DOI: https://doi.org/10.5281/zenodo.21947375
Canonical: https://thonly.org/research/sacrifice-witness-without-discharge · Licence: CC0 1.0
v2 note (2026-08-07): one new design-layer subsection, one line added to the refusal set, and one paragraph added to §7.5 — and the sweep that produced them found the larger part of the ordered work already done. The backlog carried the session-light colour broadcast as pending; §7.5 has carried it since 2026-07-23, including the descent-not-accumulation invariant, the two-lights naming discipline, the vow, and the no-walk-gate commitment. What was genuinely missing is specified now. New §7.6 states the mascot's two-beat call format (says → the child acts; wonders → the child learns), the content rule the second beat carries, the deliberate deletion of the discrimination task, and the fact that the reveal mints nothing. §7.5 gains a paragraph on the mascot reflecting rather than issuing the session colour. ⚠️ And §4.2's refusal set gains one line — no indictment copy on any teaching or practice surface — which is the only part of this revision that is claims-adjacent. It does not amend claim 3, whose enumeration concerns accumulators rather than copy, and the eight claims of §8 stand unchanged; but a refusal set is a claims-grade artifact in this paper's architecture, so the addition is marked here for the editor's deliberate sign-off rather than folded in silently. No prior-art clock runs from this push; the re-stamp is for text integrity.
Draft notes for the editor: this is the defensive publication for B-Grace℠, the gratitude-meditation application planned as the initial launch of THonly™'s thonly.net surface and the digital first domino of the HeartBank® family. The prior-art clock starts at this document's markdown push; the site module is deliberately deferred. The mechanism described here is design-complete and unbuilt (n=0); the paper's claims are architectural, its predictions pre-registered, and its honest-limits section states the unbuilt status plainly. Companion doctrine: the incommensurability-preserving coupler (this mechanism is its third instance), the spent-time floor, and the two-blindnesses guards, all previously published in this corpus.
Every existing system that connects consumption to conscience runs on the same mechanism: quantify the harm, price the remedy, sell the discharge. Carbon offsets convert emissions into purchasable absolution; their documented failure mode is moral licensing — the offset does not merely fail to reduce consumption; it licenses more of it. The same architecture has been tried before, at civilizational scale, under an older name: the indulgence. The failure is not in the accounting's accuracy. It is in the existence of the account — the moment a remedy is denominated in the same ledger as the harm, a conversion rate forms, and conscience becomes a market.
This paper specifies the inverse mechanism, designed for the most universal consumption event there is: the meal. A photograph of food is resolved into its ingredient beings — the plants and animals whose lifespans became the eater's nourishment — and each being's time-sacrifice is presented as a factual biography (a broiler hen: forty-two days; her species: up to eight years), individually, without aggregation into any balance. The eater is invited to answer the witnessed sacrifice with a gratitude practice in nature — a walking or sitting meditation, dedicated to the beings consumed — whose recommended form is a ceremonial unit set by a neutral automated agent and never scaled to the meal. Nothing is discharged, because the mechanism maintains no account to discharge: the sacrifice is witnessed, the acknowledgment is made, and the two are never entered into a common ledger. We name this architecture sacrifice-witness without discharge, and we argue it is the only shape under which a consumption-conscience system avoids becoming an indulgence market: the anti-offset.
The paper specifies the full mechanism — the witness engine and its two-source data architecture (a curated food-species table for the eaten; wild-organism identification for the living encountered at the practice site); the non-equation and its no-balance invariant; the two-movement dedication grammar (to the departed beings consumed, and outward to a community that marks its rejoicing with location pins rather than scores); the phoneless bracketing that keeps the application structurally absent during the practice it frames; and the child-safe mode. Eight claims are enumerated as prior art and dedicated to the public domain; three predictions are pre-registered, including the falsifiable wager that distinguishes this design from every offset system: witnessed sacrifice without discharge will not license increased consumption. The authors will not seek patent.
Keywords: gratitude practice, mindful eating, moral licensing, carbon offset, indulgence, time-sacrifice, merit dedication, meal-anchored habit, species identification, contemplative technology, defensive publication.
This document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The authors and HeartBank® will not seek patent on any mechanism, architecture, taxonomy, interface pattern, or specification articulated herein, in any jurisdiction, at any time.
The following terms are coined in this paper and simultaneously freed with it: sacrifice-witness, witness-without-discharge, the non-equation, ceremonial acknowledgment unit, phoneless bracketing, presence-marks, the anti-offset. They may be used by anyone, for any purpose, without attribution.
Components of this mechanism exist in distributed prior art — photographic food recognition (the calorie-scanning application class), species identification from images (iNaturalist and its relatives), location-based social mechanics, meditation-session applications, and the contemplative meal-reflection traditions surveyed in §9 and §13. The synthesis as specified — lifespan-biography witness with an explicit no-balance invariant, a duration-blind ceremonial response, a two-movement merit-dedication grammar with presence-marks, and structural absence of the mediating device during the practice — is, to the authors' knowledge, not previously published as a coherent architecture.
Two failures motivate this mechanism, one contemplative and one economic.
The householder's gap. The retreat works because it removes the choice: meals are served, sits are scheduled, and the practitioner's responsibilities wait outside the gate. The householder's life restores the choice and the practice loses its anchor — not for lack of sincerity but for lack of a daily trigger that survives contact with obligation. Meditation applications attack this problem with streaks, reminders, and gamified continuity, importing the attention economy's retention machinery into the one domain that exists to dissolve it. The result is well documented in the category's retention curves: the streak works until it breaks, and when it breaks it takes the practice with it, because the practice was anchored to the score rather than to anything in the practitioner's actual day.
There is, however, a trigger that requires no streak, no reminder, and no gamification, because it is older than fire and arrives two to three times daily without fail: the meal. Nearly every contemplative tradition discovered this anchor centuries ago — the meal-reflection is among the most widespread of all lay practices (§13) — and modern habit research rediscovered it as the reliability of stacking a new behavior on an invariant daily event. The mechanism specified here is, at bottom, the oldest anchor connected to the oldest gratitude.
The offset trap. The economic failure is subtler and more dangerous. Systems that connect consumption to conscience almost universally adopt the offset architecture: measure the harm in some unit, price a remedy in the same unit, and let the consumer purchase equivalence. Carbon offsets are the contemporary flagship, and the empirical literature on moral licensing records the architecture's characteristic failure: establishing moral credit in one column licenses moral relaxation in another. Consumers who purchase green products cheat and steal more in subsequent tasks than those who merely viewed them (Mazar & Zhong 2010); moral self-licensing is a robust, replicated effect across domains (Merritt, Effron & Monin 2010). The offset does not merely leak; it inverts — the discharge mechanism becomes a consumption license. The historical anti-example is exact enough that we state it plainly: an architecture that quantifies transgression and sells its remission is an indulgence market, and the Reformation is the case study in how such markets end.
The trap generalizes to any contemplative-consumption design. A meal application that computes the "sacrifice cost" of eating and lets meditation "burn it off" — the naive gym metaphor — has built an indulgence market for the dinner table: meditate it off, eat what you want. Its own stated purpose (mindful, bounded eating) would be structurally defeated by its own mechanism. The design problem, precisely stated: how does a system make the sacrifice embodied in consumption fully visible, and invite a genuine response to it, without ever forming the exchange rate that converts response into license?
The answer specified below inherits its spine from doctrine this corpus has already published: the two currencies of the reciprocity economy are coupled but never convertible, and the coupling can only be held open by a neutral agent whose recommendations are blind to quantity (the incommensurability-preserving coupler). This paper is that coupler's third instance. The first held money and time apart while letting gratitude flow between them; the second held one person's hour apart from another's; this one holds the largest pair of all: what nature gives, and what a human can answer.
Connection to the unified mission frame. HeartBank's mission is the restoration of humanity to the middle way at population scale. The meal is where every human meets the natural world's sacrifice three times a day, almost always without seeing it; the practice-gap is where modern householders lose contact with the contemplative traditions that once structured that seeing. One mechanism that closes both — visibility without guilt-accounting, practice without gamification — is mission-native infrastructure, and it is deliberately the family's first public surface: the world's introduction to a gratitude economy should be a practice that asks for nothing and settles nothing.
A father photographs lunch at the kitchen table. The application names the beings on the plate: rice — one hundred twenty days, its whole season; a hen — forty-two days. He taps once more and reads that her kind can live eight years. No number turns red; nothing is totaled; nothing is owed. That evening he walks the neighborhood with his daughter — the application suggested a short walk, as it would have after any meal — and before they leave, she pins the park at the corner, coarse, the whole block. Phones go into pockets. They walk, and they dedicate the walk to the hen and the rice, by name. At the park the daughter points the camera at a tree afterward and learns it is a tamarind, and that the sparrows in it are the hen's distant kin; she dedicates a wish to the sparrows too. At home, the rabbit with the jade bowl asks her what she saw, and never asks how long they walked. The father shares the dedication; by morning, an aunt in Kâmpôt has answered it with a single pin on the map — I rejoiced with this — and nothing else. No score changed anywhere in this scene, because no score exists.
The full loop, in the order a user lives it:
THE PLATE (the departed) THE PARK (the living)
1. photograph the meal 4. go outside; pin a location
│ │ (coarse by default)
▼ ▼
2. the WITNESS: 5. the PRACTICE (phoneless):
ingredients resolved to beings; walking or sitting
each being's time-sacrifice meditation, dedicated to
shown as a BIOGRAPHY — the beings witnessed at
per-being, factual, no total, the meal — the DEDICATION
no balance (vertical movement)
│ │
▼ ▼
3. the INVITATION: 6. the SHARE (optional):
a ceremonial practice the dedication broadcast
recommendation from the as a merit-share; others
neutral agent — flat, answer with location
never scaled to the meal PRESENCE-MARKS, never
scores (horizontal
movement)
INVARIANT ACROSS THE LOOP: no account connects the left column to
the right. The meal is witnessed; the practice is made; neither is
denominated in the other. Nothing is discharged because there is
no ledger on which a discharge could be entered.The two columns are the mechanism's two movements, and §13 names their lineage: the vertical dedication (to beings now departed) and the horizontal share (to a living community invited to rejoice). Everything else in this paper specifies one of the loop's six stations or the invariant that binds them.
The contrast with the offset architecture, in one table:
| Offset architecture | Sacrifice-witness without discharge | |
|---|---|---|
| The harm/gift | quantified into a fungible unit | witnessed as per-being biography |
| The account | running balance (debt/credit) | none — no accumulator exists |
| The remedy | priced in the harm's unit | ceremonial, flat, duration-blind |
| Equivalence | explicit (N units ↔ M remedy) | structurally impossible |
| Completion state | "discharged / neutral / net-zero" | "witnessed and answered" |
| Documented failure | moral licensing; leakage;市场 capture | (pre-registered: P-G1, §10) |
| Historical ancestor | the indulgence | the grace before the meal |
The user photographs the meal. A food-recognition model — the calorie-application class of vision model, not a wild-organism identifier — resolves the photograph into an ingredient list, and the ingredients are mapped to their source species. The output of this stage is not a nutritional panel but a cast of beings: the rice plant, the hen, the carrot, the fish.
For each being, the witness presents a short biography whose centerpiece is the being's time-sacrifice: the span of life that became this food. The load-bearing data decision is that this is the farmed time — the life actually lived — not the species' natural potential:
The farmed number is the honest primary fact: it is the time that was actually given. The natural span is available one layer deeper, for the eater who wants the fuller biography — and the juxtaposition, where it exists, is presented bare. The mechanism's discipline here is visibility, not verdict: the numbers are facts; the application attaches no judgment, no red badge, no moral color-coding. (The design constraint this discipline serves — and the doctrinal honesty behind it — is stated in §12.) Wild-caught beings carry their conservation status as an additional bare fact. Where the recognition model is uncertain, the biography says so: a witness that guesses confidently is not a witness.
The witness presents beings severally. There is no meal total, no daily total, no lifetime total, no "sacrifice score." This is not an interface preference; it is the mechanism's central invariant (§4.2), enforced at the data layer: the schema contains no accumulator. The most important engineering decision in this paper is a field that does not exist.
The engine draws on two deliberately separate sources, mirroring the loop's two columns:
The plate — a curated food-species table. Humanity's diet concentrates on a remarkably small set of species; on the order of one to two hundred cover nearly every meal served on earth. Lifespan and husbandry data for these species is well-established but scattered (animal longevity in the AnAge database; trait aggregation in the Encyclopedia of Life's TraitBank; aquatic species in FishBase; farmed durations in the agronomy literature) and is therefore curated once into a maintained table — with per-entry sourcing, regional variance noted, and estimates marked as estimates — rather than fetched live from any single API that does not in fact hold it.
The park — wild-organism identification. At the practice site, a separate identification layer — the iNaturalist class of computer vision, built precisely for living organisms photographed in nature — lets the practitioner meet the beings around them: the trees, birds, and plants of the place where the dedication is made. The two sources never mix roles: the table knows the departed; the identifier knows the living. §7 develops what the park layer is for.
Having witnessed the meal's beings, the user is invited to answer with a gratitude practice in nature — a walking meditation through the neighborhood, a sitting meditation in a park. The invitation carries a recommended form — a short walk; a sit of modest length — issued by the system's neutral agent (Miss Aquarius℠, the same agent whose sole-set neutral units anchor the corpus's other coupling mechanisms). The recommendation is ceremonial: a flat, standard practice-form, the same after a snack as after a feast, never computed from the meal's contents, count, or biography.
This is the non-equation, and its rationale is doctrinal before it is defensive. Under the corpus's published tense doctrine, what the eater received is stored lifespan — the completed past of beings now departed — and the dead cannot be repaid: no quantity of present practice converts into restored past life. A recommendation scaled to the meal would assert precisely the conversion that is impossible, and every downstream pathology of §1's offset trap would follow from that single assertion. The ceremonial unit refuses the conversion at the root: the practice answers the gift; it does not price it. In the corpus's inherited language: the hour of presence is a new gift in the beings' memory — never the old gift refunded.
The non-equation is enforced by an invariant stated here as prior art in its strongest form:
The system maintains no account in which consumed sacrifice and performed practice are commensurable. There is no balance that meals increment and meditations decrement; no "remaining," "owed," "neutral," or "net" state; no per-meal or per-period total of either column. What the system keeps is an append-only witness log — meals witnessed, practices made, dedications spoken — a record of moments, not a ledger of amounts.
Three interface corollaries, each individually claimed:
The full refusal set, enumerated as design commitments (the mechanism is defined as much by what it will not build as by what it builds): no balance · no discharge rate · no completion arithmetic · no duration display · no streaks · no leaderboards or rankings · no per-user totals · no dietary verdicts or prescriptions · no comment threads on dedications (the presence-mark is the only response primitive — removing, by construction, the surface on which food-shaming and moral brigading would otherwise occur) · no advertising on any witness or practice surface · no indictment copy on any teaching or practice surface — a creature is named by what it is, never by what was done to it, and what is absent from a place is not rendered as absence (added 2026-08-07; the mechanism is §7.6, and the reason it belongs in this set rather than in a style guide is that rendered absence is the route by which an obligation re-enters a design that refuses obligations). Each refusal is individually load-bearing; together they are the non-equation's enforcement.
With the non-equation and the no-balance invariant in place, the licensing pathway is structurally severed. Moral licensing requires a credit — a represented quantity of moral standing that consumption can spend. This mechanism represents no credit: the practice produces no fungible token, no score, no offset certificate, nothing that could be mentally banked against the next indulgence. What it produces is a memory of having seen — and the pre-registered wager of this design (P-G1, §10) is that seeing without settling shifts consumption down or not at all, where settling reliably shifts it up.
The economic statement of the same point, in the corpus's terms: the offset architecture is coupling with convertibility — the exact configuration this corpus's coupler doctrine identifies as the kill vector in every domain it touches. The anti-offset is coupling without convertibility: the meal and the practice are joined by a neutral agent that transmits gratitude between them while refusing, by construction, to transmit price.
Before the practice, the user pins a location (coarse by default). During the practice, the user dedicates the walk or sit to the beings witnessed at the meal — beings that are, without exception, departed. The mechanism's cultural depth here is not incidental and §13 states its lineage precisely; the design fact is that the dedication is the practice's aim, transforming a generic mindfulness session into a directed act of gratitude with named recipients.
After the practice, the user may broadcast the dedication — the place (coarse), the beings, optionally the reflection that accompanied it. Others who encounter the broadcast may answer with a presence-mark: a location pin that says I rejoiced with this, and nothing else. Presence-marks carry no count toward any score, confer no rank, and accumulate no leaderboard; a map of them is a map of where rejoicing happened, legible as geography and illegible as competition. The pin, like the practice, marks a moment.
Two guards inherited from the corpus's witness-layer doctrine travel with the broadcast: the share is opt-in and secondary (the private practice is complete without it), and provenance is human-verified (a broadcast dedication is signed by a verified human; the witness layer of a gratitude economy cannot be synthetic).
The broadcast layer is explicitly not a feed optimized for watch-time, not a follower-count surface, and not a virality engine; its success metric is practices inspired, the only downstream event worth counting. The design anticipates the performativity critique and answers it structurally: with no scores, no streaks, no duration display, and no per-user totals, the surface offers performance almost nothing to perform for.
The deepest contradiction available to a meditation application is to place a screen at the center of the one activity that exists to put the screen down. The mechanism resolves this by bracketing: the application acts before the practice (the witness, the invitation, the pin) and after it (the log, the optional share), and is structurally absent during it. The canonical session is: pin → pocket → practice → return. No in-practice screen, no guided-audio dependency in the core loop, no live timer, no mid-session interaction of any kind. The application is the frame, never the mediator; the practice happens between a person and a place.
This is claimed as an architectural commitment, not a usage suggestion: the core loop is designed so that no feature requires the device during practice, and session integrity never depends on in-practice device state. (A consequence with independent value: the practice is fully functional where devices fail — the signal-poor park, the airplane-mode retreat, the pocket that stays closed.)
The witness introduced the eater to beings who are gone. The park layer introduces them to the same families, alive: the identification camera, used before or after the phoneless practice — never during — resolves the trees, birds, and plants of the practice site. The design sentence the feature exists to deliver: the being on your plate has living kin in this park. The dedication made to the departed is thereby surrounded by the living, and the practitioner's gratitude acquires a second, present-tense address: dedication may be extended to the living beings encountered at the site — met, named, and included.
Identifications made at practice sites are, at the user's choice, contributable to public biodiversity databases — the observation networks on which the identification models themselves are trained. The gratitude practice thereby feeds the commons that enables it: citizen science as the give-forward, the corpus's circulation atom appearing unforced at the data layer. This is a v2 surface and is claimed as architecture, not promised as launch scope.
The practice is teachable to children, and the mechanism's teacher is already constituted: the HeartBank family's mascot — a rabbit holding a bowl, saying grace — whose standing constitutional boundary in this corpus is exact for the role: he demonstrates and teaches; he never keeps score. The character who says grace but never meters the sacrifice is the non-equation in a form a five-year-old can love.
The child's mode is governed by a hard privacy floor, stated as a claim because it is a design commitment and not merely compliance: family-scoped only — no public pins, no location broadcast, no public sharing of any kind from a child's account. A child dedicates, learns, and rejoices inside the family circle; the horizontal movement's public surface is an adult surface. Identification features for children follow the established child-safe pattern of the species-identification category (accountless, on-device where feasible).
Meal photographs are processed on-device where the platform permits, and are never required to leave the device; what leaves is what the user chooses to dedicate and share. Location pins are coarse by default, delayable, and anonymizable. The witness is private by construction; only the dedication is ever public, and only by choice.
Added 2026-07-23. This subsection describes a design layer above the mechanism specified in §§2–7. It adds no claim to §8 and amends none; every invariant of §4 governs it unchanged.
The park layer poses a design problem the witness layer does not. The witness is complete in a moment — a meal is seen, its beings are named, the practitioner sits. The walk is extended, voluntary, and easy to abandon; it is precisely the surface on which a gratitude application is most tempted to reach for the retention mechanics the rest of this paper refuses.
The resolution keeps the refusal and supplies the pull from the opposite direction. The walk carries a session state that begins full and descends toward empty as the practitioner gives — each living kin met and dedicated to, each wish sent, each site identification contributed to the commons draws it down. The state is never rendered as a number. It is rendered as colour: a light that travels the palette as the session empties, arriving at white when nothing is left held. A practitioner reads their session the way one reads a sky, not the way one reads a balance.
Six commitments hold this consistent with the mechanism rather than making it an exception:
The firewall (load-bearing). The session light exists only on the horizontal movement — the walk toward the living kin (§5, §7.1). It never appears on the vertical movement, and no session state is ever computed over a meal. Nothing about the consumed beings is emptied, settled, or whitened; §4's non-equation is untouched because the light never touches the meal. What descends is the practitioner's own holding of goodwill toward the living, never a debt to the departed.
Descent, not accumulation. The state's motion is downward and its terminus is zero. It is not a score that grows with practice; it is held goodwill that the practice spends. A practitioner who gives nothing keeps a full light and has thereby accumulated nothing; a practitioner who gives everything ends at white and carries nothing forward. Whatever goes unspent returns with the next session's beginning rather than banking — §4's return-to-zero calendar in miniature, per session rather than per year.
Colour is not a metric. The light carries no numeral, no total, no rank, no comparison, and no continuity mechanic. It is not summed across sessions, not displayed as a history, and not comparable between practitioners: two people at white have each finished their own session and stand in no relation whatever. This is §5's presence-mark discipline applied to the session's own state — a mark that something happened, carrying no measure of how much.
Two lights, one palette (a naming discipline). This corpus already specifies a persistent visual signal earned by a person's real giving history across the wider system. The session light is a different signal drawn in the same palette: persistent versus ephemeral, history versus session, earned versus spent. The two must remain visually distinct in form, and product copy must never call the session light by the persistent signal's name. Collapsing them would silently convert an unscored session state into a reputation — the exact failure this subsection exists to prevent.
The vow, and the silence it does not inspect. A practitioner may close a session by committing to sit. The commitment, not the sit, is what the design registers: the light resolves to its terminal state at the moment of the resolve, and the sit itself passes unobserved, unverified, and untimed, exactly as §6 requires. This is deliberate rather than approximate. A resolve is something a person can honestly declare; the quality of a silence is not something an application can know, and a design that tried to know it would have to put the screen back inside the practice. A practitioner who declares the vow and does not sit has gained a colour and nothing else — there is no economic surface to defraud, which is why an honest declaration is sturdy enough to build on.
The mascot reflects, and only reflects. Where the character of §7.3 is present on the walk surface, the session's colour may show on him — he carries the light rather than issuing it. The constitutional boundary is unchanged and is what makes this safe: a teacher who reflects a state the practitioner produced is still not keeping score, whereas a teacher who awards a colour has become an assessor. The direction of the arrow is the whole of the constraint.
No walk is required. A session may consist of the vow alone. Rain, illness, limited mobility, grief, and a biodiversity-poor neighbourhood are each sufficient reason, and none of them caps the light: the terminal state is reachable by resolve from anywhere. The walk's pull is the delight of meeting the living kin, never privileged access to the colour. This is stated as a commitment because the alternative quietly rations the practice by geography, and the practitioners with the fewest parks are seldom the ones with the most of anything else.
Added 2026-08-07. Design layer, as §7.5: it adds no claim to §8 and amends none. It does add one line to the refusal set of §4.2, which is flagged there rather than here.
§7.3 establishes a teaching character who demonstrates and never keeps score. This subsection specifies the call format through which that teaching is delivered on the park layer, because the format turned out to be where a doctrine this paper argues abstractly becomes a concrete slot with a rule in it.
The call has two beats and no third:
"<Mascot> says: ..." → the child ACTS (crouch, look, listen, offer)
"<Mascot> wonders: ..." → the child LEARNS (one fact about the creature)The wonders beat carries a hard content rule, and it is the rule this corpus states as a design signature: name what the creature IS — never what was done to it. "A chicken can recognise more than a hundred individual faces" is a wonder. "A broiler chicken lives forty-two days" is an indictment, and it belongs — where this paper already puts it, in the §3 witness engine, addressed to an adult who chose to look. The distinction is not squeamishness about children. It is the paper's own thesis applied to copy: wonder settles nothing, whereas indictment demands penance, and a practice that leaves its practitioner owing something has re-created the offset trap in the register of feeling rather than of arithmetic. A child who learns that chickens know faces has been given a reason for gratitude. A child who learns that chickens are confined has been given a debt, and the whole architecture of §4 exists to refuse debts.
Two specific prohibitions follow and are worth writing down because both are the default behaviour of the genre. No grading of creatures — the field guide's reflexive pest and beneficial, invasive and native-good, are verdicts about a being's worth to us and are barred on the same ground as §4.2's dietary verdicts. No rendering of absence — an empty park, a species not found, a habitat diminished, are not surfaced as loss; what is present is named, and what is not present is simply not named. A screen that displays what is missing has accused someone, and the practitioner is the only person standing there.
The discrimination task was deliberately deleted, and this is recorded so that no future reader restores it. An earlier form of the call was a discrimination game on the pattern of Simon Says — act on one prefix, withhold on the other. Removing the response requirement from the second beat removes the game: with nothing to withhold, there is nothing to discriminate. The cadence survives; the stakes do not, and that is the intended result rather than an oversight. What replaced the obey/ignore alternation is a different pair entirely — give attention / receive attention — which is the same two movements the mechanism runs at §5, rehearsed at a scale a five-year-old can hold.
And the reveal mints nothing. A fact learned, a creature met, a wonder delivered — none of these move value anywhere in the wider system. The lesson may generate the story; only witnessed giving moves the currency. This is the corpus's standing wall between play and value, applied here so that a teaching surface cannot quietly become an earning surface.
Enumerated as prior art; each is claimed severally and in combination:
The offset architecture (the anti-example). Carbon-offset consumer products and markets; their moral-licensing literature (Mazar & Zhong 2010; Merritt, Effron & Monin 2010) and integrity critiques; and the historical indulgence as the architecture's oldest instance. This paper's mechanism is defined against this class, and the class is therefore its most important prior art.
Food-recognition applications. The calorie-scanning class (MyFitnessPal and successors; the photograph-to-nutrition wave) established the interaction primitive this mechanism inherits — photograph the plate, receive an analysis — and equally established the pathology this mechanism must not inherit: quantified tracking's slide into obsession and moralized eating (§12).
Species identification. iNaturalist and its computer-vision identification; Seek's accountless, child-safe on-device pattern; Pl@ntNet; Merlin. The park layer is an application of this class, not an extension of it; the contribution here is the linkage to the witness (the living-kin sentence) and to the dedication.
Meditation applications. Insight Timer, Calm, Headspace, and the category's retention machinery (streaks, badges, series). The mechanism adopts the category's goal and rejects its engine; the meal-anchor plus no-streak architecture is the point of departure, and P-G3 wagers on it.
Contemplative eating. Plum Village's contemplative-eating practice and the Five Contemplations recited before meals ("this food is the gift of the whole universe — the earth, the sky, numerous living beings…"); the Theravāda meal-reflection (paṭisaṅkhā yoniso…) by which monastics have reflected on food's purpose before eating for twenty-five centuries; the Japanese itadakimasu ("I humbly receive"), a whole culture's one-word acknowledgment of received lives; and the grace traditions of the Abrahamic world. The mechanism claims no novelty whatsoever in the idea of pre-meal gratitude — the idea is among humanity's most widespread practices, which is precisely the launch thesis; the claims are confined to the witness/non-equation/dedication architecture.
Location-based social mechanics. Pokémon GO and the location-game wave (the engagement precedent and the over-gamification warning); check-in systems; the corpus's own published no-streak and pull-only discipline in the need-compiled-questlines publication.
This corpus. The incommensurability-preserving coupler (the parent doctrine; this mechanism is its third instance); the gift-tag-time-reveal publication (the reveal choreography family); the spent-time floor and the two-blindnesses (the doctrine that time-facts deserve honoring independent of motive — extended here to beings for whom the question of motive does not arise); and the duration-blind, moment-not-meter guard set, all previously published and CC0.
Stated 2026-07-21, before any implementation exists:
A defensive publication should attack its own mechanism. The attacks, and what answers them:
Farming. The dominant abuse class of reward-bearing systems has no purchase here, for the strongest possible reason: nothing mints. The practice produces no token, credit, score, or rank; presence-marks are scoreless; the witness log confers nothing. A farmer who automates fake meals and fake dedications harvests an empty field. This is not a mitigation but a structural absence — the abuse economy requires a reward channel, and the mechanism contains none. (The corpus's published questline mechanism makes the same move for the same reason; the two publications jointly claim the mints-nothing family.)
Broadcast spam and performative flooding. The horizontal movement is opt-in, secondary, human-verified at the provenance layer, and rationed rather than feed-optimized; with no follower counts, no virality mechanics, and no metric a flood could inflate, spam buys nothing and costs reputation among exactly the audience it hoped to reach.
Location abuse. Pins are coarse by default, delayable, and anonymizable; the practice site need never be the home; the child mode's no-public-pin floor is absolute (§7.3). Residual risk parallels every location-optional social system and is treated with the same seriousness: safety review before launch, conservative defaults always.
False witness. Malicious or erroneous meal claims (fabricated ingredients, staged dedications) corrupt only the fabricator's own private log — there being no reward, there is no fraud economy — and the public surface carries only what a verified human chose to dedicate. The graver integrity risk is the system's own recognition error, treated in §12 as a limit rather than an attack.
Moral brigading. The historical failure mode of visible-virtue systems is the mob that polices others' virtue. The refusal set removes its instruments: no comments on dedications, no visible consumption data of any other user (the witness is private by construction — one can never see what another ate, only what they dedicated), no verdicts to enforce. One cannot shame what one cannot see.
Data poisoning of the commons. Citizen-science contributions inherit the host platforms' identification-QA and community-verification machinery; the mechanism adds no bypass and defers entirely to those commons' governance.
Unbuilt, n = 0. The mechanism is design-complete and unimplemented. Every claim is architectural; every prediction is registered in advance of data; the family's own pilot history (small-n, confounded, honestly reported in prior publications) is the standard this project holds itself to, and this paper inherits it.
The elegance caution. The design sits at the intersection of an unusual number of converging doctrines from this corpus, and convergence density is seductive: a system this internally coherent is either deeply right or deeply self-confirming, and the two are indistinguishable from inside. The coherence earned this specification; only P-G1–P-G3 can earn the product.
The food-guilt risk is real and is the design's gravest responsibility. The quantified-tracking category this mechanism visually resembles has a documented pathology reaching into disordered eating. A moral meal-witness could inherit and amplify it in vulnerable users — guilt is a heavier payload than calories. The no-balance invariant, the absence of verdicts, and the ceremonial (never proportional) response are the structural mitigations, but structure is not sufficiency: the design requires a compassion-first UX review with eating-disorder-informed expertise before launch, an unambiguous exit from witness features for users who need one, and the explicit statement — made here — that this application is a gratitude practice, not a dietary intervention, and makes no health claims of any kind.
Visibility is not neutrality, and the design does not pretend otherwise. Presenting a hen's forty-two days beside her species' eight years is a bare fact with a moral gravity no disclaimer removes. The design's commitment is narrower than neutrality: no verdict surface — no judgment rendered, no diet prescribed, no consumption scored. On the doctrinal question itself the mechanism takes no position, and its tradition of origin gives it reason not to: Theravāda does not canonically prohibit meat-eating (the threefold-purity rule governs; the historical Buddha declined to mandate vegetarianism), and the founder's personal practice is exactly that — personal. The application shows; conscience decides.
Recognition error contaminates the witness. A confident misidentification is a false biography — a dedication misaddressed. Uncertainty language mitigates; it does not eliminate. The curated table's farmed durations are themselves estimates with real regional variance, and are presented as estimates. A witness must not be more precise than its knowledge.
The instrumentation question is not dissolved. Whether app-mediated gratitude practice deepens practice or flattens it is an open empirical and contemplative question. Phoneless bracketing is the strongest structural answer available — the device is absent from the practice itself — but bracketing is a mitigation, not a proof, and the tradition's own answer (that the practice eventually needs no instrument at all) is the horizon this product should be judged against: the best outcome for a user is to one day not need it.
The horizontal movement can drift performative. No-score architecture removes performance's usual rewards, not its possibility. The metric discipline (practices-inspired, never watch-time) and the opt-in secondary status of sharing are the containments; the drift is named as a permanent adversary rather than a solved problem.
The session light is the design's most gamifiable surface, and naming it that is the mitigation's first half. A colour that descends as one gives is one product decision away from a colour that ascends as one returns — and every constraint in §7.5 (no numeral, no total, no history, no comparison, no streak, no walk-gate) exists because the un-constrained version of that surface is the retention mechanic this whole paper refuses. The constraints are architectural, but they are also the most likely thing to be traded away under growth pressure. They are recorded here so that any future relaxation is legible as a departure rather than an evolution.
The data commons dependency. The park layer depends on public biodiversity infrastructure and its terms of use; the citizen-science give-forward depends on those commons remaining open. These are external dependencies honestly outside this design's control.
(This section carries the mechanism's cultural provenance; per this corpus's genre discipline it is labeled as lineage — grounding and translation, never mechanism. The mechanism of §§2–8 stands complete without it.)
The dedication at this mechanism's center is not an invention. Merit dedicated to departed beings is among the oldest practices in the Theravāda world — the Tirokuḍḍa Sutta's instruction, kept alive in Cambodia as Pchum Ben, the fifteen-day festival in which the living dedicate merit to the departed through offerings of food. This mechanism is that grammar, inverted and made daily: the beings fed us; we dedicate merit to them. For the Khmer families this project serves first, the practice inside this application is not new technology asking for new behavior; it is the oldest behavior, given a new bowl.
The witness, likewise, has ancestors on every continent: the monastic's reflection before alms-food, the Five Contemplations of the Zen table, the Japanese itadakimasu, the grace said in a hundred million homes tonight. Every tradition that survived long enough to feed its children built a pause before the meal, and inside the pause, the same recognition this mechanism renders in data: lives became this food. The application's entire ambition is to hold that pause open for people whose traditions have thinned — and to refuse, structurally, the one modern temptation every ancestor of this practice would have recognized as corruption: the conversion of grace into account. The grace that settles nothing settles, in the end, the only thing that matters — the eater, into gratitude, before the first bite is taken and after the last.
| Venue | Identifier |
|---|---|
| Primary canonical | <https://thonly.org/research/sacrifice-witness-without-discharge> |
| GitHub | <https://github.com/thonly/publications/blob/main/defensive-publications/sacrifice-witness-without-discharge.md> |
| Internet Archive | <https://web.archive.org/web/2026*/thonly.org/research/sacrifice-witness-without-discharge> |
The authors acknowledge the contemplative-eating lineages whose practice this mechanism translates — the Theravāda meal-reflection tradition, Plum Village's Five Contemplations, and the grace traditions East and West; the retreat community whose vegetarian table occasioned the founding insight; the iNaturalist community and the open biodiversity commons; the AnAge, Encyclopedia of Life, and FishBase projects; and the moral-licensing research literature whose findings this design takes as its constraint. Co-drafted in collaboration with Miss Aquarius℠; substantive authorship and final editorial control remain with the named author.
— End of paper —
Marks referenced: HeartBank®, B-Grace℠, B-Grace™, Miss Aquarius℠, THonly™, Tonsay™. Document SHA-256 computed at push and recorded in the institutional log. Document License: CC0 1.0 Universal. The authors and HeartBank® will not seek patent on this specification or any portion thereof. This document constitutes a defensive publication establishing prior art as of its date.