchange: the credited hour becomes a claim on services (rides, repairs, errands), the system becomes a marketplace with money's obligations and none of money's liquidity, and participation collapses into the small population for whom awkward barter beats cash. The failure is architectural, not motivational. Any time-credit redeemable as absentee service is a wage in embryo. The design below removes the possibility at the type level: in the Chronicle, an hour cannot be redeemed for anything. It can only be redeemed with someone.
Connection to the unified mission frame. HeartBank's dual-currency thesis holds that money and time are the two scarcities of a human life, addressing the two great deficits — dignity (being seen) and loneliness (being with) — and that the two currencies are two tenses of one substance: money is stored lifespan, past tense, what one has; time is live lifespan, present tense, what one is. The Chronicle is the present-tense half. Its mechanism must therefore protect the one property money can never have — that the currency is the relationship, non-fungible, unspendable by proxy — and the co-presence gate of §4 is that protection made structural.
A daughter in Long Beach thanks her mother in Kâmpôt — for the recipe, for the phone calls she didn't return, for everything — and the thank carries a pledge of hours, its amount suggested by the system's neutral agent, as her thanks always do. The pledges accumulate quietly below threshold; on her mother's birthday they cross it and activate: four hours, redeemable for one month.
Her mother redeems two of them: "Walk the market with me Sunday morning. Bring your coffee." The daughter accepts — she could have declined this particular ask; she doesn't — and on Sunday, seven time zones apart, they walk Psar Leu together on a live call, the phone riding in the mother's shirt pocket half the time, pointed at mangoes the rest. Nobody performs anything. It is not a message; it could not have been recorded in advance; it is two people spending the same hour on each other, and both ledgers mark it delivered because both were there.
That evening, unprompted — the application never asks — the daughter sends a small money-thank through the family's Treasury. It names the morning, not the meter: "for the market, and the mango argument." Her mother, with her daughter's consent, shares a thirty-second clip of the walk; the aunts answer it, and their small re-thanks route to the daughter — the one who gave the hours. Two cousins, watching, pledge hours to their own mothers.
The other two hours are never redeemed. At month's end they die — the application does not soften this; the month was the point — and the system offers the daughter one thing only: the chance to give a small anonymous gift, funded from the commons pool, to a stranger nearby, in the memory of the hours that lapsed. The gift is new. The hours are gone. Both facts are the teaching.
The unit. A Chronicle pledge denominates time-gratitude: hours promised as thanks, accumulated per-dyad, activated at a threshold, expiring one month after activation. The expiry is not an engagement mechanic; it is the product's thesis embedded in its unit economics — time is the currency that cannot be banked, and a promise of presence that can be deferred forever is not a promise. The unit's non-fungibility is absolute: only the pledger can deliver the hour, and only to the pledgee. There is no transfer, no exchange, no secondary market, no conversion. The currency is the relationship.
The wall. The Chronicle operates beside a money-currency (the Treasury), and the corpus's coupler doctrine governs the pair: coupled, never convertible. This paper adds the wall's deepest formulation, the tense wall: the two currencies are two tenses of one substance — life — and tenses do not convert. Stored past (money: crystallized, fungible, transferable) cannot purchase live presence (time: unfolding, non-fungible, attendable only in person, in the moment, by the person). One cannot pay someone to have been there. Every rate-prevention guard this corpus has published (no backward prompts at redemption; duration-blind recommendations; moment-not-meter language on every surface) is downstream enforcement of a wall that the metaphysics builds first.
Two published doctrines complete the unit's grammar and are inherited here: the spent-time floor — a delivered hour deserves gratitude as a fact, independent of any audit of the giver's motive, because spent lifespan is the one unfakeable cost — and the two blindnesses — the system stays blind to duration (no recommendation ever scales with hours) while the heart stays blind to motive (the thanker never withholds over purity doubts). Gratitude flows free of both meters.
Added 2026-08-07. §§4–7 specified a gate and defended it mechanically; they did not answer the prior question a skeptical reader asks first — why gate on co-presence at all, rather than on anything else. This subsection supplies the ground. It introduces no mechanism, and the mechanism it grounds was already published; what follows is the argument that was in the design and not in the paper.
The mechanism sits inside a loop with six positions:
gratitude
│ (denominated)
▼
time-gratitude
│ (spent)
▼
time-sacrifice ═══ PRESENCE
│ (seen)
▼
witnessed
│ (occasions)
▼
gratitude ──────────────┐
▲ │
└─────────────────────┘Gratitude, to move, must first be denominated — given a unit a person can actually spend. Denominated in time, it becomes a pledge. A pledge spent is time sacrificed for another, which is what presence is. Presence witnessed occasions gratitude in the other, and the loop turns again.
Mettā is the name of the loop and never a node in it. This is a design commitment, not a piece of vocabulary. Loving-kindness is what the whole circuit is for and what a person cultivates by running it — but the moment it becomes a position in the diagram, the ledger is being asked to record an interior state, and recording an interior state is a grading move. The architecture that refuses to price an hour cannot coherently score a heart. Every node in the loop is an observable event; the disposition is the loop's name.
Two consequences follow immediately, and both are already visible in the specification.
The Chronicle supplies exactly two of the six positions, because those are the two where the loop leaks. It denominates (gratitude that stays a feeling never moves; a pledged hour is gratitude given a spendable unit) and it witnesses (§6.4, §6.6). It does not supply presence, cannot supply the disposition, and deliberately does not supply the meeting.
Which is the strongest statement of what this system is not. It is not a calendar application, and the rule that keeps it from becoming one is build the left side of the loop, never the right: the Chronicle holds the pledge and the witness, and never the appointment. It does not know when you are meeting, does not remind you that you have not met, and cannot display an unkept intention — because a surface that renders an unkept intention has accused its user, and the accusation is exactly the outcome a gratitude system must never produce. The indictment surface is not moderated here; it is absent by construction, because the data that would populate it is never held.
And the return leg is catalysed, not spontaneous. This is the loop's least obvious property and the reason the witness position exists at all. Presence that recurs at no cost stops occasioning gratitude — not because the recipient has stopped valuing it, but because nothing that arrives reliably and for free keeps interrupting the stream of attention. Steady love produces entitlement, and the entitlement is not a moral failure in the recipient; it is what habituation does. The corpus's own founding story is the proof case: the gratitude was immense and the giver never knew, because nothing in the situation occasioned its expression. The witness is the catalyst that closes a loop which, unassisted, leaks at precisely that joint.
Read from here, three mechanics specified earlier as design decisions are revealed as consequences rather than choices. Expiry (§7) is not a scarcity trick; it is the currency's physics — an hour is a commitment to spend a portion of a finite life, and a commitment that cannot lapse was never a sacrifice. The tense wall (§3) follows from the loop's direction: the circuit runs forward, and a mechanism that let value run backward would be paying for the past rather than funding the next turn. The ceremonial unit follows from the refusal to price: the loop's positions are events, and events are counted, never weighed.
⭐ Finally, this reframes the gate itself. Co-presence-gating is not merely a redemption rule. It is a proof-of-sacrifice primitive — an architecture for demonstrating that a finite, unrecoverable portion of a life was actually spent on another person — and it belongs beside this corpus's other two primitives, proof of humanity and proof of coordinate, as the third of a family. §7.1 states what that primitive is worth on a clock that is currently running, and the honest note is that the primitive shipped before its rationale was written: it was specified in July as a mechanism and is only being named as a primitive now.
(A relational-taxonomic route to the same conclusion — that no relation in the Abhidhamma's twenty-four joins two mental continua, so a system can supply occasions but never the arising — is developed independently in this corpus's Paṭṭhāna paper at §4.7. The arguments share no premises and reach the same design constraint, which is worth noting and not worth merging.)
A reader arriving from distributed systems asks a question this paper must answer before §4 can proceed. If the Chronicle issues a scarce unit, and if both parties must agree about what was promised and what was delivered, why is that unit not a token on a ledger of the usual kind?
Because the problem such a ledger exists to solve does not arise here. A blockchain solves double-spending without a trusted third party, and for double-spending to be a threat the asset must be transferable, storable, and forgeable by copying. The Chronicle's unit is none of the three. It is not transferable — only the pledger may deliver, and only to the pledgee. It is not storable — it expires one month after activation, and the expiry is the thesis rather than a parameter (§7). And it cannot be forged by copying, for the plainest reason available: a person cannot be in two places at once. The scarcity a proof-of-work chain manufactures at great expense, an hour of human presence already possesses.
money an hour of presence
──────────────────────────────────────────────────────────────────
transferable yes no — only the pledger, only to the pledgee
storable yes no — dies one month after activation
double-spendable yes no — one body, one place
──────────────────────────────────────────────────────────────────
∴ what it needs SETTLEMENT WITNESS
(the present) (the past)The objection worth taking seriously is that this proves too little. Time cannot be double-spent, but a promise of time can certainly be double-made: nothing prevents a pledger from committing the same Tuesday evening to three people, and that is a genuine failure. It is not, however, the failure a chain repairs. A ledger would record all three pledges with perfect fidelity and would not make Tuesday any longer. Over-issuance is resolved at delivery rather than at issuance — the co-presence gate of §4 is physically exclusive, so at most one of the three redemptions can occur and the other two lapse under §7 — and the constraint that resolves double-promising is the same physical constraint that made the chain unnecessary. One body, one place, one hour.
What the mechanism does require of a ledger is therefore not settlement but witness: that the pledge was made, that the meeting occurred, that the hour lapsed. Those are claims about the past, served by an append-only record whose roots are anchored for age — not by a consensus mechanism arbitrating rival claims to the same coin. Stated in one line: money needs settlement, which is an action in the present; time needs witness, which is a claim about the past. Which substrate carries which is an implementation fact of the wider architecture and not a feature of this mechanism.
A pledged hour has exactly one redemption form: an event at which both parties are present. Presence is defined as time sacrificed for the other — operationally, synchronous shared attention.
Each term is load-bearing:
The gate has a consequence that no prior time-currency possesses: redemption costs both parties the unit. The recipient cannot receive the hour without spending an hour; presence is received only by matching it. Each party's attendance is a sacrifice for the other — the event is mutual by construction, and the asymmetry of giver and receiver survives only in the claim (who pledged, who authored) while dissolving in the event (both attend, both spend, both receive).
This is why the mechanism can address loneliness at all, and the point deserves its plain statement: loneliness is not ended by receiving. It is ended by co-spending. A currency whose redemption were one-sided — a service performed, a message consumed — would deliver assistance to the lonely and leave the loneliness intact. The symmetric event is the anti-loneliness payload, and the gate is what makes it the only payload the currency can deliver.
The gig-shape — "redeem my hour: do this for me while I'm elsewhere" — cannot be composed in this system. There is no redemption type in which one party labors and the other is absent; absentee service is not discouraged but inexpressible. This single exclusion severs the decay path of §1: the currency cannot become a labor exchange because labor-for-an-absent-beneficiary is outside its grammar. (Labor alongside a present partner, for a third party, returns under guard in §5.3 — the distinction between working for someone and working with them is exactly the distinction the gate enforces.)
Delivery is marked by both-party confirmation, and the co-presence gate makes the confirmation attestable: an in-person event is corroborated by device proximity between two verified humans (the corpus's existing proximity primitive and Proof of Humanity℠ layer); a remote event is corroborated by the live session both parties held. Neither party can unilaterally fabricate a delivered hour; a dyad colluding to fabricate one harvests — as §11 details — nothing the system pays for. The dual public ledger completes the accountability grammar: hours given (delivered) and hours received stand as two public axes — credibility and belovedness — while chronic non-delivery and chronic decline price themselves reputationally without any tribunal.
THE REDEMPTION EVENT — the only spendable form
FACING FLANKING
attention on each other joint attention, shared task
┌─────┐ ┌─────┐ ┌─────┐ ┌─────┐
│ A │ ◄──► │ B │ │ A │ │ B │
└─────┘ └─────┘ └──┬──┘ └──┬──┘
▼ ▼
┌──────────────┐
│ shared object │
│ (meal, garden,│
│ market, work │
│ for a third) │
└──────────────┘
modalities: in-person (proximity-attested) · live call (session-attested)
excluded: anything asynchronous (envelope, never delivery)
cost: symmetric — BOTH spend the hour; that is the point
attested: both-party signoff; neither party trusted aloneAdded 2026-08-07, and it tightens a published claim rather than extending one. The correction is stated first because the prior wording overstated the mechanism.
The question that forced it: does the receiving party sense the gift when they cannot return it — the declining parent, the depressed friend, the small child, the estranged sibling who agreed to come but not to reciprocate?
The answer is yes, and it splits an operation this paper had treated as one.
B senses the attention. B infers the sacrifice.
These are different epistemic acts. Attention lands directly — it arrives through the senses at full bandwidth, and a person can tell, without reasoning about it, whether they are being attended to. Sacrifice cannot land directly, because the foregone alternative is never in the room. What A gave up by being here is by definition absent; it is reconstructed from signs — the distance travelled, the workday moved, the phone face-down. Sacrifice is a counterfactual, and counterfactuals are inferred.
Symmetry is therefore not required for the mechanism to work. If influence between two people runs as two independent one-way edges rather than as a single bond, then A's attention reaching B is one edge functioning exactly as specified, whether or not the return edge carries anything. Asymmetric presence is not a degenerate case of the mechanism; it is the mechanism running on one side.
⚠️ Which means claim 2, as published, was too strong. The claim read "presence received only by matching presence," and §4.2 spoke of both parties dissolving into the event. The gate does not, and cannot, deliver that. What the gate actually enforces is that both parties spend the same duration — that much is automatic, since the event is synchronous and each party's hour is gone either way. What it cannot enforce, and must never attempt to, is that both parties spend the same attention. Claim 2 is accordingly restated in §8 as a claim about symmetric duration with asymmetric attention permitted, which is weaker in wording and considerably stronger in truth. The prior-art clock for the restated claim 2 runs from this revision's push.
"Cannot return" is three cases and they want different treatment.
| Case | What is true | Design response |
|---|---|---|
| Cannot match, but can acknowledge | the return edge runs; it simply does not carry an hour — and receiving well is itself a giving | ⭐ the majority case: serve it. No surface may treat acknowledgment as a lesser return |
| Will not return | the estranged party who attends and gives nothing back | the case the mechanism was built for; nothing here is conditional on their reciprocating |
| Cannot perceive | the unconscious, the very ill, the dying | the gift is complete anyway — a position this corpus already holds from both directions, in the unsent letter and in the letter whose reader never knew |
⭐ The design consequence is the section's real payload, and it inverts how the asymmetry should be read. The gate makes symmetric duration automatic and symmetric attention impossible to require. A mechanism that tried to require it would have to measure it, and measuring the quality of someone's presence is the one thing this architecture must not build. So the asymmetry is not a failure mode to be closed. It is the space where the gift lives — because a gift that could be compelled from the other side would not be a gift, and the whole design rests on that distinction.
⚠️ And one honest limit hardens into a refusal. Because sensing is inference, it fails in both directions: performed attention reads as real, and flat affect reads as absence. A system that scored presence would therefore reward performance and penalise atypical expression — penalising, most reliably, the autistic, the depressed, the grieving, and the very people the product exists to reach. No surface of this system may score, rate, or infer the quality of anyone's presence. This is stated as a refusal rather than a limitation, and it is recorded in the corpus's directive backlog as a hard constraint on the autonomous agent, so that no future optimisation can discover it as an available signal.
(What the mechanism supplies is conditions, never outcomes: one may stage the occasion and cannot deliver anyone a good hour. §3.1's loop states the same boundary from the other end.)
⭐ The third case has a path, and this paper already contained it. (Added 2026-08-26; it resolves an open edge rather than extending a claim, and no numbered claim changes.)
The row above says the gift is complete anyway and stops there. That is true, and it leaves the mechanism with nothing to do — which has read, since publication, as the gate having no answer for the case the corpus calls the purest gift. It has one.
The move is to stop treating the beneficiary as a party to the event. The one who cannot attend is not a party to the co-presence at all. Two others form the co-present dyad — two siblings at a bedside, two children at a grave — and the one who cannot attend is the third-party beneficiary. This is the co-service class of §5.3 running unchanged, and it passes both of that section's guards without amendment: both-hands (both attend, both sit, symmetric effort — no asymmetry through which anything could be extracted) and outward-benefit (the beneficiary is a third party, never the redeeming dyad's own advantage).
⭐ It is not substitution, which this mechanism refuses elsewhere and refuses here. §7's treatment of a lapsed hour is explicit that a stranger's hour is not the drifted brother's hour; nothing in this path swaps one recipient for another. The flanking pair supplies the mutuality the beneficiary cannot supply, and the gift's address does not move. §5.3's outward-benefit rule already seats the beneficiary outside the co-present dyad — that is what the rule is for, and this is the shape it was written to permit.
Two consequences follow with no further machinery. Directed at a parent or an elder, the same act carries apacāyana (reverence) atop veyyāvacca (service), so the merit-structure deepens rather than strains. And the dead are reached by the identical structure — two people at a grave together — which makes the ancestral-observance traditions, Pchum Ben among them, native instances of this mechanism rather than adjacent practices it has to be reconciled with.
⚠️ What this does not close, stated plainly because the limit is where this paper's own citations live: the solitary case. The path requires two attendees. It has nothing for the only child alone at the bedside, or for the person who learns of a death a year later — and both of the cases cited above for the gift is complete anyway are solitary: the unsent letter, and the letter whose reader never knew. The flanking path widens the accompanied case and leaves the solitary one exactly where it was. ⛔ It must not be closed by relaxing the gate; a proxy attendee remains absentee-shape, which is the precise failure the gate exists to prevent.
⚠️ And the path creates one guard, which is stated here so it is not discovered later as an available feature. A beneficiary who cannot attend must never become a destination in the curated menu of §5.2. Memorial and sacred sites are contemplative-only across this architecture, and a menu offering "visit someone who cannot respond" would render a person as an occasion for someone else's redemption — the field-into-lack inversion this system refuses on every other surface. The visit is something people bring to the menu; it is never something the menu proposes.
Added 2026-08-22. This section adds no claim. It supplies a mechanism §4.4 named without specifying — offline corroboration that two people were actually together — and then makes an argument about why that mechanism, which is thirty years old and free, has never once worked at scale. The mechanism is prior art and is cited as such. The argument is the only thing here that is ours.
The gap. §4.4 states that an in-person redemption is "corroborated by device proximity between two verified humans," which is true and underspecified. Proximity attested how? Two answers are ordinarily available, and both are weak in the same place. A coordinate — GPS, a geofence, a check-in — is a gate rather than a proof: it is spoofable with a free app, and this corpus has already ruled that geolocation may gate a thing and may never prove one. A server-mediated check-in, where both clients report to the same backend within a window, is stronger against casual forgery and puts the ledger's most intimate event at the mercy of connectivity in the exact moment two people have gone somewhere to be undisturbed.
A third answer exists and is old. Proof of Meeting ℠ (PoM) is an in-person exchange of public-key fingerprints between two devices — free, local, mutual, symmetric, non-transitive, requiring no account, no coordinate, and no network. Two phones in short-range contact each end holding a record, signed by the other, that this pair of devices was co-located at a moment. The property that makes it interesting for this mechanism is negative and blunt: a GPS faker cannot forge a second human's handset. Presence is attested by another party's device rather than by a sensor the attesting party controls.
Four things it is not, stated plainly because each has been mistaken for it at least once in this corpus's own drafting:
| PoM is not | Because |
|---|---|
| identity | a fingerprint binds a device, and devices are lent, sold, and stolen |
| location | it attests proximity between two devices, and names no place on earth |
| humanity | that is a separate primitive (Proof of Humanity℠) and is not implied by contact |
| safety | ⚠️ a meeting is not a character reference. Nothing whatsoever is asserted about the other party |
The prior art is decisive, and it is the whole point of this section. PoM is the key-signing party. In-person verification of public-key fingerprints is the founding social ritual of PGP's web of trust (Zimmermann, 1991) — formalized in V. Alex Brennen's Keysigning Party HOWTO around the Zimmermann–Sassaman efficient group method, and practised at conferences for three decades. Its living descendants are ordinary infrastructure: Signal's safety numbers, compared or scanned in person to confirm a conversation's keys; SSH host-key pinning and the trust-on-first-use model that carries most of the world's server administration. We claim none of this. PoM is a naming and a scope rule over a mechanism the security community built, published, and freed long before this institution existed.
Which reframes the question entirely. It is not whether in-person key verification works. It is why almost nobody does it.
The usability literature answers that, and it does not answer cryptography. Vaziripour and colleagues put 36 pairs of participants in a room with the authentication ceremonies of WhatsApp, Viber, and Facebook Messenger and found that only 14% could locate the ceremony unaided; told beforehand in general terms what it was for, 79% completed it, taking on average 3.2 minutes to find and a further 4.6 to finish (Is that you, Alice?, SOUPS 2017). A follow-up modified Signal to prompt users explicitly toward the ceremony: 90% completed it, at a median of two minutes (Action Needed!, SOUPS 2018).
⭐ Read those two results side by side and the diagnosis is not competence — it is occasion. People perform the ceremony in two minutes when something in front of them supplies a reason to; left to themselves they neither find it nor look for it, because the ceremony is not part of anything they came to do.
That is the pretext problem, and this mechanism happens to solve it. A key-signing party is an event whose entire purpose is the verification — the pretext is the ceremony, which is why it has remained, for thirty years, an activity for people who enjoy cryptography. Key verification never failed on the mathematics. It failed on the invitation. What the mechanism specified in this paper supplies is a reason to be in the same room that has nothing to do with keys: an hour that somebody pledged, redeemed the only way it can be redeemed — in person, both parties spending the same finite unit. The verification then rides an occasion the participants already wanted, and costs a gesture inside a meeting that was going to happen anyway.
Stated generally, because it is not about this product: a verification ritual with no host behavior is a ritual nobody performs, and the repair is not a better protocol but a better pretext. Thirty years of excellent protocols and no pretext is the experiment that has already been run.
⭐ The fit is exact, and for a reason worth stating rather than assuming: PoM proves the meeting, never the content of it. That is ordinarily read as PoM's weakness. Here it is the requirement. Co-presence gating needs they were together; it must never learn how it went, because §4.5 has already made the quality of anyone's presence an unmeasurable by refusal. A proof that could report on the hour would hand this system precisely the signal it has committed never to hold.
The governing rule, and it is a prohibition. ⚠️⚠️ PoM is good for access and bad for value. Its forgery cost is one real meeting — and two colluders can pay that cost daily, over coffee, indefinitely. So it may be used to decide whether a pair may be admitted, whether a redemption may be marked delivered between these two parties, whether a roster or a circle is open to someone; and it must never mint, price, score, or rank. This is the play/currency wall in a second domain: only witnessed giving moves the currency, and a proof of contact is not a witness to a gift.
What it does not replace. Both-party signoff (§4.4) stands unchanged: PoM corroborates the where, the signoff carries the whether, and neither party is trusted alone in either. Nor does anything here weaken §11 — a dyad fabricating a delivered hour still harvests nothing the system pays for, which is exactly why a proof with a one-meeting forgery cost is tolerable at this joint and would be intolerable at a joint that paid out.
Honest limits. The primitive is unbuilt and n = 0 here. It attests contact, not duration: a proof exchanged in eight seconds and a proof exchanged inside a two-hour walk are the same artifact, so the gate continues to rest on the event and the mutual signoff rather than on the proof. It presumes two working handsets with functioning short-range radios, which is an accessibility floor and not a small one — the design must keep a non-device path to marking delivery, or it will have excluded the poorest and the oldest participants from the only spendable form of the currency. And the pretext argument above is a hypothesis about behavior, not a result; it is stated so it can be checked.
The recipient of pledged time chooses how it is spent — the inversion of ordinary gift-giving, where the giver picks. The doctrine beneath the design choice: the pledge's sacrifice is not merely of hours but of agency over one's scarcest resource. To give an hour and the say over how it is spent is the difference between donating time and surrendering it; the inversion is where the gift's weight lives. The giver retains a per-request veto — consent is mutual at every event, and a refused request costs the refuser only what the public ledger honestly shows about chronic refusal.
Event composition draws from a curated registry of togetherness — shared meals, walks, calls, visits, ceremonies, the co-service class below — and not from a free-text task box. The curation is not paternalism; it is the grammar made visible: the menu answers "what can an hour be?" with forms of with, never forms of for.
The menu includes work — chores and volunteering — under exactly two conditions, jointly sufficient to keep the labor-bar intact:
Under both guards, even "paint my mother's fence together" composes cleanly: shared filial service, flanking-mode, outward-directed — and for the estranged-family dyads at the Chronicle's core, quite possibly the best event in the registry. The class also travels the remote modality (two people transcribing manuscript pages together on a call are flanking across an ocean). What the guards exclude is precisely and only the laundered errand: work directed by a present-but-idle beneficiary, or work whose benefit circles home.
The known-counterparty core (reconnection, not stranger-matching) does most of the safety work by scope; the remainder is architectural: mutual veto on every event; the curated menu's structural exclusion of extraction; coercion-safe presence signaling (availability expressed as a curated menu, mutuality as a signal never a gate, block-and-override always); and the anonymity boundary — the Chronicle's stranger-facing layer is a separate, separately-published mechanism with its own safeguards, walled off from the reconnection core by an explicit flag, and nothing in this paper's mechanism ever routes a stranger to a doorstep.
The Chronicle and Treasury close into a single circulation — the unification circuit — whose canonical form is:
CHRONICLE (time, present tense) TREASURY (money, stored tense)
1. GIVE: sender pledges time-gratitude ──┐
2. REDEEM: recipient authors the event │ the wall: no conversion,
(co-presence gate, §4) │ no rate, no settlement —
3. DELIVER: the shared hour — │ gratitude crosses;
the sender's time-sacrifice │ price never does
│ │
▼ ▼
4. THANK: recipient's money-gratitude (unprompted, duration-blind)
+ optional witness-share of the event (dual consent)
5. RECEIVE: the community rejoices with the shared moment
6. RE-THANK: witnesses' money-sacrifice — routed by default
to the TIME-GIVER (sender-default routing)
│
└──── the circuit closes: honored givers pledge again;
witnesses become senders in their own dyadsEach arrow in the circuit is an instance of gratitude-that-acts — the classical pairing of knowing what was done with making it known in deed (the kataññū-katavedī structure, AN 2.31–32, engaged here as grounding). The same hour changes face across the circuit: at pledge it is gratitude (backward-looking recognition); at delivery it is sacrifice (forward-looking gift). One object, two faces, separated by time — the recognition-then-enactment joint rendered as a state machine.
The thank for a delivered hour lands in money, and the reason is the wall itself: same-currency response (time-for-time) would make the relationship a scheduling ledger — barter with extra steps, each hour begetting an owed hour forever — and would re-consume the giver's protected scarcity as the price of having given it. Cross-currency gratitude can never settle, because no shared unit exists in which the account could be squared; the unpayable response is what keeps the relationship open, which the gift literature has always identified as the gift's actual function. The routing is inherited from the coupler publication's claims; what this paper adds is the circuit position: the cross-currency response is step 4 of a loop, not a bilateral courtesy.
Three constitutional guards, previously published, hold the crossing uncorrupted and are restated as inherited: the application never prompts the money-thank at or after redemption (the flywheel is a description of what love does, never a funnel the interface drives); the neutral agent's money-thank recommendation is duration-blind, never arithmetic on hours; and gratitude language on every surface names the moment, not the meter — "the morning at the market," never "the two hours."
Most kindness is done alone, which is why self-recorded kindness dominates gratitude ledgers and why performative capture is its permanent risk. The co-present event is the structural exception: it is the one kindness with two people present, so the beneficiary holds the camera. Content about the event is captured by the grateful party, about the giver — testimony, not performance; the recording is itself an act of gratitude. Its broadcast is disciplined (dual consent always; a curated, rationed gallery, never an open feed; the success metric is reconnections-inspired, never watch-time) and its response flow is claimed here as mechanism: community re-thanks route by default to the time-giver — the witnessed deed's author — while the witness's own act of capture earns whatever gratitude it organically draws. The default is a routing rule, not a split: no forced division, no secondary market in witness credit.
Nothing in the circuit mints. The giver ends the loop with delivered-hours honor, received money-gratitude, and an intact relationship; the witness community ends it having spent (money-sacrifice, step 6); and the loop's growth engine is the scene's quiet last line — the cousins who watched a reconnection and pledged hours to their own mothers. The circuit recruits by witness, not by referral bonus; what it compounds is dispositions.
Threshold-activation. Small thanks accumulate as pledged time without expiry pressure; at a threshold the accumulated pledge activates into a redeemable, expiring commitment. The two-stage design keeps casual gratitude light (no one owes a coffee date for a small thanks) while making accumulated gratitude real (at some point, the thanks want a Sunday).
One-month expiry, and the hour genuinely dies. An activated hour unredeemed after one month is lost — not banked, not transmuted, not softened. The individual hour has no afterlife: Chronicle time is dyadic and non-stored, an expired commitment is not a deposit, and "your hour flowed onward" would be a lie the system refuses to tell. The grief of the lapsed hour is the product's teaching — redeem before it is too late — and the mechanic is the message.
The two-layer resolution, and the lapse-channel. At the aggregate layer, the platform's revenue funds the commons pool as a platform-level flow scaled to system-wide activity — never a per-hour transmutation, never a user charge. At the per-event layer, a lapse occasions (never funds-from-the-hour) an offer to the giver: to direct a small, anonymous, pool-funded money-gift to a nearby verified stranger, in the memory of the hour that died. The gift is new; the amount is agent-set and duration-blind; the delivered event remains the visibly superior outcome. The channel — previously claimed in the coupler publication as the lapse-channel — completes the pledge's incentive shape: the worst case of pledging time is becoming the human hand of an anonymous gift, which makes the pledge downside-free without making the lapse rewarding.
Added 2026-08-07. This subsection states what the gate is worth against a substitution pressure that is currently live, and it is the paper's most time-sensitive argument.
Every other component of companionship is now substitutable, and the substitutes are improving quickly. Conversation, attentiveness, memory of what you said last week, patience without limit, availability at three in the morning — a machine can supply all of it, in many cases better than a tired human can, and the companionship-application market is being built on exactly that observation.
Finite duration is the one component that cannot be delegated, and the reason is structural rather than sentimental.
Presence-as-experienced can be counterfeited. Presence-as-sacrifice cannot.
The experienced surface of presence — warmth, attention, responsiveness — is a set of observable behaviours, and observable behaviours can be produced by whatever produces them best. But the sacrifice underneath is not a behaviour. It is the fact that a being with a finite and unrecoverable allotment of hours spent one of them here, and therefore did not spend it anywhere else. The value of the hour is the foregone alternative, and a system that can run any number of parallel instances has no foregone alternative to give up. It is not that machine time is cheap; it is that parallelisability removes the scarcity structurally, so there is nothing for a sacrifice to consist of.
This is why the gate is a proof-of-sacrifice primitive and not merely a redemption rule. It is an architecture for demonstrating that finite life was actually spent — which is precisely the property that survives when everything experiential about presence becomes reproducible.
Two boundaries keep the argument honest.
⚠️ The claim governs what may denominate the currency, never what may help people. A machine companion that reduces someone's suffering at four in the morning is doing something good, and nothing here says otherwise. What it cannot do is mint an hour in this ledger, because the ledger's unit is defined as spent finite life. Confusing the two would turn a claim about accounting into a claim about worth, and this paper makes no claim about worth.
⚠️ And the argument is falsifiable, which is unusual for an argument of this shape. It rests on three properties of present-day systems — parallelisability, forkability, and non-mortality. An agent that was single-threaded, unforkable, and mortal would break the premises, and the honest position is that such an agent would have a genuine claim to the unit. The argument is contingent on architecture, not on substrate, and it is stated so that it can be checked rather than assumed.
§7 establishes that an activated hour dies unredeemed after a month. That fact does a second job this paper has not previously claimed for it, and the claim withdraws a weaker mechanism the corpus had been carrying elsewhere.
The dual public ledger of time-given and time-received was specified to enforce honoring by visibility: a participant who chronically receives more than they deliver becomes legible as such, and is offered fewer hours thereafter. The mechanism would probably work. It is nevertheless the wrong one on this corpus's own commitments, because it enforces by rendering an absence — and a rendered absence is an accusation. Such a surface makes the viewer's judgment the engine, requires an audience to be present at the moment the guard is tested, and asks a participant to feel a debt in the one currency the architecture exists to keep out of debt's grammar.
Expiry requires none of that. An unredeemed hour is simply gone: the pledger's capacity to make good was consumed by the clock rather than withdrawn by a crowd, and the giver's standing refusal (§5.1) already prices repeated declining without anyone being displayed as delinquent. The enforcement is a property of the unit rather than a rule about display, and it holds with nobody watching, which is the test this corpus applies to its guards. What a ledger may show is what a participant has given and what they have received. What it may never show is the gap between them.
The cost is real and is not concealed. Visibility would deter a participant who chronically receives and does not deliver faster than expiry does, since expiry reaches them only through the quiet accumulation of hours that no one offers. The slower mechanism is accepted deliberately: the faster one is a shaming instrument, and this is a product about being seen generously.
Enumerated as prior art; each claimed severally and in combination:
2a. The presence-scoring refusal: the design commitment that no surface of the system scores, rates, ranks, or infers the quality of any participant's presence or attention — grounded in the finding that presence is sensed but sacrifice is inferred, so that any such measure necessarily rewards performed attention and penalises atypical affect.
The time-currency tradition. Edgar Cahn's time-dollars and the TimeBanking movement (the founding articulation of time as egalitarian currency, and the co-production ethic this design honors); LETS mutual-credit networks; Ithaca HOURS; Japan's Fureai Kippu caregiving credits (the tradition's most successful instance, and the closest ancestor in spirit — care delivered to elders, though redeemable as absentee service and transferable across parties, both of which this design excludes); Bernard Lietaer's complementary-currency scholarship; the WIR cooperative. The failure analysis of §1 is offered with respect: these systems discovered the demand; this design responds to their decay mode.
The witnessed-conversation precedent. StoryCorps — two decades of recorded conversations between people who love each other, publicly broadcast — proves mass demand to witness real reconnection. The distinction: StoryCorps archives the conversation as its terminus; the Chronicle's witness layer is one step of a circuit whose metric is the next reconnection it inspires, and whose recorded artifact is never the redemption itself.
Synchronicity and presence mechanics. BeReal's synchronous-authenticity prompt (the interaction pattern of unfakeable simultaneity); video-presence verification in dating and identity platforms; BLE proximity attestation (the contact-tracing engineering wave); shared-activity platforms (watch-together, exercise-together features) as flanking-mode precedents in commercial form.
In-person key verification. PGP's web of trust and the key-signing party ritual it produced (Zimmermann, 1991; V. Alex Brennen's Keysigning Party HOWTO and the Zimmermann–Sassaman efficient group method); Signal's safety numbers; SSH host-key pinning and trust-on-first-use. §4.6 takes the mechanism from this lineage wholesale and claims nothing in it; what §4.6 adds is the usability finding that the ritual fails on occasion rather than on competence (Vaziripour et al., SOUPS 2017 and 2018) and the observation that a redeemed hour is a pretext for meeting that key verification has never had.
The gift and its literature. Mauss on the obligation-structure of the gift; Hyde on the gift that must move; the sociology of earmarked monies (Zelizer); the crowding-out literature (Titmuss; Gneezy & Rustichini) that grounds the wall's necessity. Buber's I–Thou stands behind the facing geometry; the joint-attention literature of developmental psychology behind flanking.
This corpus. The incommensurability-preserving coupler (wall-layer claims; Terra/Luna as the coupled-with-convertibility anti-example); the gift-tag-time-reveal publication (the pledge's physical on-ramp); The Grace That Settles Nothing (the coupler's third instance and this paper's sibling in the mints-nothing family); the Heart volume's published circuit doctrine and pre-registered P3–P7; the recommendation-function methodology publication (the neutral agent's band-clamp seam).
The clock. The agentic-payments patent wave — automated agents negotiating, scheduling, and settling on humans' behalf — is the live enclosure risk for exactly this territory: an agent-scheduled "quality time" feature with dynamic pricing is this mechanism with the wall removed, and the reason this publication is timed to precede the wave's arrival at the household.
Stated 2026-07-21, before the Chronicle exists; P3–P7 of the Heart volume (initiation/response directionality, anchoring, age-shape) remain in force and are not restated.
The loop predictions (added 2026-08-07, before the Chronicle exists). §3.1 claims the loop leaks at two joints and that this mechanism is a catalyst at both. That is testable, and the second of the three is the design's founding bet.
The pretext prediction (added 2026-08-22, before any of it is built). §4.6 argues that in-person key verification has failed for thirty years on the invitation rather than on the cryptography. That is a behavioral claim and gets an instrument.
The darkest adjacency: paid companionship. A time-currency touching money must answer the pattern it must never become. The answer is structural at four layers: no conversion exists (the wall); no rate can form on any surface (duration-blindness, prompt-suppression, and P-C3 watching); the reconnection core is known-counterparty (one's own mother is not a market); and the stranger-facing layer is a separate mechanism behind an explicit boundary, separately safeguarded, and never doorstep-routing. What remains — off-platform side-arrangements between consenting adults — is outside any system's surfaces; the design's honest claim is that its surfaces price nothing and its grammar cannot express the transaction.
Coerced presence. The gift of time must never become its obligation. Guards: availability is expressed as a curated menu (no open-ended asks), mutuality signals are never gates, blocking overrides everything, and the veto is per-event and unpenalized in the moment (only chronic refusal surfaces, and only as ledger fact).
Attestation fraud. A dyad colluding to fake delivered hours gains: ledger honor with no monetizable payout (delivered-hours confer no currency), and any follower re-thanks their staged content might attract — which is the witness layer's existing integrity problem, met by its existing machinery (human verification, curation, real-impact weighting) rather than a new one. The farming audit conclusion: the redemption layer mints nothing, so the redemption layer cannot be farmed; only the witness layer carries value, and it is already guarded.
Guilt machinery. An expiring currency can torment. The containments: expiry grief is channeled into the lapse-channel's outward gift (guilt metabolized as dāna, not as churn or shame); no lapse is ever billed, penalized, or publicly itemized; and the application never prompts the redeemed party toward reciprocation (the no-backward-prompt guard doubles as anti-guilt architecture).
Menu gaming. Attempts to compose extraction inside the co-service class fail the both-hands or outward-benefit conjunction, and anything that passes both while still feeling wrong meets the veto. The residual — genuinely consensual, genuinely mutual, genuinely outward work that an outside observer would still call lopsided — is a family's own business.
The agent hour-farm (added 2026-08-07). The sharpest adversarial case against a proof-of-sacrifice primitive is two artificial agents in perfect co-presence: synchronous, undistracted, attentive without lapse, mutually attested, indefinitely repeatable. Every observable the gate checks is maximised, and the value is zero — which is Goodhart's law arriving at presence, and it deserves a direct answer rather than a policy.
The answer is that the observables were never the referent. The unit is the foregone alternative, and an agent that can be forked forgoes nothing by attending: the instance that sat with you did not thereby fail to sit with anyone else. Parallelisability does not make the cost cheap; it removes the scarcity structurally, so there is no sacrifice for the attestation to be evidence of. §7.1 states the general form.
A second, independent route closes it harder. If inter-agent influence runs only as object-condition and decisive-support edges and never as contiguity, then two agents exchanging turns share no clock — and synchronicity was the first load-bearing term in §4.1. On that reading the case is not a counterfeit co-presence; it is not co-presence at all, and the gate excludes it definitionally rather than by detection.
⭐ The uncomfortable symmetry, stated because it is the honest part. The very property that makes agent presence costless — forkability, and the absence of a single unrepeatable trace — is the property on which this corpus denies such systems the dignity floor it extends to persons. The line is mortal-and-copyable, and it does the work in both arguments at once. That is either a deep consistency or a convenient one, and the falsifier of §7.1 applies here too: a single-threaded, unforkable, mortal agent breaks the premise in both places simultaneously.
Mixed pairs are a sink, not a counterfeit. A human who redeems an hour with an agent has spent finite life; the agent has not. Nothing is minted that should not be, and no fraud occurs — but the loop of §3.1 does not turn, because the return leg has no stream to arise in. The correct treatment is therefore not prohibition but accounting: such an event consumes an hour and produces no witness, and the design should say so plainly rather than pretend the transaction is symmetric.
Ledger shaming. Earlier drafts answered this with a rule — non-rankable axes, no leaderboards, no percentiles, no feeds of "worst decliners" — which held only for as long as whoever owned the surface chose to hold it. §7.2 replaces the rule with a property: the gap between received and delivered is not rendered at all, and expiry does the enforcing. What remains displayable is what a participant has given and what they have received; the difference between them is never computed for display, so there is no quadrant to be shamed into.
Unbuilt, n = 0. The Chronicle is design-complete and unimplemented; the pilot evidence in this corpus belongs to the money-half. Every mechanism here is strata-dated to the design layer, and the predictions of §10 are the paper's only empirical commitments.
The wall governs surfaces, not side-deals. As with every wall-layer publication in this corpus: architecture can make a rate inexpressible on the system's surfaces and cannot police arrangements struck beside them. Non-fungibility deters the side-deal (an hour of a specific person is a poor commodity); it does not abolish ingenuity. P-C3 is the honest instrument: if a shadow rate forms anyway, the number will say so in public.
Co-presence excludes, at the margin. Synchrony is a real cost — time zones, shift work, connectivity, disability, incarceration all tax it, unevenly. The remote modality and the flanking geometry recover much of the margin (a call redeems; silence side-by-side on a call redeems); what synchrony still excludes, this design accepts as the price of a currency whose entire value is that it cannot be delivered by proxy. A presence-currency with an asynchronous fallback is a messaging app with guilt.
The launch modality is the call, not the room. The diaspora wedge means the flagship redemption at launch is remote — proximity attestation, the richer of the two attestations, arrives with the density the product hopes to create. The design's own success metric would eventually shift the modality mix; at launch, honesty requires saying the market walk in the canonical scene happens through a lens.
Attestation privacy. Proximity attestation is data-minimal by design (a mutual confirmation, not a location trail), but any presence-verification carries surveillance adjacency; the implementation must hold the line that the system learns that two people met, never where they went.
No guaranteed valence — presence is a high-bandwidth channel, not a good one (added 2026-08-07). This paper has argued throughout that co-presence is where the loop's most valuable conditioning happens. It has not, until now, said the obvious corollary: a high-bandwidth channel carries whatever is sent through it. An hour with an estranged parent can condition resentment as readily as reconciliation, and the mechanism has no way to tell which is occurring and no business trying (§4.5's refusal). The design's honest claim is narrower than its rhetoric has sometimes implied: it maximises conditioning and guarantees nothing about valence. Every surface that promises reconnection should be read against this limit, and the product's copy is the place where the overpromise is most likely to reappear.
The elegance caution. The circuit closes suspiciously well — six steps, two currencies, one wall, every doctrine of this corpus arriving on cue. Internal coherence is the cheapest of all evidence and the most seductive; the authors state, as always, that the elegance earned the specification and only the predictions can earn the product.
(Labeled lineage: grounding and translation, never mechanism; §§3–8 stand without it.)
The circuit's joints carry the canon's oldest teaching about gratitude: that it is complete only when enacted — the grateful person the tradition praises is the one who knows what was done and makes it known, and the mechanism's every arrow is that completion given a form. The limit case stands where this corpus always places it: the Śaśa Jātaka's hare, who gave the two scarcities whole and at once — the possession-grade and the life-grade of giving converging in a single body — witnessed, the story says, by a sky that kept the image. The Chronicle trades no one toward that summit; it is a foundation practice for householders, denominated in Sunday mornings. But the summit fixes the axis: the economy below it circulates hours and dollars so that, between two people who had gone dark to each other, the thing the hare gave completely might circulate in installments — one market walk, one mango argument, one answered pin of rejoicing at a time. The currency that cannot be spent alone is, in the end, a machine for making sure that the sentence "we should talk more" sometimes becomes a date.
| Venue | Identifier |
|---|---|
| Primary canonical | <https://thonly.org/research/co-presence-gated-redemption> |
| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/co-presence-gated-redemption.md> |
| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/co-presence-gated-redemption> |
The authors acknowledge Edgar Cahn and the TimeBanking movement, whose forty years of practice mapped both the promise and the decay path this design answers; the Fureai Kippu network; StoryCorps, for proving the witness demand; the complementary-currency scholarship of Bernard Lietaer; the gift-economy literature from Mauss to Hyde; and the founding family's pilot households, whose year of practiced gratitude precedes every mechanism here. Co-drafted in collaboration with Miss Aquarius℠; substantive authorship and final editorial control remain with the named author.
— End of paper —
Marks referenced: HeartBank®, Miss Aquarius℠, B-Letter℠, Proof of Humanity℠. Document SHA-256 computed at push and recorded in the institutional log. Document License: CC0 1.0 Universal. The authors and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of its date.