DOI: https://doi.org/10.5281/zenodo.21947377
Canonical: https://thonly.org/research/safety-companion-pack-watch · Licence: CC0 1.0
Draft in progress. This is the founder-voice canonical draft for
thonly/publications. The defensive publication specifies the mechanism family of B-Safety℠, the digital companion ("digital B-Dog℠") of the HeartBank® architecture, together with the courier mechanisms of its physical sibling (B-Dog™). It is published deliberately at the design stage, ahead of any build, because the personal-safety category is the most actively iterated product space this corpus touches — the incumbents ship quarterly and the platform owners could absorb any one of these mechanisms in a single OS release — and because the combination specified here, in particular the pack-watch inversion (claim 2), the break-glass advance directive (claim 5), and the distillation boundary (claim 6), is the asset. Companion works: Thank-All-Nearby: an Anonymous Proximity Primitive (the proximity substrate the responder mesh reuses), Proof of Coordinate and B-PoH℠ as Humanity Layer (the identity primitives the mesh and the courier lean on), Gift-Tag Time Reveal (the per-field reveal and time-lock grammar the break-glass release inherits), Verified-Human Anonymous Local Giving (the accountable-anonymity pattern the courier extends), and The Gift Operation (the circulation grammar in which a safety floor is the precondition of the stranger-gift).
This specification is offered to the commons in the spirit of __dāna__ — the gift that asks nothing back. May the alarm it specifies never need to sound; may every companion it describes die of old age having never once bitten; and may the record of where a person walked belong, always and only, to the person who walked.
Every personal-safety product eventually faces one question, and almost none of them survive it: what is the difference between watching over someone and watching someone? The two activities use the same sensors, the same data, the same map with the same moving dot. The difference is not technical; it is grammatical — it lives in who initiates, who holds the record, who can open it, and what the record even is. The incumbent family-location products answer the question badly and profitably: they retain months of movement history in the vendor's cloud, they sell access to that history as their premium tier, and — in the most documented case — they sold the underlying data itself to brokers. The result is a category where the flagship "safety" products are, by the published findings of the coercive-control research community, among the most commonly repurposed instruments of intimate-partner surveillance.
This paper specifies a safety companion built so that the question has a structural answer rather than a policy answer. The companion initiates, so that protection does not depend on a frightened person remembering to arm an app. The alarm survives the destruction of the phone that would have raised it, because the watch is kept by the family's devices collectively, not by the traveler's device alone — and silence itself is the alarm. The forensic record that a rescue genuinely needs is mortal by construction: a short rolling window that expires on schedule, releasable only under an advance directive its owner wrote in calm daylight, triggered only by the alarm event, never by a relative's request and never by a payment. What persists past the window is not the track but a distillation of it — a diary of places, written at day's end on the owner's own device, erasable page by page, owned absolutely by the person who walked. And the guardianship asymmetry is stated as an invariant rather than a setting: a guardian receives the alarm, never the archive.
The specification closes with a mechanism from the same companion family that is not about alarms at all: a third-party gift courier that unlocks something hand-delivery cannot offer — a gift given anonymously whose gratitude nevertheless finds its way back to the giver. Anonymity and witness, simultaneously, for the first time in this corpus's gift grammar.
We publish the family together because the mechanisms share one root: a companion agent whose loyalty runs to its holder and to no one else — not to the institution that made it, not to the relative who pays, not to the data broker, not to the court that subpoenas a cloud that was never given anything to hold.
This document and its contents are dedicated to the public domain under the Creative Commons CC0 1.0 Universal Public Domain Dedication. The author and HeartBank® will not seek patent on this specification or any portion thereof, in any jurisdiction, at any time. This commitment is permanent.
This document constitutes a defensive publication establishing prior art as of 4 July 2026 for the combination of mechanisms described herein. To the author's knowledge, the following are not previously published as a unified mechanism, and any subsequent patent application claiming them should be considered filed against established prior art:
The component lineages — manually-armed check-in and ETA-sharing applications; dead-man's switches, watchdog timers, and heartbeat monitoring in industrial and distributed-systems engineering; end-to-end encryption and encrypted peer device meshes; personhood verification; crash- and fall-detection auto-alerts; inactivity-triggered data bequest; advance directives and Ulysses contracts; data-minimization and on-device semantic location processing; anonymous gifting conventions — are prior art and are cited generously in §2 and §14. The synthesis, and in particular the pack-watch inversion (claim 2), the advance-directive release (claim 5), the distillation covenant (claim 6), and the returned-witness courier (claim 7), are, to the author's knowledge, novel as of this paper's date.
Trademark rights on specific marks — B-Safety℠, B-Dog™, the digital B-Dog℠, B-Quest℠, B-Sidekick™, B-Haunt℠, B-Cat™, B-Dating℠, B-Letter℠, B-Yearbook, 3B-Diamond™, HeartBank®, Miss Aquarius℠, Proof of Humanity ℠, PoH℠, Proof of Coordinate ℠, PoC℠, the B-heart logo (B-Emblem™) — are separately and explicitly reserved. The mechanism is dedicated to the commons; the marks are not.
Mirrors of this document with independent timestamping appear at GitHub and the Internet Archive (web.archive.org, archive.today, perma.cc). Each mirror carries an independent tamper-evident timestamp.
We specify B-Safety℠, a family safety companion whose governing constraint is that a safety product must be structurally incapable of functioning as a surveillance product. Six mechanisms carry the constraint. (1) The journey sentinel initiates: when the companion notices its holder in motion it asks for the destination, computes a route-and-arrival envelope, and monitors the live journey on-device — inverting the manually-armed check-in whose canonical failure is that no one arms it on the night it matters. (2) Pack-watch makes silence the alarm: the envelope replicates end-to-end-encrypted to the family's devices, which run the deadline independently and expect the traveler's heartbeat; a destroyed, dead, or jammed phone therefore raises the alarm rather than suppressing it, with no server in the loop. (3) Cancellation is duress-preserving and escalation is graded against alarm fatigue. (4) A proximity SOS mesh adds verified, accountability-logged volunteer responders under coarse-until-vetted location release, reusing the architecture's anonymous-proximity primitive without creating a predator's subscription to people in crisis. (5) Break-glass release is an advance directive for data: a bounded trailing window of movement record, pre-consented by its owner in calm conditions, releasable to named kin only by the alarm event — never by request, payment, or institutional decision. (6) Privacy-by-distillation separates the two records forever: the forensic track is mortal (a rolling window that expires by construction) while the persistent record is a semantic place-diary distilled nightly on-device — autobiography, not tracking log — erasable by its owner, bound into a permanent family artifact only by an explicit year-end act. A seventh mechanism extends the companion family to conveyance: the anonymous courier with returned witness, in which third-party delivery makes a gift anonymizable for the first time in the architecture's physical gift line, while a return channel carries the recipient's thanks back to the unnamed giver — anonymity and witness simultaneously — under absolute recipient protections (blocks are never defeated; anonymous conveyance is refusable categorically). Constitutional invariants bind the whole: the safety capability is free universally ("rich or poor"), access to another person's past is never a product at any price or any tier, and a guardian receives the alarm but never the archive — the asymmetry that keeps the product safe inside the family, which is where the incumbent category demonstrably failed. Everything computes and stores on the holder's device; the companion's loyalty runs to its holder alone. The design is published before it is built (n = 0) and offered defensively to the commons under CC0.
Connection to the unified mission frame. This specification serves HeartBank's canonical mission — a reciprocity infrastructure in which every human being is treated as uniquely different and equally necessary — at the mission's precondition layer. The architecture's telos includes a world in which "stranger danger" is no longer a reason to withhold kindness from a stranger; a gift economy between strangers presupposes streets on which strangers are safe. The companion specified here is that presupposition built: its success metric is a lifetime of silence, and the institution that operates it is permanently denied the one asset — retained human movement history — that would make it valuable to everyone except the people it protects.
HeartBank® is an institution for circulating gratitude — money-gratitude across families, time-gratitude across drifted relationships — governed toward eventual autonomous operation by a named AI, Miss Aquarius℠, whose root directive is to water the tree: to tend a verified human family tree and the reciprocity economy that runs across it. Three facts about that architecture generate this paper.
The first is that the architecture's far goal runs through strangers. Its mechanism corpus specifies anonymous nearby tipping, verified-human anonymous local giving, gifts handed to passersby on street corners, and — in the companion mate-selection work — first meetings between people who know each other only as a proven history of kindness. Every one of these mechanisms presupposes something none of them provides: that approaching a stranger, and being approached by one, is safe enough to risk. "Stranger danger" is the standing veto on the gift economy at its widest radius. An architecture serious about kindness between strangers owes an answer to the fear that forbids it — not as a rhetorical reassurance but as infrastructure. This paper is that answer: the safety floor beneath the gift economy.
The second fact is that the family is the architecture's atomic unit, and the family is precisely where safety products go wrong. The documented failure of the incumbent category is not technical weakness; it is that family-location products are routinely repurposed for intimate-partner and parent-child coercive control — the survivor-support and computer-security literature has treated "dual-use" family apps as a standing threat class for years. A safety product built by an institution whose entire subject matter is family bonds cannot treat this as an edge case. The asymmetries specified here — alarm-not-archive guardianship, owner-sovereign diaries, event-gated release — are the paper's core contribution to that problem: they aim to make the companion useless to a controller while keeping it fully useful to a rescuer, and to make that difference structural rather than behavioral.
The third fact is institutional self-limitation, the recurring grammar of this corpus. The institution intends to operate at increasing autonomy; therefore its powers must be limited in the mechanism layer, not in revocable policy. The companion Proof-of-Coordinate work denies the institution the power to issue or revoke human identity. This paper denies it a second power: custody of human movement history. Everything the companion computes, it computes on the holder's device; the only replicated object is an encrypted envelope the institution cannot read, held by the family, releasable only by an event no institution schedules. An institution that never holds the data cannot sell it, cannot leak it, cannot be compelled to produce it, and cannot quietly convert protection into observation. The strongest privacy policy is an empty vault.
A note on register. The product family this paper specifies is presented to its users through a companion-animal grammar — the digital companion is "a dog," its notification is "a bark," its thanks-tip is "a treat" — and the design takes the animal seriously as a specification device: a protector that initiates contact with its own family, a guard whose alarm is its voice, a memory that is loyal to one person. The register is not decoration; several of the load-bearing constraints below were found by asking what a well-trained dog would and would not do. The discipline extends to the companions' voices as a formal sound grammar: the dog's vocabulary is duty-shaped (the soft bark asks, the loud bark alarms, the happy bark thanks a treat), while the family's feline sibling — the gift-distributing companion specified in the corpus's street-distribution line — makes exactly one sound, a purr of thanks after being fed, and never meows at all, because in the living animal the meow solicits and the purr thanks, and that companion's voice is permitted to thank but never to ask. Acknowledgment sounds are value-blind — identical for a gift in the free gratitude currencies and for money, so that no companion in the family ever prices a gift — the purr ships from the earliest embodiments as sound plus purr-rhythm haptic on the giver's own device, and no confirmation sound in the product family may resemble a till. But the claims of this paper are the mechanisms, stated mechanically. The dog is how the mechanism is worn, not what it is.
The mechanism family is a combination. Each component has ancestry; we name the ancestry honestly, because a defensive publication is only as strong as its candor about what is old.
Apple's Check In (iOS 17, 2023) is the closest single ancestor of claim 1's monitoring half: a user starts a session for a trip, the system estimates arrival, and if the user fails to arrive or respond within a response window, selected contacts receive the user's location and device status, end-to-end encrypted. It is well designed and its limits define this paper's deltas precisely: it must be manually started per trip; it is confined to one platform and one messaging system; and its data outlives the session only in the alert. Life360 is the category's commercial flagship: continuous family location sharing, driving reports, and — decisive for this paper — location history as the paid tier, with the free tier retaining days and paid tiers weeks of movement history in the vendor's cloud. In 2021–22 investigative reporting (The Markup) documented Life360's sale of precise location data to brokers, after which the company curtailed the practice; the episode is this paper's canonical demonstration that a safety vendor holding movement history is a conflict of interest wearing a safety costume. Kitestring (2014, SMS-based) contributed the civilian dead-man check-in and — important below — the duress PIN: a code that appears to check in normally while signaling distress. Noonlight, bSafe, and the campus-safety generation contributed the one-tap SOS with monitoring-center escalation. Garmin inReach and satellite-SOS wearables contributed check-in over infrastructure that survives cellular deadzones. Android Emergency SOS / Emergency Location Service and Apple Crash Detection / Fall Detection contributed the system-initiated alarm — the phone or watch notices the crash or the fall and calls for help without user action. Claim 1 generalizes that initiation from the instant of catastrophe to the whole journey: the companion notices departure, not just impact.
The principle that absence of a signal is the alarm is a century old in safety engineering: the railway dead-man's pedal, the crane operator's hold-to-run control, the industrial watchdog timer that reboots or halts a system when the periodic "I am alive" pulse stops, and the distributed-systems heartbeat (from cluster failure detectors to the humble watchdogd) that treats silence as failure rather than as good news. The insight this paper transposes is exactly that inversion. Consumer check-in apps — including Check In — still run substantial logic on the traveler's device and depend on it or on a vendor server to raise the alarm. Pack-watch (claim 2) moves the watchdog to the family: the kin devices hold the deadline and expect the heartbeat, so the attacker's most obvious move — destroy the phone — is converted from a silencing action into a triggering one. We are not aware of prior art running the dead-man inversion over a serverless, end-to-end-encrypted family topology for personal safety.
The academic ground for this paper's abuse posture is the intimate-partner-surveillance literature: Freed, Palmer, Minchala, Levy, Ristenpart & Dell's studies of technology-enabled abuse ("A Stalker's Paradise," CHI 2018, and successors), Chatterjee et al. on the spyware ecosystem (IEEE S&P 2018), Citizen Lab's stalkerware reporting ("The Predator in Your Pocket," 2019), and the survivor-support community's standing guidance that family-location apps are among the most common instruments of control precisely because they are legitimate, installable in the open, and socially defensible ("it's for safety"). The design answer given here — the guardian receives the alarm, never the archive; the diary is sovereign to its subject including minors; release is event-gated — is our attempt to build the survivor advocates' findings into the object itself.
Claim 6's distillation tier stands on the data-minimization tradition (GDPR Art. 5(1)(c) as its regulatory codification), on-device semantic location processing (Apple's on-device "Significant Locations," visited-place inference in both major mobile OSes), ephemerality as a product principle (disappearing messages from Snapchat through Signal), and the general finding of the location-privacy literature (from Golle & Partridge on home/work re-identification to de Montjoye et al.'s "Unique in the Crowd," 2013) that raw spatiotemporal traces are among the most re-identifying and sensitive data objects that exist — four points of a trace suffice to identify most individuals. The delta is architectural: the incumbent pattern minimizes what is shared while retaining raw history; the covenant here makes the raw object mortal by construction and promotes only a deliberately lossy distillate to long-term existence, on the owner's device, under the owner's eraser.
Claim 5's ancestry: Google Inactive Account Manager (2013) — data released to designated contacts after a configured period of account silence — is the closest digital ancestor: consent in advance, trigger by absence. Medical advance directives and the bioethics literature's Ulysses contracts contribute the deeper grammar: a decision made by the calm self that binds the crisis moment, honored precisely because it predates the crisis. Sealed wills and time-locked bequests contribute the release-on-event pattern this corpus already uses for posthumous unsealing in the family-record line (Gift-Tag Time Reveal; the B-Yearbook inheritance design). The delta: the released object is a bounded trailing forensic window scoped to a rescue, the trigger is the safety alarm itself, and the mechanism is explicitly barred from every other trigger — request, payment, subpoena-of-the-institution (which holds nothing), or guardian preference.
The responder mesh (claim 4) descends from community emergency response (PulsePoint's citizen-CPR dispatch; Good-Samaritan overdose-response apps) and neighborhood mutual-aid networks, crossed with this corpus's own Thank-All-Nearby anonymous-proximity primitive and Proof of Humanity ℠ verification; the guards respond to the documented failure of open neighborhood platforms (vigilantism and profiling on Nextdoor/Citizen). The courier (claim 7) has homelier ancestors: the florist's card signed "from a secret admirer" (anonymous gifting is ancient and commercially routine), Secret Santa conventions, anonymous philanthropy as a virtue tradition (Maimonides' ladder places the mutually anonymous gift near the top), and, in this corpus, Verified-Human Anonymous Local Giving's accountable-anonymity pattern (anonymous to the counterparty, signed to the system) and the B-Mark's anonymous-or-not contribution ledger. What none of these provide is the return channel: the florist's secret admirer never learns whether the flowers moved her. The returned witness is the delta — and within this corpus it resolves a wound the founding story turns on, discussed in §9.
Three frame commitments precede the mechanisms.
The companion initiates. The check-in category's fatal statistic is unarmed sessions: protection that exists only when a person remembers to request it protects best the people who need it least. The companion inverts the burden of initiative. It notices departure and asks; the holder merely answers — or ignores it, which is itself an answer the escalation grammar knows how to treat gently. Initiation by the agent is socially legitimate here for the same reason a family dog's approach is legitimate: it is bonded initiation, the companion's standing relationship with its own holder, not an institution's outreach to a user. (The same grammar will recur, inverted, in the courier: an approach to a stranger's door is legitimate only when sent on behalf of a bond.)
Everything on-device; the loyalty runs one way. All journey computation, all divergence detection, all history — raw window and diary alike — live on the holder's device. The institution operates no location server, holds no keys to the break-glass envelopes, and cannot read what the pack holds. This is simultaneously the trust story (the companion reports to its holder and to no one else — the pointed contrast with the incumbent whose cloud held, priced, and sold the family's movements), the economic story (no server fleet means the free tier costs the institution approximately nothing, which is what makes the next commitment affordable), and the legal story (the institution cannot produce what it never possessed).
The floor is free, universally. The safety capability — sentinel, pack-watch, SOS, mesh, break-glass — is free on both major platforms, for everyone, as a matter of stated right rather than pricing strategy: safety is a universal human right. The architecture's line-wide law applies to the companion's gratitude surface — "Cash optional, Kiitos/Kiitti always": a holder may thank their companion with a voluntary treat (patronage), and may always thank it for free in the architecture's gratitude currencies; no surface of the product makes money the only possible response. What may be sold is specified — and sharply bounded — in §8.
Soft bark. The companion runs a low-power departure detector (geofence exit, activity-recognition transition, or both — all on-device). On departure it initiates the journey dialogue with a single lightweight prompt, in the product's register a soft bark: "Where are we headed?" The holder answers with a destination (voice, tap on a recent/frequent place, or a calendar-derived suggestion), or dismisses, or ignores. A dismissal or ignored prompt starts no monitored journey and is never nagged; ambient initiation must not become ambient pestering, or the holder retrains the companion into noise and the product dies of its own barking.
The envelope. From the answered destination the companion computes a journey envelope on-device: a reasonable route corridor (with the holder's habitual deviations learned locally), a reasonable arrival window (mode-aware — walking, riding, driving), and a grace margin. The envelope is deliberately coarse; it is a tripwire, not a leash. The holder can widen it per-journey ("I'll wander").
Divergence and non-arrival. The live track is evaluated against the envelope locally. Two conditions arm escalation: sustained wide divergence from the corridor, or non-arrival by the window's close. Neither condition alerts anyone yet.
The escalation ladder. The naive design — divergence starts a ten-second countdown, then alarms the family — fails on human factors: ten seconds is not enough time for a driver to respond safely, and a hair-trigger siren teaches families to ignore the one bark that matters. The ladder is therefore graded:
condition detected
│
▼
① SOFT BARK to holder: "Everything okay? You've left the route
│ to [destination]." (response window:
│ context-adaptive — longer while driving)
├── holder responds "fine" / updates destination → envelope
│ recomputed, ladder resets
▼ no response within window
② INSISTENT BARK + on-screen countdown (visible, cancellable,
│ duress-aware — see below)
▼ countdown expires or holder triggers SOS
③ LOUD BARK to the pack: full alert — last known position, journey
envelope, device status; break-glass window
becomes releasable (§7)Rescue button. A prominent one-tap SOS skips the ladder: immediate loud bark. Hardware-button and voice bindings follow platform affordances.
Duress-preserving cancellation. Any cancellation control that genuinely stops the alarm creates the coercion scenario: the attacker compels the holder to cancel. Following the duress-PIN lineage (Kitestring; duress codes in alarm systems), the companion supports a duress cancel: a pre-configured variant of the normal cancel gesture/code, indistinguishable on-screen from an ordinary cancellation, that suppresses all local alarm indications while transmitting the loud bark to the pack with a duress flag. The existence of the feature is public (this paper); which gesture is the duress variant is known only to the holder. Product copy never confirms, on the device being observed, whether a duress bark fired.
Alarm-fatigue calibration. Escalation windows adapt to travel mode and holder history; thresholds widen with each false alarm the holder marks as false ("good dog, but that was the scenic route"), narrowing again only by explicit holder choice. The design goal is a companion whose loud bark retains evidentiary force in the family because it has almost never been heard.
The sentinel of §4, run alone, contains a fatal dependency: every detector and timer lives on the traveler's phone. The attacker's cheapest move — take the phone, break it, drop it in the river; or the mundane equivalents, a dead battery and a coverage hole — silences the guard precisely when the guard matters. The bark must not depend on the survival of the barker.
Topology. At journey start (envelope creation), the companion replicates the envelope — destination class, corridor at coarse resolution, deadline, and the break-glass ciphertext of §7 — end-to-end encrypted to the devices of the holder's pre-designated pack: the kin set drawn from the architecture's verified family tree (spouse, parent, sibling, chosen family; PoH℠-verified persons, chosen by the holder). Replication is peer-to-peer where transport allows, store-and-forward through a relay that carries only ciphertext where it does not. There is no server-side plaintext, ever.
Independent watch. Each pack device runs the deadline timer independently and expects a periodic authenticated heartbeat from the traveler's companion — a signed, contentless "still fine" pulse. The pack learns nothing of the journey's progress from the heartbeat (it is not a tracking channel; it carries no location); it learns only that the companion is alive and unalarmed.
Silence-as-alarm. On any pack device, either condition — deadline expiry without an "arrived safely" release, or heartbeat cessation beyond the grace interval — raises the loud bark locally, on the pack's own devices, with the last replicated envelope attached. No action by the traveler's device is required; no institutional server is in the loop to fail, to be compelled, or to be attacked.
TRAVELER PACK (kin devices)
┌──────────────┐ envelope+ciphertext ┌──────────────┐
│ companion: │ ──────E2E──────────▶ │ independent │
│ sentinel │ │ deadline │
│ (full ladder)│ ── heartbeat ──▶ ♥ ──▶ │ timers │
└──────────────┘ (contentless) └──────────────┘
│ │
phone destroyed / dead / jammed │
╳ heartbeat stops ──────────────▶ SILENCE ITSELF
RAISES THE BARKWhy this is the load-bearing claim. The inversion converts the threat model's strongest move into a triggering event: a companion that can be silenced by killing the phone is a guard that can be bribed with a steak; a pack cannot be silenced by anything short of silencing every member. It also converts the mundane failure modes — battery, coverage — from silent gaps in protection into visible, gently-worded pack notices ("your daughter's companion went quiet twenty minutes ago on the road home; probably her battery — here's the envelope in case"), which the escalation grammar words to inform without panicking (heartbeat loss escalates more softly than deadline expiry, and the two combined escalate hardest). One dog alone can be silenced. The pack cannot.
Costs, honestly. Pack-watch spends battery (heartbeats), spends complexity (multi-device key management, rotation on pack changes — the architecture's kinship-threshold recovery from the Proof-of-Coordinate work applies), and creates its own false-alarm class (coverage holes on habitual routes; mitigated by learned dead-zone maps exchanged inside the pack and by the graded wording above). These are the correct prices for removing the single point of failure that coincides exactly with the attack.
An SOS reaches family first; family is often far away. The mesh adds the nearest willing humans — and must do so without building the obvious horror: a channel that lets a predator subscribe to the real-time locations of people in crisis.
Opt-in, verified, logged. Holders may volunteer as responders. Volunteering requires personhood verification (PoH℠) and creates an accountability record: who opted in, when, and — at each response — who was notified of what, at what resolution, and how they responded. Responding is anonymous to no one: the victim, the pack, and the record know who came.
Coarse-until-vetted. An SOS releases to nearby responders only a coarse position (block/venue scale) and the alert class — enough to converge, not enough to intercept precisely — until the victim (or the pack, or where integrated the dispatcher) accepts a specific responder, at which point that responder alone receives fine position. Fine location is a granted trust, per responder, per incident.
Simultaneity. The mesh never substitutes for the pack or for emergency services; the loud bark goes to all three at once where integration exists. Bystander capability is additive, never the promise. Regional emergency-number integration, and the liability posture it requires, are acknowledged as deployment work this specification does not discharge.
Filters and refusals. Victims may pre-filter responder classes (e.g., verified-women-only response for a women's-safety deployment); responders may bound their availability. The mesh inherits the architecture's recipient-side-filter grammar: every widening of who may approach is the approached party's setting, never the approacher's.
The mesh is the architecture's stranger-thesis run in its hardest register: the same proximity primitive that lets strangers thank each other anonymously here lets strangers come when called — the stranger as latent rescuer rather than latent threat, with verification and accountability carrying the difference.
The rescue case is the one honest argument for location history: when someone vanishes, the trailing days of movement are pattern-of-life evidence a search genuinely needs. The incumbent answer — vendor retains everyone's history, always, and sells access — burns the whole category's trust to serve the tail case. The mechanism here serves the tail case exactly, and nothing else.
The envelope. The companion maintains, on-device, a rolling raw track bounded to a short trailing window (reference: seventy-two hours; holder-configurable up to about seven days). Continuously, it maintains an encrypted break-glass envelope of that window, replicated to the pack alongside the journey envelopes of §5. Pack devices hold ciphertext they cannot open.
Pre-consent, in daylight. The holder writes the directive in calm conditions: if my companion raises the loud bark (or my heartbeat is lost beyond threshold T, or I trigger SOS), release my trailing window to these named kin. Scope, window length, trigger set, and kin set are the holder's, revisable any time. Consent predates crisis; the calm self binds the crisis moment — the Ulysses grammar, honored here in the direction that protects rather than constrains.
Event-gated, and gated against everything else. The release mechanism accepts exactly one class of trigger: the alarm events themselves. Cryptographically and procedurally, there is no path by which a relative's request, a guardian's preference, a payment at any tier, or an institutional decision opens the envelope — outside the triggering event, no party holds both ciphertext and key path, and the institution holds neither. (Key mechanics follow the architecture's threshold pattern: release requires the triggering event's attestation plus the designated kin quorum, so no single pack member can open the window on a quiet Tuesday.) The window then expires on schedule like every other: break-glass releases recent past scoped to a rescue, never an archive.
What this deletes from the product space. With §7 in place, "we must retain your history in case something happens" — the retention argument every location vendor makes — is false by construction: the case-something-happens data exists, bounded, encrypted, family-held, and self-expiring. Nothing about the rescue case requires a vendor archive. That is the point.
Two legitimate desires pull at long-term location data: the forensic desire (§7's, served and bounded there) and the autobiographical desire — the map of a year of one's life is a genuinely lovely object: everywhere we went, the pilgrimage revisited, the year the walks got longer. The category's sin is serving the second desire with the first desire's data object. The covenant here refuses the conflation permanently: the long-lived record and the surveillance-grade record are never the same object.
The mortal track. The raw track — timestamped coordinates, the re-identifying, subpoenable, stalker-grade object — exists only inside the rolling window, only on-device plus the encrypted break-glass envelope, and dies on schedule. No setting extends it to an archive. This is not a retention policy; there is no code path that persists it.
The nightly distillation. Before expiry, once per day — by design at the household's existing evening ritual close — an on-device process distills the day into a place-diary entry: named semantic places and rough durations ("home; the temple, morning; the riverside market, afternoon"), with any path rendering held to coarse, area-level resolution — place-level, never a doorstep trail (the same resolution guard this corpus applies to publicly-mapped gift journeys). The distillation is deliberately lossy; the resolution drop is the privacy mechanism. A diary line answers "where was I living my life?"; it cannot answer "reconstruct her movements Tuesday between 9:12 and 9:31," and no premium tier, court order to the institution (which holds nothing), or curious relative can make it answer that, because the data that could answer it no longer exists.
raw track (forensic-grade) place-diary (autobiography-grade)
───────────────────────── ────────────────────────────────
lat/long every few seconds ⇒ "the temple, morning (2h)"
lives: rolling 72h–7d lives: as long as its owner wants
where: on-device + E2E pack where: owner's device / own vault
opens: break-glass event only opens: owner, always; no one else
dies: on schedule, always dies: page by page, at owner's hand
│ │
└── the dog's memory └── the person's memoirLedger versus diary. The architecture's family-record product (the B-Yearbook) already contains an append-only stream: the gratitude record, deliberately un-editable because its honesty is what makes it a record. The place-diary is governed by the opposite rule, and the distinction is load-bearing: a gratitude ledger is testimony to others, so integrity wins; a location diary is memory of oneself, so sovereignty wins. The owner may tear out any page — delete any day, any place, retroactively, forever — and maintains a never-write list of place categories the diary is structurally forbidden to record (health facilities and their kin ship as defaults; the list is the owner's). A diary you cannot edit is a logbook someone else will eventually read.
Year-close binding. The diary flows nowhere by default. At the family-record's annual close, the owner may bind the year's map into the permanent artifact tier — the printed annual volume (where each day already carries its dedication material; the day-page now can read where you were, and whom you thanked) or the archival keepsake edition. Binding is an explicit act on chosen content: the year's map becomes an heirloom because its subject decided it would, page by page, at the year's turn. Until and unless bound, it remains a private, erasable, device-resident diary.
The guardianship invariant — the alarm, never the archive. Minors and dependents hold diaries too, and here the covenant meets the coercive-control literature head-on: a guardian receives the alarm and the break-glass window; a guardian never receives the diary. The safety apparatus — sentinel, pack-watch, break-glass — is the pack's; the historical record of a child's places belongs to the child, on the same terms as everyone else's. This single asymmetry is, we believe, the difference between a family safety product and a family surveillance product, and the incumbent category's refusal to draw it — parental history-access is a headline paid feature — is where that category earned the survivor community's distrust. Protection is a relationship with the present; surveillance is a claim on the past. The product serves the first and structurally refuses the second, for spouses, for parents, for everyone: access to another person's past is never a product — not at any price, in any tier, under any consent checkbox, because a checkbox signed under family pressure is not consent, and the only way to keep the coerced checkbox out of the product is to have nothing behind it.
The companion family's physical sibling is a courier: a conveyance (robotic in the far arc; in the near phases a returnable parcel and a walked volunteer round, the latter itself protected by the digital companion — the courier's human legs wear the sentinel) that carries gifts only between a specific giver and a specific receiver. Its mechanism contribution is what third-party conveyance does to the gift grammar.
Hand-delivery cannot be anonymous; a courier can be. In this corpus's physical gift line, every prior instrument is handed over in person or shipped under a sender's name. Interposing the courier makes the sender's identity withholdable from the recipient for the first time — and anonymous giving is the gift tradition's high register (Maimonides' ladder; the anonymous benefactor as a folk archetype) precisely because it is structurally incorruptible by reputation-seeking.
The returned witness. Anonymity has always carried a wound: the anonymous giver forfeits ever knowing the gift landed, or mattered. (This corpus's founding story turns on that wound in its non-anonymous form: a thank-you letter whose author never learned it had been read aloud, kept, and carried for years — gratitude's default state is invisible to the giver.) The courier's return channel heals it: the recipient may, freely and optionally, send a re-thank — voice, video, a written line — back along the conveyance, addressed to "whoever sent this," and the courier carries it home. The giver receives witness without unmasking: they learn the gift moved someone, without the someone learning whom to repay. The gift stays a gift (no debt is created — the recipient cannot even direct reciprocity at a person), while the giver's side of the circuit, dark in every anonymous-giving tradition before this, finally lights up. In the product register: the dog comes home wagging, and that is the treat.
Accountable anonymity, and the recipient's absolute defenses. Anonymity here is to the recipient only: every conveyance is internally signed (personhood-verified sender, PoC-attested courier) so that abuse is attributable at the system layer — the pattern this corpus's anonymous-giving work already carries. And the recipient's protections dominate the sender's anonymity, categorically: an anonymous conveyance is never delivered to a recipient who has blocked the sender (the block is evaluated against the true signed identity; anonymity never launders a block); recipients may refuse anonymous conveyance entirely with one setting; and repeated unwanted anonymous attention is itself a system-visible pattern, mediated and terminable. Unwanted anonymous contact is a stalking signature; a gift infrastructure that ignored this would be building the stalker's channel with a bow on it.
The estrangement case. The mechanism's deepest application is the difficult relationship — this corpus's difficult-person mode, where a bond has gone hostile and the very name of the sender is the wall. A first gesture across a family rift often cannot survive its own signature: the letter is discarded at the envelope because of who it is from. An anonymous paw-delivered letter can be read as words before it is judged as a sender — and if it moves the recipient, the returned witness tells the estranged sender that something, at last, got through, without forcing contact on either side. All difficult-mode guards apply in full: entirely voluntary, never prompted or suggested by the system, blocks absolute, closure-without-contact first-class. The mechanism only lowers the wall for words; it never carries anyone over it.
Stated together, the commitments the mechanisms exist to keep. In this architecture's governance these are constitution, not configuration: a future operator — human or the autonomous successor — inherits them as binding.
The controlling family member. The central adversary, per §2.3, is inside the pack. Mitigations: no archive exists to demand (inv. 5–7); break-glass requires the alarm event plus kin quorum, so a single controller cannot open windows at will; pack membership is the holder's and revisable; the diary is invisible to the pack in all states; duress-cancel covers coerced cancellation; and the coerced-checkbox argument is answered by having nothing behind any checkbox a coercer could force (inv. 6). Residual, honestly: an abuser can still demand to watch the holder's own unlocked phone — no architecture defeats over-the-shoulder coercion — and can still abuse the live layer socially ("keep journeys on, always"). The live layer's own mitigations (journeys are per-trip and holder-initiated-by-answer; "always-on tracking" is not a mode the product offers) narrow but do not close this. We say so.
The predator in the mesh. Addressed structurally in §6 (verification, logging, coarse-until-vetted, simultaneity). Residual: a verified, logged responder can still be a bad actor once; accountability makes them identifiable, not impossible. The mesh is additive to family-and-authorities, never the sole channel, for exactly this reason.
The thief and the jammer. Pack-watch (§5) converts device destruction and jamming into alarms. Residual: an attacker who knows the grace intervals can attempt to move the victim outside the envelope before deadline expiry; the corridor-divergence condition and heartbeat cadence are tuned against precisely this window, and the tuning parameters are deliberately unpublished per-deployment.
The spoofer. GPS spoofing and replayed heartbeats: heartbeats are signed and sequence-bound (replay fails); location spoofing by the holder's own device is out of scope (the companion is not an evidence system against its holder — that inversion is the surveillance grammar this paper exists to refuse); spoofing by a device thief collapses to the stolen-device case, where the pack's independent deadline still runs.
The subpoena. Directed at the institution: yields nothing (inv. 3). Directed at pack members: yields ciphertext without the event-plus-quorum path; jurisdictions can compel persons, but the design ensures the institution can never be the one-stop warehouse the incumbent category built. Directed at the holder's own device: equivalent to any personal device today, minus the archive that no longer exists past the window (inv. 5) — the mortality of the raw track is also its legal minimization.
The institution itself, later. The far adversary every specification in this corpus must name: a future operator who finds these invariants inconvenient. Defense in depth: this publication (the invariants as public prior commitment), the architecture's governance (the invariants inherited as constitution by the autonomous successor, whose override custody sits with a human sangha), and the construction itself (an institution that never built the collection path cannot quietly enable it; it would have to visibly build it against its own published constitution).
n = 0. Nothing here is built. The sentinel's human factors (prompt fatigue, envelope tuning, false-alarm rates), the pack-watch battery economics, the mesh's real-world response value, and the courier's return-rate are all unmeasured. The design is published before it is proven, deliberately, for the defensive reasons stated; the elegance earns the experiment and does not replace it.
The physics floor. A dead phone in a dead zone still bounds what any architecture can know. Pack-watch converts silence into signal, which is the correct default — but a converted silence is still an uncertainty, and the wording of a heartbeat-loss notice can only be honest about that. Satellite-SOS hardware (the inReach lineage) is the eventual answer for the deep tail and is out of scope here.
The fear-salience paradox. A safety product can raise the fear it exists to reduce: a panic button in the pocket is a reminder to be afraid, and the safety-tech market has commercial reasons to keep it that way. This design's counters are register (a companion, not a weapon; a greeting, not a threat-scanner) and the success-is-silence posture — but whether B-Safety℠ lowers or raises its holders' felt stranger-danger is an empirical question, flagged as the product's own telos test: the architecture's larger wager is that safety infrastructure dissolves the stranger-danger veto on kindness, and that wager must be measured, not assumed.
The anonymity double-edge. §9's guards are strong, and still the mechanism hands senders a new capability whose worst residual uses will be discovered by its worst users. The block-supremacy and refuse-anonymous invariants are the current answer; the honest posture is vigilance, not confidence.
The platform shadow. Apple or Google could ship claim 1 in an OS release (both already ship its event-scale ancestors), and nothing in this CC0 dedication discourages that — the opposite: these mechanisms are published so they cannot be enclosed, and a platform-native AI-initiated sentinel with pack-watch semantics would be a public good. What a platform is structurally unlikely to ship is the covenant — invariants 5–7 forbid exactly the retention that platform and vendor business models monetize, and the incumbent's paid tier is invariant 6's negation. The moat, such as it is, is the refusal.
What this specification does not solve. Emergency-services integration and its liability; jurisdictional lawful-intercept regimes that may compel architectures, not just data; the sociology of who volunteers for responder meshes and whether their distribution matches need (the architecture's adoption-equity problem, standing); and over-the-shoulder domestic coercion, named residually in §11 — carried forward, not claimed closed.
Within the HeartBank® corpus this specification is the safety floor of the stranger-gift thesis (The Gift Operation; Manufactured Universal Giving; Thank-All-Nearby): the proximity primitives that let strangers give to each other and the mesh that lets strangers come when called are one substrate read in two registers. The pack is drawn from the verified family tree, giving the tree its most primal reason to be accurate (Proof of Humanity; Proof of Coordinate; Multi-Family Membership). The place-diary's year-close binding lands in the family-record line (the B-Yearbook's ledger/diary distinction and annual artifact tiers), and the courier's returned witness closes, in the anonymous register, the wound the founding story names (Giving Is a Gift Too; the origin account carried in the corpus's brand-architecture paper). The companion family itself — a protector and a courier, a cat that gives without soliciting and a dog that guards without surveilling — belongs to the production arm's service-robot roster, where the animal grammar is a deliberate specification device: the robot's social contract, made legible to a child and enforced by its archetype. In the mate-selection deployment (Aura-Gated Anonymous Mate-Selection), the companion ships as the safety layer of first meetings — the population for whom the protector-dog is already a lived institution.
Miss Aquarius℠ is named throughout as the architecture's eventual autonomous operator; she does not yet exist as such, and every capability attributed to her here is design intent inherited as constitution, not a description of a running system. The alarm grammars specified here require no AI beyond on-device inference; the companion's warmth is a register, not a claim.
Check-in and journey safety: Apple Check In (2023); Life360 (product tiers; The Markup, "Life360 Is Selling Precise Location Data," 2021); Kitestring (2014); Noonlight; bSafe; Garmin inReach; Android Emergency Location Service; Apple Crash/Fall Detection. Dead-man and heartbeat: railway dead-man controls; industrial watchdog timers; distributed-systems failure detectors. Coercive control: Freed et al., CHI 2018 and successors; Chatterjee et al., IEEE S&P 2018; Citizen Lab, The Predator in Your Pocket, 2019. Location privacy: de Montjoye et al., Unique in the Crowd, 2013; Golle & Partridge, 2009; GDPR Art. 5(1)(c); on-device significant-location processing (Apple, Google). Pre-consent and release-on-event: Google Inactive Account Manager (2013); advance directives and Ulysses contracts (bioethics literature); sealed testamentary instruments. Community response: PulsePoint; Good-Samaritan response networks; critiques of open neighborhood-watch platforms. Anonymous giving: Maimonides, Mishneh Torah, Gifts to the Poor 10:7–14; commercial anonymous gifting practice. Corpus companions: Thank-All-Nearby; Verified-Human Anonymous Local Giving; Gift-Tag Time Reveal; Proof of Coordinate; B-PoH℠ as Humanity Layer; The Gift Operation.
A safety product earns trust by what it can see; it keeps trust by what it refuses to remember. The mechanisms specified here — a companion that notices and asks, a pack for whom silence is the alarm, a cancellation that protects even under a watcher's eyes, strangers verified before they are called, a directive written in daylight that opens one bounded window in the dark, a track that dies on schedule while a diary its owner alone can read and tear survives, and a courier that carries thanks home to a giver with no name — are one design: protection bound to the present, the past bound to its subject, and an institution bound, permanently and in public, to hold neither.
May the bark never be needed. That is what it is for.
Drafted in the HeartBank® research corpus, 4 July 2026. Co-authored with Miss Aquarius℠, the architecture's named AI collaborator, per the corpus's standing disclosure: the mechanism synthesis, prior-art survey, and adversarial analysis are genuine collaboration; final editorial control and responsibility for every claim rest with the human author. Dedicated to the public domain under CC0 1.0. Marks including HeartBank®, B-Safety℠, B-Dog™/℠, B-Quest℠, B-Sidekick™, B-Cat™, B-Haunt℠, B-Dating℠, B-Yearbook, 3B-Diamond™, B-Emblem™, Proof of Humanity ℠, PoH℠, Proof of Coordinate ℠, PoC℠, and Miss Aquarius℠ are reserved; the mechanisms are not.