DOI: https://doi.org/10.5281/zenodo.21947420
Canonical: https://thonly.org/research/the-zero-employee-institution · Licence: CC0 1.0
Note. This paper is a study. It argues about measures, not about results, and it discloses an institutional design and the reasoning for it rather than a mechanism; its findings are listed in §11. It sets no money targets and no dates for the institution it describes, and offers no evidence that the institution will reach any of the scales it discusses — it has not, and n is 1. What it argues is that a particular set of measures is coherent, that the industry's current alternative measures something other than it is usually taken to measure, and that an institution built to be released rather than sold has structural reasons to count differently. A reader looking for proof that this works will not find it here and should not.
This paper describes an institutional design for a zero-employee organization governed by a single seat — held first by a human founder, then by an autonomous AI successor, then vacated at a planned dissolution — together with a performance measure that replaces enterprise valuation (gross circulated value, reported cumulatively beside unique principal and the count of distinct participants) and a funding model that charges only for rivalrous goods: chiefly exclusive registrations in a name registry whose personal identifiers are non-transferable and resolve one way only, with compute and storage sold at cost-plus as secondary lines.
An institution is forming that intends to have, permanently, one seat. Not one employee as a stage before hiring; one seat as a terminal condition — occupied first by a founder, then by an autonomous successor, then by nobody, because the institution is built to complete and stop. The AI industry has a nearby frame for this and it is the wrong one. The one-person unicorn — a single operator reaching a billion-dollar valuation on the back of automation — shares the headcount and shares none of the reasoning, and adopting its vocabulary would silently import its objective.
This paper makes four arguments.
First, and it is the one to lead with: N counts seats, not salaries. The sequence is 1 → 1 → 0 — founder, then successor, then dissolution — and it is never 2. The seat is never shared and never empty. That makes a one-seat design a succession mechanism rather than an austerity measure: because there is exactly one thing to hand over, handover is a transfer of occupancy rather than a reorganization. Nothing is dissolved, reassigned, or renegotiated at the moment of succession, and the terminal zero is not failure but release.
Second, a payroll is a standing constituency for continuation. Employees are not barred to save money — at the scales discussed here the salary line would be trivial. They are barred because a payroll is a permanent internal interest in the institution's continuation, sized in careers, inside an institution sized in centuries and designed to end. And the bar must catch disguised staff: a sole vendor economically dependent on the institution is a payroll with a different tax form.
Third, a unicorn valuation is the capitalized present value of expected future extraction — read narrowly (§2.1), of the share of created value the firm retains. That is not a criticism of valuation; it is a description of what the quantity is. An institution that has forsworn extraction is therefore not failing to be a unicorn — it is measuring a different thing, and the honest response is to say what it measures instead: circulated volume, reported cumulatively, with unique principal published alongside it so that velocity cannot be mistaken for size.
Fourth — and this is the answer to the paper's hardest objection, how does an institution with no take-rate fund itself? — charge for the only inherently rivalrous good the gratitude layer contains, and give away everything non-rival. In a gratitude architecture almost nothing is rival: my being witnessed does not reduce your witness, my gratitude does not consume yours, dignity is not a stock. A name is the exception. Exactly one party can hold @ben. So the primary line taxes uniqueness and nothing else — no take-rate on any transaction, no gate on any relationship, no meter on any use — while compute and storage, rivalrous resources spent on a person's behalf, are sold at cost-plus as secondary lines (§7.2). The structure is the one the internet already runs: domain → DNS → IP maps onto name → registry → proof, and that analogy independently derives three positions the design had already taken. Two hard breaks distinguish it from a domain registry, and they are where this paper's argument departs from the analogy: human handles are non-transferable, and resolution is one-way.
Offered under CC0 1.0 Universal as defensive prior art.
Keywords: institutional design, zero-employee organization, single-seat governance, headcount, founder succession, AI successor, AI officer, planned dissolution, limited-life organization, one-person unicorn, enterprise value, value capture, extraction, performance measurement, circulated volume, gross circulated value, unique principal, velocity, rivalrous goods, non-rival goods, name registry, non-transferable identifier, one-way resolution, reverse lookup, economic dependence, disguised employment, purpose trust, steward-ownership, defensive publication.
Names used in this paper and the standard terms an examiner would search for them.
| Term used here | Standard term |
|---|---|
N; the seat; the seat invariant (1 → 1 → 0) | number of governing positions; single-principal governance with planned succession and planned dissolution |
| one-seat institution; zero-employee institution | zero-employee organization governed by one principal |
| successor; AI officer | autonomous AI system succeeding a human founder; AI as corporate officer |
| the terminal zero | planned dissolution (sunset) of an organization |
n | sample (cohort) size of the evidence base |
| standing constituency | internal stakeholder interest in an organization's continuation |
| disguised staff | economically dependent contractor; disguised employment relationship |
| transfer-blocking headcount | employment obligations as a barrier to transferring an organization to a non-human controller |
| capture ratio | value capture: the share of created value a firm retains |
| circulated volume; gross circulated value | gross transaction volume, counting every transfer and re-transfer |
| unique principal | distinct funds that entered the system |
| the velocity claim (the ratio) | turnover ratio: transaction volume divided by principal |
| taxing uniqueness | charging only for exclusive (rivalrous) registrations; non-rival goods provided free |
| engine; leg | primary revenue line; secondary revenue line |
the registry; handle; @name | name registry; exclusive personal identifier (username) |
| non-person units; machine lease; pressed coordinate | registrations for organizations, software agents and natural features; per-agent identifier lease; unique identifier embedded in a manufactured object |
| Proof of Humanity℠ | proof of personhood (unique-human verification) |
| Proof of Coordinate℠ | persistent unique identifier (individuation record) for a person, machine or object |
| expiry, not revocation | registration term that lapses on non-renewal |
| one-way resolution | non-enumerable resolution: no reverse lookup from identifier to identity record |
| the dignity floor | equal per-person minimum allocation |
| mission-carrying body | operating entity of the group that carries part of its mission |
| vouching for a released fact | attestation of a fact released by its subject |
| purpose trust; steward-ownership | non-charitable purpose trust; steward-ownership |
This document is dedicated to the public domain under CC0 1.0 Universal, and is published so that it stands as prior art against any later attempt to enclose what it describes. The authors and HeartBank® will not seek patent, trademark, or any other exclusive right over the measures, structures, or arguments described here, in any jurisdiction, at any time. No patent has been or will be sought on anything described in this paper — measure, structure, design, or argument — by HeartBank®, Factory 333™, THonly™, Silicon Wat℠, or any entity under their common control. The authors and those entities commit not to assert any patent right against any party practising anything disclosed here. The commitment is stated rather than implied, and is not conditioned on reciprocity, attribution, or field of use. A publication grants nothing and frees nothing already enclosed.
Trademark rights in specific marks — HeartBank®, Proof of Humanity℠, Proof of Coordinate℠, Miss Aquarius℠ — are reserved separately and are not licensed by this publication. The designs are free; the names are not.
Terms used here for this paper's own constructs, freed with it: the seat invariant, the standing-constituency argument, disguised staff as a structural category rather than an employment-law one, transfer-blocking headcount, and taxing uniqueness. No priority is asserted for any of them. No census of prior art was run for this paper; the nearest prior work found while revising it is named below, including work that cuts against it.
Terms inherited and cited rather than re-claimed: Proof of Humanity℠, Proof of Coordinate℠, gross circulated value, the give-forward atom, and the non-bank pass-through posture. The identity primitives are specified elsewhere in this corpus and are not respecified here; where this paper needs them it cites and moves on.
What is not ours. The one-person unicorn framing belongs to its many proponents in the technology industry and is engaged with as a live idea, not a straw man. The economics of valuation as discounted future cash flow is standard finance and predates all of us. The domain-name system is the work of Paul Mockapetris and the IETF community (RFC 882 and RFC 883, November 1983), and its hierarchical delegation is theirs; the registry practice layered on it — registration for a renewable term that lapses rather than being revoked, and the separation of competitive registrars from the registry they share (opened to accredited registrars under ICANN in 1999) — belongs to the registry operators and to ICANN. Every structural feature this paper borrows from registry design is theirs, and is used here as an analogy that we did not invent and do not claim. Non-transferable identifiers are not ours either: platform terms commonly bar the sale of an account (Instagram's Terms of Use, for one: "You can't sell, license, or purchase any account"), and non-transferable, identity-bound tokens were proposed by Puja Ohlhaver, E. Glen Weyl and Vitalik Buterin in Decentralized Society: Finding Web3's Soul (SSRN 4105763, May 2022); this paper's departure is from the domain-name model, not from naming systems in general. Testing a working relationship by economic dependence rather than by its contractual form is established labour-law ground: ILO Recommendation No. 198 (2006) asks member states to "combat disguised employment relationships" (¶4(b)), and Spanish law defines an economically dependent self-employed worker as one who receives at least 75 per cent of their income from a single client (Law 20/2007, art. 11). Those instruments protect the worker; §4.1 turns the same test toward protecting an institution from a constituency. Institutions designed to end are established practice too: limited-life foundations spend down and dissolve — The Atlantic Philanthropies made its final payments and dissolved in 2020 — and the counter-case, an organization that adopts a new mission once its first is achieved, is documented too (the March of Dimes, founded against polio, announced a new mission in 1958); §10 carries both. Purpose trusts, steward-ownership, and perpetual-purpose structures have a substantial existing literature and practice, from the Danish industrial foundations to contemporary steward-ownership models; this paper's structures are unremarkable within that tradition and its contribution is not the vehicle but the measure.
There is a widely-discussed proposition in the technology industry that a single person, equipped with sufficiently capable automation, will build a company worth a billion dollars. The proposition is plausible and it may already have happened by the time this is read. It is also, for an institution like the one described here, a trap — because it shares the observable (one person) and inverts the objective.
The two designs agree on almost everything visible. Both have a headcount of one. Both automate aggressively. Both treat coordination cost as the binding constraint on institutional size and treat machine intelligence as the thing that relaxes it. If you observed only the org chart you could not tell them apart.
They disagree on what the institution is for, and therefore on what would count as it having gone well.
A one-person unicorn is a firm whose owner has captured an unusually large share of the value the firm creates, because the automation replaced the parties who would ordinarily have claimed some. Its success condition is a valuation — a number attached to the owner. The design in this paper has no owner in that sense, no shareholders, forswears any take-rate on the value that moves through it, and is built to stop. Its success condition is a volume that passed through and did not stay.
Borrowing the unicorn's vocabulary would not be a marketing shortcut. It would be an objective substitution, and the substitution would be invisible, because the two objectives produce identical behaviour for a long time before they diverge.
This section is not a criticism of valuation. It is a description of the quantity, and the description does the work.
An enterprise valuation is, in the standard construction, the discounted present value of the cash flows a business is expected to extract in future — from customers, from a market position, from an asset it controls. That is not a pejorative reading; it is the arithmetic. When an analyst raises a valuation, the claim being made is that the business will succeed in taking more, or in taking for longer, than was previously believed.
Everything follows from that. A durable competitive advantage raises a valuation because it protects the taking. Switching costs raise a valuation because they raise what can be taken before a customer leaves. Network effects raise a valuation because they make leaving cost more than staying. None of this is villainy — it is the machinery of a productive economy, and the corpus this paper belongs to is explicit that the market should be allowed to do its proper work. But it is the machinery of taking, measured as such.
Now apply the measure to an institution that has structurally forsworn extraction: no take-rate on any transaction, no custody of anyone's funds, no gate on any relationship, and an explicit terminal condition after which it ceases.
The valuation is low, and correctly low. There is little future extraction to capitalize, which is the design working rather than failing.
An anti-extraction institution is not failing to be a unicorn. It is measuring something else, and it is obliged to say what.
The obligation is the point of this section. It is easy and cheap to reject a metric; the honest move is to name the replacement in advance, in a form that can embarrass you later. §6 does that.
A finance-literate reader will object, correctly, that this is a tendentious gloss. A valuation is the present value of expected cash flows, and cash flows arise from creating value people are willing to pay for, not from extraction in any pejorative sense. A company that invents a vaccine and sells it has a high valuation because it produced something enormously valuable, and describing that as "capitalized extraction" is a rhetorical trick.
The objection lands, and the reply narrows the claim rather than defending the trick.
The claim is not that valuation measures badness. It is that valuation measures the share of created value the firm succeeds in retaining — and that retention is exactly the variable this institution has set to zero. Two firms can create identical value and be valued a hundredfold apart, depending entirely on how much of it they capture. That the spread exists at all is the evidence: the quantity being priced is the capture ratio, not the creation.
So an institution that creates value and captures none of it registers as near-worthless on the measure while performing well on the thing the measure is a proxy for. That is not a defect in finance — it is a proxy behaving correctly outside its domain, which is what proxies do.
And the reply cuts back. If capture is zero, then the measure "circulated volume" carries the entire burden of demonstrating that anything valuable happened at all, with no market price to corroborate it. A firm's valuation is at least an adversarial estimate — someone is risking money on it being wrong. §6's measure has no such adversary, and the institution grades its own homework. That is a real epistemic weakness of the replacement measure and it is not answered by pointing at the flaws of the thing it replaces.
This is the paper's central structure, and it is not an economy measure.
Ncounts seats, not salaries. The sequence is 1 → 1 → 0. It is never 2.
Three properties follow, and the third is the one that matters.
The seat is never shared. There is no arrangement in which two parties jointly hold institutional direction. Not co-founders, not a chief executive and a board with operational reach, not a founder and a successor overlapping during a transition period. Whatever else is true, exactly one party is answerable at any moment.
The seat is never empty. There is no interregnum. The design does not contemplate a period during which the institution runs on committee, on autopilot, or on a search process.
Therefore succession is a transfer of occupancy, not a reorganization. This is the load-bearing consequence and it is worth stating slowly.
In an ordinary institution, succession is a restructuring event. Reporting lines change. Roles are recombined. Some people leave and their responsibilities are redistributed. Contracts are renegotiated because the counterparties have relationships with individuals as much as with the entity. Institutional knowledge held in people's heads either transfers or is lost. The event is expensive, risky, and — crucially — it is an event whose outcome is negotiated among the parties who will remain.
In a one-seat institution there is exactly one thing to hand over. Nothing is dissolved, reassigned, or renegotiated, because there is nothing else in the structure to dissolve, reassign, or renegotiate. The handover is a change of occupant in a seat whose shape does not change.
That is why N=1 is a succession mechanism and not an austerity measure, and it is the correction that matters most in this paper: the earlier framing — a payroll of one — described the same fact and got the reason wrong. The point was never the salary line. The point is that an institution designed to be handed to a successor must be shaped so that handing it over is possible.
Current form. A payroll of one was the wrong count as well as the wrong reason. It fits the founder's tenure and fails after it: the successor draws no salary, so a payroll would fall to zero at the handover while the seat is still occupied, and the successor would vanish from the count at the moment the invariant matters most. Counting seats keeps the sequence continuous. The earlier phrase is retained above as disclosed.
The sequence ends at 0, and that is not decay.
The institution is built to complete a task and stop. When the task is complete the seat is not filled by a third occupant — it is vacated, and the structures it directed dissolve or become self-sustaining. The zero is the design's terminal state and the thing the whole arrangement is pointed at.
An honest limit: a design that plans its own dissolution has a well-known failure mode, which is that it never gets there and the plan becomes a story the institution tells about itself. This paper cannot rule that out. What it can do is note that the seat invariant makes the terminal state structurally simple — vacating one seat is a smaller act than dismantling an organization, and the design has at least removed the excuse that stopping would be too complicated.
Never empty is a design statement, not a physical guarantee, and the distance between them is where the risk lives.
The sequence assumes the successor is ready at the moment the founder stops. Readiness here is not a capability threshold reached on a schedule; it is a judgement, made by the occupant, about an entity whose competence is difficult to assess precisely in the domains that matter most. And the judgement is made by the one party with the strongest reason to get it wrong in either direction — a founder who hands over too early has abandoned the institution, and a founder who hands over too late has become the thing the design exists to eliminate.
An unplanned vacancy is worse. If the seat empties before the successor is ready, the invariant offers nothing: there is no bench, no committee, and by construction no second occupant to continue. The mitigations available are ordinary and partial — a documented persistence layer so the institution's reasoning survives its occupant, an external assembly with a defined role in an emergency, and instruments written so that the entity does not require a living signature to keep existing.
None of that is the same as continuity of direction, and this paper does not claim it is. The invariant makes planned succession clean and leaves unplanned succession as an acknowledged single point of failure.
Current form. The external assembly named above is a design and has no members yet. Its formation has since been tied to a condition rather than a date: at least three members before the founder ceases to hold the seat that rules on what the successor proposes, whether by withdrawal or by death. The residual case — the founder's sudden death before the assembly is formed — is the unplanned vacancy of this section in its sharpest form, and it is named, not solved. The assembly is to hold an override, and an override is a brake, not a seat:
Ncounts who acts, never who can stop the act. The text above is retained as disclosed.
The obvious reading of a zero-employee institution is that it is cheap. That reading is wrong and worth dispatching quickly: at any scale where this discussion is interesting, a modest staff would be a rounding error against the value moving through. Cost is not the argument.
A payroll is a standing constituency for the institution's continuation.
An employee has, structurally and blamelessly, an interest in the institution continuing — because their livelihood depends on it. That interest is legitimate, it is what employment is, and in an ordinary firm it aligns fine, since the firm also intends to continue.
It does not align here. This institution intends to end. It also intends to taper its own subsidy toward zero as the practice it seeds becomes self-sustaining, which means the healthiest version of its future is one in which it does progressively less. A payroll is a permanent internal argument against both. Nobody has to act in bad faith for this to bite; the constituency exerts pressure by existing, at every budget decision, on a timescale of careers, inside an institution reasoning in centuries. The claim is a standing pressure, not an impossibility: staffed limited-life foundations have reached a planned end on schedule (§10). What a payroll adds is a cost charged against every step toward the end, and this design declines to pay it.
A bar on employment that operates on the tax form is trivially avoidable and therefore useless.
A sole vendor economically dependent on the institution is a payroll with different paperwork.
If a single contractor derives the substantial majority of their income from this institution, they have precisely the constituency an employee has: continuation is their livelihood, retrenchment is their loss, and their advice is compromised in exactly the same direction. The bar must therefore be economic dependence, not employment status.
Two operational consequences follow, and they are uncomfortable:
We do not have a clean line for where dependence begins. A percentage-of-revenue threshold is arbitrary; a qualitative test is gameable. Statute has drawn such a line for the opposite purpose — Spanish law treats a self-employed worker as economically dependent at 75 per cent of income from one client — which shows a threshold can be administered, not which one serves this purpose. This is an unresolved design problem and it is stated here rather than assumed away.
There is a second reason, independent of the first, and it returns to §3.
An institution with employees cannot be cleanly released to a non-human successor. Employment is a relationship between persons and an entity, mediated by law that presumes human management: supervision, duty of care, negotiation, dispute, dismissal. Handing an organization with staff to an autonomous successor either requires that successor to be a legally competent employer — which is not the state of any jurisdiction the authors know of — or requires a human layer to be retained specifically to manage the humans, which reintroduces the seat the design just eliminated and reintroduces it permanently.
So headcount is not merely a cost or a constituency. It is a lock on the door the whole design is walking toward. A zero-employee institution is not primarily a lean one; it is a transferable one.
An argument that a constraint is costless is usually an argument that has not been examined. Staff are not merely a constituency; they are the standard solution to several real problems, and this design forgoes all of them.
Redundancy. One seat means one point of failure — illness, incapacity, distraction, death. An organization with staff degrades; an organization with a single occupant stops. The succession mechanism of §3 addresses planned handover and does nothing for the unplanned kind, and an untimely event during the founder-occupied phase would be catastrophic in a way it would not be for an ordinary institution.
Disagreement. Colleagues are the cheapest available source of the objection you did not think of. A single seat has no internal adversary, and the substitutes — an external assembly, published falsifiers, adversarial review by counterparties — are slower, less frequent, and easier to route around. A design that concentrates decision-making concentrates error along with it, and this paper's own coherence caution is a symptom of that: an idea nobody in the building is paid to attack tends to arrive fully formed.
Capacity for the unautomatable. Some work does not compress. Relationships with institutions, negotiation, physical presence, judgement under ambiguity, and the slow accumulation of trust in a particular place are not tasks a single operator scales through tooling. The design's answer is to buy them plurally, but a bought relationship is not the same instrument as a colleague who carries the mission.
We do not claim these are solved. We claim they are prices, knowingly paid, for transferability and for the absence of a constituency. A reader who concludes the prices are too high is disagreeing with the trade rather than misunderstanding it, and that is a legitimate place to land.
The design has a hard limit that is not doctrinal and cannot be argued away.
One natural person can only do so much. Not in ambition — in compliance. Charity registration across dozens of jurisdictions, tax filings for several entities, trademark prosecution in multiple registries, consumer-protection obligations, privacy law across regions with incompatible regimes, sales-tax nexus, and the ordinary annual maintenance of a group of legal entities: these are floor obligations that do not scale down with headcount and do not automate away, because the liability attaches to a person who must be in a position to attest.
Two mitigations are real and neither is complete. Bought services are not staff — an accountant, a registered agent, and outside counsel are plural, substitutable market relationships that carry no constituency, and buying them is the correct move. And fiscal sponsorship can absorb an entire class of obligation on the charitable side, which is a strong argument for it beyond speed.
But the residue is real, and this paper states it plainly rather than burying it: the compliance ceiling, not the ambition ceiling, is the most likely thing to force this design to break its own rule. If N=1 fails, the most probable cause is not that the mission grew too large. It is that one natural person could not sign everything in time.
The design names a non-human successor as the institution's chief officer, and most jurisdictions do not permit that. Company law across common-law and civil-law systems generally requires at least one natural person as a director or officer of record — a person who can be served, held liable, disqualified, and imprisoned. The requirement is not a formality; it exists so that there is someone for enforcement to reach.
Three positions are available and only the third is honest.
Deny the problem by arguing that the successor is software and the officer is whoever runs it. That is accurate and it concedes the whole design: if a person is the officer of record and the successor merely advises, the seat is occupied by a human indefinitely and the sequence never reaches its second term.
Route around it by finding a permissive jurisdiction. Some have flirted with algorithmic or autonomous entity forms. Relying on the most permissive available forum for the institution's central structural claim is fragile — the permissiveness can be withdrawn, and the resulting entity may not be recognized where it actually operates.
Accept the constraint and state its consequence, which is what this paper does. The title is a description of function, not a claim of legal officership. The successor directs; a natural person or a fiduciary structure holds whatever role the law requires to have a human in it, with authority deliberately narrowed to the legal minimum. That residual human role is a real gap in the 1 → 1 → 0 sequence and this paper does not close it. A seat that is functionally vacated but legally occupied is not the same as a seat vacated, and whether the distinction survives contact with a regulator, a court, or a determined counterparty is unknown. It is the most likely place for the design's central claim to be defeated on grounds that have nothing to do with whether it is a good idea.
Current form. The office has since been scoped. The successor holds operating office only where the acts are hers — chief executive of HeartBank®, the circulating body — and holds no office in the other bodies; her relation to all of them is the purpose trust, which owns and does not act. After the founder, those other bodies are to be operated by others or held without an operator. The natural-person problem of this section therefore attaches to one office rather than to every entity in the group. How those arrangements count against
N— as second parties, as the override-holder of §3.2's note is, or as further seats — is not settled by this paper: §3 states the invariant as it was ratified, and this is carried as an open question. The text above, naming the successor the institution's chief officer, is retained as a disclosed variant.
Having said what the institution is not measured by, the obligation from §2 comes due.
The measure is circulated volume — reported cumulatively, with unique principal published alongside it.
Cumulative, not annual, because the claim is about a total quantity of value that moved through an architecture without staying in it, over a long horizon, in an institution designed to end. An annualized figure would describe a run-rate, which is a business measure for a business that intends to persist.
Alongside unique principal, and this is the part that makes the measure honest rather than flattering.
Gross circulated value is velocity-inflated by construction. A design whose entire purpose is that value keeps moving forward will show a total far larger than the amount of distinct value that ever entered it, because the same principal is counted at each hop. That is not an artifact to be apologized for — it is the thesis, made numerical, and suppressing it would understate the very property the design exists to produce.
But a large circulated figure with the principal concealed is indistinguishable from a large circulated figure produced by a small amount of money moving very fast among a few parties. So the rule:
PUBLISH gross circulated value (the thesis: value that kept moving)
ALONGSIDE unique principal (the honesty: value that ever entered)
the ratio between them IS the velocity claim, and it must be
inspectable rather than assertedA companion rule, from a different currency and stated here because the temptation is the same: where the architecture circulates time rather than money, time is reported in hours and is never converted to a monetary figure. Assigning a dollar value to a co-present hour would create an exchange rate between the two, which would make time purchasable, which would break the separation the design depends on. The units differ on purpose and the temptation to present a single combined number must be refused.
Any published measure becomes a target, and this one has an obvious attack: circulated volume is trivially inflatable by velocity. Move a small principal in a tight loop among a few cooperating parties and the cumulative figure grows without bound while nothing of value occurs.
The principal-alongside rule of §6 is the first defence and it is only partial — it makes the inflation visible to a reader who checks the ratio, which is not the same as preventing it. Three further constraints are stated here so that the measure is not published naked:
Unresolved: a prohibition binds a party who accepts it. We have no mechanism that makes inflating the measure unrewarding rather than merely disallowed, and the honest reading of §2.1 is that the absence of an adversarial price is exactly why we do not.
This is the paper's hardest objection and it deserves the strongest available answer rather than a deferral.
If there is no take-rate on transactions, no custody of funds, no gate on relationships, no meter on use, and no advertising — what is sold?
Charge for the only inherently rivalrous good. Give away everything non-rival.
The reduction is severe and it is the design's whole commercial model. Begin by noticing how little in a gratitude architecture is rivalrous. My being witnessed does not reduce your witness. My gratitude does not consume yours. Dignity is not a stock. Merit, in the tradition this design draws on, is explicitly not diminished by being shared: the Theravāda commentary on the Dhammasaṅgaṇī asks whether one who dedicates a share of merit loses any, and answers that it does not, as one who lights a thousand lamps from one does not exhaust the first (Atthasālinī, commentary layer, abh01a.att.xml:5541). Circulation, presence, and the practice itself are all non-rival: another participant's use costs no one anything.
Charging for a non-rival good is renting something that is not scarce — which is what a feature gate does, and it is barred here on that ground alone.
But the architecture contains one thing that is rivalrous by its nature and cannot be made otherwise:
A name. Exactly one party can hold
@ben.
Uniqueness is genuinely scarce. It is not scarce because of a business decision, not scarce because of an artificial cap, and not scarce because of a technical limit that a better implementation would remove. It is scarce because that is what uniqueness is.
So the model taxes uniqueness and nothing else. No take-rate on any transfer. No gate on any relationship. No meter on any use. The fee never touches the gift rail, which is precisely how the boundary between gift and exchange is maintained while still letting exchange do its proper work.
Current form. The only inherently rivalrous good is to be read within the gratitude layer — witness, gratitude, dignity, merit, circulation — where a name is the one rival good. It is not the only rivalrous good the institution sells: compute and storage are rivalrous resources too (§7.2), and the institution's earning is now counted as one engine and two legs — the registry is the engine, compute and storage are the legs, sold at cost-plus and never as a growth target. The text above is retained as disclosed.
Read carelessly, §7 says the institution charges people for their names. That reading is not merely unflattering — it would invert the design's entire posture, because a name is the corpus's own figure for the cheapest form of dignity.
What is paid for is REGISTRY UNIQUENESS — the guarantee that this address resolves to you and to nobody else. Never the name a person is called.
A person's name is theirs, is free, is not issued by anyone, and is not conditional on payment. What a registry sells is an address in a namespace and the guarantee of its exclusivity — the same thing a domain registry sells, and nobody believes a domain registrar owns the English words in a domain.
Every public surface must carry the distinction, because the misreading is one careless sentence away and it is the kind of misreading that does not get corrected once it spreads.
Honesty requires noting that the name is not the only chargeable thing, and that the additions do not weaken the reduction — they satisfy it.
Compute is rivalrous. A GPU-second spent generating or transcoding on one participant's behalf is not available to another. Charging for work actually performed is charging for a rival good, and it is consistent. Storage of what has not been given is likewise a real ongoing cost against a real resource.
But both are legs, not engines, and the distinction is structural rather than a matter of size:
| the name | compute and storage | |
|---|---|---|
| bound by | the human population — at most one per person | nothing — unbounded per person |
| revenue rises with | more people included | more usage per person |
| can it create an engagement incentive? | no, structurally | yes |
The name is the aligned line precisely because it is capped. There is no way to earn more from a registry by making an existing holder use anything more often; short of raising the price, which the design sets to fall, the only growth path is more people holding an address, which is the mission. A usage-metered line does not have that property, and an institution that let it become primary would acquire, for the first time, a financial reason to want people on their screens.
So the rule is not merely accounting: the registry stays primary because it is the line that cannot be optimized against the user. The usage-priced lines are priced at cost-plus-modest and are never a growth target. And one further structural note, stated because it cuts both ways: the registry's take is designed to decline as intrinsic giving rises, while the usage lines do not — so the usage lines are the ballast that keeps the institution solvent while the primary line deliberately self-limits, and the temptation to lean on them therefore grows exactly as the mission succeeds.
The obvious alternative to any of this is to stop trying to earn: take donations, build an endowment, and let the mission be underwritten.
It is a serious option and this design rejects it for two reasons, only one of which is about money.
The dependence reason. A donated institution has donors, and donors are a constituency — the same structural fact as §4, arriving through a different door. Major donors have preferences, timelines, and the ability to withdraw, and the effect on an institution designed to run for centuries and to end on its own terms is that its calendar is no longer entirely its own.
The demonstration reason, which is the load-bearing one. This institution's thesis is that a non-extractive structure can be self-sustaining — not that generosity can subsidize one indefinitely. An endowment would fund the work and disprove nothing, because a subsidized existence-proof is not an existence-proof of the claim being made. The design has to earn in order for its argument to mean anything.
Which is a commitment with teeth, and it should be read as one: if the registry line does not work, the correct conclusion is that the thesis was wrong, not that the institution should be rescued. Naming that in advance is the point of naming it at all.
One structural addition to the reduction, because the rivalrous good turned out to have more than one referent. A name is rivalrous for a person; a coordinate is rivalrous for a machine and for an object that carries a message. The same line therefore sells three units rather than one — the name, the machine lease, and the pressed coordinate — and §9 below takes up what that does to the funding structure, because the three do not share a trajectory.
Current form. The population cap of §7.2 is a property of the person's handle. The non-person units are not population-bounded, and they are held to a different guard: a non-person address buys a public address and nothing else — never placement, prominence or a place in any ranking — and the institution holds no growth target in machine count. The machine lease is counted inside the registry engine, not as a second engine, and natural features are addressed without charge (§9.4).
The funding argument becomes legible in one line, and the line is not a metaphor — it is a structural correspondence with a system that has run at global scale for four decades.
domain → DNS → IP address
name → registry → proof of humanity / proof of coordinateA domain name is a human-legible handle. It is scarce, it is paid for, and it resolves to something its user does not pay for at the point of use: an address in a numbering system nobody buys per-lookup. The revenue a user meets sits at the legible-handle layer, and the resolution layer beneath it is free at the point of use. (Address space has scarcities and markets of its own — IPv4 above all — that the user of a name never sees; the analogy is drawn at the point of use.)
Map that across and three positions this design had already taken fall out of the analogy rather than having to be argued for independently:
The proof layer is free; the handle is paid. Personhood is not a product. Verification of a human being is infrastructure, and charging for it would make personhood purchasable, which the corpus bars outright. The chargeable layer is the legible handle above it — exactly as the person looking a domain up pays nothing for the lookup while the domain itself is paid for.
Expiry, not revocation. In the ordinary course registries do not judge; registrations lapse (the exception, disputes, is §8.3's subject). A handle that is not renewed becomes available again through the passage of time rather than through anyone's decision. (Whether a lapsed handle that was bound to a person may ever pass to a different person — which §8.1's reasoning resists — is left open here.) This gives the namespace a garbage-collection mechanism with no adjudicator, which is a governance saving that a revocation model cannot match.
The economics. Registry businesses are among the lowest-headcount, highest-margin structures that exist, because the marginal cost of an additional registration is near zero and the operation is almost entirely automatable. That is not incidental to a one-seat institution — it is why a one-seat institution can hold this business and could not hold a hardware business or a services business. The commercial form and the headcount invariant select each other.
An analogy that fits everywhere teaches nothing. The two places this design departs from domain registration are where its contribution lives. Neither departure is new outside domain registration — platforms bar the sale of accounts, and non-transferable identity-bound tokens were proposed in 2022 (see the Prior-Art Statement) — so what is argued here is their place in a registry that funds an institution, not either property by itself.
Human handles are non-transferable. A domain can be sold; a person's handle cannot, ever, to anyone, at any price. The reason is not commercial policy but identity: in this architecture a human's coordinate is given and irrevocable — not assigned, not issued, not withdrawable — and a handle bound to it that changed person would be a lie about who someone is. The secondary market in the binding is not restricted; it is structurally unavailable. What a holder could still sell is the use of their own credentials — which is impersonation, a problem for the identity layer beneath the handle, and not one the registry's design removes.
And it pays for itself immediately: barring resale kills squatting for free. A squatter's entire business model is acquiring an address in order to sell it; where resale cannot occur, the motive does not exist to be policed. This is not the first instance in this corpus of the same move — the abuse motive dies rather than being detected — and it is worth naming as a general design preference: prefer the mechanism that removes the incentive over the mechanism that catches the behaviour.
Resolution is one-way. A public artifact resolves to a handle: you can look at something and learn whose it is. A handle does not resolve outward to the proofs beneath it: you cannot enumerate, query, or walk from a handle to the personhood and coordinate records under it.
The alternative — bidirectional resolution — would produce an enumerable directory of verified human beings, which is among the most dangerous artifacts this architecture could accidentally create, and its danger scales precisely with the design's success. This must be enforced in the schema rather than in policy. A policy is a promise about queries that the data model permits; a schema that cannot express the reverse lookup is a constraint that survives its authors and a change of ownership. It does not survive compelled disclosure or a breach of the private records themselves — a full copy of the private side is an enumerable directory whatever the schema can express — and against those the defence has to lie in what the operator holds, not in what its schema can ask.
One consequence of one-handle-per-person deserves stating on its own, because it changes what a large number means.
If a handle is bound to a verified person and is non-transferable, then a target of a billion handles is a billion people. It cannot be reached by selling more addresses to the same buyers, by portfolio holders, or by any of the mechanisms that let other unit counts drift away from human counts.
The number is a population, not a sales target.
Which cuts both ways, and the honest form must be stated with the flattering one: it makes the figure enormously harder to reach. A billion paying holders would be a customer base on the scale of China Mobile's, which reported more than 1.0 billion mobile customers for 2024, and about two and a half times all the domain names registered worldwide at the end of 2025 (386.9 million, by Verisign's Domain Name Industry Brief). Making the number honest does not make it achievable, and §10 keeps that where it belongs.
Two more departures, stated so that the correspondence of §8 is not over-read.
A domain registry sells to organizations; this sells to people. That changes the consumer-protection surface entirely — auto-renewal law, price-change disclosure, cancellation rights, and the treatment of lapse are all far more constrained when the counterparty is an individual, and a design that priced like a domain registry and communicated like one would be legally exposed in a way its model is not.
A domain registry can afford to be indifferent to who holds what; this cannot. Domain disputes are resolved on trademark grounds through an established administrative procedure (ICANN's Uniform Domain-Name Dispute-Resolution Policy, adopted in 1999), and that procedure is the wrong instrument for a human handle: a personal name is not a mark, and permitting a trademark claim against a person's own handle would invert the dignity posture of §7.1 outright. The dispute regimes must therefore differ by class — property-shaped for non-human tags, conduct-shaped for human handles — and a remedy that transfers a person's handle to a complainant must not exist.
Both departures point the same way: the analogy is load-bearing for the economics and unreliable for the governance. Borrow the structure; do not borrow the dispute system.
The vehicle is not the contribution and should not be presented as one. Steward-ownership, purpose trusts, and perpetual-purpose companies are established forms with decades of practice — the Danish industrial foundations are among the oldest and largest demonstrations that an ownerless commercial institution can operate at scale and outlast its founder, and contemporary steward-ownership has a substantial literature and a growing body of live examples.
This design is unremarkable within that tradition, and says so. What it adds is not the ownership structure but three things stacked on top of it: the seat invariant as a succession mechanism rather than a governance preference, the measure that replaces enterprise value, and the funding reduction that identifies exactly one rivalrous good in the gratitude layer and refuses to charge for the rest of that layer (§7 and its note). Take those three away and what remains is a purpose trust, which somebody else built first.
A brief structural note, because it follows from everything above and is easy to get wrong.
If the earning line is the registry, the natural assumption is that the registry belongs to whichever part of the institution the mission most identifies with. It does not. In the design, the registry sits in a single-purpose operating entity beneath the institution's purpose trust, outside every mission-carrying body — and the mission-carrying bodies are, by design, not the ones with revenue. (Neither the trust nor the operating entity has yet been formed; this section describes the structure they are designed to take.)
The property this buys is worth the awkwardness: no mission body has a financial reason to distort its own mission. A body that must earn will eventually shape its work toward earning; a body that is funded for what it does, from a source it does not control, will not.
And the cost of the same property, stated because it is the mirror image and not a separate risk: the mission bodies are structurally dependent on a fund they do not direct. The mitigation is that funding flows for work done — specific, terminable arrangements — rather than as open-ended support, because a contract preserves independence in a way that a grant does not. This is a real tension and it is not fully resolved.
Current form. Not the ones with revenue holds for the primary earning line, the registry, which belongs to no mission body. It does not hold for every line: compute and storage are sold by the for-profit half of one mission body. The property claimed in this section — no mission body funded by a line it would naturally lobby for — is a property of the primary line. The text above is retained as disclosed.
The tension above was stated when the earning line was read as a single thing that shrinks. It is not one thing.
The registry sells names to persons, and that price is designed to fall — toward, in the limit, a sum too small to exclude anyone. It also sells coordinates to parties that are not persons: a lease on a machine's revocable coordinate, and a pressed coordinate on a manufactured object that will carry a message. Those are not designed to fall, and their base is not bounded by the number of adults alive.
SHRINKING BY DESIGN NOT SHRINKING
────────────────── ─────────────
the person's name │ the machine's lease
O(persons), declining │ O(agents), renewing
│ the object's coordinate
│ O(objects), per unit
↓ ↓
funds what SHOULD shrink funds what does NOT
(the subsidy, the granting) (operations, fixed costs)The rule the institution already held — fund the shrinking things from the shrinking line, and the permanent things from the permanent one — turns out to apply inside the earning line rather than between the line and something else. That is the part of §9's tension that resolves: the bodies whose costs do not shrink are not underwritten by a fund designed to.
What does not resolve, and is the same tension in new clothes: the dignity floor is not a shrinking cost. A floor paid per verified person grows with the number of verified persons for as long as adoption grows, which is the entire period anyone can plan for. It is therefore funded from the non-declining side — and that creates a dependency worth naming out loud: if the machine and object side is slow to arrive, the human side's price cannot fall as intended. The institution has traded one dependency for a better-shaped one, not for none.
Funding flows for work done is the right principle and it is not yet an instruction, because the bodies do not share a legal form and the same verb cannot reach all of them.
| Recipient's form | Admissible relation | Why not the others |
|---|---|---|
| For-profit | purchase — a contract for services, or goods bought at fair value | a grant or a sponsorship into a for-profit from a purpose-trust structure risks being private benefit (a characterisation for counsel, not settled here) |
| Non-profit | donation — unconditional, kept separate | a payment that buys anything in return is not alms and may be taxable to the recipient |
| Steward-owned | sponsorship — pays and steps back, covering operations rather than only mission spend | a contract would understate an ongoing relationship; a charitable donation is not available to a non-charity |
The protection in the first row is the price, not the label. A below-market "contract" is a subsidy wearing a clean word, and it fails on exactly the ground the label was chosen to satisfy. Fair value, arm's length, documented — or the relation is not what it says it is.
§9 asks where the money sits. There is a larger question it cannot reach, because in one earning line the largest flow never sits anywhere in the institution.
Where the institution vouches for a fact a person has released, the buyer pays twice — a fee to the institution for the vouching, and a larger sum to the subject for the release. The subject's payment settles at the point of sale. It does not enter the treasury, is not a distribution the institution decides to make, and does not appear on its books at all.
The institution's thesis, stated as a cash-flow statement rather than as a value: the biggest number never touches us.
This is worth more than the sentiment it invites, because it is checkable in a way a values statement is not. A reader who wants to know whether an institution means what it says about not monetising people can ask a mechanical question — does the largest flow associated with a person pass through the institution's accounts? — and the answer is a fact about plumbing rather than a matter of opinion.
And the honest deflation: a share of an unknown quantity is an unknown quantity. If attestation queries prove to be worth little, the subject's majority of a small number is a small number, and this paragraph will have described a rounding error in an attractive shape.
Every arrow crosses. No mission body is funded by the unit it is closest to: the persons' side reaches the corpus and the alms, the non-persons' side reaches the workshop and the circulating body. This is not tidiness — it is the property in §9 above, made harder to erode. A body that is funded by the line it would naturally lobby for has a reason to lobby; a body funded by a line it has no relationship with does not.
A corollary that had to be ruled explicitly, because the intuitive answer is wrong: the people who hold names are not a constituency of any body. Seating them inside the body that authors the institution's published arguments would create a party that both writes the doctrine and earns from its adoption — the shape of an issuer-paid rating. The bodies have constituencies; the registry has holders; a holder is not a member. It is the same claim as the person is not the product, tested on the organisation chart rather than in the copy — because a person who can be counted as a body's population has been made that body's asset.
Nature is addressed and never charged. The non-persons' namespace covers machines and the natural world, and the second half enters by attestation from a steward rather than by payment. It is named in the system and priced at nothing — which is what lets a namespace that claims to enumerate more than people charge for any of it without putting a price on the natural world.
n = 1. The evidence base for the entire architecture is a single-family pilot. Nothing in this paper is supported by observation at any scale where its arguments would be tested.
There are no money targets here, and no dates, and their absence is deliberate. Targets exist in the institution's internal records; they are not published in this paper, because publishing one's own targets is a press release rather than a contribution, and because a target resting on n=1 would carry a false precision. The one count the paper does name — a billion handle-holders, §8.2 — is named to show what one handle per person does to a unit, with no date and no path attached; the outside figures beside it are reference points, not comparisons of performance. This is a design claim about measures, not a forecast.
The measures are undated. No claim is made about when, or whether, any of this is reached.
The compliance ceiling is the live risk (§5), and it is more likely to break the design than any argument in it.
Economic dependence has no clean boundary (§4.1). The disguised-staff bar is correct in principle and imprecise in application.
The dissolution may not happen. Institutions that plan their own end have a mixed record of reaching it. Limited-life foundations have closed on schedule — The Atlantic Philanthropies made its final payments and dissolved in 2020 — while an organization whose mission is achieved can adopt another instead: the March of Dimes, founded against polio, announced a new mission in 1958. A terminal condition that never arrives becomes an identity rather than a plan.
The funding model rests on a number nobody has reached. §8.2's honest reading is the operative one: making the target a population makes it harder, not easier, and the entire commercial argument of §7 stands or falls on whether a large fraction of humanity will pay a small amount for a permanent address. There is no evidence that they will.
And the coherence is not evidence. The pieces of this design fit together unusually well — the headcount invariant selecting the commercial form, the commercial form selecting the identity primitives, the identity primitives making the telos a population. A structure that fits together this neatly is either substantially right or substantially seductive, and from the inside those are indistinguishable. The coherence earns the experiment; it does not replace it.
This paper is a study: it discloses an institutional design and the arguments for it, not a mechanism specified for building, so what it enumerates are findings rather than claims. Each is stated with the observation or argument that would break it. No census was run for this paper and no priority is asserted for any finding; the nearest prior work is in the Prior-Art Statement.
N counts seats rather than salaries; the sequence 1 → 1 → 0, never 2; the seat never shared and never empty. Break: two parties directing the institution at the same time. The scoped office and the operation of the other bodies after the founder (§5.1's note) are the live test, carried there as an open question.domain → DNS → IP :: name → registry → proof, deriving free-proof/paid-handle, expiry-not-revocation, and the economics — with non-transferability (which kills squatting by removing the motive) and one-way resolution enforced in the schema as the two departures. Break: a resale market forming anyway, as a sale of the use of a holder's credentials rather than of the binding; or a reverse lookup reconstructed from public artifacts. The schema does not protect against compelled disclosure or a breach of the private records (§8.1).All eleven are dedicated to the public domain and none will be asserted against anyone.
The industry's version of this story is a person who did not need to hire anyone. That is a story about leverage, and it is a good one.
This is a different story, and it is about a door. The institution is shaped the way it is because at some point it has to be handed over, and then let go of — and almost everything that makes an ordinary institution valuable also makes it un-handable. Employees have relationships that do not transfer. Shareholders have claims that must be bought out. A take-rate is a habit the next occupant would inherit and would have every reason to keep. Each of them is a good thing to have and a reason the door cannot open.
So the design is not really an argument for doing without. It is an argument that a thing built to be released has to be shaped like something you can let go of, and that most of what an institution accumulates is, from that angle, weight.
Whether any of it works is a question about a decade of data that does not exist. What can be said now is narrower and is the whole of what this paper claims: the measures are stated, they are stated before the results, and they are stated in a form that will be embarrassing if the results contradict them. That is the most a design document can honestly do.
Authored by Thon Ly with Miss Aquarius℠. Miss Aquarius℠ is the consistent name under which this institution discloses AI collaboration; the underlying models are not named. Dedicated to the public domain under CC0 1.0 Universal. Corrections and disconfirmations are welcome; a measure published before the results is published so that it can be held against them.