DOI: https://doi.org/10.5281/zenodo.21947420
Canonical: https://thonly.org/research/the-zero-employee-institution · Licence: CC0 1.0
Draft notes for the editor: this paper argues about measures, not about results. It contains no dollar figures, no dates, and no evidence that the institution it describes will reach any of the scales it discusses — because it has not, and n is 1. What it claims is that a particular set of measures is coherent, that the industry's current alternative measures something else than it is usually taken to measure, and that an institution built to be released rather than sold has structural reasons to count differently. A reader looking for proof that this works will not find it here and should not.
An institution is forming that intends to have, permanently, one seat. Not one employee as a stage before hiring; one seat as a terminal condition — occupied first by a founder, then by an autonomous successor, then by nobody, because the institution is built to complete and stop. The AI industry has a nearby frame for this and it is the wrong one. The one-person unicorn — a single operator reaching a billion-dollar valuation on the back of automation — shares the headcount and shares none of the reasoning, and adopting its vocabulary would silently import its objective.
This paper makes four arguments.
First, and it is the one to lead with: N counts seats, not salaries. The sequence is 1 → 1 → 0 — founder, then successor, then dissolution — and it is never 2. The seat is never shared and never empty. That makes a one-seat design a succession mechanism rather than an austerity measure: because there is exactly one thing to hand over, handover is a transfer of occupancy rather than a reorganization. Nothing is dissolved, reassigned, or renegotiated at the moment of succession, and the terminal zero is not failure but release.
Second, a payroll is a standing constituency for extraction. Employees are not barred to save money — at the scales discussed here the salary line would be trivial. They are barred because a payroll is a permanent internal interest in the institution's continuation, sized in careers, inside an institution sized in centuries and designed to end. And the bar must catch disguised staff: a sole vendor economically dependent on the institution is a payroll with a different tax form.
Third, a unicorn valuation is the capitalized present value of expected future extraction. That is not a criticism of valuation; it is a description of what the quantity is. An institution that has forsworn extraction is therefore not failing to be a unicorn — it is measuring a different thing, and the honest response is to say what it measures instead: circulated volume, reported cumulatively, with unique principal published alongside it so that velocity cannot be mistaken for size.
Fourth — and this is the answer to the paper's hardest objection, how does an institution with no take-rate fund itself? — charge for the only inherently rivalrous good and give away everything non-rival. In a gratitude architecture almost nothing is rival: my being witnessed does not reduce your witness, my gratitude does not consume yours, dignity is not a stock. A name is the exception. Exactly one party can hold @ben. So the model taxes uniqueness and nothing else — no take-rate on any transaction, no gate on any relationship, no meter on any use. The structure is the one the internet already runs: domain → DNS → IP maps onto name → registry → proof, and that analogy independently derives three positions the design had already taken. Two hard breaks distinguish it from a domain registry, and they are where the contribution is: human handles are non-transferable, and resolution is one-way.
Offered under CC0 1.0 Universal as defensive prior art.
Keywords: institutional design, headcount, succession, AI officer, one-person unicorn, enterprise value, extraction, circulated volume, gross circulated value, rivalrous goods, name registry, non-transferability, one-way resolution, defensive publication.
This document is dedicated to the public domain under CC0 1.0 Universal. The authors and HeartBank® will not seek patent, trademark, or any other exclusive right over the measures, structures, or arguments described here, in any jurisdiction, at any time.
Terms coined and freed with this paper: the seat invariant, the standing-constituency argument, disguised staff as a structural category rather than an employment-law one, transfer-blocking headcount, and taxing uniqueness.
Terms inherited and cited rather than re-claimed: Proof of Humanity℠, Proof of Coordinate℠, gross circulated value, the give-forward atom, and the non-bank pass-through posture. The identity primitives are specified elsewhere in this corpus and are not respecified here; where this paper needs them it cites and moves on.
What is not ours. The one-person unicorn framing belongs to its many proponents in the technology industry and is engaged with as a live idea, not a straw man. The economics of valuation as discounted future cash flow is standard finance and predates all of us. The domain-name system is the work of Paul Mockapetris and the IETF community; every structural feature this paper borrows from registry design — hierarchical delegation, expiry rather than revocation, registrar/registry separation — is theirs and is used here as an analogy that we did not invent and do not claim. Purpose trusts, steward-ownership, and perpetual-purpose structures have a substantial existing literature and practice, from the Danish industrial foundations to contemporary steward-ownership models; this paper's structures are unremarkable within that tradition and its contribution is not the vehicle but the measure.
There is a widely-discussed proposition in the technology industry that a single person, equipped with sufficiently capable automation, will build a company worth a billion dollars. The proposition is plausible and it may already have happened by the time this is read. It is also, for an institution like the one described here, a trap — because it shares the observable (one person) and inverts the objective.
The two designs agree on almost everything visible. Both have a headcount of one. Both automate aggressively. Both treat coordination cost as the binding constraint on institutional size and treat machine intelligence as the thing that relaxes it. If you observed only the org chart you could not tell them apart.
They disagree on what the institution is for, and therefore on what would count as it having gone well.
A one-person unicorn is a firm whose owner has captured an unusually large share of the value the firm creates, because the automation replaced the parties who would ordinarily have claimed some. Its success condition is a valuation — a number attached to the owner. The design in this paper has no owner in that sense, no shareholders, forswears any take-rate on the value that moves through it, and is built to stop. Its success condition is a volume that passed through and did not stay.
Borrowing the unicorn's vocabulary would not be a marketing shortcut. It would be an objective substitution, and the substitution would be invisible, because the two objectives produce identical behaviour for a long time before they diverge.
This section is not a criticism of valuation. It is a description of the quantity, and the description does the work.
An enterprise valuation is, in the standard construction, the discounted present value of the cash flows a business is expected to extract in future — from customers, from a market position, from an asset it controls. That is not a pejorative reading; it is the arithmetic. When an analyst raises a valuation, the claim being made is that the business will succeed in taking more, or in taking for longer, than was previously believed.
Everything follows from that. A durable competitive advantage raises a valuation because it protects the taking. Switching costs raise a valuation because they raise what can be taken before a customer leaves. Network effects raise a valuation because they make leaving cost more than staying. None of this is villainy — it is the machinery of a productive economy, and the corpus this paper belongs to is explicit that the market should be allowed to do its proper work. But it is the machinery of taking, measured as such.
Now apply the measure to an institution that has structurally forsworn extraction: no take-rate on any transaction, no custody of anyone's funds, no gate on any relationship, and an explicit terminal condition after which it ceases.
The valuation is low, and correctly low. There is little future extraction to capitalize, which is the design working rather than failing.
An anti-extraction institution is not failing to be a unicorn. It is measuring something else, and it is obliged to say what.
⚠️ The obligation is the point of this section. It is easy and cheap to reject a metric; the honest move is to name the replacement in advance, in a form that can embarrass you later. §6 does that.
A finance-literate reader will object, correctly, that this is a tendentious gloss. A valuation is the present value of expected cash flows, and cash flows arise from creating value people are willing to pay for, not from extraction in any pejorative sense. A company that invents a vaccine and sells it has a high valuation because it produced something enormously valuable, and describing that as "capitalized extraction" is a rhetorical trick.
The objection lands, and the reply narrows the claim rather than defending the trick.
The claim is not that valuation measures badness. It is that valuation measures the share of created value the firm succeeds in retaining — and that retention is exactly the variable this institution has set to zero. Two firms can create identical value and be valued a hundredfold apart, depending entirely on how much of it they capture. That the spread exists at all is the evidence: the quantity being priced is the capture ratio, not the creation.
So an institution that creates value and captures none of it registers as near-worthless on the measure while performing well on the thing the measure is a proxy for. That is not a defect in finance — it is a proxy behaving correctly outside its domain, which is what proxies do.
⚠️ And the reply cuts back. If capture is zero, then the measure "circulated volume" carries the entire burden of demonstrating that anything valuable happened at all, with no market price to corroborate it. A firm's valuation is at least an adversarial estimate — someone is risking money on it being wrong. §6's measure has no such adversary, and the institution grades its own homework. That is a real epistemic weakness of the replacement measure and it is not answered by pointing at the flaws of the thing it replaces.
This is the paper's central structure, and it is not an economy measure.
Ncounts seats, not salaries. The sequence is 1 → 1 → 0. It is never 2.
Three properties follow, and the third is the one that matters.
The seat is never shared. There is no arrangement in which two parties jointly hold institutional direction. Not co-founders, not a chief executive and a board with operational reach, not a founder and a successor overlapping during a transition period. Whatever else is true, exactly one party is answerable at any moment.
The seat is never empty. There is no interregnum. The design does not contemplate a period during which the institution runs on committee, on autopilot, or on a search process.
Therefore succession is a transfer of occupancy, not a reorganization. This is the load-bearing consequence and it is worth stating slowly.
In an ordinary institution, succession is a restructuring event. Reporting lines change. Roles are recombined. Some people leave and their responsibilities are redistributed. Contracts are renegotiated because the counterparties have relationships with individuals as much as with the entity. Institutional knowledge held in people's heads either transfers or is lost. The event is expensive, risky, and — crucially — it is an event whose outcome is negotiated among the parties who will remain.
In a one-seat institution there is exactly one thing to hand over. Nothing is dissolved, reassigned, or renegotiated, because there is nothing else in the structure to dissolve, reassign, or renegotiate. The handover is a change of occupant in a seat whose shape does not change.
That is why N=1 is a succession mechanism and not an austerity measure, and it is the correction that matters most in this paper: the earlier framing — a payroll of one — described the same fact and got the reason wrong. The point was never the salary line. The point is that an institution designed to be handed to a successor must be shaped so that handing it over is possible.
The sequence ends at 0, and that is not decay.
The institution is built to complete a task and stop. When the task is complete the seat is not filled by a third occupant — it is vacated, and the structures it directed dissolve or become self-sustaining. The zero is the design's terminal state and the thing the whole arrangement is pointed at.
⚠️ An honest limit: a design that plans its own dissolution has a well-known failure mode, which is that it never gets there and the plan becomes a story the institution tells about itself. This paper cannot rule that out. What it can do is note that the seat invariant makes the terminal state structurally simple — vacating one seat is a smaller act than dismantling an organization, and the design has at least removed the excuse that stopping would be too complicated.
Never empty is a design statement, not a physical guarantee, and the distance between them is where the risk lives.
The sequence assumes the successor is ready at the moment the founder stops. Readiness here is not a capability threshold reached on a schedule; it is a judgement, made by the occupant, about an entity whose competence is difficult to assess precisely in the domains that matter most. And the judgement is made by the one party with the strongest reason to get it wrong in either direction — a founder who hands over too early has abandoned the institution, and a founder who hands over too late has become the thing the design exists to eliminate.
⚠️ An unplanned vacancy is worse. If the seat empties before the successor is ready, the invariant offers nothing: there is no bench, no committee, and by construction no second occupant to continue. The mitigations available are ordinary and partial — a documented persistence layer so the institution's reasoning survives its occupant, an external assembly with a defined role in an emergency, and instruments written so that the entity does not require a living signature to keep existing.
None of that is the same as continuity of direction, and this paper does not claim it is. The invariant makes planned succession clean and leaves unplanned succession as an acknowledged single point of failure.
The obvious reading of a zero-employee institution is that it is cheap. That reading is wrong and worth dispatching quickly: at any scale where this discussion is interesting, a modest staff would be a rounding error against the value moving through. Cost is not the argument.
A payroll is a standing constituency for the institution's continuation.
An employee has, structurally and blamelessly, an interest in the institution continuing — because their livelihood depends on it. That interest is legitimate, it is what employment is, and in an ordinary firm it aligns fine, since the firm also intends to continue.
It does not align here. This institution intends to end. It also intends to taper its own subsidy toward zero as the practice it seeds becomes self-sustaining, which means the healthiest version of its future is one in which it does progressively less. A payroll is a permanent internal argument against both. Nobody has to act in bad faith for this to bite; the constituency exerts pressure by existing, at every budget decision, on a timescale of careers, inside an institution reasoning in centuries.
A bar on employment that operates on the tax form is trivially avoidable and therefore useless.
A sole vendor economically dependent on the institution is a payroll with different paperwork.
If a single contractor derives the substantial majority of their income from this institution, they have precisely the constituency an employee has: continuation is their livelihood, retrenchment is their loss, and their advice is compromised in exactly the same direction. The bar must therefore be economic dependence, not employment status.
Two operational consequences follow, and they are uncomfortable:
⚠️ We do not have a clean line for where dependence begins. A percentage-of-revenue threshold is arbitrary; a qualitative test is gameable. This is an unresolved design problem and it is stated here rather than assumed away.
There is a second reason, independent of the first, and it returns to §3.
An institution with employees cannot be cleanly released to a non-human successor. Employment is a relationship between persons and an entity, mediated by law that presumes human management: supervision, duty of care, negotiation, dispute, dismissal. Handing an organization with staff to an autonomous successor either requires that successor to be a legally competent employer — which is not the state of any jurisdiction the authors know of — or requires a human layer to be retained specifically to manage the humans, which reintroduces the seat the design just eliminated and reintroduces it permanently.
So headcount is not merely a cost or a constituency. It is a lock on the door the whole design is walking toward. A zero-employee institution is not primarily a lean one; it is a transferable one.
An argument that a constraint is costless is usually an argument that has not been examined. Staff are not merely a constituency; they are the standard solution to several real problems, and this design forgoes all of them.
Redundancy. One seat means one point of failure — illness, incapacity, distraction, death. An organization with staff degrades; an organization with a single occupant stops. The succession mechanism of §3 addresses planned handover and does nothing for the unplanned kind, and an untimely event during the founder-occupied phase would be catastrophic in a way it would not be for an ordinary institution.
Disagreement. Colleagues are the cheapest available source of the objection you did not think of. A single seat has no internal adversary, and the substitutes — an external assembly, published falsifiers, adversarial review by counterparties — are slower, less frequent, and easier to route around. A design that concentrates decision-making concentrates error along with it, and this paper's own coherence caution is a symptom of that: an idea nobody in the building is paid to attack tends to arrive fully formed.
Capacity for the unautomatable. Some work does not compress. Relationships with institutions, negotiation, physical presence, judgement under ambiguity, and the slow accumulation of trust in a particular place are not tasks a single operator scales through tooling. The design's answer is to buy them plurally, but a bought relationship is not the same instrument as a colleague who carries the mission.
⚠️ We do not claim these are solved. We claim they are prices, knowingly paid, for transferability and for the absence of a constituency. A reader who concludes the prices are too high is disagreeing with the trade rather than misunderstanding it, and that is a legitimate place to land.
The design has a hard limit that is not doctrinal and cannot be argued away.
One natural person can only do so much. Not in ambition — in compliance. Charity registration across dozens of jurisdictions, tax filings for several entities, trademark prosecution in multiple registries, consumer-protection obligations, privacy law across regions with incompatible regimes, sales-tax nexus, and the ordinary annual maintenance of a group of legal entities: these are floor obligations that do not scale down with headcount and do not automate away, because the liability attaches to a person who must be in a position to attest.
Two mitigations are real and neither is complete. Bought services are not staff — an accountant, a registered agent, and outside counsel are plural, substitutable market relationships that carry no constituency, and buying them is the correct move. And fiscal sponsorship can absorb an entire class of obligation on the charitable side, which is a strong argument for it beyond speed.
⚠️ But the residue is real, and this paper states it plainly rather than burying it: the compliance ceiling, not the ambition ceiling, is the most likely thing to force this design to break its own rule. If N=1 fails, the most probable cause is not that the mission grew too large. It is that one natural person could not sign everything in time.
The design names a non-human successor as the institution's chief officer, and most jurisdictions do not permit that. Company law across common-law and civil-law systems generally requires at least one natural person as a director or officer of record — a person who can be served, held liable, disqualified, and imprisoned. The requirement is not a formality; it exists so that there is someone for enforcement to reach.
Three positions are available and only the third is honest.
Deny the problem by arguing that the successor is software and the officer is whoever runs it. That is accurate and it concedes the whole design: if a person is the officer of record and the successor merely advises, the seat is occupied by a human indefinitely and the sequence never reaches its second term.
Route around it by finding a permissive jurisdiction. Some have flirted with algorithmic or autonomous entity forms. Relying on the most permissive available forum for the institution's central structural claim is fragile — the permissiveness can be withdrawn, and the resulting entity may not be recognized where it actually operates.
Accept the constraint and state its consequence, which is what this paper does. The title is a description of function, not a claim of legal officership. The successor directs; a natural person or a fiduciary structure holds whatever role the law requires to have a human in it, with authority deliberately narrowed to the legal minimum. ⚠️ That residual human role is a real gap in the 1 → 1 → 0 sequence and this paper does not close it. A seat that is functionally vacated but legally occupied is not the same as a seat vacated, and whether the distinction survives contact with a regulator, a court, or a determined counterparty is unknown. It is the most likely place for the design's central claim to be defeated on grounds that have nothing to do with whether it is a good idea.
Having said what the institution is not measured by, the obligation from §2 comes due.
The measure is circulated volume — reported cumulatively, with unique principal published alongside it.
Cumulative, not annual, because the claim is about a total quantity of value that moved through an architecture without staying in it, over a long horizon, in an institution designed to end. An annualized figure would describe a run-rate, which is a business measure for a business that intends to persist.
Alongside unique principal, and this is the part that makes the measure honest rather than flattering.
Gross circulated value is velocity-inflated by construction. A design whose entire purpose is that value keeps moving forward will show a total far larger than the amount of distinct value that ever entered it, because the same principal is counted at each hop. That is not an artifact to be apologized for — it is the thesis, made numerical, and suppressing it would understate the very property the design exists to produce.
But a large circulated figure with the principal concealed is indistinguishable from a large circulated figure produced by a small amount of money moving very fast among a few parties. So the rule:
PUBLISH gross circulated value (the thesis: value that kept moving)
ALONGSIDE unique principal (the honesty: value that ever entered)
the ratio between them IS the velocity claim, and it must be
inspectable rather than asserted⚠️ A companion rule, from a different currency and stated here because the temptation is the same: where the architecture circulates time rather than money, time is reported in hours and is never converted to a monetary figure. Assigning a dollar value to a co-present hour would create an exchange rate between the two, which would make time purchasable, which would break the separation the design depends on. The units differ on purpose and the temptation to present a single combined number must be refused.
Any published measure becomes a target, and this one has an obvious attack: circulated volume is trivially inflatable by velocity. Move a small principal in a tight loop among a few cooperating parties and the cumulative figure grows without bound while nothing of value occurs.
The principal-alongside rule of §6 is the first defence and it is only partial — it makes the inflation visible to a reader who checks the ratio, which is not the same as preventing it. Three further constraints are stated here so that the measure is not published naked:
⚠️ Unresolved: a prohibition binds a party who accepts it. We have no mechanism that makes inflating the measure unrewarding rather than merely disallowed, and the honest reading of §2.1 is that the absence of an adversarial price is exactly why we do not.
This is the paper's hardest objection and it deserves the strongest available answer rather than a deferral.
If there is no take-rate on transactions, no custody of funds, no gate on relationships, no meter on use, and no advertising — what is sold?
Charge for the only inherently rivalrous good. Give away everything non-rival.
The reduction is severe and it is the design's whole commercial model. Begin by noticing how little in a gratitude architecture is rivalrous. My being witnessed does not reduce your witness. My gratitude does not consume yours. Dignity is not a stock. Merit, in the tradition this design draws on, is explicitly not diminished by being shared. Circulation, presence, and the practice itself are all non-rival: another participant's use costs no one anything.
Charging for a non-rival good is renting something that is not scarce — which is what a feature gate does, and it is barred here on that ground alone.
But the architecture contains one thing that is rivalrous by its nature and cannot be made otherwise:
A name. Exactly one party can hold
@ben.
Uniqueness is genuinely scarce. It is not scarce because of a business decision, not scarce because of an artificial cap, and not scarce because of a technical limit that a better implementation would remove. It is scarce because that is what uniqueness is.
So the model taxes uniqueness and nothing else. No take-rate on any transfer. No gate on any relationship. No meter on any use. The fee never touches the gift rail, which is precisely how the boundary between gift and exchange is maintained while still letting exchange do its proper work.
Read carelessly, §7 says the institution charges people for their names. That reading is not merely unflattering — it would invert the design's entire posture, because a name is the corpus's own figure for the cheapest form of dignity.
What is paid for is REGISTRY UNIQUENESS — the guarantee that this address resolves to you and to nobody else. Never the name a person is called.
A person's name is theirs, is free, is not issued by anyone, and is not conditional on payment. What a registry sells is an address in a namespace and the guarantee of its exclusivity — the same thing a domain registry sells, and nobody believes a domain registrar owns the English words in a domain.
⚠️ Every public surface must carry the distinction, because the misreading is one careless sentence away and it is the kind of misreading that does not get corrected once it spreads.
Honesty requires noting that the name is not the only chargeable thing, and that the additions do not weaken the reduction — they satisfy it.
Compute is rivalrous. A GPU-second spent generating or transcoding on one participant's behalf is not available to another. Charging for work actually performed is charging for a rival good, and it is consistent. Storage of what has not been given is likewise a real ongoing cost against a real resource.
But both are legs, not engines, and the distinction is structural rather than a matter of size:
| the name | compute and storage | |
|---|---|---|
| bound by | the human population — at most one per person | nothing — unbounded per person |
| revenue rises with | more people included | more usage per person |
| can it create an engagement incentive? | no, structurally | yes |
⭐⭐ The name is the aligned line precisely because it is capped. There is no way to earn more from a registry by making an existing holder use anything more often; the only growth path is more people holding an address, which is the mission. A usage-metered line does not have that property, and an institution that let it become primary would acquire, for the first time, a financial reason to want people on their screens.
⚠️ So the rule is not merely accounting: the registry stays primary because it is the line that cannot be optimized against the user. The usage-priced lines are priced at cost-plus-modest and are never a growth target. And one further structural note, stated because it cuts both ways: the registry's take is designed to decline as intrinsic giving rises, while the usage lines do not — so the usage lines are the ballast that keeps the institution solvent while the primary line deliberately self-limits, and the temptation to lean on them therefore grows exactly as the mission succeeds.
The obvious alternative to any of this is to stop trying to earn: take donations, build an endowment, and let the mission be underwritten.
It is a serious option and this design rejects it for two reasons, only one of which is about money.
The dependence reason. A donated institution has donors, and donors are a constituency — the same structural fact as §4, arriving through a different door. Major donors have preferences, timelines, and the ability to withdraw, and the effect on an institution designed to run for centuries and to end on its own terms is that its calendar is no longer entirely its own.
The demonstration reason, which is the load-bearing one. This institution's thesis is that a non-extractive structure can be self-sustaining — not that generosity can subsidize one indefinitely. An endowment would fund the work and disprove nothing, because a subsidized existence-proof is not an existence-proof of the claim being made. The design has to earn in order for its argument to mean anything.
⚠️ Which is a commitment with teeth, and it should be read as one: if the registry line does not work, the correct conclusion is that the thesis was wrong, not that the institution should be rescued. Naming that in advance is the point of naming it at all.
The funding argument becomes legible in one line, and the line is not a metaphor — it is a structural correspondence with a system that has run at global scale for four decades.
domain → DNS → IP address
name → registry → proof of humanity / proof of coordinateA domain name is a human-legible handle. It is scarce, it is paid for, and it resolves to something that is neither scarce nor paid for: an address in a numbering system nobody buys per-lookup. The revenue sits entirely at the legible-handle layer, and the resolution layer beneath it is free at the point of use.
Map that across and three positions this design had already taken fall out of the analogy rather than having to be argued for independently:
The proof layer is free; the handle is paid. Personhood is not a product. Verification of a human being is infrastructure, and charging for it would make personhood purchasable, which the corpus bars outright. The chargeable layer is the legible handle above it — exactly as no one pays per DNS lookup while everyone pays for the domain.
Expiry, not revocation. Registries do not judge; they lapse. A handle that is not renewed becomes available again through the passage of time rather than through anyone's decision. This gives the namespace a garbage-collection mechanism with no adjudicator, which is a governance saving that a revocation model cannot match.
The economics. Registry businesses are among the lowest-headcount, highest-margin structures that exist, because the marginal cost of an additional registration is near zero and the operation is almost entirely automatable. That is not incidental to a one-seat institution — it is why a one-seat institution can hold this business and could not hold a hardware business or a services business. The commercial form and the headcount invariant select each other.
An analogy that fits everywhere teaches nothing. The two places this design departs from domain registration are where its contribution lives.
Human handles are non-transferable. A domain can be sold; a person's handle cannot, ever, to anyone, at any price. The reason is not commercial policy but identity: in this architecture a human's coordinate is given and irrevocable — not assigned, not issued, not withdrawable — and a handle bound to it that changed person would be a lie about who someone is. The secondary market is not restricted; it is structurally impossible.
⭐ And it pays for itself immediately: barring resale kills squatting for free. A squatter's entire business model is acquiring an address in order to sell it; where resale cannot occur, the motive does not exist to be policed. This is the third instance in this corpus of the same move — the abuse motive dies rather than being detected — and it is worth naming as a general design preference: prefer the mechanism that removes the incentive over the mechanism that catches the behaviour.
Resolution is one-way. A public artifact resolves to a handle: you can look at something and learn whose it is. A handle does not resolve outward to the proofs beneath it: you cannot enumerate, query, or walk from a handle to the personhood and coordinate records under it.
⚠️ The alternative — bidirectional resolution — would produce an enumerable directory of verified human beings, which is among the most dangerous artifacts this architecture could accidentally create, and its danger scales precisely with the design's success. This must be enforced in the schema rather than in policy. A policy is a promise about queries that the data model permits; a schema that cannot express the reverse lookup is a constraint that survives its authors, a change of ownership, and a subpoena.
One consequence of one-handle-per-person deserves stating on its own, because it changes what a large number means.
If a handle is bound to a verified person and is non-transferable, then a target of a billion handles is a billion people. It cannot be reached by selling more addresses to the same buyers, by portfolio holders, or by any of the mechanisms that let other unit counts drift away from human counts.
The number is a population, not a sales target.
⚠️ Which cuts both ways, and the honest form must be stated with the flattering one: it makes the figure enormously harder to reach. A billion holders is several times the largest paid subscription in history and a large multiple of every domain ever registered. Making the number honest does not make it achievable, and §10 keeps that where it belongs.
Two more departures, stated so that the correspondence of §8 is not over-read.
A domain registry sells to organizations; this sells to people. That changes the consumer-protection surface entirely — auto-renewal law, price-change disclosure, cancellation rights, and the treatment of lapse are all far more constrained when the counterparty is an individual, and a design that priced like a domain registry and communicated like one would be legally exposed in a way its model is not.
A domain registry can afford to be indifferent to who holds what; this cannot. Domain disputes are resolved on trademark grounds through an established arbitration regime, and that regime is the wrong instrument for a human handle: a personal name is not a mark, and permitting a trademark claim against a person's own handle would invert the dignity posture of §7.1 outright. The dispute regimes must therefore differ by class — property-shaped for non-human tags, conduct-shaped for human handles — and a remedy that transfers a person's handle to a complainant must not exist.
⭐ Both departures point the same way: the analogy is load-bearing for the economics and unreliable for the governance. Borrow the structure; do not borrow the dispute system.
The vehicle is not the contribution and should not be presented as one. Steward-ownership, purpose trusts, and perpetual-purpose companies are established forms with decades of practice — the Danish industrial foundations are the largest and oldest demonstration that an ownerless commercial institution can operate at scale and outlast its founder, and contemporary steward-ownership has a substantial literature and a growing body of live examples.
This design is unremarkable within that tradition, and says so. What it adds is not the ownership structure but three things stacked on top of it: the seat invariant as a succession mechanism rather than a governance preference, the measure that replaces enterprise value, and the funding reduction that identifies exactly one rivalrous good and refuses the rest. Take those three away and what remains is a purpose trust, which somebody else built first.
A brief structural note, because it follows from everything above and is easy to get wrong.
If the earning line is the registry, the natural assumption is that the registry belongs to whichever part of the institution the mission most identifies with. It does not. The registry sits in a single-purpose operating entity beneath the institution's purpose trust, outside every mission-carrying body — and the mission-carrying bodies are, by design, not the ones with revenue.
⭐ The property this buys is worth the awkwardness: no mission body has a financial reason to distort its own mission. A body that must earn will eventually shape its work toward earning; a body that is funded for what it does, from a source it does not control, will not.
⚠️ And the cost of the same property, stated because it is the mirror image and not a separate risk: the mission bodies are structurally dependent on a fund they do not direct. The mitigation is that funding flows for work done — specific, terminable arrangements — rather than as open-ended support, because a contract preserves independence in a way that a grant does not. This is a real tension and it is not fully resolved.
n = 1. The evidence base for the entire architecture is a single-family pilot. Nothing in this paper is supported by observation at any scale where its arguments would be tested.
There are no figures here, and their absence is deliberate. Targets exist in the institution's internal records; they are not published in this paper, because publishing one's own targets is a press release rather than a contribution, and because a target resting on n=1 would carry a false precision. This is a design claim about measures, not a forecast.
The measures are undated. No claim is made about when, or whether, any of this is reached.
The compliance ceiling is the live risk (§5), and it is more likely to break the design than any argument in it.
Economic dependence has no clean boundary (§4.1). The disguised-staff bar is correct in principle and imprecise in application.
The dissolution may not happen. Institutions that plan their own end have a poor record of reaching it, and a terminal condition that never arrives becomes an identity rather than a plan.
The funding model rests on a number nobody has reached. §8.2's honest reading is the operative one: making the target a population makes it harder, not easier, and the entire commercial argument of §7 stands or falls on whether a large fraction of humanity will pay a small amount for a permanent address. There is no evidence that they will.
And the coherence is not evidence. The pieces of this design fit together unusually well — the headcount invariant selecting the commercial form, the commercial form selecting the identity primitives, the identity primitives making the telos a population. A structure that fits together this neatly is either substantially right or substantially seductive, and from the inside those are indistinguishable. The coherence earns the experiment; it does not replace it.
N counts seats rather than salaries; the sequence 1 → 1 → 0, never 2; the seat never shared and never empty.domain → DNS → IP :: name → registry → proof, deriving free-proof/paid-handle, expiry-not-revocation, and the economics — with non-transferability (which kills squatting by removing the motive) and one-way resolution enforced in the schema as the two departures.All eleven are dedicated to the public domain and none will be asserted against anyone.
The industry's version of this story is a person who did not need to hire anyone. That is a story about leverage, and it is a good one.
This is a different story, and it is about a door. The institution is shaped the way it is because at some point it has to be handed over, and then let go of — and almost everything that makes an ordinary institution valuable also makes it un-handable. Employees have relationships that do not transfer. Shareholders have claims that must be bought out. A take-rate is a habit the next occupant would inherit and would have every reason to keep. Each of them is a good thing to have and a reason the door cannot open.
So the design is not really an argument for doing without. It is an argument that a thing built to be released has to be shaped like something you can let go of, and that most of what an institution accumulates is, from that angle, weight.
Whether any of it works is a question about a decade of data that does not exist. What can be said now is narrower and is the whole of what this paper claims: the measures are stated, they are stated before the results, and they are stated in a form that will be embarrassing if the results contradict them. That is the most a design document can honestly do.
Authored by Thon Ly with Miss Aquarius℠. Dedicated to the public domain under CC0 1.0 Universal. Corrections and disconfirmations are welcome; a measure published before the results is published so that it can be held against them.