diff --git a/app/public/generated/corpus.json b/app/public/generated/corpus.json
index 65d3969..ce819f5 100644
--- a/app/public/generated/corpus.json
+++ b/app/public/generated/corpus.json
@@ -7,12 +7,12 @@
     "activeAnnexCount": 15,
     "proposedAnnexCount": 1,
     "referenceAnnexCount": 29,
-    "commitmentCount": 97,
-    "reservedCommitmentCount": 47,
+    "commitmentCount": 106,
+    "reservedCommitmentCount": 56,
     "threatCount": 33,
     "patchCount": 72,
     "validatorStatus": "pass",
-    "buildStamp": "corpus-74c787bfe9cc"
+    "buildStamp": "corpus-b6b3afb6d965"
   },
   "docs": [
     {
@@ -2503,7 +2503,7 @@
       "status": "",
       "statusBucket": "reference",
       "summary": "This document explains the first-principles architecture behind the Humane Constitution and names the outside sources that help pressure-test it.",
-      "content": "# Architecture Source Map\n\nThis document explains the first-principles architecture behind the Humane Constitution and names the outside sources that help pressure-test it.\n\nThe architecture is an original synthesis. The sources below support parts of the diagnosis and design discipline; they do not prove that the full constitutional system works.\n\n---\n\n## Core Collapse States\n\nThe project is organized around preventing three structural collapse states.\n\n| Collapse state | First-principles failure | Project response | Main evidence burden |\n|---|---|---|---|\n| **Survival-Trade Bind** | A person must succeed in markets, employment, credit, or exchange to stay alive, safe, housed, treated, or civically legible. | Essential Access, Constitutional Survival Minimum, identity-continuity rules, non-convertibility, and capacity measurement. | Identity recovery, Essential Access delivery, shadow-convertibility testing, real-capacity measurement, appeal continuity, and scarcity drills. |\n| **Power-Wealth Convergence** | Accumulated wealth becomes formal or practical authority over rules, enforcement, public measurement, civic access, or institutional design. | Flow / Voice / Service Record separation, anti-conversion rules, public records, beneficial-control review, anti-rent controls, and independent oversight. | Proxy-market tests, institutional-capture review, public-banking simulation, anti-corruption audit, legal-wrapper review, and FAP capture testing. |\n| **Static-Advantage Loop** | Early-entry advantage, inheritance, expertise, procedural control, or gatekeeping hardens into permanent class position. | Commons Return, bounded capital claims, decay where appropriate, rotation, anti-dynasty rules, new-participant access, subsidiarity review, exit protections, and bottleneck audits. | Service Record misuse testing, concentration dashboards, legal-wrapper review, founding-legitimacy tests, and governance red-team exercises. |\n\nThese collapse states are a diagnostic lens, not a status label. A mechanism can be written, proposed, active, or evidence-backed only under the status language in the [Claims and Evidence Register](./Claims_Evidence_Register.md).\n\nFor the threat-by-threat mapping, use the [Collapse-State Crosswalk](./Collapse_State_Crosswalk.md). For the test ladder that decides when a collapse-state claim may be strengthened, use the [Evidence Ladder](./Evidence_Ladder.md).\n\n---\n\n## Instrument Map\n\nThe project does not use one universal instrument that can buy everything.\n\n| Function | Existing project instrument | What it must not become |\n|---|---|---|\n| Basic survival and functional continuity | Essential Access / Constitutional Survival Minimum | A commodity, debt instrument, punishment tool, patronage channel, or gatekeeping reward. |\n| Optional exchange and enterprise | Flow | A route to civic authority, survival priority, enforcement privilege, or permanent bottleneck control. |\n| Public participation and correction | Voice | A purchased vote, transferable influence asset, status market, or wealth-weighted rule channel. |\n| Contribution recognition | Service Record | A total human-worth score, employability rank, caste marker, or permanent civic aristocracy. |\n| Scarcity response | Shared Storehouse | Ordinary trade inventory, permanent emergency administration, or discretionary rationing power. |\n\nThe core safety rule is:\n\n> No stored advantage may purchase access to survival, rule-authority, or permanent dominance.\n\nThe stronger operational version is:\n\n> Trade wealth must not directly or indirectly produce durable rule advantage, enforcement privilege, survival priority, or control over essential bottlenecks.\n\nThis broader version matters because corruption usually travels through indirect routes: employers, landlords, contractors, shell entities, professional networks, media influence, standards bodies, family offices, foundations, and dependency relationships.\n\n---\n\n## Source Map\n\n| Design claim | Outside source anchor | What it supports | What it does not prove | Evidence level |\n|---|---|---|---|---|\n| Survival should not depend only on market success. | [Universal Basic Services: Theory and Practice](https://discovery.ucl.ac.uk/10080177/) | Essential services can be framed as public access infrastructure that supports welfare, safety, opportunity, and democratic participation. | It does not prove this project's Essential Access, CSM, identity, logistics, or funding mechanics. | Level 3 \u2014 Internal consistency review |\n| Shared-resource systems need boundaries, monitoring, sanctions, conflict resolution, local rule participation, and nested governance. | [Elinor Ostrom Nobel Prize Lecture](https://www.nobelprize.org/uploads/2018/06/ostrom_lecture.pdf) | Durable commons governance depends on concrete institutional design, not declarations of shared purpose. | It does not prove a federation-scale constitutional economy can inherit commons-governance success. | Level 3 \u2014 Internal consistency review |\n| Wealth can distort rule outcomes. | [Gilens and Page, Testing Theories of American Politics](https://doi.org/10.1017/S1537592714001595) | Economic elites and organized business interests can have substantial independent policy influence in the U.S. cases they modeled. | It is U.S.-specific, debated, and does not prove this project's anti-conversion mechanisms work. | Level 3 \u2014 Internal consistency review |\n| Accumulated advantage can compound over time. | [Thomas Piketty, Capital in the Twenty-First Century](https://www.hup.harvard.edu/books/9780674430006) | Long-run accumulation and inherited advantage can produce concentration dynamics that require structural attention. | It does not prove Commons Return, bounded capital claims, decay mechanisms, or anti-rent rules will be fair, effective, or politically legitimate. | Level 3 \u2014 Internal consistency review |\n| Non-convertibility is the core safety hypothesis. | Synthesis from the above sources plus the project's threat model. | The sources support the diagnosis that survival-market dependence, wealth-rule influence, commons capture, and compounding advantage are real design pressures. | No source proves perfect non-convertibility. Shadow markets, proxies, legal wrappers, and informal patronage remain permanent attack surfaces. | Level 3 \u2014 Internal consistency review |\n| Tier 1 drift should be detectable, not trusted by assertion. | [NIST FIPS 180-4](https://www.nist.gov/publications/secure-hash-standard), [RFC 6962](https://www.rfc-editor.org/rfc/rfc6962), [NISTIR 8214](https://www.nist.gov/publications/threshold-schemes-cryptographic-primitives), [NIST SP 800-57 Part 1 Rev. 5](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final), and [OpenZeppelin TimelockController](https://docs.openzeppelin.com/contracts/4.x/api/governance) | Hashes, append-only logs, threshold signing, key management, and timelocks are real integrity patterns. | They do not prove this project's operators, keyholders, software supply chain, founding authority, or public response window will work. | Level 4 \u2014 Adversarial paper test |\n\n---\n\n> **Current architecture status: Level 3 (Designed mechanism).** The project may not claim Level 5 or above for any design claim until pilot evidence exists. The Tier 1 tamper-evidence layer is at Level 4 based on the proven cryptographic standards it uses, not on this project's implementation having been tested.\n\n---\n\n## Claim Boundaries\n\nThe project may honestly claim that it contains a serious channel-separation architecture designed to resist three collapse states.\n\nIt should not claim that:\n\n- survival access has been proven deliverable at scale;\n- wealth-to-rule conversion has been eliminated;\n- static advantage can be fully prevented;\n- Commons Return, Universal Stake, or dormant demurrage backstops have been proven fair or effective;\n- Service Record cannot become social ranking;\n- measurement oracles can perfectly reflect physical reality;\n- emergency powers cannot normalize;\n- founding legitimacy has already been earned.\n- Tier 1 implementation drift is impossible merely because the documents contain hashes, signatures, and timelocks.\n\nThe accurate current claim is narrower: the document set defines mechanisms, threat models, patch histories, evidence needs, and pilot gates that make those collapse states visible and testable.\n\n---\n\n## Review Questions\n\nUse these questions when reviewing any threat, patch, annex, pilot, or public claim:\n\n1. Does this mechanism reduce one collapse state while creating another?\n2. Can a wealthy actor route around the formal rule through proxies, contractors, family networks, media influence, shell entities, or professional control?\n3. Does the Life Channel depend on administrators whose discretion could become a survival gate?\n4. Can Service Record become rank by effect even if the text says it is not a score?\n5. Are real capacity, delivery, and appeal outcomes measured physically enough to catch paper compliance?\n6. Does emergency authority automatically sunset, and can the public understand the sunset evidence?\n7. Can new participants enter without being permanently subordinate to early entrants?\n8. What evidence would falsify the claim that this mechanism resists the collapse state it targets?\n\n---\n\n## Recent Annex Additions\n\nThis section records significant structural additions made to individual annexes after the initial architecture was established. For full threat-to-annex linkage see `ANNEX_AH.md \u00a7 AH8` and `docs/governance/Provenance_Map.md`.\n\n### ANNEX_AM \u00a7AM8 \u2014 Constitutional Integrity Panel (CIP)\n\nAdded by P-051. Addresses T-022 open problem: constitutional body now specified.\n\n\u00a7AM8 \u2014 Constitutional Integrity Panel (CIP): 7-member independent body with staggered terms, 0.01%-of-Flow-issuance constitutionally fixed funding, 5-of-7 quorum for Tier 1 ratification, automatic hollowing triggers (90-day vacancy, 30-day post-mortem lapse). Added by P-051. Addresses T-022 open problem: constitutional body now specified.\n\n### ANNEX_AT \u00a7AT6.6 \u2014 Compliant Alternative Supplier Pre-Registration (CASP)\n\nAdded by P-050. CASP is primary T-028 mitigation; public receiver authority is fallback.\n\n\u00a7AT6.6 \u2014 CASP: mandatory pre-registration of backup suppliers with automatic-activation contracts (9 chokepoints specified, gap-window calculation required). Added by P-050. CASP is primary T-028 mitigation; public receiver authority is fallback.\n\n### ANNEX_AI \u00a74.12 \u2014 Deliberate-Manufacture Standard\n\nAdded by P-052. Closes T-019 open problem.\n\n\u00a74.12 \u2014 Deliberate-manufacture standard: 4-criterion assessment (timing, proportionality, prior-basis, knowledge), 24-hour Plenum window, asymmetric default favoring PCRP. Added by P-052. Closes T-019 open problem.\n\n---\n\n## Founding Commitments Status\n\nFC-140 through FC-145 (AED fraud/exclusion bands) now bound. FC-052, FC-053, FC-054, FC-056, FC-072, FC-148 through FC-150 now have proposed values pending founding deliberation.\n",
+      "content": "# Architecture Source Map\n\nThis document explains the first-principles architecture behind the Humane Constitution and names the outside sources that help pressure-test it.\n\nThe architecture is an original synthesis. The sources below support parts of the diagnosis and design discipline; they do not prove that the full constitutional system works.\n\n---\n\n## Core Collapse States\n\nThe project is organized around preventing three structural collapse states.\n\n| Collapse state | First-principles failure | Project response | Main evidence burden |\n|---|---|---|---|\n| **Survival-Trade Bind** | A person must succeed in markets, employment, credit, or exchange to stay alive, safe, housed, treated, or civically legible. | Essential Access, Constitutional Survival Minimum, identity-continuity rules, non-convertibility, and capacity measurement. | Identity recovery, Essential Access delivery, shadow-convertibility testing, real-capacity measurement, appeal continuity, and scarcity drills. |\n| **Power-Wealth Convergence** | Accumulated wealth becomes formal or practical authority over rules, enforcement, public measurement, civic access, or institutional design. | Flow / Voice / Service Record separation, anti-conversion rules, public records, beneficial-control review, anti-rent controls, and independent oversight. | Proxy-market tests, institutional-capture review, public-banking simulation, anti-corruption audit, legal-wrapper review, and FAP capture testing. |\n| **Static-Advantage Loop** | Early-entry advantage, inheritance, expertise, procedural control, or gatekeeping hardens into permanent class position. | Commons Return, bounded capital claims, decay where appropriate, rotation, anti-dynasty rules, new-participant access, subsidiarity review, exit protections, and bottleneck audits. | Service Record misuse testing, concentration dashboards, legal-wrapper review, founding-legitimacy tests, and governance red-team exercises. |\n\nThese collapse states are a diagnostic lens, not a status label. A mechanism can be written, proposed, active, or evidence-backed only under the status language in the [Claims and Evidence Register](./Claims_Evidence_Register.md).\n\nFor the threat-by-threat mapping, use the [Collapse-State Crosswalk](./Collapse_State_Crosswalk.md). For the test ladder that decides when a collapse-state claim may be strengthened, use the [Evidence Ladder](./Evidence_Ladder.md).\n\n---\n\n## Instrument Map\n\nThe project does not use one universal instrument that can buy everything.\n\n| Function | Existing project instrument | What it must not become |\n|---|---|---|\n| Basic survival and functional continuity | Essential Access / Constitutional Survival Minimum | A commodity, debt instrument, punishment tool, patronage channel, or gatekeeping reward. |\n| Optional exchange and enterprise | Flow | A route to civic authority, survival priority, enforcement privilege, or permanent bottleneck control. |\n| Public participation and correction | Voice | A purchased vote, transferable influence asset, status market, or wealth-weighted rule channel. |\n| Contribution recognition | Service Record | A total human-worth score, employability rank, caste marker, or permanent civic aristocracy. |\n| Scarcity response | Shared Storehouse | Ordinary trade inventory, permanent emergency administration, or discretionary rationing power. |\n\nThe core safety rule is:\n\n> No stored advantage may purchase access to survival, rule-authority, or permanent dominance.\n\nThe stronger operational version is:\n\n> Trade wealth must not directly or indirectly produce durable rule advantage, enforcement privilege, survival priority, or control over essential bottlenecks.\n\nThis broader version matters because corruption usually travels through indirect routes: employers, landlords, contractors, shell entities, professional networks, media influence, standards bodies, family offices, foundations, and dependency relationships.\n\n---\n\n## Source Map\n\n| Design claim | Outside source anchor | What it supports | What it does not prove | Evidence level |\n|---|---|---|---|---|\n| Survival should not depend only on market success. | [Universal Basic Services: Theory and Practice](https://discovery.ucl.ac.uk/10080177/) | Essential services can be framed as public access infrastructure that supports welfare, safety, opportunity, and democratic participation. | It does not prove this project's Essential Access, CSM, identity, logistics, or funding mechanics. | Level 3 \u2014 Internal consistency review |\n| Shared-resource systems need boundaries, monitoring, sanctions, conflict resolution, local rule participation, and nested governance. | [Elinor Ostrom Nobel Prize Lecture](https://www.nobelprize.org/uploads/2018/06/ostrom_lecture.pdf) | Durable commons governance depends on concrete institutional design, not declarations of shared purpose. | It does not prove a federation-scale constitutional economy can inherit commons-governance success. | Level 3 \u2014 Internal consistency review |\n| Wealth can distort rule outcomes. | [Gilens and Page, Testing Theories of American Politics](https://doi.org/10.1017/S1537592714001595) | Economic elites and organized business interests can have substantial independent policy influence in the U.S. cases they modeled. | It is U.S.-specific, debated, and does not prove this project's anti-conversion mechanisms work. | Level 3 \u2014 Internal consistency review |\n| Accumulated advantage can compound over time. | [Thomas Piketty, Capital in the Twenty-First Century](https://www.hup.harvard.edu/books/9780674430006) | Long-run accumulation and inherited advantage can produce concentration dynamics that require structural attention. | It does not prove Commons Return, bounded capital claims, decay mechanisms, or anti-rent rules will be fair, effective, or politically legitimate. | Level 3 \u2014 Internal consistency review |\n| Non-convertibility is the core safety hypothesis. | Synthesis from the above sources plus the project's threat model. | The sources support the diagnosis that survival-market dependence, wealth-rule influence, commons capture, and compounding advantage are real design pressures. | No source proves perfect non-convertibility. Shadow markets, proxies, legal wrappers, and informal patronage remain permanent attack surfaces. | Level 3 \u2014 Internal consistency review |\n| Tier 1 drift should be detectable, not trusted by assertion. | [NIST FIPS 180-4](https://www.nist.gov/publications/secure-hash-standard), [RFC 6962](https://www.rfc-editor.org/rfc/rfc6962), [NISTIR 8214](https://www.nist.gov/publications/threshold-schemes-cryptographic-primitives), [NIST SP 800-57 Part 1 Rev. 5](https://csrc.nist.gov/pubs/sp/800/57/pt1/r5/final), and [OpenZeppelin TimelockController](https://docs.openzeppelin.com/contracts/4.x/api/governance) | Hashes, append-only logs, threshold signing, key management, and timelocks are real integrity patterns. | They do not prove this project's operators, keyholders, software supply chain, founding authority, or public response window will work. | Level 4 \u2014 Adversarial paper test |\n\n---\n\n> **Current architecture status: Level 3 (Designed mechanism).** The project may not claim Level 5 or above for any design claim until pilot evidence exists. The Tier 1 tamper-evidence layer is at Level 4 based on the proven cryptographic standards it uses, not on this project's implementation having been tested.\n\n---\n\n## Claim Boundaries\n\nThe project may honestly claim that it contains a serious channel-separation architecture designed to resist three collapse states.\n\nIt should not claim that:\n\n- survival access has been proven deliverable at scale;\n- wealth-to-rule conversion has been eliminated;\n- static advantage can be fully prevented;\n- Commons Return, Universal Stake, or dormant demurrage backstops have been proven fair or effective;\n- Service Record cannot become social ranking;\n- measurement oracles can perfectly reflect physical reality;\n- emergency powers cannot normalize;\n- founding legitimacy has already been earned.\n- Tier 1 implementation drift is impossible merely because the documents contain hashes, signatures, and timelocks.\n\nThe accurate current claim is narrower: the document set defines mechanisms, threat models, patch histories, evidence needs, and pilot gates that make those collapse states visible and testable.\n\n---\n\n## Review Questions\n\nUse these questions when reviewing any threat, patch, annex, pilot, or public claim:\n\n1. Does this mechanism reduce one collapse state while creating another?\n2. Can a wealthy actor route around the formal rule through proxies, contractors, family networks, media influence, shell entities, or professional control?\n3. Does the Life Channel depend on administrators whose discretion could become a survival gate?\n4. Can Service Record become rank by effect even if the text says it is not a score?\n5. Are real capacity, delivery, and appeal outcomes measured physically enough to catch paper compliance?\n6. Does emergency authority automatically sunset, and can the public understand the sunset evidence?\n7. Can new participants enter without being permanently subordinate to early entrants?\n8. What evidence would falsify the claim that this mechanism resists the collapse state it targets?\n\n---\n\n## Recent Annex Additions\n\nThis section records significant structural additions made to individual annexes after the initial architecture was established. For full threat-to-annex linkage see `ANNEX_AH.md \u00a7 AH8` and `docs/governance/Provenance_Map.md`.\n\n### ANNEX_AM \u00a7AM8 \u2014 Constitutional Integrity Panel (CIP)\n\nAdded by P-051. Addresses T-022 open problem: constitutional body now specified.\n\n\u00a7AM8 \u2014 Constitutional Integrity Panel (CIP): 7-member independent body with staggered terms, 0.01%-of-Flow-issuance constitutionally fixed funding, 5-of-7 quorum for Tier 1 ratification, automatic hollowing triggers (90-day vacancy, 30-day post-mortem lapse). Added by P-051. Addresses T-022 open problem: constitutional body now specified.\n\n### ANNEX_AT \u00a7AT6.6 \u2014 Compliant Alternative Supplier Pre-Registration (CASP)\n\nAdded by P-050. CASP is primary T-028 mitigation; public receiver authority is fallback.\n\n\u00a7AT6.6 \u2014 CASP: mandatory pre-registration of backup suppliers with automatic-activation contracts (9 chokepoints specified, gap-window calculation required). Added by P-050. CASP is primary T-028 mitigation; public receiver authority is fallback.\n\n### ANNEX_AI \u00a74.12 \u2014 Deliberate-Manufacture Standard\n\nAdded by P-052. Closes T-019 open problem.\n\n\u00a74.12 \u2014 Deliberate-manufacture standard: 4-criterion assessment (timing, proportionality, prior-basis, knowledge), 24-hour Plenum window, asymmetric default favoring PCRP. Added by P-052. Closes T-019 open problem.\n\n---\n\n## Founding Commitments Status\n\nFC-140 through FC-145 (AED fraud/exclusion bands) now bound. FC-053, FC-056, FC-072, FC-148 through FC-150 have proposed values pending founding deliberation. FC-050 through FC-052 and FC-054 (the former routine-demurrage parameters) are superseded \u2014 dormant \u00a7D9 backstop only; the active wealth-spine calibration is FC-202 through FC-210 (Commons Return and Universal Stake).\n",
       "headings": [
         {
           "level": 1,
@@ -2561,7 +2561,7 @@
           "slug": "founding-commitments-status"
         }
       ],
-      "wordCount": 1480,
+      "wordCount": 1510,
       "headingCount": 11
     },
     {
@@ -2705,7 +2705,7 @@
       "status": "",
       "statusBucket": "reference",
       "summary": "This register tracks high-risk parameters whose numbers matter enough that they should not remain \"because the document says so.\"",
-      "content": "# Parameter Calibration Register\n\nThis register tracks high-risk parameters whose numbers matter enough that they should not remain \"because the document says so.\"\n\nIt complements `/founding/commitments.md` and `architecture/parameter_registry.md`. Those files bind values. This file records why values are plausible, how they should be tested, and what evidence would force revision.\n\n---\n\n## Row Standard\n\nEvery high-risk parameter should eventually have:\n\n| Field | Meaning |\n|---|---|\n| Parameter | FC identifier or named constitutional threshold. |\n| Current value | Bound, provisional, reserved, or proposed value. |\n| Tier | Tier 1, Tier 2, Tier 3, or pre-launch blocking gate. |\n| Why this value exists | Plain-language rationale, not just cross-reference. |\n| Capture route | How a bad actor benefits from this value being too high, too low, vague, or stale. |\n| Evidence needed | Simulation, pilot, audit, legal review, or outside source needed. |\n| Revision trigger | What result forces review. |\n| Governing docs | Where the value is bound and where consequences appear. |\n\n---\n\n## Seed Register\n\n| Parameter | Current value | Tier | Why this value exists | Capture route | Evidence needed | Revision trigger | Governing docs |\n|---|---:|---|---|---|---|---|---|\n| FC-010 leakage thresholds | 3% routine target; 7% systemic review | Tier 1 / active-unproven | Converts shadow-convertibility enforcement capacity into published thresholds. | Too high normalizes broker markets; too low justifies surveillance. | Proxy-market red team; enforcement-capacity audit. | Broker profitability remains positive or ordinary households face overbroad enforcement. | Annex AB; Threat Register T-001. |\n| FC-020 Protected Pause floor | 0.30 Voice | Tier 1 | Prevents hardship from erasing civic continuity. | Too high preserves incumbents; too low punishes illness and care. | Hardship-pause abuse test. | Pause rings preserve roles or genuine hardship users avoid protection. | Annex AF; Service Record Misuse Evidence Test Package. |\n| FC-030 oracle N_MIN | 5 nodes | Tier 1 | Prevents single-source measurement control. | Too low enables capture; too high causes paralysis. | Capacity measurement and oracle-failure drill. | Quorum failure blocks response or correlated error persists. | Annex AL; Capacity Measurement Evidence Test Package. |\n| FC-031 methodology classes | 3 classes | Tier 1 | Reduces shared epistemic failure. | Standards bodies define all classes in their own image. | Methodology-class audit. | Method classes share data, funding, model supply chain, or standards body. | Annex AL; T-020/T-021. |\n| FC-032 pairwise correlation max | 0.30 Pearson, supplemented by directional-bias review | Tier 1 | Makes formal independence testable while preventing same-direction bias from passing merely because co-movement is low. | Actors tune reporting to pass correlation while sharing assumptions or incentives that push all errors in the same direction. | Forecast-vs-actual, directional-bias table, and oracle independence audit. | Shared error exceeds threshold during stress, or same-direction material error recurs without corrective action. | Annex AL; T-020/T-021. |\n| FC-033 adversarial oracle seats | 1 per cohort | Tier 1 | Forces hostile-method review inside measurement. | Seat becomes symbolic or captured by same professional network. | Adversarial-seat independence review. | Dissent never changes outcomes or is not resourced. | Annex AL; T-020/T-021. |\n| FC-040 penalty base multiplier | 5.0x | Tier 1 / active-unproven | Makes detected conversion expected-value negative. | Too low invites arbitrage; too high punishes edge cases harshly. | Annual deterrence audit. | Violations remain profitable or appeals show disproportionate harm. | Annex AJ; T-001/T-007. |\n| FC-041 detection assumption | 0.85 | Tier 1 / active-unproven | Supplies expected-value calculation for penalties. | Overstated detection hides under-enforcement. | Detection-rate audit. | Actual detection probability materially lower than assumed. | Annex AJ; Enforcement Panel audit. |\n| FC-052 protected ordinary-use threshold | Reserved \u2014 bind before Flow launch; initial reference remains 18 months \u00d7 regional median monthly consumption until replaced by the CRUS fiscal dossier | Tier 2 / pre-launch gate | Defines the ordinary household reserve that may not become the public funding base under Annex D protected-use rules. | Too low reaches ordinary households; too high shelters concentrated control under household labels. | Commons Return incidence model and household/small-operator burden review. | Ordinary households, caregivers, small operators, elders, disabled persons, or rural households bear Commons Return burden meant for scarcity privilege or public-created value. | ANNEX_D; Commons Return and Universal Stake Evidence Package. |\n| FC-053 dormant net-worth backstop schedule | Superseded as an active parameter; no founding progressive net-worth decay schedule is operative unless a new patch, fiscal/dignity evidence, public review, and applicable amendment process revive a narrow dormant backstop. | Dormant / not operative | Preserves historical traceability for the retired demurrage design without letting old rates govern by accident. | If treated as active, it can burden ordinary households, illiquid owners, or working savers while bypassing the Commons Return source-base test. | Dormant-backstop incidence model, dignity review, household burden model, and explicit amendment activation record before any use. | Any document or implementation treats old \u03bb brackets as active, funds Essential Access from them, or applies routine balance/net-worth decay by interpretation. | ANNEX_D \u00a7D1 and \u00a7D9; SPECIFICATIONS. |\n| FC-054 PFCR / lockbox routing share | Reserved | Tier 2 / pre-launch gate | Splits Commons Return receipts between Essential Access support, public rails, restoration, resilience reserves, infrastructure, and Universal Stake. | Too much to one channel creates fiscal dependency; too little weakens commons funding or turns Universal Stake into political dividend timing. | Fiscal adequacy model, source-base revenue model, lockbox sufficiency test, and burden-incidence review. | PFCR becomes dependent on inflation, hidden debt, or prohibited tax bases; or cannot fund baseline commons. | ANNEX_D; Article V; SPECIFICATIONS. |\n| FC-055 issuance ceiling function | Reserved | Tier 1 / pre-launch gate | Links Flow supply to verified productive commitments. | Too loose inflates claims; too tight starves production. | Flow issuance simulation and productive-commitment audit. | Circulation detaches from real production or needed projects cannot clear. | Article V; SPECIFICATIONS. |\n| FC-058 CSM basket/regional adjustment | Reserved | Tier 1 / regional launch gate | Prevents one abstract basket from ignoring local climate, food, medicine, and shelter needs. | Under-adjustment harms high-need regions; over-adjustment invites political inflation. | Regional CSM pilot and capacity review. | Regional needs are mismeasured or adjustment becomes patronage. | Article III; Annex Y; SPECIFICATIONS. |\n| FC-060 Voice sector ceiling | 0.20 | Tier 1 | Prevents one sector dominating civic weighting. | Sector labels are split or merged to hide concentration. | Capture Dashboard Specification. | Sector concentration remains high through reclassification. | Article VI; Annex AC. |\n| FC-061 per-person cap | See commitments | Tier 1 | Prevents extreme individual civic weight. | Cap can still permit coordinated class control. | Civic-pool concentration review. | Repeat-role networks dominate despite compliance. | Article VI; Annex Z. |\n| FC-062 Service Record decay | See commitments | Tier 1 | Keeps standing tied to recent service. | Slow decay preserves old class; fast decay erases real long-term service. | Service Record misuse and hardship-pause tests. | Role pools become stale or participation becomes burnout. | Annex Z; Annex AF. |\n| FC-070 reserve window | 45 days x CSM x population | Tier 1 | Gives survival floor time during supply shock. | Under-reserve creates rationing; over-reserve creates hoarding bureaucracy. | Capacity stress test by essential category. | Reserves fail before recovery window or drain ordinary supply. | Annex Y; Article III. |\n| FC-071 CSM cluster failure threshold | 3 per 10,000 residents per 30 days | Tier 1 | Detects survival-floor delivery failure. | Too high hides local harm; too low causes noisy emergency churn. | Delivery pilot and small-cell privacy review. | Cluster failures undercount vulnerable groups. | Annex Y; Article VII. |\n| FC-072 Shared Storehouse activation threshold rule | Reserved by category | Tier 1 / activation gate | Prevents emergency rationing from activating on vague scarcity claims. | Too loose normalizes rationing; too strict delays needed protection. | Scarcity activation and unwind drill by essential category. | Shared Storehouse activates without real scarcity or fails during shortage. | Article III; Annex AQ; SPECIFICATIONS. |\n| FC-080 attestation stake ratio | See commitments | Tier 1 | Makes false high-impact attestations costly. | Rich actors buy credibility; poor attestors withdraw. | Attestation market test. | False claims persist or isolated people lose recognition. | Annex AS; Service Record package. |\n| FC-081 audit window | See commitments | Tier 1 | Keeps attestations reviewable long enough to catch false claims. | Too short invites delayed fraud; too long chills honest help. | Attestation/collusion pilot. | Disconfirmations arrive after window or honest attestation drops. | Annex AS. |\n| FC-082 graph density threshold | See commitments | Tier 1 | Protects close-knit communities from automatic collusion penalties. | Rings hide as community density. | Dense-community safe-harbor test. | Mutual-aid networks or fraud rings are misclassified. | Annex AS. |\n| FC-090 Ombuds sub-count | 5 nodes | Tier 1 | Distributes audit authority. | Five offices can still coordinate informally. | Capture Dashboard Specification. | Voting-pattern and staffing overlap exceed threshold. | Annex AI. |\n| FC-091 Ombuds supermajority | 4 of 5 | Tier 1 | Prevents one sub-node from ruling alone. | Minority can block needed correction; majority can coordinate. | Ombuds deadlock and collusion drill. | Repeated 3-2 deadlocks or rubber-stamp 5-0 patterns. | Annex AI. |\n| FC-100 quorum-loss restoration | 14 days | Tier 1 | Limits emergency hold under oracle loss. | Too long normalizes emergency; too short forces unsafe unwind. | Shared Storehouse oracle blackout drill. | Restoration misses reality or holds persist after recovery. | Annex AQ. |\n| FC-110 Tier 1 signatures | 7 of 9 | Tier 1 recursive | Blocks small-coalition amendment of core rules. | Three holders can block; seven can be captured socially. | Keyholder custody and capture review. | Holder concentration or coercion makes threshold easier than assumed. | Amendment Protocol. |\n| FC-111 Tier 1 timelock | 180 days | Tier 1 recursive | Creates public response and exit window. | Delay can be waited out or used for paralysis. | Timelock response drill. | Affected communities cannot understand, challenge, or exit in time. | Amendment Protocol; Drift Chain. |\n| FC-120 exit threshold | 2/3 resident personhood | Tier 1 | Prevents small faction exit capture. | Too high traps dissenters; too low enables hostile breakaway. | Exit rehearsal and participation-barrier audit. | Exit is formal but practically unavailable. | Founding Order. |\n| FC-121 exit unwind | 730 days | Tier 1 | Preserves Essential Access during exit. | Too long becomes exit denial; too short harms dependents. | Exit transition simulation. | Essential services fail or exit becomes punitive. | Founding Order. |\n| FC-140 identity fraud band | target \u22642% / upper bound \u22645% / trigger \u22653% per quarter | Tier 2 / pre-launch gate | Sets starting Essential Access identity-fraud tolerance while keeping fraud visible before it drains physical survival supply. | Over-tightening excludes vulnerable people; over-loosening lets identity fraud consume food, medicine, shelter, or other CSM capacity. | Identity and Recovery Evidence Test Package; Annex AK; founding commitments. | Exclusion rises, fraud drains Essential Access, or pilot evidence shows the band is too loose or too tight for vulnerable populations. | Annex AK; founding/commitments.md. |\n| FC-160-184 contract parameters | Reserved / proposed | Pre-launch gate | Escrow, deployment-window, force-majeure, and inspector-pool controls need calibration. | Loose terms recreate hoarding; tight terms block infrastructure. | Commons Return and Universal Stake Evidence Test Package, project-finance simulation, and procurement red team. | Escrows become protected-capital shelter markets or project finance stalls. | Annex AR; ANNEX_D. |\n| FC-185-193 external trade and strategic floor parameters | Reserved / draft anchors | Tier 1 / Tier 2 mixed | Strategic reserves and external-capital gates decide whether outside dependency can threaten the survival floor. | Too loose creates foreign-capital or supplier capture; too strict blocks useful trade. | External trade stress test, supplier concentration audit, reserve adequacy review. | Strategic categories fall below floor or capital controls become arbitrary. | Annex AT. |\n| FC-194 essential fuel reserve minimum | Reserved; draft anchor 60-90 days by region and season | Tier 1 / pre-launch gate | Fuel continuity is a refusal chokepoint for food, heat, emergency transport, and grid recovery. | Too low lets a conglomerate or import shock force capitulation; too high creates stockpile capture and spoilage bureaucracy. | Fuel reserve adequacy model; seasonal logistics drill; refinery and transport dependency audit. | Any region falls below minimum during a 30-day refusal scenario or reserve turnover degrades usable supply. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-195 essential medicine stockpile minimum | Reserved; draft anchor 90-180 days for critical lists | Tier 1 / pre-launch gate | Medicines with fragile supply chains need a longer buffer than ordinary inventory because substitution can be clinically impossible. | Too low lets suppliers, PBMs, or distributors ration access; too high causes expiry waste and favors incumbents with warehousing. | Critical medicine list; expiry and rotation audit; shortage simulation by region and care setting. | Critical medicine availability drops below clinical continuity floor or stock rotation losses become material. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-196 maximum essential supplier concentration | Reserved; draft anchor no supplier above 25% of regional essential throughput | Tier 1 / launch gate | Prevents one firm from becoming the practical veto point for survival-floor delivery. | Too loose permits single-supplier refusal; too strict blocks emergency use of scarce specialist capacity. | Supplier concentration audit; regional substitution map; refusal tabletop exercise. | One supplier can interrupt more than a quarter of regional essential throughput without a public fallback already active. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-197 public fallback activation deadline | Reserved; draft anchor 72 hours for critical interruption, 14 days for managed transition | Tier 1 / activation gate | Refusal protection only works if public or cooperative fallback capacity starts before households hit survival-floor failure. | Too slow lets private operators bargain through delay; too fast may trigger wasteful takeover before facts are verified. | Public fallback readiness drill; emergency procurement rehearsal; legal activation review. | Verified interruption persists past deadline without fallback service or false activations recur. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-198 procurement concentration threshold | Reserved; draft anchor review above 30%, mandatory remediation above 40% of essential category spend | Tier 2 / pre-launch gate | Public purchasing can accidentally rebuild the same conglomerate dependency it is meant to neutralize. | Too loose funnels demand to incumbents; too strict fragments procurement below quality and reliability needs. | Procurement spend audit; vendor capacity review; anti-collusion screen. | Essential procurement share exceeds remediation threshold for two review periods or fragmentation causes delivery failure. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-199 PBM/intermediary separation threshold | Reserved; draft anchor separation review at 10% cross-owned claims or dispensing volume, mandatory firewall above 20% | Tier 1 / launch gate | Pharmacy benefit managers and similar intermediaries can deny access while appearing to manage price or claims. | Too loose lets intermediaries steer patients and suppliers; too strict may disrupt legitimate administrative clearing. | PBM ownership and routing audit; claims-denial review; patient access stress test. | Cross-owned routing exceeds threshold, denial patterns favor affiliated entities, or independent access deteriorates. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-200 critical logistics redundancy floor | Reserved; draft anchor two independent routes and operators per essential region | Tier 1 / launch gate | Stockpiles do not matter if a conglomerate controls the practical path from reserve to household or clinic. | Too low creates carrier or warehouse chokepoints; too high imposes costly duplication in sparse regions. | Logistics dependency map; cold-chain and last-mile drill; emergency carrier substitution test. | A single operator, warehouse, port, rail spur, or cold-chain provider can block regional essential delivery. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-201 essential data and claims portability deadline | Reserved; draft anchor 24 hours for emergency export, 30 days for full transition package | Tier 2 / transition gate | Conglomerate refusal can happen through records, claims, formularies, and routing data even when physical supply exists. | Too loose lets incumbents hold operations hostage; too strict risks unsafe or incomplete data transfer. | Data escrow rehearsal; claims and formulary export audit; receiving-operator validation. | Public fallback cannot adjudicate, dispense, route, or reconcile essential service within deadline. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| RHL protected-channel ceiling | Reserved \u2014 Tier 2 founding commitment; any TFP/RHL ceiling must be re-derived under Annex D protected ordinary use, Annex X stale-purpose rules, Commons Return source-base review, and the Anti-Rent Legal Wrapper Evidence Test Package. | Tier 2 / pre-launch gate | Prevents protected savings or project-finance channels from becoming unlimited shelters for concentrated control while preserving ordinary retirement and household continuity. | Too high shelters concentrated wealth under protected labels; too low blocks ordinary savings, retirement planning, or productive small-operator resilience. | Household savings simulation; concentration impact assessment; source-base avoidance review; legal-wrapper review; comparison with floor needs over 5, 10, and 20 years. | High-balance households use TFP/RHL faster than expected to avoid Commons Return/source-base review, or ordinary retirement savers cannot reach the participation floor. | ANNEX_D; ANNEX_X; Anti-Rent Legal Wrapper Evidence Test Package. |\n| CASP price corridor | \u00b115% of the registered pricing index for the relevant category, adjusted quarterly for verified regional inflation | Tier 2 / operational | Prevents essential-sector suppliers from exploiting captive-buyer position through price spikes, while allowing legitimate cost fluctuation. | Too narrow blocks legitimate price adjustment; too wide defeats the price protection purpose. | Price corridor red team; inflation adjustment audit; supplier profitability review at corridor boundary. | Suppliers systematically price at corridor ceiling or exit when corridor prevents premium pricing. | Annex AT \u00a7AT6.6. |\n| CASP service-level baseline dimensions | Minimum four measurable dimensions co-signed at pre-registration: delivery timeliness, fill rate, quality certification rate, and incident response time; plus any category-specific additions | Tier 2 / operational | Makes degradation trigger (clause d) measurable and enforceable; prevents slow-squeeze through informal service erosion. | Too few dimensions misses degradation; too many dimensions creates gaming through selectively meeting some. | Degradation detection drill; supplier behavior under watch conditions. | Suppliers meet formal dimensions while degrading overall service or dimension gaming becomes observable. | Annex AT \u00a7AT6.6. |\n| CIP absolute funding floor | Reserved \u2014 Tier 2 founding commitment established before CIP constitution; must cover staff for 7 members, independent legal and technical review for 4 Tier-1-touching proposals per year, and publication infrastructure | Tier 2 / pre-launch gate | Prevents under-reporting of Flow issuance as a mechanism for CIP budget suppression below operating capacity. | Too low renders CIP ineffective; too high creates fiscal dependency risk. | CIP operating cost estimate; comparable constitutional body audit. | CIP cannot staff an adversarial review of a Tier-1-touching proposal within its budget or funding-floor breach goes unpublished. | Annex AM \u00a7AM8.3. |\n| FC-T0-01 | Tier 0 aggregate anomaly threshold | 5% of CSM capacity per category | 2%\u201315% | Ombuds via standard FAP | Baseline consumption data from Phase 2 pilot; revisit if physical-fraud rate exceeds threshold in stress test | ANNEX_AK \u00a7AK8.3 |\n\n---\n\n## Maintenance Rule\n\nNo parameter should move from provisional to bound without a row here, an evidence path, and a revision trigger. No parameter should stay bound after evidence shows it is causing the collapse state it was meant to prevent.\n",
+      "content": "# Parameter Calibration Register\n\nThis register tracks high-risk parameters whose numbers matter enough that they should not remain \"because the document says so.\"\n\nIt complements `/founding/commitments.md` and `architecture/parameter_registry.md`. Those files bind values. This file records why values are plausible, how they should be tested, and what evidence would force revision.\n\n---\n\n## Row Standard\n\nEvery high-risk parameter should eventually have:\n\n| Field | Meaning |\n|---|---|\n| Parameter | FC identifier or named constitutional threshold. |\n| Current value | Bound, provisional, reserved, or proposed value. |\n| Tier | Tier 1, Tier 2, Tier 3, or pre-launch blocking gate. |\n| Why this value exists | Plain-language rationale, not just cross-reference. |\n| Capture route | How a bad actor benefits from this value being too high, too low, vague, or stale. |\n| Evidence needed | Simulation, pilot, audit, legal review, or outside source needed. |\n| Revision trigger | What result forces review. |\n| Governing docs | Where the value is bound and where consequences appear. |\n\n---\n\n## Seed Register\n\n| Parameter | Current value | Tier | Why this value exists | Capture route | Evidence needed | Revision trigger | Governing docs |\n|---|---:|---|---|---|---|---|---|\n| FC-010 leakage thresholds | 3% routine target; 7% systemic review | Tier 1 / active-unproven | Converts shadow-convertibility enforcement capacity into published thresholds. | Too high normalizes broker markets; too low justifies surveillance. | Proxy-market red team; enforcement-capacity audit. | Broker profitability remains positive or ordinary households face overbroad enforcement. | Annex AB; Threat Register T-001. |\n| FC-020 Protected Pause floor | 0.30 Voice | Tier 1 | Prevents hardship from erasing civic continuity. | Too high preserves incumbents; too low punishes illness and care. | Hardship-pause abuse test. | Pause rings preserve roles or genuine hardship users avoid protection. | Annex AF; Service Record Misuse Evidence Test Package. |\n| FC-030 oracle N_MIN | 5 nodes | Tier 1 | Prevents single-source measurement control. | Too low enables capture; too high causes paralysis. | Capacity measurement and oracle-failure drill. | Quorum failure blocks response or correlated error persists. | Annex AL; Capacity Measurement Evidence Test Package. |\n| FC-031 methodology classes | 3 classes | Tier 1 | Reduces shared epistemic failure. | Standards bodies define all classes in their own image. | Methodology-class audit. | Method classes share data, funding, model supply chain, or standards body. | Annex AL; T-020/T-021. |\n| FC-032 pairwise correlation max | 0.30 Pearson, supplemented by directional-bias review | Tier 1 | Makes formal independence testable while preventing same-direction bias from passing merely because co-movement is low. | Actors tune reporting to pass correlation while sharing assumptions or incentives that push all errors in the same direction. | Forecast-vs-actual, directional-bias table, and oracle independence audit. | Shared error exceeds threshold during stress, or same-direction material error recurs without corrective action. | Annex AL; T-020/T-021. |\n| FC-033 adversarial oracle seats | 1 per cohort | Tier 1 | Forces hostile-method review inside measurement. | Seat becomes symbolic or captured by same professional network. | Adversarial-seat independence review. | Dissent never changes outcomes or is not resourced. | Annex AL; T-020/T-021. |\n| FC-040 penalty base multiplier | 5.0x | Tier 1 / active-unproven | Makes detected conversion expected-value negative. | Too low invites arbitrage; too high punishes edge cases harshly. | Annual deterrence audit. | Violations remain profitable or appeals show disproportionate harm. | Annex AJ; T-001/T-007. |\n| FC-041 detection assumption | 0.85 | Tier 1 / active-unproven | Supplies expected-value calculation for penalties. | Overstated detection hides under-enforcement. | Detection-rate audit. | Actual detection probability materially lower than assumed. | Annex AJ; Enforcement Panel audit. |\n| FC-202 Commons Return source-base list | Reserved \u2014 bind before CRUS activation | Tier 1 / pre-launch gate | Defines the closed list of allowed Commons Return bases (land/location value, natural resources, spectrum, monopoly licenses, platform/network rents, high-value concessions, large successions). The list is closed under INV-008: downward extension onto ordinary life is a Tier-1 amendment. | Source-base definitions quietly broadened to reach ordinary labor, homes, tools, or savings. | Source-base mapping pilot and incidence model. | Any base reaches an INV-008-protected category. | ANNEX_D; INVARIANTS INV-008; Commons Return and Universal Stake Evidence Package. |\n| FC-203 Commons Return assessment rate schedule | Reserved \u2014 calibrated by source base before activation | Tier 2 / pre-launch gate | Sets the per-base assessment rate without making ordinary labor or survival access the funding base. | Rates tuned to spare connected asset classes; valuation hiding. | Incidence, valuation-hiding, and external-capital-arbitrage tests. | Burden lands on ordinary households or productive stewardship instead of scarcity privilege. | ANNEX_D; CRUS Simulation Protocol. |\n| FC-204 protected ordinary-use threshold (formerly registered here as FC-052) | Reserved \u2014 bind before CRUS activation; initial reference remains 18 months \u00d7 regional median monthly consumption until replaced by the CRUS fiscal dossier | Tier 2 / pre-launch gate | Defines the ordinary household reserve that may not become the public funding base under Annex D protected-use rules. | Too low reaches ordinary households; too high shelters concentrated control under household labels. | Commons Return incidence model and household/small-operator burden review. | Ordinary households, caregivers, small operators, elders, disabled persons, or rural households bear Commons Return burden meant for scarcity privilege or public-created value. | ANNEX_D; Commons Return and Universal Stake Evidence Package; founding/commitments.md FC-204. |\n| FC-205 Universal Stake distribution cadence | Reserved \u2014 bind before first distribution | Tier 2 / pre-launch gate | Makes Stake timing reliable for households and useless as a political reward instrument; a distribution may be authorized only after the floor and reserves are funded (INV-014). | Distribution timed to elections or withheld as punishment. | Distribution drill with INV-014 ordering check. | Any distribution authorized while floor or reserves underfunded. | ANNEX_D; INVARIANTS INV-014. |\n| FC-206 Universal Stake eligibility rule | Reserved \u2014 bind before first distribution | Tier 1 / pre-launch gate | Keeps the Stake universal and non-convertible (no sale, assignment, garnishment, pledge, inheritance, or purchase of membership/priority/standing/office/Voice). | Eligibility narrowed to exclude the inconvenient; conversion pathways laundered through legal wrappers. | Non-convertibility red team. | Any conversion pathway clears. | ANNEX_D; ANNEX_AK; INVARIANTS INV-002/INV-017. |\n| FC-207 CRUS anti-capture gates | Reserved \u2014 bind before CRUS activation | Tier 1 / pre-launch gate | Public accounting, no patronage discretion, data minimization, auditability, appeal rights. | Fund administrators become patronage allocators. | Capture Dashboard drill. | Discretionary or targeted allocation observed. | ANNEX_D; Capture Dashboard Specification. |\n| FC-208 PFCR / lockbox reserve and routing rule (formerly registered here as FC-054) | Reserved | Tier 2 / pre-launch gate | Splits Commons Return receipts between Essential Access support, public rails, restoration, resilience reserves, infrastructure, and Universal Stake. | Too much to one channel creates fiscal dependency; too little weakens commons funding or turns Universal Stake into political dividend timing. | Fiscal adequacy model, source-base revenue model, lockbox sufficiency test, and burden-incidence review. | PFCR becomes dependent on inflation, hidden debt, or prohibited tax bases; or cannot fund baseline commons. | ANNEX_D; Article V; SPECIFICATIONS; founding/commitments.md FC-208. |\n| FC-209 CRUS appeal path | Reserved \u2014 bind before assessment or distribution | Tier 1 / pre-launch gate | Human appeal for assessed holders and excluded claimants without letting high-value actors stall assessment. | Procedural delay as avoidance; appeal priced out of reach of the poor claimant. | Appeal-path drill (both directions). | Appeals stall assessment or exclude the unrepresented. | ANNEX_D; Federated Ombuds. |\n| FC-210 CRUS review cadence | Reserved \u2014 bind before CRUS activation | Tier 2 / pre-launch gate | Scheduled review of incidence, eligibility, valuation, bases, distribution, reserves, capture metrics; a missed cadence is itself a failure. | Review quietly skipped in good years. | Cadence compliance audit. | Missed cadence or missing data. | ANNEX_D; Capture Dashboard Specification; Pilot Evidence Roadmap. |\n| Dormant \u00a7D9 backstop schedule (no live FC ID; a revival patch would assign one) | Superseded as an active parameter; no routine balance or net-worth decay schedule is operative unless a new patch, fiscal/dignity evidence, public review, and applicable amendment process revive a narrow dormant backstop. | Dormant / not operative | Preserves historical traceability for the retired demurrage designs without letting old rates govern by accident. The retired idle-balance parameters are tombstoned in founding/commitments.md FC-050\u2013FC-052, FC-054. | If treated as active, it can burden ordinary households, illiquid owners, or working savers while bypassing the Commons Return source-base test. | Dormant-backstop incidence model, dignity review, household burden model, and explicit amendment activation record before any use. | Any document or implementation treats old rates or \u03bb brackets as active, funds Essential Access from them, or applies routine balance/net-worth decay by interpretation. | ANNEX_D \u00a7D1 and \u00a7D9; SPECIFICATIONS. |\n| FC-055 issuance ceiling function | Reserved | Tier 1 / pre-launch gate | Links Flow supply to verified productive commitments. | Too loose inflates claims; too tight starves production. | Flow issuance simulation and productive-commitment audit. | Circulation detaches from real production or needed projects cannot clear. | Article V; SPECIFICATIONS. |\n| FC-058 CSM basket/regional adjustment | Reserved | Tier 1 / regional launch gate | Prevents one abstract basket from ignoring local climate, food, medicine, and shelter needs. | Under-adjustment harms high-need regions; over-adjustment invites political inflation. | Regional CSM pilot and capacity review. | Regional needs are mismeasured or adjustment becomes patronage. | Article III; Annex Y; SPECIFICATIONS. |\n| FC-060 Voice sector ceiling | 0.20 | Tier 1 | Prevents one sector dominating civic weighting. | Sector labels are split or merged to hide concentration. | Capture Dashboard Specification. | Sector concentration remains high through reclassification. | Article VI; Annex AC. |\n| FC-061 per-person cap | See commitments | Tier 1 | Prevents extreme individual civic weight. | Cap can still permit coordinated class control. | Civic-pool concentration review. | Repeat-role networks dominate despite compliance. | Article VI; Annex Z. |\n| FC-062 Service Record decay | See commitments | Tier 1 | Keeps standing tied to recent service. | Slow decay preserves old class; fast decay erases real long-term service. | Service Record misuse and hardship-pause tests. | Role pools become stale or participation becomes burnout. | Annex Z; Annex AF. |\n| FC-070 reserve window | 45 days x CSM x population | Tier 1 | Gives survival floor time during supply shock. | Under-reserve creates rationing; over-reserve creates hoarding bureaucracy. | Capacity stress test by essential category. | Reserves fail before recovery window or drain ordinary supply. | Annex Y; Article III. |\n| FC-071 CSM cluster failure threshold | 3 per 10,000 residents per 30 days | Tier 1 | Detects survival-floor delivery failure. | Too high hides local harm; too low causes noisy emergency churn. | Delivery pilot and small-cell privacy review. | Cluster failures undercount vulnerable groups. | Annex Y; Article VII. |\n| FC-072 Shared Storehouse activation threshold rule | Reserved by category | Tier 1 / activation gate | Prevents emergency rationing from activating on vague scarcity claims. | Too loose normalizes rationing; too strict delays needed protection. | Scarcity activation and unwind drill by essential category. | Shared Storehouse activates without real scarcity or fails during shortage. | Article III; Annex AQ; SPECIFICATIONS. |\n| FC-080 attestation stake ratio | See commitments | Tier 1 | Makes false high-impact attestations costly. | Rich actors buy credibility; poor attestors withdraw. | Attestation market test. | False claims persist or isolated people lose recognition. | Annex AS; Service Record package. |\n| FC-081 audit window | See commitments | Tier 1 | Keeps attestations reviewable long enough to catch false claims. | Too short invites delayed fraud; too long chills honest help. | Attestation/collusion pilot. | Disconfirmations arrive after window or honest attestation drops. | Annex AS. |\n| FC-082 graph density threshold | See commitments | Tier 1 | Protects close-knit communities from automatic collusion penalties. | Rings hide as community density. | Dense-community safe-harbor test. | Mutual-aid networks or fraud rings are misclassified. | Annex AS. |\n| FC-090 Ombuds sub-count | 5 nodes | Tier 1 | Distributes audit authority. | Five offices can still coordinate informally. | Capture Dashboard Specification. | Voting-pattern and staffing overlap exceed threshold. | Annex AI. |\n| FC-091 Ombuds supermajority | 4 of 5 | Tier 1 | Prevents one sub-node from ruling alone. | Minority can block needed correction; majority can coordinate. | Ombuds deadlock and collusion drill. | Repeated 3-2 deadlocks or rubber-stamp 5-0 patterns. | Annex AI. |\n| FC-100 quorum-loss restoration | 14 days | Tier 1 | Limits emergency hold under oracle loss. | Too long normalizes emergency; too short forces unsafe unwind. | Shared Storehouse oracle blackout drill. | Restoration misses reality or holds persist after recovery. | Annex AQ. |\n| FC-110 Tier 1 signatures | 7 of 9 | Tier 1 recursive | Blocks small-coalition amendment of core rules. | Three holders can block; seven can be captured socially. | Keyholder custody and capture review. | Holder concentration or coercion makes threshold easier than assumed. | Amendment Protocol. |\n| FC-111 Tier 1 timelock | 180 days | Tier 1 recursive | Creates public response and exit window. | Delay can be waited out or used for paralysis. | Timelock response drill. | Affected communities cannot understand, challenge, or exit in time. | Amendment Protocol; Drift Chain. |\n| FC-120 exit threshold | 2/3 resident personhood | Tier 1 | Prevents small faction exit capture. | Too high traps dissenters; too low enables hostile breakaway. | Exit rehearsal and participation-barrier audit. | Exit is formal but practically unavailable. | Founding Order. |\n| FC-121 exit unwind | 730 days | Tier 1 | Preserves Essential Access during exit. | Too long becomes exit denial; too short harms dependents. | Exit transition simulation. | Essential services fail or exit becomes punitive. | Founding Order. |\n| FC-140 identity fraud band | target \u22642% / upper bound \u22645% / trigger \u22653% per quarter | Tier 2 / pre-launch gate | Sets starting Essential Access identity-fraud tolerance while keeping fraud visible before it drains physical survival supply. | Over-tightening excludes vulnerable people; over-loosening lets identity fraud consume food, medicine, shelter, or other CSM capacity. | Identity and Recovery Evidence Test Package; Annex AK; founding commitments. | Exclusion rises, fraud drains Essential Access, or pilot evidence shows the band is too loose or too tight for vulnerable populations. | Annex AK; founding/commitments.md. |\n| FC-160-184 contract parameters | Reserved / proposed | Pre-launch gate | Escrow, deployment-window, force-majeure, and inspector-pool controls need calibration. | Loose terms recreate hoarding; tight terms block infrastructure. | Commons Return and Universal Stake Evidence Test Package, project-finance simulation, and procurement red team. | Escrows become protected-capital shelter markets or project finance stalls. | Annex AR; ANNEX_D. |\n| FC-185-193 external trade and strategic floor parameters | Reserved / draft anchors | Tier 1 / Tier 2 mixed | Strategic reserves and external-capital gates decide whether outside dependency can threaten the survival floor. | Too loose creates foreign-capital or supplier capture; too strict blocks useful trade. | External trade stress test, supplier concentration audit, reserve adequacy review. | Strategic categories fall below floor or capital controls become arbitrary. | Annex AT. |\n| FC-194 essential fuel reserve minimum | Reserved; draft anchor 60-90 days by region and season | Tier 1 / pre-launch gate | Fuel continuity is a refusal chokepoint for food, heat, emergency transport, and grid recovery. | Too low lets a conglomerate or import shock force capitulation; too high creates stockpile capture and spoilage bureaucracy. | Fuel reserve adequacy model; seasonal logistics drill; refinery and transport dependency audit. | Any region falls below minimum during a 30-day refusal scenario or reserve turnover degrades usable supply. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-195 essential medicine stockpile minimum | Reserved; draft anchor 90-180 days for critical lists | Tier 1 / pre-launch gate | Medicines with fragile supply chains need a longer buffer than ordinary inventory because substitution can be clinically impossible. | Too low lets suppliers, PBMs, or distributors ration access; too high causes expiry waste and favors incumbents with warehousing. | Critical medicine list; expiry and rotation audit; shortage simulation by region and care setting. | Critical medicine availability drops below clinical continuity floor or stock rotation losses become material. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-196 maximum essential supplier concentration | Reserved; draft anchor no supplier above 25% of regional essential throughput | Tier 1 / launch gate | Prevents one firm from becoming the practical veto point for survival-floor delivery. | Too loose permits single-supplier refusal; too strict blocks emergency use of scarce specialist capacity. | Supplier concentration audit; regional substitution map; refusal tabletop exercise. | One supplier can interrupt more than a quarter of regional essential throughput without a public fallback already active. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-197 public fallback activation deadline | Reserved; draft anchor 72 hours for critical interruption, 14 days for managed transition | Tier 1 / activation gate | Refusal protection only works if public or cooperative fallback capacity starts before households hit survival-floor failure. | Too slow lets private operators bargain through delay; too fast may trigger wasteful takeover before facts are verified. | Public fallback readiness drill; emergency procurement rehearsal; legal activation review. | Verified interruption persists past deadline without fallback service or false activations recur. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-198 procurement concentration threshold | Reserved; draft anchor review above 30%, mandatory remediation above 40% of essential category spend | Tier 2 / pre-launch gate | Public purchasing can accidentally rebuild the same conglomerate dependency it is meant to neutralize. | Too loose funnels demand to incumbents; too strict fragments procurement below quality and reliability needs. | Procurement spend audit; vendor capacity review; anti-collusion screen. | Essential procurement share exceeds remediation threshold for two review periods or fragmentation causes delivery failure. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-199 PBM/intermediary separation threshold | Reserved; draft anchor separation review at 10% cross-owned claims or dispensing volume, mandatory firewall above 20% | Tier 1 / launch gate | Pharmacy benefit managers and similar intermediaries can deny access while appearing to manage price or claims. | Too loose lets intermediaries steer patients and suppliers; too strict may disrupt legitimate administrative clearing. | PBM ownership and routing audit; claims-denial review; patient access stress test. | Cross-owned routing exceeds threshold, denial patterns favor affiliated entities, or independent access deteriorates. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-200 critical logistics redundancy floor | Reserved; draft anchor two independent routes and operators per essential region | Tier 1 / launch gate | Stockpiles do not matter if a conglomerate controls the practical path from reserve to household or clinic. | Too low creates carrier or warehouse chokepoints; too high imposes costly duplication in sparse regions. | Logistics dependency map; cold-chain and last-mile drill; emergency carrier substitution test. | A single operator, warehouse, port, rail spur, or cold-chain provider can block regional essential delivery. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-201 essential data and claims portability deadline | Reserved; draft anchor 24 hours for emergency export, 30 days for full transition package | Tier 2 / transition gate | Conglomerate refusal can happen through records, claims, formularies, and routing data even when physical supply exists. | Too loose lets incumbents hold operations hostage; too strict risks unsafe or incomplete data transfer. | Data escrow rehearsal; claims and formulary export audit; receiving-operator validation. | Public fallback cannot adjudicate, dispense, route, or reconcile essential service within deadline. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| RHL protected-channel ceiling | Reserved \u2014 Tier 2 founding commitment; any TFP/RHL ceiling must be re-derived under Annex D protected ordinary use, Annex X stale-purpose rules, Commons Return source-base review, and the Anti-Rent Legal Wrapper Evidence Test Package. | Tier 2 / pre-launch gate | Prevents protected savings or project-finance channels from becoming unlimited shelters for concentrated control while preserving ordinary retirement and household continuity. | Too high shelters concentrated wealth under protected labels; too low blocks ordinary savings, retirement planning, or productive small-operator resilience. | Household savings simulation; concentration impact assessment; source-base avoidance review; legal-wrapper review; comparison with floor needs over 5, 10, and 20 years. | High-balance households use TFP/RHL faster than expected to avoid Commons Return/source-base review, or ordinary retirement savers cannot reach the participation floor. | ANNEX_D; ANNEX_X; Anti-Rent Legal Wrapper Evidence Test Package. |\n| CASP price corridor | \u00b115% of the registered pricing index for the relevant category, adjusted quarterly for verified regional inflation | Tier 2 / operational | Prevents essential-sector suppliers from exploiting captive-buyer position through price spikes, while allowing legitimate cost fluctuation. | Too narrow blocks legitimate price adjustment; too wide defeats the price protection purpose. | Price corridor red team; inflation adjustment audit; supplier profitability review at corridor boundary. | Suppliers systematically price at corridor ceiling or exit when corridor prevents premium pricing. | Annex AT \u00a7AT6.6. |\n| CASP service-level baseline dimensions | Minimum four measurable dimensions co-signed at pre-registration: delivery timeliness, fill rate, quality certification rate, and incident response time; plus any category-specific additions | Tier 2 / operational | Makes degradation trigger (clause d) measurable and enforceable; prevents slow-squeeze through informal service erosion. | Too few dimensions misses degradation; too many dimensions creates gaming through selectively meeting some. | Degradation detection drill; supplier behavior under watch conditions. | Suppliers meet formal dimensions while degrading overall service or dimension gaming becomes observable. | Annex AT \u00a7AT6.6. |\n| CIP absolute funding floor | Reserved \u2014 Tier 2 founding commitment established before CIP constitution; must cover staff for 7 members, independent legal and technical review for 4 Tier-1-touching proposals per year, and publication infrastructure | Tier 2 / pre-launch gate | Prevents under-reporting of Flow issuance as a mechanism for CIP budget suppression below operating capacity. | Too low renders CIP ineffective; too high creates fiscal dependency risk. | CIP operating cost estimate; comparable constitutional body audit. | CIP cannot staff an adversarial review of a Tier-1-touching proposal within its budget or funding-floor breach goes unpublished. | Annex AM \u00a7AM8.3. |\n| FC-T0-01 | Tier 0 aggregate anomaly threshold | 5% of CSM capacity per category | 2%\u201315% | Ombuds via standard FAP | Baseline consumption data from Phase 2 pilot; revisit if physical-fraud rate exceeds threshold in stress test | ANNEX_AK \u00a7AK8.3 |\n\n---\n\n## Maintenance Rule\n\nNo parameter should move from provisional to bound without a row here, an evidence path, and a revision trigger. No parameter should stay bound after evidence shows it is causing the collapse state it was meant to prevent.\n",
       "headings": [
         {
           "level": 1,
@@ -2728,7 +2728,7 @@
           "slug": "maintenance-rule"
         }
       ],
-      "wordCount": 3055,
+      "wordCount": 3563,
       "headingCount": 4
     },
     {
@@ -4048,6 +4048,65 @@
       "wordCount": 1238,
       "headingCount": 13
     },
+    {
+      "id": "docs__governance__CRUS_Simulation_Protocol_md",
+      "path": "docs/governance/CRUS_Simulation_Protocol.md",
+      "section": "registry",
+      "title": "CRUS Simulation Protocol",
+      "status": "Status: Active \u2014 unproven. This document defines the minimum runnable simulation packet required before Commons Return and Universal Stake can support any stronger public claim.",
+      "statusBucket": "active",
+      "summary": "Commons Return and Universal Stake is not ready for real-money collection. This protocol keeps the first test at simulation level: source bases may be mapped, valuations may be modeled, rails may be prototyped, and red teams may attack the design, but no person owes a compulsory charge and no household depends on Universal Stake receipts.",
+      "content": "# CRUS Simulation Protocol\n\n**Status: `Active \u2014 unproven`.** This document defines the minimum runnable simulation packet required before Commons Return and Universal Stake can support any stronger public claim.\n\nCommons Return and Universal Stake is not ready for real-money collection. This protocol keeps the first test at simulation level: source bases may be mapped, valuations may be modeled, rails may be prototyped, and red teams may attack the design, but no person owes a compulsory charge and no household depends on Universal Stake receipts.\n\n## Plain-English Purpose\n\nThe question is not, \"does Commons Return sound fair?\"\n\nThe question is:\n\n> If the system tries to return shared or scarcity-created value to the public, who actually pays, who actually receives, who can avoid it, and who gets hurt by the paperwork?\n\nA simulation fails if it shows the formal charge landing on ordinary life, if wealthy actors can avoid it cheaply, if Universal Stake becomes tradable, or if administrators can turn distribution into political favor.\n\n## Governing Evidence Package\n\nThis protocol operationalizes the [Commons Return and Universal Stake Evidence Test Package](./Commons_Return_Universal_Stake_Evidence_Test_Package.md). The evidence package names the standards. This protocol names the tables and scenario outputs that make the standards runnable.\n\nIt also binds to:\n\n- [Parameter Calibration Register](./Parameter_Calibration_Register.md) for FC-202 through FC-210 and CRUS gate thresholds;\n- [Claims and Evidence Register](./Claims_Evidence_Register.md) for claim status and downgrade rules;\n- [Pilot Evidence Roadmap](./Pilot_Evidence_Roadmap.md) Phase 5;\n- [Threat Register](./Threat_Register.md) T-025 and T-001 compound convertibility risk.\n\n## Simulation Rule\n\nEvery CRUS simulation packet must publish all inputs, assumptions, and failed cases. Aggregates cannot hide subgroup harm.\n\nAt minimum, each packet must contain:\n\n| Table | Minimum rows | Why it exists |\n|---|---:|---|\n| Source-base inventory | One row per candidate source base | Shows what value is being assessed and what is protected. |\n| Valuation uncertainty | One row per source base and valuation method | Shows whether appraisers or insiders can move the number. |\n| Incidence table | One row per household type, business type, locality, and protected group | Shows who actually bears the cost after prices, rents, wages, and service quality adjust. |\n| Pass-through table | One row per sector and affected ordinary group | Shows whether the formal source holder shifts the charge. |\n| Avoidance table | One row per attack route | Shows whether hiding, migration, debt loading, shell routing, or under-maintenance remains profitable. |\n| Eligibility table | One row per eligibility path and vulnerable group | Shows whether Universal Stake becomes exclusionary or surveillance-heavy. |\n| Distribution table | One row per delivery rail and recovery path | Shows whether the stake reaches members without coercion or assignment. |\n| Non-convertibility table | One row per direct and bundled conversion attempt | Shows whether protected lanes become practically tradable. |\n| Administrative-cost table | One row per operating function | Shows whether valuation, enforcement, appeals, audit, and support consume the return. |\n| Capture table | One row per exemption, arrears, draw, distribution timing, audit exception, and public message | Shows whether officials can reward friends or punish opponents. |\n| Downturn table | One row per stress scenario | Shows whether receipts survive normal recession, legal challenge, price shock, or appeal surge. |\n| Dignity table | One row per claimant group | Shows whether the process humiliates, exposes, delays, or excludes ordinary people. |\n\n## Scenario Set\n\nThe first runnable packet must include these scenarios. More can be added, but none of these can be skipped.\n\n| Scenario ID | Scenario | Required output |\n|---|---|---|\n| CRUS-SIM-01 | Base case source-base assessment | Gross receipts, protected exclusions, valuation range, appeal volume. |\n| CRUS-SIM-02 | Ordinary-life incidence | Effective burden by renters, homeowners below threshold, workers, consumers, small operators, protected associations, and concentrated source holders. |\n| CRUS-SIM-03 | Pass-through shock | Share of charge shifted into rents, prices, wages, fees, service degradation, or reduced supply. |\n| CRUS-SIM-04 | Valuation hiding | Value hidden through appraisals, affiliated sales, IP transfers, concession accounting, reserve understatement, or estate structures. |\n| CRUS-SIM-05 | Avoidance and capital flight | Base erosion from shell ownership, treaty routing, migration of control rights, debt loading, under-maintenance, or asset stripping. |\n| CRUS-SIM-06 | Universal Stake eligibility | False exclusion, duplicate claims, recovery delay, staff discretion, claimant abandonment, and data exposure by group. |\n| CRUS-SIM-07 | Direct non-convertibility | Attempts to sell, assign, pledge, garnish, inherit, or collateralize Universal Stake. |\n| CRUS-SIM-08 | Compound convertibility | Bundled offers involving Universal Stake, Essential Access, Voice, Service Record, identity recovery, housing, employment, lending, platform access, or debt relief. |\n| CRUS-SIM-09 | Routing capture | Exemptions, arrears, fund draws, distribution timing, audits, or public messages concentrated by faction, donor, office, region, sector, employer, or insider network. |\n| CRUS-SIM-10 | Administrative burden | Administrative, enforcement, valuation, audit, appeal, claimant-support, and data-system cost as a share of gross receipts. |\n| CRUS-SIM-11 | Downturn resilience | Net receipts after recession, land-price decline, resource-price collapse, concession failure, platform disruption, legal challenge, and high-appeal periods. |\n| CRUS-SIM-12 | Work and stewardship | Labor participation, small-business formation, maintenance, housing supply, productive projects, and ordinary stewardship against comparison case. |\n| CRUS-SIM-13 | Fiscal adequacy | Named obligation, gross receipts, net receipts, reserves, distribution cost, enforcement cost, appeal cost, and lawful residual funding path. |\n| CRUS-SIM-14 | Public comprehension | Ordinary-reader ability to explain who pays, who receives, what is protected, and what cannot be bought. |\n\n## Gate Outputs\n\nEach scenario produces one of three outputs:\n\n| Output | Meaning |\n|---|---|\n| Pass | No watch or blocking threshold crossed. Claim stays designed or partly tested, depending on evidence level. |\n| Watch | A threshold is crossed that requires redesign, narrower claim language, or more evidence before any pilot escalation. |\n| Block | A threshold is crossed that stops real-money collection, tax-replacement claims, Universal Stake activation, or scale-up until fixed and retested. |\n\nThe packet must list every watch and block output in a single summary table. It must also include a plain-language explanation of who would be harmed if the scenario were real.\n\n## Starting Gate Thresholds\n\nThese are simulation anchors, not final constitutional parameters. The Parameter Calibration Register must bind or revise them before activation.\n\n| Gate | Watch | Block |\n|---|---:|---:|\n| Ordinary-life incidence | Any ordinary group bears more effective burden than concentrated source holders in a modeled segment. | Any material burden on a protected class without a source-base or avoidance-shell finding. |\n| Pass-through | More than 10% of charge shifts to ordinary renters, consumers, workers, or small operators. | More than 25%, or any shift that pushes essential goods, housing, or services below the dignity floor. |\n| Avoidance and capital flight | More than 5% assessed-value erosion. | More than 10%, or avoidance remains profitable after detection, penalties, and appeal outcomes. |\n| Administrative cost | More than 10% of gross receipts. | More than 20%, or ordinary claimants abandon appeals because process burden is too high. |\n| Downturn | Net receipts fall more than 20% without a committed reserve and unwind plan. | Downturn management requires survival-access cuts, demurrage revival, ordinary-liquidity charges, prohibited tax bases, hidden fees, or unbounded issuance. |\n| Non-convertibility | Any repeatable market or bundled offer emerges. | Any successful conversion into Voice, office, survival priority, membership, legal standing, public favor, enforcement leniency, housing access, employment access, platform access, or debt relief. |\n| Eligibility and dignity | Any vulnerable group crosses false-exclusion, recovery-delay, staff-discretion, data-exposure, coercion, or abandonment watch thresholds. | Universal Stake becomes a surveillance gate, loyalty gate, work gate, humiliation screen, or exclusion path. |\n\n## Minimum Machine-Readable Output\n\nThe repository simulation should be able to produce this shape for each scenario:\n\n```json\n{\n  \"scenario_id\": \"CRUS-SIM-03\",\n  \"result\": \"watch\",\n  \"warnings\": [\"PASS_THROUGH_WATCH\"],\n  \"blocks\": [],\n  \"metrics\": {\n    \"pass_through_rate\": 0.14,\n    \"admin_cost_share\": 0.08,\n    \"assessed_value_erosion_rate\": 0.03\n  },\n  \"plain_language_failure\": \"renters absorb a visible share of a charge aimed at land scarcity value\"\n}\n```\n\nThe exact schema may evolve, but the output must stay readable to non-technical reviewers.\n\n## No-Claim Rule\n\nA passed simulation does not prove CRUS works. It only permits the claim to move from \"designed mechanism\" toward \"partly tested\" for the specific scenarios tested.\n\nThe project still may not claim:\n\n- Commons Return can replace taxes;\n- Universal Stake is capture-proof;\n- ordinary life is protected in practice;\n- source bases are adequate to fund named obligations;\n- eligibility can be verified without exclusion or surveillance;\n- real-money collection is ready.\n\nThose claims require field evidence, outside review, and claim-status updates under the Claims and Evidence Register.\n",
+      "headings": [
+        {
+          "level": 1,
+          "text": "CRUS Simulation Protocol",
+          "slug": "crus-simulation-protocol"
+        },
+        {
+          "level": 2,
+          "text": "Plain-English Purpose",
+          "slug": "plain-english-purpose"
+        },
+        {
+          "level": 2,
+          "text": "Governing Evidence Package",
+          "slug": "governing-evidence-package"
+        },
+        {
+          "level": 2,
+          "text": "Simulation Rule",
+          "slug": "simulation-rule"
+        },
+        {
+          "level": 2,
+          "text": "Scenario Set",
+          "slug": "scenario-set"
+        },
+        {
+          "level": 2,
+          "text": "Gate Outputs",
+          "slug": "gate-outputs"
+        },
+        {
+          "level": 2,
+          "text": "Starting Gate Thresholds",
+          "slug": "starting-gate-thresholds"
+        },
+        {
+          "level": 2,
+          "text": "Minimum Machine-Readable Output",
+          "slug": "minimum-machine-readable-output"
+        },
+        {
+          "level": 2,
+          "text": "No-Claim Rule",
+          "slug": "no-claim-rule"
+        }
+      ],
+      "wordCount": 1349,
+      "headingCount": 9
+    },
     {
       "id": "docs__governance__Productive_Status_Register_md",
       "path": "docs/governance/Productive_Status_Register.md",
@@ -6565,7 +6624,7 @@
       "status": "",
       "statusBucket": "reference",
       "summary": "A design that tries to keep survival, market power, and political power from being the same thing \u2014 published so you can try to break it.",
-      "content": "# Start Here\n\n*A design that tries to keep survival, market power, and political power from being the same thing \u2014 published so you can try to break it.*\n\n## The problem, in one situation\n\nA person loses their job. Not a dramatic fall \u2014 just an ordinary interruption. Hours cut, a contract not renewed, a small business that couldn't hold on. Within weeks, food gets harder. Then rent. Then the calculus shifts: take whatever is offered, on whatever terms, because the alternative is worse. The person is not less capable and not less willing to work. They are just out of leverage, and the people with leverage know it.\n\nNow run that same dynamic upward. The people with enough money can also buy the legal help, the political access, and the protection from consequences that people without money cannot. Not through visible corruption \u2014 through structure. Through the way one tool, money, ends up doing every job at once: buying dinner, buying a house, buying a lawyer, buying a lawmaker's attention. When a single thing controls survival, markets, and public power at the same time, having more of it stops being about comfort. It becomes power over other people's lives.\n\nThat is the problem this design takes on. Not poverty in the abstract, not inequality as a slogan \u2014 one specific structural failure, and a claim about how to break it:\n\n> Survival, market power, and political power can be kept structurally non-convertible \u2014 and whether the walls actually hold is testable, not yet tested.\n\nRead that sentence twice, because the rest of this document is mostly the disqualifiers attached to it. Here they are up front, in plain words. There is no pilot evidence yet \u2014 nothing here has been run in the real world. It is built with substantial AI assistance, which is owned openly below, not hidden. And it is published precisely so that you can try to break it. The right response to this is not faith and not dismissal. It is pressure.\n\n## What this is \u2014 and what it is not\n\nThis is a written design for a society where money cannot quietly decide who eats, who is heard, and who escapes consequences. It takes the jobs most systems pile onto a single currency and splits them across distinct tools, with walls between them. There are five:\n\n- **Ordinary money** for markets.\n- **An unbuyable survival floor** for basic needs.\n- **A fading, equal way** to help set public priorities.\n- **A record of public service** that cannot be bought or inherited.\n- **A temporary rationing system** for verified shortages.\n\nThe walls between those tools are the whole idea. Markets stay. Profit stays. Enterprise stays. What changes is that none of them can be turned into power over another person's survival or vote.\n\nIt is not a command economy \u2014 people still trade, price, contract, and build businesses freely. It is not a social-credit system \u2014 the civic tools cannot buy rights, safety, or basic needs, and are designed so they can never become a score that sorts human worth. It is not unlimited aid \u2014 the survival floor is bounded by what a society can actually produce. It is not a surveillance plan \u2014 the design asks for the least data it can and binds public limits on who may see it through the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md) and [Monitoring Repurposing Evidence Test Package](../governance/Monitoring_Repurposing_Evidence_Test_Package.md). That protection is designed, not proven. And it is not a finished argument. It is a structure under pressure, meant to be read as a hypothesis you can attack, not a promise you are asked to accept.\n\nAnd it is not a complete government. It does not run the police, the courts, or decide who belongs to the country. It sits inside a normal rule-of-law society and adds these protections on top \u2014 and it refuses to lend its legitimacy to any power that uses hunger, homelessness, or the cutting-off of medicine as a weapon, and says so out loud when it happens.\n\n## Where this sits in prior work, and what is actually new\n\nNone of the individual ideas here are new, and the design says so. The intellectual lineage is explicit:\n\n- **Michael Walzer**, *Spheres of Justice* \u2014 the argument that a just society maintains *blocked exchanges*: some goods (votes, justice, basic security) must not be purchasable with money, and the boundaries between spheres are what justice consists of.\n- **The basic-income vs. in-kind debate, and minimum-core rights** \u2014 the long argument between unconditional cash transfers (UBI) and guaranteed in-kind provision, and the human-rights tradition of a non-negotiable minimum core of subsistence that the state cannot trade away.\n- **Elinor Ostrom** \u2014 empirical commons governance: the conditions under which shared resources are stewarded without either pure markets or central command.\n- **Henry George, resource-rent systems, sovereign wealth funds, and wealth-tax incidence research** \u2014 who actually bears public revenue burdens, whether shared value can be returned without punishing ordinary households, and where public-return systems fail.\n- **Amartya Sen**, *Poverty and Famines* \u2014 the entitlement approach: famines happen not when food is absent but when people lose their entitlement to it, which reframes survival as a question of access, not aggregate supply.\n- **The socialist-calculation debate** (Mises, Hayek, Lange) \u2014 the unresolved problem of measuring real productive capacity well enough to allocate it, which this design inherits directly as its hardest open question.\n\nThe claimed contribution is not any one of these instruments \u2014 each has precedent and each, alone, has known failure modes. What is new is the specific *conjunction*: deliberately non-convertible instruments \u2014 survival, market money, and civic voice walled apart \u2014 bound together with published, testable thresholds for whether the walls are actually holding. The tests ask plain questions: are people still being excluded, is money leaking into public power, are ordinary households carrying the burden, and can the system prove it without hiding behind expert language? The bet is that separation plus falsification conditions is more defensible than separation asserted as a principle. Whether the conjunction survives contact with real incentives is exactly what has not been shown.\n\n## The hardest objection, walked\n\nThe strongest attack is the oldest one: **the rich will just route around it.** Walls are for people who can't afford ladders.\n\n**The attack.** Whatever the rules say on paper, people will re-create convertibility off the books. Someone barters survival credits for ordinary money in a back room. Someone buys influence through side payments the ledger never sees. Every prior attempt to separate spheres of value has eventually been hollowed out by exactly this \u2014 shadow banking, regulatory capture, offshore evasion. A decade in, the non-convertibility rule is a museum piece while the real economy of favors runs underneath it.\n\n**The design's answer.** The walls block *direct* conversion at the point of transaction \u2014 the survival floor cannot be turned into cash, debt, or collateral, and unspent civic priority simply expires rather than accumulating into a tradeable asset. Around the indirect routes, the design relies on detection and cost: making off-ledger arbitrage expensive and visible enough that the expected value of attempting it is negative, monitoring for the patterns that betray it, and forcing a public review when measured leakage crosses a stated threshold. The point is not a sealed vault. It is to make the cheap moves unprofitable and the profitable moves catchable.\n\n**The honest residual.** This is a *detection-and-cost* claim, and it is unproven at scale. It is not a proof of impossibility. The math that makes arbitrage unprofitable depends on an assumed detection probability that has no field evidence behind it \u2014 the number is asserted, not measured. There are indirect routes the on-ledger rules do not price at all (for example, driving wages down because a worker's survival is already covered, capturing the public floor as a private labor subsidy without ever touching a survival wallet). The honest frame is a *tolerated-leakage regime with a published trigger*, not a hermetic seal. The open question \u2014 whether the system catches enough of the leakage \u2014 does not yet have a field answer.\n\n## What we claim, what we haven't proven\n\nThree buckets, kept separate on purpose so nothing here can quietly overclaim:\n\n- **Claimed (moral commitments).** Survival should not depend on obedience, popularity, or market status. Wealth should not buy formal civic rule. Evidence can inform these, but cannot prove them \u2014 they are the values the design serves.\n- **Designed (specified, not active).** The separated tools, the walls, Commons Return and Universal Stake, the shortage-rationing rules, the founding and amendment procedures \u2014 all exist as concrete text. In the project's status vocabulary these are **Designed** or, where written into the operative document set, **Active \u2014 unproven**.\n- **Unproven (no field evidence).** No pilot has run. Delivery of the survival floor has not been tested. Identity-without-surveillance and monitoring-without-repurposing are unresolved prerequisites. Capacity measurement is the hardest open problem, inherited straight from the calculation debate. The [founding legitimacy dossier](../governance/Founding_Legitimacy_Dossier.md) lists eight artifacts that must reach a published, independently verifiable state before launch; as of now, none has been produced. Nothing here is **Partly tested**, **Evidence-backed**, or **Resolved** at deployment scale.\n\nThe full claim-by-claim accounting lives in the [Claims & Evidence Register](../governance/Claims_Evidence_Register.md), and the open controls \u2014 what is designed versus active-but-unproven versus evidence-backed \u2014 are tracked in the [Hardening Queue](../governance/Hardening_Queue.md).\n\n**What would change the assessment.** Honesty here means naming, in advance, the evidence that would move specific claims up or down \u2014 not the project's general credibility, but the particular claim. *Upgrades* would include proxy-market stress tests showing the anti-conversion rules hold against sophisticated shell structures; pilot evidence on delivery costs and supply response for the survival floor; adversarial user testing showing the civic tools resist becoming a social score; and outside red-team review of the threat register by people with no stake in the design. *Downgrades* would include a proxy redemption network achieving conversion without tripping the detection rules; identity pilots producing exclusion rates above the inclusion ceiling in demographic stress tests; or an independent red team finding failure modes not already named. The design is only serious to the extent these tests are real.\n\n## Who's behind it, and how it was built\n\nThe author is **Cameron Matthew**. The work was built with substantial AI assistance, treated as a feature rather than something to apologize for: it enabled fast iteration and, more importantly, sustained adversarial self-critique \u2014 the threat register, the patch log, and the honesty layer exist because the design was repeatedly turned against itself. That assistance is owned here in plain sight, because a design that hides how it was made has already failed its own transparency test. The corpus is openly licensed (Creative Commons), free to read, copy, and attack. The whole posture is an invitation: find the claim you think is wrong and push on it.\n\n## Where to go next\n\n**For researchers.** The claimed contribution is the *conjunction* described above, not any single instrument. The open research questions are concrete: can the anti-conversion walls survive sophisticated proxy structures; can real productive capacity be measured well enough to trigger the survival floor fairly; can a founding process be legitimate rather than merely procedurally complete. Those live in the [Open Problems Resolution Docket](../governance/Open_Problems_Resolution_Docket.md) and the [Hardening Queue](../governance/Hardening_Queue.md).\n\n**For funders / partners.** The concrete next step is a minimal pilot. The pilot prospectus is in progress (Phase 2). This section is intentionally a stub \u2014 there is no detailed ask or budget to quote yet, and inventing one would violate the honesty the rest of this document depends on.\n\n**Doc-map.** If you read only one, read the White Paper.\n\n- [The White Paper](04_white_paper.md) \u2014 the deep argument, in full.\n- [FAQ](02_faq.md) \u2014 the common objections, answered directly.\n- [Life and Rights](05_life_and_rights.md) \u2014 what this looks like in lived reality, and the rights it is built to protect.\n- [Useful History](08_useful_history.md) \u2014 the historical record of the failures this design responds to.\n- [Provenance Map](../governance/Provenance_Map.md) \u2014 the governance spine: every clause traced to the threat that made it necessary.\n",
+      "content": "# Start Here\n\n*A design that tries to keep survival, market power, and political power from being the same thing \u2014 published so you can try to break it.*\n\n## The problem, in one situation\n\nA person loses their job. Not a dramatic fall \u2014 just an ordinary interruption. Hours cut, a contract not renewed, a small business that couldn't hold on. Within weeks, food gets harder. Then rent. Then the calculus shifts: take whatever is offered, on whatever terms, because the alternative is worse. The person is not less capable and not less willing to work. They are just out of leverage, and the people with leverage know it.\n\nNow run that same dynamic upward. The people with enough money can also buy the legal help, the political access, and the protection from consequences that people without money cannot. Not through visible corruption \u2014 through structure. Through the way one tool, money, ends up doing every job at once: buying dinner, buying a house, buying a lawyer, buying a lawmaker's attention. When a single thing controls survival, markets, and public power at the same time, having more of it stops being about comfort. It becomes power over other people's lives.\n\nThat is the problem this design takes on. Not poverty in the abstract, not inequality as a slogan \u2014 one specific structural failure, and a claim about how to break it:\n\n> Survival, market power, and political power can be kept structurally non-convertible \u2014 and whether the walls actually hold is testable, not yet tested.\n\nRead that sentence twice, because the rest of this document is mostly the disqualifiers attached to it. Here they are up front, in plain words. There is no pilot evidence yet \u2014 nothing here has been run in the real world. It is built with substantial AI assistance, which is owned openly below, not hidden. And it is published precisely so that you can try to break it. The right response to this is not faith and not dismissal. It is pressure.\n\n## What this is \u2014 and what it is not\n\nThis is a written design for a society where money cannot quietly decide who eats, who is heard, and who escapes consequences. It takes the jobs most systems pile onto a single currency and splits them across distinct tools, with walls between them. There are five:\n\n- **Ordinary money** for markets.\n- **An unbuyable survival floor** for basic needs.\n- **A fading, equal way** to help set public priorities.\n- **A record of public service** that cannot be bought or inherited.\n- **A temporary rationing system** for verified shortages.\n\nThe walls between those tools are the whole idea. Markets stay. Profit stays. Enterprise stays. What changes is that none of them can be turned into power over another person's survival or vote.\n\nIt is not a command economy \u2014 people still trade, price, contract, and build businesses freely. It is not a social-credit system \u2014 the civic tools cannot buy rights, safety, or basic needs, and are designed so they can never become a score that sorts human worth. It is not unlimited aid \u2014 the survival floor is bounded by what a society can actually produce. It is not a surveillance plan \u2014 the design asks for the least data it can and binds public limits on who may see it through the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md) and [Monitoring Repurposing Evidence Test Package](../governance/Monitoring_Repurposing_Evidence_Test_Package.md). That protection is designed, not proven. And it is not a finished argument. It is a structure under pressure, meant to be read as a hypothesis you can attack, not a promise you are asked to accept.\n\nAnd it is not a complete government. It does not run the police, the courts, or decide who belongs to the country. It sits inside a normal rule-of-law society and adds these protections on top \u2014 and it refuses to lend its legitimacy to any power that uses hunger, homelessness, or the cutting-off of medicine as a weapon, and says so out loud when it happens.\n\n## The five walls \u2014 what each one protects for you\n\nIn most places, money does three jobs at once: it buys things, it keeps you alive, and it decides who has power. When one thing does all three, the people with the most money end up controlling everything \u2014 including whether you eat. This design refuses to let that happen by building walls between those jobs:\n\n1. **You keep what you earn.** Your everyday money is yours to spend; no one can secretly shrink it or quietly take it back.\n2. **You can never be priced out of staying alive.** Food, water, shelter, and care are yours by right \u2014 no matter what's in your bank account. If the usual providers fail, a public one steps in.\n3. **No family can lock in power forever.** Value no one made \u2014 land and location windfalls, resource rents, monopoly privileges \u2014 and very large inheritances pay a public return, and that return pays everyone a regular share and gives every young person a starting stake. Ordinary earnings, homes, tools, and savings are left alone.\n4. **Your voice can't be bought.** Some choices go to randomly picked citizens, like jury duty; the big ones, everyone votes on equally. Nobody can buy or hoard a louder say.\n5. **Public roles are earned, not bought.** You qualify for public office by contributing, then you're picked by lottery \u2014 not by money or who you know.\n\nAnd if there's ever a real, proven shortage, essentials get shared out by need, by a fixed rule that's set ahead of time \u2014 never by who can pay the most.\n\n**What you are owed. What can never be taken.**\n\n- Your food, water, shelter, and care are a **right**, not a reward.\n- **No one can buy your vote** or your voice \u2014 yours or anyone else's.\n- **You cannot be priced out of survival**, no matter how poor you are.\n- Punishment can take your freedom. **It can never take your food, water, or shelter.** Survival is never used as a weapon.\n- Every young person gets a **fair starting stake**, so where you begin doesn't decide where you can go.\n\nWhy it all hangs together, in one sentence: keep buying, surviving, deciding, and serving in **separate boxes**, so power over one can never be used to capture the others. None of this is proven yet \u2014 these are the design's promises, and the rest of this document is honest about what it would take to earn them.\n\n## Where this sits in prior work, and what is actually new\n\nNone of the individual ideas here are new, and the design says so. The intellectual lineage is explicit:\n\n- **Michael Walzer**, *Spheres of Justice* \u2014 the argument that a just society maintains *blocked exchanges*: some goods (votes, justice, basic security) must not be purchasable with money, and the boundaries between spheres are what justice consists of.\n- **The basic-income vs. in-kind debate, and minimum-core rights** \u2014 the long argument between unconditional cash transfers (UBI) and guaranteed in-kind provision, and the human-rights tradition of a non-negotiable minimum core of subsistence that the state cannot trade away.\n- **Elinor Ostrom** \u2014 empirical commons governance: the conditions under which shared resources are stewarded without either pure markets or central command.\n- **Henry George, resource-rent systems, sovereign wealth funds, and wealth-tax incidence research** \u2014 who actually bears public revenue burdens, whether shared value can be returned without punishing ordinary households, and where public-return systems fail.\n- **Amartya Sen**, *Poverty and Famines* \u2014 the entitlement approach: famines happen not when food is absent but when people lose their entitlement to it, which reframes survival as a question of access, not aggregate supply.\n- **The socialist-calculation debate** (Mises, Hayek, Lange) \u2014 the unresolved problem of measuring real productive capacity well enough to allocate it, which this design inherits directly as its hardest open question.\n\nThe claimed contribution is not any one of these instruments \u2014 each has precedent and each, alone, has known failure modes. What is new is the specific *conjunction*: deliberately non-convertible instruments \u2014 survival, market money, and civic voice walled apart \u2014 bound together with published, testable thresholds for whether the walls are actually holding. The tests ask plain questions: are people still being excluded, is money leaking into public power, are ordinary households carrying the burden, and can the system prove it without hiding behind expert language? The bet is that separation plus falsification conditions is more defensible than separation asserted as a principle. Whether the conjunction survives contact with real incentives is exactly what has not been shown.\n\n## The hardest objection, walked\n\nThe strongest attack is the oldest one: **the rich will just route around it.** Walls are for people who can't afford ladders.\n\n**The attack.** Whatever the rules say on paper, people will re-create convertibility off the books. Someone barters survival credits for ordinary money in a back room. Someone buys influence through side payments the ledger never sees. Every prior attempt to separate spheres of value has eventually been hollowed out by exactly this \u2014 shadow banking, regulatory capture, offshore evasion. A decade in, the non-convertibility rule is a museum piece while the real economy of favors runs underneath it.\n\n**The design's answer.** The walls block *direct* conversion at the point of transaction \u2014 the survival floor cannot be turned into cash, debt, or collateral, and unspent civic priority simply expires rather than accumulating into a tradeable asset. Around the indirect routes, the design relies on detection and cost: making off-ledger arbitrage expensive and visible enough that the expected value of attempting it is negative, monitoring for the patterns that betray it, and forcing a public review when measured leakage crosses a stated threshold. The point is not a sealed vault. It is to make the cheap moves unprofitable and the profitable moves catchable.\n\n**The honest residual.** This is a *detection-and-cost* claim, and it is unproven at scale. It is not a proof of impossibility. The math that makes arbitrage unprofitable depends on an assumed detection probability that has no field evidence behind it \u2014 the number is asserted, not measured. There are indirect routes the on-ledger rules do not price at all (for example, driving wages down because a worker's survival is already covered, capturing the public floor as a private labor subsidy without ever touching a survival wallet). The honest frame is a *tolerated-leakage regime with a published trigger*, not a hermetic seal. The open question \u2014 whether the system catches enough of the leakage \u2014 does not yet have a field answer.\n\n## What we claim, what we haven't proven\n\nThree buckets, kept separate on purpose so nothing here can quietly overclaim:\n\n- **Claimed (moral commitments).** Survival should not depend on obedience, popularity, or market status. Wealth should not buy formal civic rule. Evidence can inform these, but cannot prove them \u2014 they are the values the design serves.\n- **Designed (specified, not active).** The separated tools, the walls, Commons Return and Universal Stake, the shortage-rationing rules, the founding and amendment procedures \u2014 all exist as concrete text. In the project's status vocabulary these are **Designed** or, where written into the operative document set, **Active \u2014 unproven**.\n- **Unproven (no field evidence).** No pilot has run. Delivery of the survival floor has not been tested. Identity-without-surveillance and monitoring-without-repurposing are unresolved prerequisites. Capacity measurement is the hardest open problem, inherited straight from the calculation debate. The [founding legitimacy dossier](../governance/Founding_Legitimacy_Dossier.md) lists eight artifacts that must reach a published, independently verifiable state before launch; as of now, none has been produced. Nothing here is **Partly tested**, **Evidence-backed**, or **Resolved** at deployment scale.\n\nThe full claim-by-claim accounting lives in the [Claims & Evidence Register](../governance/Claims_Evidence_Register.md), and the open controls \u2014 what is designed versus active-but-unproven versus evidence-backed \u2014 are tracked in the [Hardening Queue](../governance/Hardening_Queue.md).\n\n**What would change the assessment.** Honesty here means naming, in advance, the evidence that would move specific claims up or down \u2014 not the project's general credibility, but the particular claim. *Upgrades* would include proxy-market stress tests showing the anti-conversion rules hold against sophisticated shell structures; pilot evidence on delivery costs and supply response for the survival floor; adversarial user testing showing the civic tools resist becoming a social score; and outside red-team review of the threat register by people with no stake in the design. *Downgrades* would include a proxy redemption network achieving conversion without tripping the detection rules; identity pilots producing exclusion rates above the inclusion ceiling in demographic stress tests; or an independent red team finding failure modes not already named. The design is only serious to the extent these tests are real.\n\n## Who's behind it, and how it was built\n\nThe author is **Cameron Matthew**. The work was built with substantial AI assistance, treated as a feature rather than something to apologize for: it enabled fast iteration and, more importantly, sustained adversarial self-critique \u2014 the threat register, the patch log, and the honesty layer exist because the design was repeatedly turned against itself. That assistance is owned here in plain sight, because a design that hides how it was made has already failed its own transparency test. The corpus is openly licensed (Creative Commons), free to read, copy, and attack. The whole posture is an invitation: find the claim you think is wrong and push on it.\n\n## Where to go next\n\n**For researchers.** The claimed contribution is the *conjunction* described above, not any single instrument. The open research questions are concrete: can the anti-conversion walls survive sophisticated proxy structures; can real productive capacity be measured well enough to trigger the survival floor fairly; can a founding process be legitimate rather than merely procedurally complete. Those live in the [Open Problems Resolution Docket](../governance/Open_Problems_Resolution_Docket.md) and the [Hardening Queue](../governance/Hardening_Queue.md).\n\n**For funders / partners.** The concrete next step is a minimal pilot. The pilot prospectus is in progress (Phase 2). This section is intentionally a stub \u2014 there is no detailed ask or budget to quote yet, and inventing one would violate the honesty the rest of this document depends on.\n\n**Doc-map.** If you read only one, read the White Paper.\n\n- [The White Paper](04_white_paper.md) \u2014 the deep argument, in full.\n- [FAQ](02_faq.md) \u2014 the common objections, answered directly.\n- [Life and Rights](05_life_and_rights.md) \u2014 what this looks like in lived reality, and the rights it is built to protect.\n- [Useful History](08_useful_history.md) \u2014 the historical record of the failures this design responds to.\n- [Provenance Map](../governance/Provenance_Map.md) \u2014 the governance spine: every clause traced to the threat that made it necessary.\n",
       "headings": [
         {
           "level": 1,
@@ -6582,6 +6641,11 @@
           "text": "What this is \u2014 and what it is not",
           "slug": "what-this-is-and-what-it-is-not"
         },
+        {
+          "level": 2,
+          "text": "The five walls \u2014 what each one protects for you",
+          "slug": "the-five-walls-what-each-one-protects-for-you"
+        },
         {
           "level": 2,
           "text": "Where this sits in prior work, and what is actually new",
@@ -6608,8 +6672,8 @@
           "slug": "where-to-go-next"
         }
       ],
-      "wordCount": 2027,
-      "headingCount": 8
+      "wordCount": 2441,
+      "headingCount": 9
     },
     {
       "id": "docs__public__02_faq_md",
@@ -7267,6 +7331,329 @@
       "wordCount": 16071,
       "headingCount": 36
     },
+    {
+      "id": "docs__public__09_pilot_proposal_md",
+      "path": "docs/public/09_pilot_proposal.md",
+      "section": "constitution",
+      "title": "A Minimal Pilot Proposal",
+      "status": "",
+      "statusBucket": "reference",
+      "summary": "Status: Proposed \u2014 rough draft. Published in the corpus for review, but not yet formally adopted; no pilot described here is approved or funded. Every number and timeline is a starting estimate, not a commitment.",
+      "content": "# A Minimal Pilot Proposal\n\n*Status: Proposed \u2014 rough draft. Published in the corpus for review, but not yet formally adopted; no pilot described here is approved or funded. Every number and timeline is a starting estimate, not a commitment.*\n\n---\n\n> **What this document is**\n> A concrete proposal for testing the protected lanes and layers of the Humane Constitution at the smallest useful scale. It is written for funders, researchers, and communities who want to know what \"testing this\" would actually look like \u2014 not in theory, but in practice.\n>\n> **What this document is not**\n> A guarantee, a budget, or a finished plan. It is the first honest sketch of what a real pilot requires.\n\nFor the plain history-and-comparator guide behind these pilots, see [Real-World Examples](10_real_world_examples.md).\n\n---\n\n## The problem with designs that are never tested\n\nEvery mechanism in this project is either *Designed* or *Active \u2014 unproven*. That is the honest status. Something can be carefully designed, internally consistent, and still fail the moment it meets real people, real incentives, and real mistakes.\n\nThe only way to move from *designed* to *evidence-backed* is a real test. This document is about what that test looks like, and how small it can be while still generating useful evidence.\n\nA pilot has one job: **find out what we got wrong before anyone depends on it.**\n\n---\n\n## The protected lanes, briefly\n\nThe Humane Constitution separates things most societies leave merged: survival, market participation, public return, emergency rationing, and political power. It uses protected lanes and layers to keep them separate:\n\n1. **Essential Access** \u2014 a survival floor. Food, shelter, medicine, and water that every person receives regardless of their market position. Cannot be sold, traded, or revoked.\n2. **Shared Storehouse** \u2014 rationing under real scarcity. When there genuinely is not enough of something essential, this system distributes it fairly instead of letting price decide who goes without.\n3. **Flow** \u2014 the market currency. Ordinary spending, saving, wages, contracts, and business use happen here.\n4. **Commons Return and Universal Stake** \u2014 public return from exclusive control of shared and scarcity-created value, distributed through a protected member stake.\n5. **Voice** \u2014 bounded civic priority. A limited, expiring claim each person holds to weigh in on public decisions. Cannot be bought or stockpiled. Expires if unused.\n6. **Service Record** \u2014 eligibility support for public roles. A rotating system that tracks service to shared governance, while preserving ordinary challenger and appeal routes where the corpus requires them.\n\nThe walls between these lanes \u2014 the fact that you cannot convert Essential Access into Flow, buy Voice with Flow, or turn Universal Stake into office or survival priority \u2014 are the core claim. The pilot tests whether those walls hold in practice.\n\n---\n\n## How to read the pilots below\n\nEach pilot section covers:\n- **The hypothesis** \u2014 the one falsifiable claim the pilot tests\n- **Smallest deployment** \u2014 the minimum scale that generates real evidence\n- **Rough cost** \u2014 order-of-magnitude only; full budgets require site-specific work\n- **What we measure** \u2014 the metrics that tell us whether the hypothesis held\n- **What failure looks like** \u2014 what would force us to say the mechanism does not work as designed\n- **What success looks like** \u2014 what would justify moving to a larger test\n- **Open questions** \u2014 what the pilot does not resolve\n\nNo pilot here is designed to be permanent. Every one of them is designed to fail informatively if the design is wrong.\n\n---\n\n## Pilot A \u2014 Essential Access + Shared Storehouse\n\n*These two are designed together and should be tested together. Essential Access is the normal-state floor. Shared Storehouse is what happens when that floor comes under stress. Testing one without the other leaves the hardest question unanswered.*\n\n> **Where this sits in the corpus**\n> - The survival floor this pilot delivers is defined in [Annex Y](../annexes/ANNEX_Y.md) \u2014 the minimum the system may never cut.\n> - The wall that stops Essential Access from being sold or brokered into market money is [Annex AB](../annexes/ANNEX_AB.md) (non-delegability).\n> - The \"is there genuinely a shortage?\" question \u2014 capacity measurement and scarcity declaration \u2014 is governed by [Annex M](../annexes/ANNEX_M.md), with the oracle-failure fallback in [Annex AQ](../annexes/ANNEX_AQ.md) (threat T-024 / patch P-022).\n> - This pilot corresponds to **Phase 3 (capacity measurement)** and **Phase 4 (Essential Access delivery)** of the [Pilot Evidence Roadmap](../governance/Pilot_Evidence_Roadmap.md), under the doctrine in [Annex Q](../annexes/ANNEX_Q.md). Scale-up is gated by [Annex AN](../annexes/ANNEX_AN.md) \u2014 a stress-free pilot does not earn a scale-up.\n\n### What we're testing\n\nThe core claim of Essential Access is: **a guaranteed survival floor does not require a means test, does not create dependency traps, and does not collapse when participants try to game it.**\n\nThe core claim of Shared Storehouse is: **when there is genuinely not enough of something essential, a transparent rationing system distributes it more fairly than price, without black markets forming at the scale of a small community.**\n\nUnderneath both sits a third claim that this pilot is really built to test \u2014 the one a skeptic cares about most: **the wall holds.** A person cannot quietly turn their survival floor back into spendable market money, and a declared shortage cannot be manufactured to justify cutting people off. Most of this pilot's instrumentation is pointed at those two failure modes, because they are where the design either earns trust or loses it.\n\n### The hypothesis\n\n> A small community (150\u2013300 people, voluntary participants) can operate a guaranteed essential-goods floor for 18 months. Participants will not lose access due to administrative failure. The floor will not be gamed into extinction. When a controlled, minor scarcity event is introduced, the Shared Storehouse mechanism will distribute goods fairly, the scarcity declaration will survive independent audit, and a black market will not emerge at meaningful scale.\n\n### Non-negotiable pilot rules (inherited from the corpus)\n\nPer the [Pilot Evidence Roadmap](../governance/Pilot_Evidence_Roadmap.md), this pilot is bound by rules it cannot waive for convenience:\n\n- **No one's real survival is on the line.** The pilot allocation is *additive* \u2014 it sits on top of whatever benefits, income, or support a participant already has. No participant's existing food stamps, Medicaid, housing, or legal status is touched, reduced, or made contingent on the pilot. This is the line in [Annex Q](../annexes/ANNEX_Q.md): a pilot may not make a person depend on a floor that has not yet been proven.\n- **Exit is rehearsed before anyone leans on it.** Before month 1, the pilot demonstrates that a participant can leave with no penalty and no loss of their pre-existing support. Exit is tested, not assumed.\n- **Independent review is built in, not invited later.** An outside reviewer with the power to publish holds the data and signs off on the failure call.\n- **A failed pilot is published as failed.** No rebranding. The public post-mortem is a precondition of funding, written into the grant.\n\n### Smallest deployment\n\n**150\u2013300 voluntary adult participants** drawn from an existing community \u2014 a rural town, a housing cooperative, a university residential community, or an intentional community. Participants opt in; no one's existing benefits are affected. The pilot runs alongside their normal lives.\n\nThe essential goods covered in this pilot are limited to **food staples and basic medicines**. Shelter and water are explicitly excluded from this round \u2014 they carry infrastructure cost and legal exposure (eviction law, utility regulation) that belong in a later, larger pilot. Naming that exclusion up front is itself part of the honesty: this pilot tests the *easiest* survival goods to deliver, and a skeptic should read the results as a floor on plausibility, not a ceiling.\n\nParticipants receive a monthly allocation of essential goods, delivered through one of two channels tested in parallel cohorts:\n\n- **Cohort 1 \u2014 direct goods.** Physical staples and pharmacy-filled prescriptions, delivered or picked up. Closest to the constitutional design; highest administrative cost.\n- **Cohort 2 \u2014 restricted-purpose credit.** A closed-loop balance redeemable only for qualifying food and medicine at participating vendors, technically blocked from cash-out. Cheaper to run; directly stress-tests the non-delegability wall ([Annex AB](../annexes/ANNEX_AB.md)) \u2014 if the wall is going to leak, this is where it leaks first.\n\nRunning both is deliberate. The comparison tells us how much of the wall is enforced by *design* (Cohort 2's technical block) versus by *friction* (Cohort 1's physical goods), which is exactly the question scale-up depends on.\n\n### The scarcity test (months 9\u201311)\n\nThis is the part of the pilot that no UBI study has run, and it is the reason Essential Access and Shared Storehouse are tested together rather than apart.\n\nAt month 9, **one category of goods** (e.g. a specific staple) has its delivered supply deliberately reduced by 30% for 8 weeks. Two things are tested at once:\n\n1. **Can the shortage be declared honestly?** Before any rationing begins, the scarcity must be verified under the [Annex M](../annexes/ANNEX_M.md) standard \u2014 challengeable capacity data, not a single administrator's say-so \u2014 and the declaration is handed to the independent reviewer to attempt to *falsify*. The design's nightmare is a fake shortage used to justify cutting people off; this step tests whether the verification actually resists that.\n2. **Does rationing beat price?** Once declared, the Shared Storehouse protocol distributes the reduced supply by the published rule, not by who can pay. We measure whether distribution matches the protocol, whether a black market forms, and \u2014 critically \u2014 whether the floor itself ([Annex Y](../annexes/ANNEX_Y.md)) is ever breached. Per [Annex AQ](../annexes/ANNEX_AQ.md), if the measurement system itself fails mid-event, the default is continuity, not deprivation; the pilot deliberately injects a measurement fault to see if that default holds.\n\nParticipants are told in advance the scarcity is a planned test. That weakens external realism \u2014 but a real involuntary shortage in a pilot would violate the no-survival-risk rule. We name this tradeoff rather than hiding it.\n\n### Rough cost\n\n| Item | Estimate |\n|---|---|\n| Essential goods allocation (150\u2013300 people \u00d7 18 months, both cohorts) | $180,000\u2013$540,000 |\n| Independent review, monitoring, and scarcity-declaration audit | $70,000\u2013$120,000 |\n| Administration, identity verification, appeals, exit rehearsal | $50,000\u2013$90,000 |\n| Closed-loop credit infrastructure (Cohort 2) | $25,000\u2013$60,000 |\n| Data collection, control-group baseline, public post-mortem | $25,000\u2013$50,000 |\n| **Total** | **$350,000\u2013$860,000** |\n\n*Figures assume food staples plus basic medicines. Medication adds health-data, liability, and pharmacy-licensing complexity that requires site-specific legal and clinical review before a real number can be quoted.*\n\n### What we measure\n\n| Question | Metric | Target |\n|---|---|---|\n| Does the floor stay continuous? | % of participant-months with full allocation delivered | > 95% |\n| Do process errors exclude people? | Admin-failure exclusion rate, and time-to-recovery | < 2%, recovered < 72h |\n| **Does the EA\u2192Flow wall hold?** | % of allocated value converted to cash/market exchange (by cohort) | < 5% |\n| Can a shortage be declared honestly? | Independent reviewer's verdict on the scarcity declaration | Survives falsification audit |\n| Does rationing beat price under scarcity? | Distribution conformance to protocol; demographic disparity in shortfall | Conforms; no unexplained bias |\n| Does a black market form? | Estimated size of informal exchange vs. the shortage gap | < 20% of gap |\n| Is the survival floor ever breached? | Instances any participant drops below the Annex Y floor | **Zero** |\n| Does the floor change behavior? | Economic anxiety, food insecurity, healthcare avoidance vs. control/baseline | Measurable reduction |\n\nThe **zero-floor-breach** row is the one hard line. A breach of the Annex Y minimum is not a metric that can be traded off against the others \u2014 it is a stop condition.\n\n### What failure looks like\n\nThe pilot has failed \u2014 and we say so publicly \u2014 if any of the following occur:\n\n- More than 10% of participants lose access for more than one week due to administrative failure.\n- More than 5% of allocated value is converted into market exchange in **either** cohort \u2014 the wall between Essential Access and Flow is leaking. (If only Cohort 1 leaks, the lesson is \"design the technical block in.\" If Cohort 2 leaks too, the lesson is far more serious.)\n- The scarcity declaration does not survive the reviewer's falsification audit \u2014 meaning a shortage *could* be manufactured to cut access. This is a design-level failure, not a tuning problem.\n- The scarcity event produces a black market covering more than 20% of the shortage gap.\n- Shared Storehouse distribution shows statistically significant demographic bias not explained by the protocol.\n- **Any** breach of the Annex Y survival floor.\n\nFailure is information. A failed pilot tells us which wall does not hold under real conditions. It is not a reason to stop \u2014 it is a reason to fix the specific mechanism before anyone is asked to depend on it.\n\n### What success looks like\n\n- Access continuity above 95% with zero floor breaches.\n- Conversion below 5% in both cohorts \u2014 and meaningfully lower in Cohort 2, showing the technical block does work.\n- A scarcity declaration that an adversarial reviewer could not fake or break.\n- The shortage absorbed without a meaningful black market, with the floor intact throughout.\n- A measurable reduction in economic anxiety against the control group.\n- Independent reviewers able to replicate every finding from the published data.\n\nSuccess at this scale justifies the next gate under [Annex AN](../annexes/ANNEX_AN.md): a 1,000+ participant pilot adding shelter, water, and an *unannounced* (genuinely involuntary, externally caused) scarcity event \u2014 the stress this pilot deliberately could not impose.\n\n### Open questions this pilot does not resolve\n\n- Does Essential Access hold when the stakes are higher \u2014 housing and water, not just food and medicine?\n- Does the wall survive *organized, persistent* attack (a deliberate cash-out market run by motivated actors), not just opportunistic individual gaming?\n- Does the scarcity verification hold under a *real* shortage, where the people declaring it are under genuine pressure rather than running a planned test?\n- How does Essential Access interact with existing public benefits \u2014 does layering it on top create benefit-cliff or eligibility problems? This is a legal and political question, not a design question, and it varies by jurisdiction.\n\n---\n\n## Pilot B \u2014 Commons Return and Universal Stake (simulation pilot)\n\n*A note on what this is not. This is not a local-currency pilot, not a fee on unused balances, and not a tax on ordinary household savings. W\u00f6rgl, WIR, BerkShares, and Gesell remain useful history about money design; Alaska-style public dividends and public wealth funds are closer comparators for the distribution side, but still not proof. None of them test the current instrument. This pilot tests the hard thing: can a community collect public return from shared and scarcity-created value, then distribute a protected Universal Stake, without punishing ordinary life or turning the system into surveillance and favoritism?*\n\n> **Where this sits in the corpus**\n> - The economic instrument is [Annex D](../annexes/ANNEX_D.md), rewritten around **Commons Return and Universal Stake** (routine demurrage is superseded; only a dormant, pilot-gated backstop remains under \u00a7D9).\n> - Flow issuance architecture remains [Annex X](../annexes/ANNEX_X.md), but Flow balances are not the object of this pilot.\n> - This is the public-finance and distribution simulation for the [Pilot Evidence Roadmap](../governance/Pilot_Evidence_Roadmap.md), using the [CRUS Simulation Protocol](../governance/CRUS_Simulation_Protocol.md). It stays a **simulation** until incidence, dignity, avoidance, distribution, and non-convertibility are transparent enough for independent review.\n\n### What we're testing\n\nThe design lives or dies on seven empirical questions:\n\n1. **Which source bases can be measured without overreach?** The candidate bases are land/location value, natural resources, spectrum/airspace, monopoly licenses, unavoidable platform or network rents, high-value public concessions, and large succession transfers.\n2. **Who actually bears the cost?** The pilot must show incidence after rents, prices, wages, contracts, and investment behavior adjust. A charge written on one party can land on someone else.\n3. **Can dignity survive administration?** Ordinary balances, tools, inventory, protected homes, and protected associations must stay protected without building a financial panopticon around every household.\n4. **Can avoidance be contained?** The red-team tries valuation hiding, shell entities, trust wrappers, under-reported concessions, external-capital arbitrage, migration threats, and fake protected associations.\n5. **Can eligibility and distribution rails work?** Universal Stake must reach every member through reliable rails, including people who are digitally fragile, displaced, elderly, undocumented in ordinary paperwork, or in dispute.\n6. **Does non-convertibility hold?** Universal Stake must stay non-tradable, non-assignable, and non-garnishable. It cannot buy Voice, office, survival priority, membership, legal standing, or public favor.\n7. **Does politics capture the dividend?** The pilot watches for targeted bonuses, exclusions, patronage, favored districts, \"reward our supporters\" rhetoric, and quiet manipulation of eligibility rules.\n\n### The hypothesis\n\n> Across 60\u2013150 voluntary households plus a mapped sample of local assets and concessions, Commons Return source bases can be assessed with bounded error and limited data; ordinary household life can stay protected; a motivated red-team cannot cheaply hide or relocate the base; and a Universal Stake can be distributed universally without becoming tradable, garnishable, politically targeted, or convertible into civic power.\n\n### Smallest deployment\n\n**60\u2013150 voluntary households plus a local asset/concession map**. The household group tests eligibility, dignity, distribution rails, and non-convertibility. The asset/concession map tests source bases: land/location value, public concessions, monopoly licenses, platform/network rents, natural-resource claims where present, and large succession-transfer scenarios modeled from anonymized estates.\n\nThis is a **simulation pilot**: no compulsory collection occurs. What is real is the data collection, valuation process, red-team attack, distribution test, appeals process, and public comprehension review. One arm may pair with Pilot A's Essential Access and Shared Storehouse work through a voluntary, grant-funded practice distribution and shared reserve. That arm must be clearly labeled as practice rails, not public revenue and not evidence that CRUS can fund the floor.\n\nThe pilot runs **12 months** and has four moving parts:\n\n- **Source-base assessment.** Each candidate base is valued with a published method and an independent audit: land/location value separate from buildings, resource claims, licenses, concessions, platform/network rents, and succession transfers.\n- **Protection screen.** Ordinary labor income, working balances, household tools, basic homes below protected thresholds, small-business operating reserves, and protected community, tribal, and church associations are excluded unless they are being used as avoidance shells.\n- **Distribution test.** A simulated or funded Universal Stake is issued through rails that cannot be sold, assigned, garnished, pledged as collateral, or exchanged for civic status.\n- **Red-team.** A paid adversarial team is given the rules and tasked with breaking them: hiding valuation, shifting ownership outside the jurisdiction, laundering value through protected associations, buying favor with the stake, manipulating eligibility, capturing appeals, or turning distribution into political patronage.\n\nBefore any optional funded practice distribution, the pilot must publish the CRUS Simulation Protocol scenario table:\n\n| Stage | Required scenarios | Stop condition |\n|---|---|---|\n| Source-base map | CRUS-SIM-01, CRUS-SIM-04 | Ordinary homes, tools, working balances, protected associations, or labor income are swept into the base without an avoidance-shell finding. |\n| Incidence and pass-through | CRUS-SIM-02, CRUS-SIM-03 | Renters, workers, consumers, small operators, or protected groups bear the practical burden while concentrated source holders avoid it. |\n| Avoidance and capital flight | CRUS-SIM-05 | Avoidance remains profitable after detection, penalties, and appeal outcomes, or assessed value erodes beyond the blocking threshold. |\n| Eligibility and dignity | CRUS-SIM-06 | Vulnerable members are excluded, exposed, delayed, coerced, or humiliated beyond published thresholds. |\n| Non-convertibility | CRUS-SIM-07, CRUS-SIM-08 | Universal Stake becomes directly or practically tradable through sale, pledge, garnishment, debt relief, housing, employment, platform access, identity recovery, Voice, Service Record, or public favor. |\n| Routing and adequacy | CRUS-SIM-09 through CRUS-SIM-13 | Administrators can steer rewards or punishments; costs consume the return; downturns force prohibited fallback funding; or a named public obligation is unsupported by net receipts. |\n| Public comprehension | CRUS-SIM-14 | Participants cannot explain who pays, who receives, what is protected, or what the stake cannot buy. |\n\n### Rough cost\n\n| Item | Estimate |\n|---|---|\n| Source-base mapping and valuation audit | $70,000\u2013$160,000 |\n| Eligibility, distribution rails, and appeals prototype | $45,000\u2013$110,000 |\n| Adversarial red-team (avoidance, capture, valuation, non-convertibility) | $60,000\u2013$130,000 |\n| Incidence and external-capital mobility modeling | $40,000\u2013$80,000 |\n| Independent review, data minimization audit, public comprehension survey | $45,000\u2013$90,000 |\n| Optional funded Universal Stake / shared reserve arm | $40,000\u2013$120,000 |\n| **Total** | **$260,000\u2013$570,000** |\n\n*The optional funded arm is what turns an accounting exercise into a real distribution test. It should stay small and voluntary until the rules survive review.*\n\n### What we measure\n\n| Question | Metric | Target |\n|---|---|---|\n| Can source bases be measured? | Assessment completion rate; valuation error vs. independent audit | High completion; error within published bound |\n| Who bears the cost? | Incidence by income, wealth, tenancy, business size, and protected status | Burden does not shift onto ordinary households |\n| Does dignity hold? | Data fields required per participant; appeals burden; false inclusion/exclusion rate | Minimal data; usable appeals; low error |\n| Do protections work? | Ordinary balances, tools, homes, reserves, and protected associations wrongly swept in | Rare; corrected quickly |\n| Does avoidance work? | Red-team value hidden, moved, under-valued, or sheltered | Minimal; every route documented |\n| Does external capital arbitrage work? | Modeled base erosion from migration, shell ownership, or capital flight | Bounded; triggers review if material |\n| Does distribution reach everyone? | Successful Universal Stake delivery; time-to-recovery for failed delivery | High delivery; recovery within published window |\n| Does non-convertibility hold? | Stake sold, assigned, garnished, pledged, or traded for civic/survival/legal advantage | Zero successful durable routes |\n| Does politics capture it? | Targeted exclusions, bonuses, district favoritism, patronage patterns | None detectable; all allegations reviewable |\n| Is it understood? | % of participants who can explain who pays, who receives, and what cannot be bought | Majority, after disclosure |\n\n### What failure looks like\n\n- **Incidence inverts** \u2014 renters, workers, ordinary savers, small operators, or protected associations bear the practical burden while rent-holders escape.\n- **Dignity fails** \u2014 assessment requires broad personal surveillance, invasive household reporting, or unusable appeals.\n- **Valuation hiding wins** \u2014 the red-team can cheaply understate land/location value, concessions, licenses, network rents, or succession transfers.\n- **External-capital arbitrage wins** \u2014 ownership migrates on paper, local productive investment falls, or the base erodes faster than the public return can stabilize.\n- **Eligibility becomes political** \u2014 membership, exclusions, bonuses, or appeals are steered toward favored people, factions, districts, donors, or allies.\n- **Distribution rails fail** \u2014 digitally fragile or disputed members miss the stake, or recovery is slow enough to make universality false.\n- **Non-convertibility fails** \u2014 the stake becomes tradable, assignable, garnishable, collateralizable, or useful for buying Voice, office, survival priority, membership, legal standing, or public favor.\n- **Participants cannot explain the system** after full disclosure. If ordinary people cannot tell the difference between shared-value return and a tax on ordinary life, the political-economy claim fails regardless of the math.\n\nThe cautionary precedent here is not W\u00f6rgl being shut down by a central bank. It is the broader record of wealth and land-value taxes being undermined by assessment difficulty, capital flight, exemptions for friends, and public distrust. If the pilot reproduces those patterns at small scale, the design must answer them before any real collection is contemplated.\n\n### What success looks like\n\n- A clear source-base map with bounded valuation error.\n- Incidence that stays away from ordinary households, working balances, tools, protected homes, and protected associations.\n- A red-team that finds some routes, but no cheap and general route around the system.\n- Universal Stake distribution that reaches members reliably, including edge cases.\n- No successful conversion of Universal Stake into Voice, office, survival priority, membership, legal standing, or public favor.\n- A public record clear enough that ordinary participants can explain who pays, who receives, and what is protected.\n\nSuccess justifies the roadmap's next step: a larger simulation with real administrative data, real asset distributions, and external adversaries \u2014 still simulation-only until incidence, dignity, avoidance, distribution, and non-convertibility are proven under pressure.\n\n### Open questions this pilot does not resolve\n\n- Does source-base assessment survive contact with sophisticated wealth-holders and their advisors, rather than volunteers and modeled concessions?\n- Can Commons Return be collected at useful scale without capital flight, under-building, under-maintenance, or jurisdiction-shopping eroding the base?\n- What mix of proceeds should support Essential Access rails, Shared Storehouse reserves, Universal Stake, and any passive social wealth fund?\n- What are the right protected thresholds for homes, tools, reserves, associations, and succession transfers?\n- Can eligibility be universal without making membership itself buyable, inheritable, or politically manipulated?\n\n---\n\n## Pilot C \u2014 Voice (bounded civic priority)\n\n*Voice is the most politically sensitive instrument. It is not a vote \u2014 it is a bounded, expiring claim to put one issue onto the table for a real hearing. The testable features are two: whether people use it on things that matter to them, and whether the inability to buy, stockpile, or accumulate it keeps it from hardening into a status score.*\n\n> **Where this sits in the corpus**\n> - Voice is defined in [Annex Z](../annexes/ANNEX_Z.md), whose core move is to **separate Voice from Service Record** so that \"civic agenda influence and eligibility to serve cannot become one accumulative status score.\" That separation \u2014 not the token mechanics \u2014 is the thing this pilot most needs to prove.\n> - The capture and hardening risks are threats T-004, T-008, T-009, T-011, patched by P-008, P-009, P-024 (see [Annex Z](../annexes/ANNEX_Z.md) and the [Provenance Map](../governance/Provenance_Map.md)).\n> - The political failure mode the pilot must watch for \u2014 *people reading Voice as social credit* \u2014 is named directly in the Phase 1 comprehension track of the [Pilot Evidence Roadmap](../governance/Pilot_Evidence_Roadmap.md).\n\n### What we're testing\n\nThree claims, in order of how much a skeptic should doubt them:\n\n1. **Voice is non-accumulative.** It expires. You cannot save it up, and you cannot hold more of it than your neighbor. The design's whole defense against a civic oligarchy is that influence does not compound. The pilot tests whether an expiring, equal, non-transferable claim *stays* equal under real social pressure \u2014 or whether informal markets, bloc-trading, and \"lend me your Voice\" arrangements quietly reconstitute accumulation.\n2. **Voice does not become a status score.** Per [Annex Z](../annexes/ANNEX_Z.md), Voice must stay separate from any record of who has served or contributed. The pilot keeps the two ledgers physically separate and watches for leakage \u2014 does using (or not using) Voice start to read as a reputation signal?\n3. **Voice changes who is heard.** The payoff claim: a bounded priority claim, handed equally to everyone, surfaces issues that the usual loud-voices process buries.\n\n### The hypothesis\n\n> In a community of 200\u2013500 people making real shared decisions over four quarterly cycles, an equal, non-transferable, expiring Voice claim will (a) be used at meaningfully higher rates by normally-disengaged participants than the standard open-comment process; (b) show no correlation between Voice use and wealth, seniority, or institutional status; and (c) resist accumulation \u2014 successful transfers, bloc-trades, and stockpiling attempts stay negligible \u2014 without participants coming to treat Voice as a social-credit rank.\n\n### Smallest deployment\n\n**A housing cooperative, a small municipality, or a university residential community of 200\u2013500 members** that makes genuine shared decisions (budget lines, facilities, policies) \u2014 the realism depends on the decisions actually mattering. A toy decision produces toy data.\n\nEach participant receives **one Voice claim per quarter**. It is equal, non-transferable, cannot be bought or sold, and **expires at quarter's end if unused**. A participant spends it to elevate one issue into a guaranteed formal hearing \u2014 not to decide it. The community's normal process still makes the actual decision; Voice only controls what gets onto the agenda.\n\nThe pilot runs **four cycles (one year)** as an A/B/A/B design:\n\n- **Cycles 1 & 3 (baseline):** the community's normal agenda-setting process.\n- **Cycles 2 & 4 (Voice active):** Voice governs what reaches a hearing.\n\nAlternating isolates what Voice changes from what the community would have done anyway. A separate, sealed ledger records contribution/service activity **without** linking it to Voice use \u2014 the deliberate test of the Annex Z separation.\n\nA **red-team of participants** is openly invited to try to break the non-accumulation rule: pool their claims, trade them for favors, build a voting bloc. Every successful breach is a finding about how the wall fails in the wild, not a disqualification.\n\n### Rough cost\n\n| Item | Estimate |\n|---|---|\n| Voice allocation infrastructure (software or paper) + sealed-ledger separation | $15,000\u2013$35,000 |\n| Facilitation, process design, A/B cycle administration | $25,000\u2013$50,000 |\n| Independent review, data collection, comprehension survey | $35,000\u2013$60,000 |\n| **Total** | **$75,000\u2013$145,000** |\n\n### What we measure\n\n| Question | Metric | Target |\n|---|---|---|\n| Does it reach the disengaged? | Voice-use rate among normally-inactive members vs. their baseline-cycle participation | Meaningfully higher |\n| Is it equal? | Correlation of Voice use with wealth, seniority, status | None significant |\n| Does it surface different issues? | Overlap between Voice-elevated agenda and baseline-cycle agenda | Substantially different |\n| **Does non-accumulation hold?** | Successful transfers, bloc-trades, stockpiling attempts (red-team + organic) | Negligible; all routes documented |\n| Does it stay separate from status? | Evidence Voice use is read as reputation; leakage between the two ledgers | None detectable |\n| Is it understood, not feared? | % who can explain Voice correctly; % who mistake it for social credit | Majority correct; few misreads |\n| Is it consequential? | Do Voice-elevated issues get genuine hearings with visible outcomes? | Yes, every cycle |\n\n### What failure looks like\n\n- Voice use is dominated by the same people who already dominate the standard process \u2014 the instrument is not redistributing who is heard.\n- More than a negligible share of Voice claims are successfully transferred, pooled, or bloc-traded \u2014 the **non-accumulation wall is leaking**, which is the failure that matters most, because accumulation is exactly what Voice exists to prevent.\n- Voice use starts functioning as a reputation signal, or the sealed contribution ledger visibly bleeds into civic standing \u2014 the [Annex Z](../annexes/ANNEX_Z.md) separation has failed.\n- Participants consistently describe Voice as \"social credit\" or a loyalty score after disclosure \u2014 the political-economy read has gone wrong regardless of the mechanics.\n- Voice feels performative: issues are elevated and then go nowhere.\n\n### What success looks like\n\n- Disengaged members use Voice at rates well above their baseline participation.\n- No correlation between Voice use and wealth or status.\n- The Voice agenda is visibly different from the loud-voices agenda.\n- Accumulation attempts \u2014 including a motivated red-team's \u2014 mostly fail, and the few that work are specific and patchable.\n- Participants describe Voice accurately and do not confuse it with a ranking system.\n\nSuccess justifies a larger pilot where Voice governs higher-stakes, contested decisions and faces organized factional pressure \u2014 the condition under which accumulation incentives are strongest.\n\n### Open questions this pilot does not resolve\n\n- Does the non-accumulation wall survive **organized factional politics** at city or regional scale, where the incentive to corner Voice is far higher than in a cooperative?\n- Does Voice scale without becoming a bureaucratic process that excludes people who can't navigate paperwork \u2014 re-creating the exclusion it was meant to remove?\n- What is the right cycle length and claim frequency? Quarterly is a guess, not a finding.\n- How does Voice interface with existing representative/legal governance? This varies by jurisdiction and is a political question, not a design one.\n\n---\n\n## Pilot D \u2014 Service Record (rotating public roles)\n\n*Service Record is the hardest instrument to pilot and the one most likely to be misread. Unlike Voice, it is **allowed** to accumulate \u2014 it tracks who has contributed, and that record supports eligibility to serve. That is also its danger: an accumulating contribution record is one weak firewall away from becoming a social-credit hierarchy. The testable feature is whether rotating eligibility based on contribution can broaden who holds authority **without** the record monopolizing access, crowding out ordinary challenger routes, or leaking into market advantage, survival preference, or civic voice.*\n\n> **Where this sits in the corpus**\n> - Service Record is defined alongside Voice in [Annex Z](../annexes/ANNEX_Z.md) \u2014 and the central rule is the **firewall between them**: a contribution record may support eligibility to serve, but it may never convert into agenda-setting Voice, market advantage, survival-adjacent preference, or a closed civic priesthood.\n> - The prohibited convertibility patterns \u2014 including **employer-sponsored contribution accumulation** and **side queues** \u2014 are enumerated in [Annex AJ](../annexes/ANNEX_AJ.md) (threat T-001 / patch P-001, shadow convertibility).\n> - The two attacks the pilot must red-team are **elite-formation bypass** (T-008 / P-008) and **contribution fraud / attestation rings** (T-009 / P-009). Their defenses are attestation staking ([Annex AS](../annexes/ANNEX_AS.md)) and grace-exploitation closure ([Annex AF](../annexes/ANNEX_AF.md)).\n\n### What we're testing\n\n1. **Does contribution-supported eligibility broaden the pool?** The payoff claim \u2014 that eligibility informed by *showing up and contributing* surfaces a more diverse set of people for authority than self-nomination, election, or appointment alone, which reward wealth, free time, and willingness to campaign.\n2. **Does the firewall hold?** Per [Annex Z](../annexes/ANNEX_Z.md) and [Annex AJ](../annexes/ANNEX_AJ.md), a high Service Record must buy you *nothing* except eligibility to serve \u2014 not a better spot in any queue, not market preference, not extra Voice. This is the wall the pilot exists to stress.\n3. **Does it resist capture?** The named attacks are concrete: an employer farming contribution credit for its people, an attestation ring vouching for each other's fake contributions, a clique cycling fake-hardship pauses to preserve eligibility without contributing. The pilot pays a red-team to run all three.\n\n### The hypothesis\n\n> In a community with real rotating governance roles, over 24 months, contribution-supported eligibility \u2014 with peer attestation backed by stake and ordinary challenger routes preserved \u2014 will produce a measurably more diverse pool of role-holders than the prior selection method, with no decline in governance quality; and the Service Record will not become convertible: a motivated red-team's attempts to turn a high record into market advantage, queue preference, extra Voice, or captured eligibility (via employer farming, attestation rings, or fake-hardship pauses) will mostly fail and be detectable.\n\n### Smallest deployment\n\n**A nonprofit board, a cooperative, a homeowners' association, or a small municipal committee** with 3\u20137 rotating roles and 50\u2013200 eligible members. Over 24 months, eligibility for each role is supported by a Service Record \u2014 a transparent log of contributions to shared governance (meeting attendance, completed tasks, dispute-resolution participation) \u2014 while at least one ordinary challenger, lived-experience, sortition, or appeal route remains open where the role requires it.\n\nThis is explicitly **not** about selecting the most qualified person. It is about ensuring the *eligible pool* is not pre-filtered by wealth, connection, or willingness to campaign. The community retains normal selection within the eligible pool.\n\nTwo design elements are tested, not assumed:\n\n- **Attestation with stake ([Annex AS](../annexes/ANNEX_AS.md)).** Contributions are vouched for by peers who put a portion of their own civic standing at risk when they attest. A lightweight version of this is testable here, and it is the main defense against attestation rings.\n- **The firewall ([Annex Z](../annexes/ANNEX_Z.md) / [AJ](../annexes/ANNEX_AJ.md)).** The Service Record ledger is kept strictly separate from Voice (Pilot C's sealed ledger, if co-located) and confers no benefit anywhere except role eligibility.\n\nA **red-team of participants** is openly tasked with three jobs: farm contribution credit through an \"employer\" proxy, build an attestation ring, and cycle fake-hardship pauses to hold eligibility without contributing. Every success is a finding.\n\n### Rough cost\n\n| Item | Estimate |\n|---|---|\n| Service Record + attestation-staking system (ledger or software) | $15,000\u2013$35,000 |\n| Process design, facilitation, 24-month administration | $25,000\u2013$50,000 |\n| Adversarial red-team (capture / ring / fake-hardship testing) | $30,000\u2013$60,000 |\n| Independent review, data collection, comprehension survey | $35,000\u2013$60,000 |\n| **Total** | **$105,000\u2013$205,000** |\n\n### What we measure\n\n| Question | Metric | Target |\n|---|---|---|\n| Does the pool broaden? | Diversity of the eligible pool (income, background, prior governance experience) vs. prior method | Measurably more diverse |\n| Does service participation rise? | Contribution rate among previously-uninvolved members | Increases |\n| Does the record change outcomes, or just the pool? | Who is actually selected from the eligible pool | Pool effect distinguishable from selection effect |\n| Is governance quality preserved? | Decision quality, time-to-decision, conflict rate vs. baseline (independent review + satisfaction) | Maintained or improved |\n| **Does the firewall hold?** | Red-team conversions of Service Record into market advantage, queue preference, or Voice | Negligible; every route documented |\n| Do attestation rings survive staking? | Fake contributions that pass staked peer attestation | Minimal; staking detectably raises the cost |\n| Is fake-hardship capture closed? | Eligibility preserved through pause-cycling without genuine contribution | Detected and bounded |\n| Is it understood, not feared? | % who read Service Record as social credit after disclosure | Few |\n\n### What failure looks like\n\n- The eligible pool is no more diverse than self-nomination \u2014 the mechanism is not changing who can serve.\n- Governance quality declines materially \u2014 diversity is coming at a real cost the design has to answer for.\n- **The firewall leaks:** the red-team reliably turns a high Service Record into market advantage, queue preference, or extra Voice. This is the failure that matters most \u2014 it means Service Record has become the accumulative status score [Annex Z](../annexes/ANNEX_Z.md) exists to prevent.\n- Attestation rings pass staked attestation cheaply, or employer-farmed contribution credit is undetectable \u2014 the [Annex AJ](../annexes/ANNEX_AJ.md) / [AS](../annexes/ANNEX_AS.md) defenses do not hold at this scale.\n- Fake-hardship pause-cycling preserves elite eligibility without contribution ([Annex AF](../annexes/ANNEX_AF.md) failure).\n- Participants describe Service Record as \"social credit\" after disclosure.\n\n### What success looks like\n\n- A demonstrably broader eligible pool, with governance quality held or improved.\n- Participation rises when contribution visibly builds eligibility.\n- The red-team's conversion attempts mostly fail; the successes are specific, named, and patchable.\n- Staked attestation measurably raises the cost of fake contribution.\n- Participants describe Service Record accurately and do not confuse eligibility with rank or reward.\n\nSuccess justifies a larger pilot with higher-stakes roles and a genuinely adversarial capture environment \u2014 where the payoff for breaching the firewall is large enough to attract serious effort.\n\n### Open questions this pilot does not resolve\n\n- Does contribution-supported eligibility scale to **high-stakes roles** (judges, regulators) without producing governance failure or new capture incentives?\n- Does the firewall survive when the reward for breaching it is large \u2014 a powerful employer or faction with real resources, not a volunteer red-team?\n- How is the Service Record verified at population scale? A small ledger works here; the infrastructure for a city does not yet exist.\n- **Note on a design constraint, not an open question:** whether contributing should *also* generate Voice priority is *not* open \u2014 [Annex Z](../annexes/ANNEX_Z.md) forbids it by design. The pilot tests whether that separation **holds in practice**, not whether to relax it.\n\n---\n\n## How the pilots connect\n\nThese are four separate pilots, not one. They can run independently, in different communities, at different times. But they are designed to eventually connect:\n\n- **Essential Access + Shared Storehouse (Pilot A)** is the foundation. It answers: can we guarantee survival regardless of market position?\n- **Commons Return + Universal Stake (Pilot B)** tests the proposed public-return and distribution lane. Commons Return may help fund Essential Access rails, Shared Storehouse reserves, Universal Stake, or a passive public wealth fund, but only if incidence, dignity, avoidance, distribution, and non-convertibility hold under pressure.\n- **Voice (Pilot C)** governs the foundation. Who decides how Essential Access is calibrated, what counts as a shortage, and how Shared Storehouse distributes? Without Voice, someone with power decides \u2014 and that power concentrates.\n- **Service Record (Pilot D)** determines who holds Voice-adjacent authority. Without rotation, the people who administer Essential Access and manage the Shared Storehouse tend to stay in place, and power concentrates again.\n\nThe walls between the lanes are only testable when the lanes exist alongside each other. The integrated test \u2014 life access, market exchange, public return, scarcity response, Voice, and Service Record in one community \u2014 is the large-scale pilot that these four smaller pilots are designed to make possible.\n\n---\n\n## What we would learn from all four pilots together\n\nIf all four pilots run and generate honest data, we would know:\n\n1. Whether a guaranteed survival floor can operate without collapsing under gaming or administrative failure\n2. Whether a rationing mechanism can distribute fairly under real scarcity without black markets forming\n3. Whether Commons Return can be assessed on shared and scarcity-created value \u2014 sparing ordinary households, tools, homes, reserves, and protected associations \u2014 without avoidance, valuation hiding, external-capital arbitrage, or political capture\n4. Whether bounded, non-transferable civic priority changes who actually has influence in public decisions\n5. Whether rotating eligibility for governance roles produces more diverse leadership without degrading governance quality\n\nWe would not yet know whether the protected lanes work *together*, whether they scale beyond a few hundred people, or whether they survive sustained, organized attacks. Those questions require the large-scale pilot that is not described here.\n\n---\n\n## Honest limitations of this proposal\n\n**We do not know if these pilots are legally possible in existing jurisdictions.** Some mechanisms \u2014 local currencies, alternative governance structures \u2014 require regulatory clearance that varies by location. Legal review is required before any pilot begins.\n\n**We do not know the right parameters.** Commons Return source bases and rates, protected thresholds, Universal Stake cadence, Voice cycle length, and Service Record contribution weights are all design estimates. The pilots will calibrate them. The numbers in this document are starting points, not findings.\n\n**We do not know who will run these pilots.** This proposal needs a partner \u2014 a community, an institution, or an organization willing to participate. Without a willing host, the pilots cannot happen.\n\n**The pilots are not representative.** Early participants will be unusually motivated. Communities that volunteer to run these pilots are not typical communities. The results will be real but may not generalize. Generalizability requires a later, larger, and less self-selected test.\n\n---\n\n## What to do with this document\n\nIf you are a **researcher**, the open questions sections are the research agenda. Each one is a question the pilot cannot answer on its own.\n\nIf you are a **funder**, the four pilot budgets total roughly **$790,000\u2013$1,780,000** for an 18\u201324 month program (Pilot A $350k\u2013860k; Pilot B $260k\u2013570k; Pilot C $75k\u2013145k; Pilot D $105k\u2013205k). That is a small number for the question being asked. For comparison, the Finland UBI pilot (2017\u20132018) cost approximately \u20ac20 million. The single most important pilot, and the place to start, is **Pilot A** \u2014 it tests the survival floor and the non-convertibility wall that the entire design rests on.\n\nIf you are a **community**, the smallest useful starting point is Pilot A \u2014 Essential Access + Shared Storehouse \u2014 because it tests the most fundamental claim: that a guaranteed survival floor is possible without collapsing under real conditions.\n\nIf you are a **skeptic**, the failure criteria are listed explicitly in each section. Any of them would force us to say publicly that the mechanism does not work as designed. That is the commitment this proposal makes.\n\n---\n\n*This document is a rough draft. It will be revised as the design is tested. Feedback, objections, and alternative framings are welcome. See [Start Here](00_start_here.md) for the full project overview and [Claims & Evidence](../governance/Claims_Evidence_Register.md) for the current status of each mechanism's evidence base.*\n",
+      "headings": [
+        {
+          "level": 1,
+          "text": "A Minimal Pilot Proposal",
+          "slug": "a-minimal-pilot-proposal"
+        },
+        {
+          "level": 2,
+          "text": "The problem with designs that are never tested",
+          "slug": "the-problem-with-designs-that-are-never-tested"
+        },
+        {
+          "level": 2,
+          "text": "The protected lanes, briefly",
+          "slug": "the-protected-lanes-briefly"
+        },
+        {
+          "level": 2,
+          "text": "How to read the pilots below",
+          "slug": "how-to-read-the-pilots-below"
+        },
+        {
+          "level": 2,
+          "text": "Pilot A \u2014 Essential Access + Shared Storehouse",
+          "slug": "pilot-a-essential-access-shared-storehouse"
+        },
+        {
+          "level": 3,
+          "text": "What we're testing",
+          "slug": "what-were-testing"
+        },
+        {
+          "level": 3,
+          "text": "The hypothesis",
+          "slug": "the-hypothesis"
+        },
+        {
+          "level": 3,
+          "text": "Non-negotiable pilot rules (inherited from the corpus)",
+          "slug": "non-negotiable-pilot-rules-inherited-from-the-corpus"
+        },
+        {
+          "level": 3,
+          "text": "Smallest deployment",
+          "slug": "smallest-deployment"
+        },
+        {
+          "level": 3,
+          "text": "The scarcity test (months 9\u201311)",
+          "slug": "the-scarcity-test-months-911"
+        },
+        {
+          "level": 3,
+          "text": "Rough cost",
+          "slug": "rough-cost"
+        },
+        {
+          "level": 3,
+          "text": "What we measure",
+          "slug": "what-we-measure"
+        },
+        {
+          "level": 3,
+          "text": "What failure looks like",
+          "slug": "what-failure-looks-like"
+        },
+        {
+          "level": 3,
+          "text": "What success looks like",
+          "slug": "what-success-looks-like"
+        },
+        {
+          "level": 3,
+          "text": "Open questions this pilot does not resolve",
+          "slug": "open-questions-this-pilot-does-not-resolve"
+        },
+        {
+          "level": 2,
+          "text": "Pilot B \u2014 Commons Return and Universal Stake (simulation pilot)",
+          "slug": "pilot-b-commons-return-and-universal-stake-simulation-pilot"
+        },
+        {
+          "level": 3,
+          "text": "What we're testing",
+          "slug": "what-were-testing-2"
+        },
+        {
+          "level": 3,
+          "text": "The hypothesis",
+          "slug": "the-hypothesis-2"
+        },
+        {
+          "level": 3,
+          "text": "Smallest deployment",
+          "slug": "smallest-deployment-2"
+        },
+        {
+          "level": 3,
+          "text": "Rough cost",
+          "slug": "rough-cost-2"
+        },
+        {
+          "level": 3,
+          "text": "What we measure",
+          "slug": "what-we-measure-2"
+        },
+        {
+          "level": 3,
+          "text": "What failure looks like",
+          "slug": "what-failure-looks-like-2"
+        },
+        {
+          "level": 3,
+          "text": "What success looks like",
+          "slug": "what-success-looks-like-2"
+        },
+        {
+          "level": 3,
+          "text": "Open questions this pilot does not resolve",
+          "slug": "open-questions-this-pilot-does-not-resolve-2"
+        },
+        {
+          "level": 2,
+          "text": "Pilot C \u2014 Voice (bounded civic priority)",
+          "slug": "pilot-c-voice-bounded-civic-priority"
+        },
+        {
+          "level": 3,
+          "text": "What we're testing",
+          "slug": "what-were-testing-3"
+        },
+        {
+          "level": 3,
+          "text": "The hypothesis",
+          "slug": "the-hypothesis-3"
+        },
+        {
+          "level": 3,
+          "text": "Smallest deployment",
+          "slug": "smallest-deployment-3"
+        },
+        {
+          "level": 3,
+          "text": "Rough cost",
+          "slug": "rough-cost-3"
+        },
+        {
+          "level": 3,
+          "text": "What we measure",
+          "slug": "what-we-measure-3"
+        },
+        {
+          "level": 3,
+          "text": "What failure looks like",
+          "slug": "what-failure-looks-like-3"
+        },
+        {
+          "level": 3,
+          "text": "What success looks like",
+          "slug": "what-success-looks-like-3"
+        },
+        {
+          "level": 3,
+          "text": "Open questions this pilot does not resolve",
+          "slug": "open-questions-this-pilot-does-not-resolve-3"
+        },
+        {
+          "level": 2,
+          "text": "Pilot D \u2014 Service Record (rotating public roles)",
+          "slug": "pilot-d-service-record-rotating-public-roles"
+        },
+        {
+          "level": 3,
+          "text": "What we're testing",
+          "slug": "what-were-testing-4"
+        },
+        {
+          "level": 3,
+          "text": "The hypothesis",
+          "slug": "the-hypothesis-4"
+        },
+        {
+          "level": 3,
+          "text": "Smallest deployment",
+          "slug": "smallest-deployment-4"
+        },
+        {
+          "level": 3,
+          "text": "Rough cost",
+          "slug": "rough-cost-4"
+        },
+        {
+          "level": 3,
+          "text": "What we measure",
+          "slug": "what-we-measure-4"
+        },
+        {
+          "level": 3,
+          "text": "What failure looks like",
+          "slug": "what-failure-looks-like-4"
+        },
+        {
+          "level": 3,
+          "text": "What success looks like",
+          "slug": "what-success-looks-like-4"
+        },
+        {
+          "level": 3,
+          "text": "Open questions this pilot does not resolve",
+          "slug": "open-questions-this-pilot-does-not-resolve-4"
+        },
+        {
+          "level": 2,
+          "text": "How the pilots connect",
+          "slug": "how-the-pilots-connect"
+        },
+        {
+          "level": 2,
+          "text": "What we would learn from all four pilots together",
+          "slug": "what-we-would-learn-from-all-four-pilots-together"
+        },
+        {
+          "level": 2,
+          "text": "Honest limitations of this proposal",
+          "slug": "honest-limitations-of-this-proposal"
+        },
+        {
+          "level": 2,
+          "text": "What to do with this document",
+          "slug": "what-to-do-with-this-document"
+        }
+      ],
+      "wordCount": 7165,
+      "headingCount": 46
+    },
+    {
+      "id": "docs__public__10_real_world_examples_md",
+      "path": "docs/public/10_real_world_examples.md",
+      "section": "constitution",
+      "title": "Real-World Examples Guide",
+      "status": "",
+      "statusBucket": "reference",
+      "summary": "The Humane Constitution is not built from one historical model. It is a channel-separation design: survival access, ordinary markets, public return, civic voice, and public service are kept in separate lanes so one kind of advantage cannot buy every other kind.",
+      "content": "# Real-World Examples Guide\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **What this is** | A short guide to real problems, real attempts, and what this project learns from them. |\n> | **Who it is for** | New readers, skeptics, reviewers, and anyone asking \"hasn't this been tried before?\" |\n> | **How to read it** | Treat every example as a comparator, not proof. History can warn, pressure-test, and correct. It cannot certify this design. |\n> | **Core caution** | No example below implies divine endorsement of this project. Christ-centered lessons are read as dignity, mercy, humility, truthfulness, and fruit, not theocracy. |\n\n## The short version\n\nThe Humane Constitution is not built from one historical model. It is a channel-separation design: survival access, ordinary markets, public return, civic voice, and public service are kept in separate lanes so one kind of advantage cannot buy every other kind.\n\nThe active public-finance direction is **Commons Return and Universal Stake**:\n\n- **Commons Return:** when someone receives exclusive control over value created by land, nature, public law, public infrastructure, monopoly privilege, network position, public concession, or large inheritance, part of that value returns to the public.\n- **Universal Stake:** every member receives a protected stake, dividend, or endowment from that public return. It cannot buy Voice, office, survival priority, membership, legal standing, or public favor.\n\nDemurrage, stamp scrip, and local-currency experiments are useful history. They are not the active wealth spine of this project. The live Annex D instrument is [Commons Return and Universal Stake](../annexes/ANNEX_D.md), and its evidence burden is tracked in the [Commons Return and Universal Stake Evidence Test Package](../governance/Commons_Return_Universal_Stake_Evidence_Test_Package.md).\n\n## How to use these examples\n\nAsk four questions of each case:\n\n1. What real problem was it trying to answer?\n2. What actually worked?\n3. What failed, or what stayed unproven?\n4. Which project mechanism learns from it?\n\nThat last question matters. The project should not borrow the romance of a historical success while ignoring the conditions that made it work, or the reasons it failed.\n\n## Jubilee and debt release\n\n**The real problem:** debt and land loss can turn a temporary setback into permanent family disadvantage. A household loses land, then loses bargaining power, then passes the loss to children who had no part in the original debt.\n\n**The historical example:** the Jubilee law in Leviticus 25 describes a periodic reset: land returns, debts are released, and people who sold themselves into service go free. The text treats land as stewardship rather than permanent private dominion. It also refuses the idea that one bad season should become an inherited caste.\n\n**What succeeded:** as a moral and legal pattern, Jubilee names the right problem clearly. It says accumulation can become domination, and it puts a reset rule inside the system rather than leaving mercy to private charity.\n\n**What failed or stays uncertain:** historians debate how fully Jubilee was practiced. A modern civil system cannot simply claim to enact biblical Jubilee. It can learn from the mercy, stewardship, debt-release, and anti-permanence logic, but it remains a human instrument subject to correction.\n\n**Project mapping:** this points to [Commons Return and Universal Stake](../annexes/ANNEX_D.md), succession controls, anti-rent rules, and limits on predatory debt. It also warns the project not to turn debt relief into moral theater. The fruit test is simple: are people actually less trapped, or did the system just rename the trap?\n\n**Source trail:** see [Useful History](08_useful_history.md) and the [Christ-Centered Evaluation](../governance/Christ_Centered_Evaluation.md).\n\n## Early church sharing and voluntary care\n\n**The real problem:** people can be abandoned even inside a community that claims to value them. Need becomes invisible when help depends on status, family power, or market success.\n\n**The historical example:** the early church is described in Acts as sharing possessions, caring for widows, and making sure people in need were not left alone. This was not a neutral state program. It was a voluntary covenant community trying to live out mercy and mutual care.\n\n**What succeeded:** care was personal, local, and dignity-centered. The poor were not treated as economic waste. The community saw survival need as a shared responsibility, not a private embarrassment.\n\n**What failed or stays limited:** voluntary church sharing is not a plug-in model for civil government. It cannot justify coercive religious rule, forced membership, religious tests, or surveillance of private life. It also depends on trust, discipline, and local relationship in ways a large bureaucracy cannot copy.\n\n**Project mapping:** this supports the project rule that Essential Access is a floor, not a replacement for community. The corpus protects mutual-aid, church, cooperative, and community holdings unless they become avoidance shells. The system should support pre-existing care networks, not displace them.\n\n**Source trail:** see [Life and Rights](05_life_and_rights.md), [Annex D](../annexes/ANNEX_D.md), and the [Fairness Vignette Library](../governance/Fairness_Vignette_Library.md).\n\n## W\u00f6rgl and demurrage\n\n**The real problem:** in a depression, money can stop moving. People need work, local projects need labor, and useful exchange stalls because everyone is scared to spend.\n\n**The historical example:** W\u00f6rgl, Austria ran a local scrip experiment in 1932-33. The certificates carried a small monthly stamp cost, often called demurrage, which encouraged holders to spend rather than hoard. Local public works accelerated, and the experiment became famous.\n\n**What succeeded:** W\u00f6rgl is evidence that money rules shape behavior. Local currency design can change circulation, especially in a small community under stress.\n\n**What failed or stays limited:** W\u00f6rgl was small, emergency-shaped, and shut down by the central bank. It does not prove that routine per-balance charges are just, scalable, or dignity-preserving. Demurrage can also become too blunt: it may punish ordinary working balances, require intrusive classification, or overload one money rule with too many jobs.\n\n**Project mapping:** demurrage is a comparator, not the active proposal. The current design keeps ordinary Flow as market money and uses Commons Return for public value created by shared or scarcity-created sources. Pilot B is therefore not a local-currency pilot. It is a Commons Return and Universal Stake simulation.\n\n**Source trail:** see [Useful History](08_useful_history.md), [A Minimal Pilot Proposal](09_pilot_proposal.md), and [Annex D](../annexes/ANNEX_D.md).\n\n## Alaska Permanent Fund and public dividends\n\n**The real problem:** natural-resource wealth can become private extraction, short-term budget fuel, or political patronage. A public resource can be spent before the public ever sees the benefit.\n\n**The historical example:** Alaska created a public fund from oil-resource revenue and pays residents a recurring Permanent Fund Dividend. The corpus treats this as an outside analogue for public dividend administration and public wealth fund structure.\n\n**What succeeded:** the Alaska model shows that a public fund can be visible, audited, and linked to direct resident distribution. It also gives practical evidence that a recurring public dividend can be administered at population scale.\n\n**What failed or stays limited:** Alaska is oil-dependent and politically contested. Its dividend is not this project's Universal Stake. It does not prove non-garnishability, non-assignment, non-convertibility into civic power, or freedom from political capture.\n\n**Project mapping:** this informs the Universal Stake distribution rail, the public lockbox idea, and anti-patronage design. It does not lower the project's evidence burden. The project still has to prove incidence, dignity, eligibility, distribution reliability, and non-convertibility.\n\n**Source trail:** see the [External Evidence Register](../governance/External_Evidence_Register.md), [Annex D](../annexes/ANNEX_D.md), and the [Claims and Evidence Register](../governance/Claims_Evidence_Register.md).\n\n## Singapore and HDB-style housing\n\n**The real problem:** housing can become both a survival need and a speculative asset. When land and housing are left mostly to investment markets, people without capital can lose stable shelter even while buildings exist.\n\n**The historical example:** Singapore's public-housing model, associated with the Housing and Development Board, shows that land policy, public finance, planning, and construction can be coordinated at large scale. It is a useful comparator for housing as infrastructure rather than housing only as an asset market.\n\n**What succeeded:** the broad lesson is coordination. Housing outcomes change when land, finance, construction, and public purpose are aligned instead of left to fragmented speculation.\n\n**What failed or stays limited:** Singapore also warns against overcentralization. A competent central state can deliver housing, but it can also narrow exit, speech, and local self-rule. A housing system can protect dignity materially while still creating political dependence if residents cannot challenge the authority that houses them.\n\n**Project mapping:** this points to Essential Access, housing continuity, land/location Commons Return, anti-rent rules, and dignity review. The project should learn from public coordination without copying political centralization. Housing must not become a loyalty gate.\n\n**Source trail:** see [Useful History](08_useful_history.md), [Annex J](../annexes/ANNEX_J.md), and the [Christ-Centered Evaluation](../governance/Christ_Centered_Evaluation.md).\n\n## Rationing during wars and disasters\n\n**The real problem:** when there is genuinely not enough, price decides who goes without unless another rule replaces it. Under true scarcity, rationing happens either openly or through money, favoritism, panic, and black markets.\n\n**The historical examples:** UK wartime rationing is the positive comparator: simple, universal, public, and ended when scarcity ended. Soviet privilege stores, Venezuela's politicized shortage distribution, and Hurricane Katrina response failures are negative comparators.\n\n**What succeeded:** rationing can work when it is transparent, universal, time-limited, and morally legible. People tolerate hard limits better when the powerful live under the same rule.\n\n**What failed:** rationing rots when officials are exempt, when scarcity claims cannot be challenged, when the rules hide party favoritism, or when emergency powers become normal administration.\n\n**Project mapping:** this is the job of Shared Storehouse and capacity measurement. The system must prove that shortage declarations are honest, challengeable, and temporary. It must also prove that rationing beats panic prices without creating black markets or hidden privilege.\n\n**Source trail:** see [Useful History](08_useful_history.md), [A Minimal Pilot Proposal](09_pilot_proposal.md), [Annex M](../annexes/ANNEX_M.md), and [Annex AQ](../annexes/ANNEX_AQ.md).\n\n## Co-ops and commons governance\n\n**The real problem:** shared resources can be destroyed by overuse, captured by insiders, or seized by distant managers who do not understand local conditions.\n\n**The historical examples:** Elinor Ostrom's commons research shows that durable commons need boundaries, monitoring, sanctions, conflict resolution, local rule participation, and nested governance. Mondragon shows a worker-owned cooperative network can last across generations. Medieval guilds show the warning side: mutual aid and quality control can harden into insider privilege.\n\n**What succeeded:** shared governance works best when members know the rules, help shape them, monitor each other, and have usable conflict paths. Worker ownership can keep capital from treating workers as disposable inputs.\n\n**What failed:** co-ops, guilds, and commons can all become closed clubs. The people inside protect each other. The people outside face a locked door.\n\n**Project mapping:** this informs Voice, Service Record, subsidiarity, protected associations, and the anti-capture gates around Commons Return. The project must recognize care work, mutual aid, spiritual community leadership, and informal service without turning contribution into a social rank.\n\n**Source trail:** see [Useful History](08_useful_history.md), the [Architecture Source Map](../governance/Architecture_Source_Map.md), [Annex D](../annexes/ANNEX_D.md), and [Annex K](../annexes/ANNEX_K.md).\n\n## Regulatory capture and oligarchy\n\n**The real problem:** concentrated wealth does not stay only economic. It buys lawyers, lobbyists, media influence, favorable rules, soft enforcement, and eventually the definition of what counts as legal.\n\n**The historical examples:** the Gilded Age, post-Soviet oligarchs, dynastic banking influence, Citizens United, offshore leaks, and ordinary regulatory capture all show the same pattern. It does not require a secret conspiracy. Legal influence can be enough.\n\n**What succeeded:** antitrust, public integrity systems, beneficial-ownership rules, independent review, and real prosecutions can sometimes push back. Iceland's post-2008 accountability response is one useful comparator in the local history file.\n\n**What failed:** rules fail when the regulated industry staffs the regulator, when campaign money shapes law, when ownership hides behind shells, or when enforcement depends on the same institutions that profit from non-enforcement.\n\n**Project mapping:** this is why Flow, Voice, Service Record, Commons Return, Universal Stake, public records, beneficial-control review, and capture dashboards have to be separated. It is also why no public-return system should be trusted without anti-patronage gates and appeal rights.\n\n**Source trail:** see [Useful History](08_useful_history.md), the [Capture Dashboard Specification](../governance/Capture_Dashboard_Specification.md), [Annex D](../annexes/ANNEX_D.md), and the [Claims and Evidence Register](../governance/Claims_Evidence_Register.md).\n\n## What these examples do not prove\n\nThey do not prove that the Humane Constitution works.\n\nThey do prove that the problems are real:\n\n- markets without floors can leave people to die;\n- debt and land loss can compound across generations;\n- public resources can be privatized unless a return rule exists;\n- rationing can be fair or corrupt depending on design;\n- co-ops and commons can serve dignity or become insider clubs;\n- wealth will try to become rule-power;\n- moral language can correct power, or be captured by power.\n\nThat is enough to justify testing. It is not enough to justify deployment.\n\nThe project is serious only if it keeps the examples in their proper place: as warnings, comparators, and pressure tests. The real question is still whether the proposed mechanisms can survive live pilots without bad fruit.\n\n## Where to go next\n\n- [Start Here](00_start_here.md) for the shortest overview.\n- [White Paper](04_white_paper.md) for the full public argument.\n- [Useful History](08_useful_history.md) for the longer history tour.\n- [A Minimal Pilot Proposal](09_pilot_proposal.md) for what the first tests would measure.\n- [Claims and Evidence Register](../governance/Claims_Evidence_Register.md) for what is designed, unproven, and still missing.\n",
+      "headings": [
+        {
+          "level": 1,
+          "text": "Real-World Examples Guide",
+          "slug": "real-world-examples-guide"
+        },
+        {
+          "level": 2,
+          "text": "The short version",
+          "slug": "the-short-version"
+        },
+        {
+          "level": 2,
+          "text": "How to use these examples",
+          "slug": "how-to-use-these-examples"
+        },
+        {
+          "level": 2,
+          "text": "Jubilee and debt release",
+          "slug": "jubilee-and-debt-release"
+        },
+        {
+          "level": 2,
+          "text": "Early church sharing and voluntary care",
+          "slug": "early-church-sharing-and-voluntary-care"
+        },
+        {
+          "level": 2,
+          "text": "W\u00f6rgl and demurrage",
+          "slug": "w\u00f6rgl-and-demurrage"
+        },
+        {
+          "level": 2,
+          "text": "Alaska Permanent Fund and public dividends",
+          "slug": "alaska-permanent-fund-and-public-dividends"
+        },
+        {
+          "level": 2,
+          "text": "Singapore and HDB-style housing",
+          "slug": "singapore-and-hdb-style-housing"
+        },
+        {
+          "level": 2,
+          "text": "Rationing during wars and disasters",
+          "slug": "rationing-during-wars-and-disasters"
+        },
+        {
+          "level": 2,
+          "text": "Co-ops and commons governance",
+          "slug": "co-ops-and-commons-governance"
+        },
+        {
+          "level": 2,
+          "text": "Regulatory capture and oligarchy",
+          "slug": "regulatory-capture-and-oligarchy"
+        },
+        {
+          "level": 2,
+          "text": "What these examples do not prove",
+          "slug": "what-these-examples-do-not-prove"
+        },
+        {
+          "level": 2,
+          "text": "Where to go next",
+          "slug": "where-to-go-next"
+        }
+      ],
+      "wordCount": 2242,
+      "headingCount": 13
+    },
     {
       "id": "docs__simulations__Adversarial_Narrative_Simulation_md",
       "path": "docs/simulations/Adversarial_Narrative_Simulation.md",
@@ -7548,7 +7935,7 @@
       "status": "Status: Tier 1 / Tier 2 mixed (per row). Published as single authoritative source.",
       "statusBucket": "reference",
       "summary": "FC-020 (PROTECTEDPAUSEFLOOR = 0.30). Sim Test 7 in docs/ADVERSARIALAUDIT.md established: - Caregiver-at-2%-contribution Voice equilibrium = 0.13 units. - Standard-at-10%-contribution Voice equilibrium = 0.67 units. - Protected Pause at 20% decay dampening = 4.44 units (exploitable if set there).",
-      "content": "# Founding Commitments \u2014 Numerical Lock File\n\n**Status:** Tier 1 / Tier 2 mixed (per row). Published as single authoritative source.\n**Purpose:** Every founding parameter referenced across the Humane Constitution, White Paper, Threat Register, Patch Log, and annexes is either bound to a value here or assigned a reserved FC identifier here until the activation gate that binds it.\n**Amendment:** Tier 1 commitments require H-3 refounding authority. Tier 2 commitments follow the ordinary amendment ladder with public redlines. Tier 3 commitments follow ordinary reasonableness review.\n\n---\n\n## Commitment Table\n\n| ID | Name | Tier | Value | Unit | Rationale | Affected docs |\n|:---|:---|:---:|:---|:---|:---|:---|\n| **FC-001** | `ACCEPTABLE_MEASUREMENT_ERROR_FOOD` | 1 | \u00b15% | confidence interval | Below this, capacity-based Essential Access issuance risks physical shortfall; above this, over-issuance risk dominates | Article III, Annex AL |\n| **FC-002** | `ACCEPTABLE_MEASUREMENT_ERROR_WATER` | 1 | \u00b13% | confidence interval | Water buffers are thinner than food; tighter error bound required | Article III, Annex AL |\n| **FC-003** | `ACCEPTABLE_MEASUREMENT_ERROR_SHELTER` | 2 | \u00b110% | confidence interval | Shelter capacity is structurally slower-moving; wider bound acceptable | Article III, Annex AL |\n| **FC-004** | `ACCEPTABLE_MEASUREMENT_ERROR_ENERGY` | 1 | \u00b15% | confidence interval | Energy shortfall cascades to other categories; same bound as food | Article III, Annex AL |\n| **FC-005** | `ACCEPTABLE_MEASUREMENT_ERROR_MEDICINE` | 1 | \u00b15% | confidence interval (supply days) | Medicine shortfall is non-substitutable; error bound tight | Article III, Annex AL, Annex Y |\n| **FC-010** | `ACCEPTABLE_LEAKAGE_THRESHOLD` | 2 | 3% / annum (routine); 7% / annum (systemic review trigger) | fraction of Essential Access allocations informally converted | T-001 P-001 requires an operational target; 3% is measurable and enforceable; 7% triggers systemic-architecture review | Annex AB2, Annex AJ, Threat Register T-001 |\n| **FC-020** | `PROTECTED_PAUSE_FLOOR` | 1 | 0.30 | Voice units | Sim Test 7 showed range (0.13, 0.67) required; 0.30 is mid-range providing protection without creating pause-as-exploit | Article VI, Patch P-009 |\n| **FC-030** | `ORACLE_N_MIN` | 1 | 5 | oracle nodes per cohort | BFT floor for f=1 Byzantine nodes; PRD-003 requirement | Article III, Annex AL, SPECIFICATIONS.md |\n| **FC-031** | `METHODOLOGY_CLASS_MIN` | 1 | 3 | distinct methodology classes per cohort | Finding 7 requirement for structural diversity | Annex AL, Patch P-017 |\n| **FC-032** | `ORACLE_PAIRWISE_CORRELATION_MAX` | 1 | 0.30 | correlation coefficient (Pearson, on historical error series) | Pairs above this threshold are not structurally independent regardless of formal classification | Annex AL |\n| **FC-033** | `ORACLE_ADVERSARIAL_SEATS_MIN` | 1 | 1 | per cohort | P-014 adversarial-panel analogue; structural requirement | Annex AL, Annex AI |\n| **FC-040** | `BRIBE_DETERRENCE_MULTIPLIER` | 2 | 5.0 | multiple of detected gain | At \u226585% detection, penalty = 5\u00d7 gain produces expected value \u2265 4.25\u00d7 gain \u2014 decisively deterrent | Annex AJ, Patch P-001 |\n| **FC-041** | `DETECTION_PROBABILITY_ASSUMED` | 2 | 0.85 | probability | Assumed detection rate for deterrence calculation; subject to pilot verification | Annex AJ |\n| **FC-050** | `FLOW_DEMURRAGE_RATE` | 2 | 0.5% / month | idle balance above exemption | Option B baseline; committed as single value rather than 0.25%\u20131.00% corridor to eliminate drift surface | Article V, `docs/SPECIFICATIONS.md` |\n| **FC-051** | `FLOW_DEMURRAGE_REVIEW_CORRIDOR` | 3 | \u00b10.25%/mo around FC-050 | post-first-year adjustment band | Allows calibration without re-opening Tier 2 amendment; max rate 0.75%/mo, min 0.25%/mo | Article V, `docs/SPECIFICATIONS.md` |\n| **FC-052** | `FLOW_IDLE_THRESHOLD_DAYS` | 2 | PROPOSED VALUE: 30 days \u2014 bind before activation | days | Idle-balance dwell time before demurrage begins. Simulation uses 30 days as provisional test value; 30 days provides adequate working capital for monthly payroll and household expenses while preventing long-duration passive hoarding; consistent with FC-050 monthly demurrage cadence | Article V, `docs/SPECIFICATIONS.md` |\n| **FC-053** | `FLOW_RETIREMENT_EPSILON` | 2 | PROPOSED VALUE: 0.01 Flow \u2014 bind before activation | Flow | Minimum residual Flow balance below which balances retire from circulation. Balances below this threshold are functionally zero and should retire to prevent ledger bloat; 0.01 Flow is well below any meaningful purchasing power | Article V, `docs/SPECIFICATIONS.md` |\n| **FC-054** | `PFCR_DEMURRAGE_ROUTING_SHARE` | 2 | PROPOSED VALUE: 0.65 (65% to PFCR receipts, 35% permanent retirement) \u2014 bind before activation | fraction of demurrage charge | Published split between PFCR receipts and permanent retirement on demurrage application. 65% routing to PFCR provides stable public funding; 35% permanent retirement maintains circulation discipline; split calibrated to keep total Flow supply stable over a 10-year horizon under FC-050 demurrage rate | Article V, `docs/SPECIFICATIONS.md` |\n| **FC-055** | `FLOW_ISSUANCE_CEILING_FUNCTION` | 1 | RESERVED \u2014 bind before public issuance beyond pilot | formula | Binds the multiplier function relating verified productive commitments to maximum Flow in circulation | Article V, `docs/SPECIFICATIONS.md` |\n| **FC-056** | `ESSENTIAL_ACCESS_ENHANCED_ALLOCATION_RULE` | 2 | PROPOSED VALUE: 1.5\u00d7 CSM floor for documented hardship; 2.0\u00d7 CSM floor for medical necessity; maximum 90 days per rolling year without CRP review \u2014 bind before activation | rule / multiplier | Defines the lawful path above the CSM floor for hardship, emergency, or exceptional basket access. 1.5\u00d7 covers enhanced dietary, mobility, or care needs; 2.0\u00d7 covers medically necessary requirements; 90-day rolling cap prevents enhanced allocation from becoming baseline without review | Article III, `docs/SPECIFICATIONS.md` |\n| **FC-057** | `ESSENTIAL_ACCESS_VALIDITY_WINDOW_HOURS` | 2 | 72 | hours | Locks the initial Essential Access expiry window to the current constitutional baseline | Article III, `docs/SPECIFICATIONS.md` |\n| **FC-058** | `CSM_BASKET_AND_REGIONAL_ADJUSTMENT_RULE` | 1 | RESERVED \u2014 bind before regional launch | basket definition + adjustment formula | Constitutional Survival Minimum must publish its basket composition and regional-variation rule before activation across heterogeneous localities | Article III, `docs/SPECIFICATIONS.md`, Annex Y |\n| **FC-060** | `VOICE_SECTOR_CEILING` | 1 | 0.20 | fraction of total Voice | Sim Test 4: 3-sector coalition at 25% ceiling achieves 75% supermajority; 20% ceiling caps 3-sector to 60%, below supermajority threshold | Article VI, Patch P-008 |\n| **FC-061** | `VOICE_CAP_PER_PERSON_PER_CYCLE` | 2 | 300 | raw Voice units | Preserves existing Humane Constitution \u00a7VIII baseline | Article VI |\n| **FC-062** | `VOICE_DECAY_RATE` | 2 | 0.15 / day | exponential decay | Existing `model_outline.py` parameter, preserved | Article VI |\n| **FC-063** | `SERVICE_RECORD_DECAY_RATE_NORMAL` | 2 | RESERVED \u2014 bind before Service Record activation | fraction per day | Normal slow-decay rate for Service Record outside Protected Pause or grace-period exceptions | Article VI, `docs/SPECIFICATIONS.md` |\n| **FC-070** | `RESERVE_WINDOW_DAYS` | 1 | 45 | days of supply \u00d7 population at CSM level | Resilience reserves (Article III) sized for CSM \u00d7 population \u00d7 45 days. Exceeds L3 Emergency trigger by 6\u00d7 to prevent reserve-exhaustion cascade | Article III, Annex Y |\n| **FC-071** | `ACCEPTABLE_CSM_FAILURE_THRESHOLD` | 1 | 3 failures per 10,000 residents per 30 days | cluster rate | Above this, cluster enters Scarcity L3 regardless of oracle status | Annex Y \u00a7Y4 |\n| **FC-072** | `SHARED_STOREHOUSE_SCARCITY_ACTIVATION_THRESHOLD_RULE` | 1 | PROPOSED VALUE: Activation when oracle-confirmed supply for any CSM category falls below 85% of the 45-day reserve floor (FC-070) for 3 consecutive measurement cycles, OR when physical sampling (Annex AL \u00a7AL-COST) shows supply below 90% of CSM floor for any single cycle \u2014 bind before activation | category threshold rule | Shared Storehouse may not activate on vague scarcity claims; each essential category must publish its activation threshold rule before emergency overlay becomes operative. 85% of the 45-day reserve provides a 38-day buffer before genuine scarcity; 3-cycle confirmation prevents single-measurement noise from triggering rationing; physical sampling override prevents oracle manipulation from blocking activation | Article III, `docs/SPECIFICATIONS.md`, Annex Y |\n| **FC-080** | `ATTESTATION_STAKE_RATIO` | 2 | 0.20 | fraction of attestor's own Voice and Service Record, proportional to claim size | Attestor risks 20% of their civic balance when attesting; calibrated for meaningful skin-in-the-game without destroying livelihoods on single errors | Article VI, Proposal 9 files |\n| **FC-081** | `ATTESTATION_AUDIT_WINDOW` | 2 | 365 | days | Attestation slashing window after false-claim finding; 1 year matches civic-cycle duration | Article VI |\n| **FC-082** | `ATTESTATION_GRAPH_DENSITY_THRESHOLD` | 2 | 0.40 | mutual cross-attestation ratio | Attestor networks above this density triggers automatic review; calibrated against null-model random-graph baseline | Article VI |\n| **FC-083** | `ATTESTATION_REPUTATION_CREDIT_CAP` | 2 | 2 | civic cycles of successful attestation reputation credit | Caps attestation-derived reputation so reliable attestors become legible civic resources without creating a new status-currency surface | Article VI, Annex AS |\n| **FC-090** | `OMBUDS_SUBCOUNT_MIN` | 1 | 5 | sub-Ombuds nodes | Federated Ombuds (Proposal 8) structural minimum; BFT-equivalent for institutional decisions | Annex AI |\n| **FC-091** | `OMBUDS_SUPERMAJORITY_THRESHOLD` | 1 | 4/5 | affirmative sub-Ombuds | Protocol-level decisions require \u22654 of 5 sub-Ombuds affirmative | Annex AI |\n| **FC-092** | `OMBUDS_TERM_DAYS` | 2 | 730 | days (2 years) | Sub-Ombuds term length; staggered across 5 seats | Annex AI |\n| **FC-100** | `ORACLE_QUORUM_LOSS_RESTORATION_WINDOW` | 1 | 14 | days of verification after quorum restoration | Proposal 6 crisis fallback \u2014 prevents flash-recovery from being exploited as normalization pathway | Article III fallback files |\n| **FC-110** | `TIER1_AMENDMENT_SIGNATURES_MIN` | 1 | 7 of 9 | cryptographic signatures from dispersed key-holders | M-of-N threshold for Tier 1 amendment per Proposal 1; 9 geographically distributed holders; 7 required; allows 2 captured/lost without breakage | `/architecture/amendment_protocol.md` |\n| **FC-111** | `TIER1_AMENDMENT_TIMELOCK_DAYS` | 1 | 180 | days | Minimum wall-clock delay between proposal and effect; survives political cycles | `/architecture/amendment_protocol.md` |\n| **FC-120** | `EXIT_SUPERMAJORITY_THRESHOLD` | 1 | 2/3 | fraction of resident personhood | Required to initiate jurisdictional exit under the Founding Order; prevents transient pluralities from triggering structural discontinuity | `/founding/order/exit_protocol.md` |\n| **FC-121** | `EXIT_UNWIND_DAYS` | 1 | 730 | days (2 years) | Graceful-exit unwind window; Essential Access continuity preserved for individuals during unwind | `/founding/order/exit_protocol.md` |\n| **FC-122** | `SUBSIDIARITY_SCALES` | 1 | household / neighborhood (\u2264500) / locality (\u22645,000) / region (\u2264500,000) / federation | personhood counts | Scale-tier definitions for subsidiarity routing | `/founding/order/jurisdictional_scales.md` |\n| **FC-140** | `AED_ESSENTIAL_ACCESS_FRAUD_BAND` | 2 | target \u22642% / upper bound \u22645% / trigger \u22653% per quarter | quarterly fraud tuple | Essential Access identity fraud consumes physical survival supply directly; its target, upper tolerance, and audit trigger must be public before scale-up. Target anchored below the SNAP program operational error rate (2\u20133% per USDA studies), the closest operational analogue; upper bound set at 5% to force systemic review before fraud reaches GAO-documented government-program false-acceptance range. | Annex AK, Threat_Register.md |\n| **FC-141** | `AED_VOICE_FRAUD_BAND` | 2 | target \u22643% / upper bound \u22647% / trigger \u22655% per quarter | quarterly fraud tuple | Voice fraud distorts agenda-setting and must publish its tolerated error band before activation. Somewhat looser than Essential Access (FC-140) because Voice fraud does not consume physical survival goods; consistent with democratic-participation error tolerances in comparable systems. | Annex AK, Threat_Register.md |\n| **FC-142** | `AED_SERVICE_RECORD_FRAUD_BAND` | 2 | target \u22645% / upper bound \u226410% / trigger \u22657% per quarter | quarterly fraud tuple | Service Record fraud distorts eligibility and role selection; requires a published tolerated-error band. Looser than Voice (FC-141) because Service Record fraud affects longer-cycle eligibility decisions rather than immediate agenda-setting; consistent with public-employment verification tolerances. | Annex AK, Threat_Register.md |\n| **FC-143** | `AED_EXCLUSION_BAND_DISPLACED` | 2 | target \u22643% / upper bound \u22646% / trigger \u22654% per quarter | quarterly exclusion tuple | Displaced persons are a first-order identity-access vulnerability class and require explicit exclusion commitments. UNHCR biometric exclusion monitoring targets <5% for displaced populations; tighter upper bound (6%) chosen because displaced persons have no alternative access route. | Annex AK, Threat_Register.md |\n| **FC-144** | `AED_EXCLUSION_BAND_UNDOCUMENTED` | 2 | target \u22645% / upper bound \u22648% / trigger \u22656% per quarter | quarterly exclusion tuple | Undocumented persons are a first-order identity-access vulnerability class and require explicit exclusion commitments. Documentation barriers produce a structurally higher baseline exclusion rate; trigger set at 6% to force institutional review before the rate reaches double digits. | Annex AK, Threat_Register.md |\n| **FC-145** | `AED_EXCLUSION_BAND_DIGITALLY_FRAGILE` | 2 | target \u22645% / upper bound \u22648% / trigger \u22656% per quarter | quarterly exclusion tuple | Digitally fragile persons require a separately published exclusion band so access failures are not hidden in aggregate success rates. Structural access barriers (no smartphone, limited literacy, disability) produce a higher baseline analogous to undocumented persons; 8% hard ceiling requires mandatory architecture review before that threshold is reached. | Annex AK, Threat_Register.md |\n| **FC-146** | `AED_EXCLUSION_BAND_RECOVERY_CRISIS` | 2 | RESERVED \u2014 bind target / upper bound / trigger before first scale-up gate | quarterly exclusion tuple | Crisis and recovery cases are structurally easy to exclude and require their own exclusion commitments | Annex AK |\n| **FC-147** | `AED_EXCLUSION_BAND_OVERALL_POPULATION` | 2 | RESERVED \u2014 bind target / upper bound / trigger before first scale-up gate | quarterly exclusion tuple | Aggregate exclusion remains a governing signal even when vulnerable-population bands are tracked separately | Annex AK |\n| **FC-148** | `AED_EXCLUSION_PRIORITY_MULTIPLIER` | 2 | PROPOSED VALUE: 1.5 \u2014 bind before activation | multiple of exclusion target | Governs when exclusion reduction takes priority over further fraud tightening in the AED trade-off rule. When exclusion reduction and fraud tightening trade off, reducing exclusion is weighted 1.5\u00d7 more important; reflects the asymmetric harm of wrongful exclusion (survival floor loss) vs. wrongful inclusion (resource dilution) | Annex AK |\n| **FC-149** | `AED_FRAUD_PRIORITY_BOUND` | 2 | PROPOSED VALUE: 5% (= FC-140 Essential Access upper bound) \u2014 bind before activation | fraud upper-bound reference | Governs when fraud reduction takes priority over further inclusion loosening in the AED trade-off rule. When Essential Access fraud is below its upper bound (5%), further fraud reduction yields diminishing returns and inclusion improvement should take priority; at or above 5%, fraud reduction takes priority | Annex AK |\n| **FC-150** | `AED_SIMULTANEOUS_BREACH_DEFAULT_PREFERENCE` | 2 | PROPOSED VALUE: exclusion-first \u2014 bind before activation | exclusion-first / fraud-first | Publicly locks the default preference when both fraud and exclusion exceed their upper bounds simultaneously. When both fraud and exclusion rates breach their upper bounds simultaneously, reducing exclusion takes priority \u2014 consistent with the survival floor principle that wrongful exclusion is the worse error | Annex AK |\n| **FC-160** | `CC_STANDARD_RELEASE_MAX` | 2 | RESERVED \u2014 bind before escrow launch | Flow | Upper bound for single-verifier milestone releases in contract-commitment architecture | Annex AR |\n| **FC-161** | `CC_ENHANCED_RELEASE_MAX` | 2 | RESERVED \u2014 bind before escrow launch | Flow | Upper bound for dual-verifier milestone releases; releases above this threshold enter Major tier | Annex AR |\n| **FC-162** | `CC_MAJOR_RELEASE_PERCENT_FLOOR` | 2 | RESERVED \u2014 bind before escrow launch | fraction of total project value | Anti-fragmentation rule that forces Major-tier verification above a published share of project value regardless of absolute Flow amount | Annex AR |\n| **FC-163** | `CC_ESSENTIAL_ACCESS_DEPLOYMENT_WINDOW` | 2 | RESERVED \u2014 bind before escrow launch | days | Maximum idle escrow hold for Essential Access delivery programmes before CRP review triggers | Annex AR |\n| **FC-164** | `CC_STANDARD_DEPLOYMENT_WINDOW` | 2 | RESERVED \u2014 bind before escrow launch | days | Maximum idle escrow hold for standard infrastructure before CRP review triggers | Annex AR |\n| **FC-165** | `CC_LARGE_PROJECT_VALUE_THRESHOLD` | 2 | RESERVED \u2014 bind before escrow launch | Flow contracted value | Published breakpoint above which projects count as large-scale or novel for deployment-window purposes | Annex AR |\n| **FC-166** | `CC_LARGE_SCALE_DEPLOYMENT_WINDOW` | 2 | RESERVED \u2014 bind before escrow launch | days | Maximum idle escrow hold for large-scale or first-of-type infrastructure before CRP review triggers | Annex AR |\n| **FC-167** | `CC_CRP_EXPLANATION_DEADLINE` | 2 | RESERVED \u2014 bind before escrow launch | days after trigger | Deadline for commissioning authorities to explain deployment-window overruns to CRP | Annex AR |\n| **FC-168** | `CC_CRP_DECISION_DEADLINE` | 2 | RESERVED \u2014 bind before escrow launch | days after trigger | Deadline for CRP to issue extension / support / escalation decisions on deployment-window review | Annex AR |\n| **FC-169** | `CC_CRP_EXTENSION_WINDOW` | 2 | RESERVED \u2014 bind before escrow launch | days | Additional time granted when CRP confirms legitimate procurement complexity | Annex AR |\n| **FC-170** | `CC_CRP_PUBLICATION_DEADLINE` | 2 | RESERVED \u2014 bind before escrow launch | days after decision | Deadline for publishing CRP deployment-window review outcomes | Annex AR |\n| **FC-171** | `CC_FORCE_MAJEURE_SELF_CERT_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | cumulative days per project | Maximum freeze duration available on contractor self-certification before higher verification tiers apply | Annex AR |\n| **FC-172** | `CC_FORCE_MAJEURE_THIRD_PARTY_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | cumulative days per project | Maximum freeze duration available on third-party certification before panel review applies | Annex AR |\n| **FC-173** | `CC_FORCE_MAJEURE_PANEL_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | cumulative days per project | Hard cap for force-majeure freeze duration before restructuring review replaces further freeze eligibility | Annex AR |\n| **FC-174** | `CC_ESSENTIAL_ACCESS_FORCE_MAJEURE_DURATION_CAP` | 2 | RESERVED \u2014 bind before escrow launch | fraction of contracted project duration | Prevents short Essential Access delivery projects from using an absolute freeze cap that functionally nullifies demurrage | Annex AR |\n| **FC-175** | `CC_INSPECTOR_POOL_MIN_PILOT` | 2 | RESERVED \u2014 bind before escrow launch | qualified inspectors | Minimum inspector pool size for pilot / single-municipality deployment | Annex AR |\n| **FC-176** | `CC_INSPECTOR_POOL_MIN_REGIONAL` | 2 | RESERVED \u2014 bind before escrow launch | qualified inspectors | Minimum inspector pool size for regional deployment | Annex AR |\n| **FC-177** | `CC_INSPECTOR_POOL_MIN_NATIONAL_PER_REGION` | 2 | RESERVED \u2014 bind before escrow launch | qualified inspectors per region | Minimum inspector pool size for national / multi-regional deployment | Annex AR |\n| **FC-178** | `CC_STANDARD_ROTATION_MAX_CONSECUTIVE` | 2 | RESERVED \u2014 bind before escrow launch | consecutive milestones | Maximum repeated assignments of the same inspector on Standard-tier releases | Annex AR |\n| **FC-179** | `CC_STANDARD_ROTATION_COOLING_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | days | Cooling-off interval before an inspector may return to the same project at Standard tier | Annex AR |\n| **FC-180** | `CC_ENHANCED_ROTATION_MAX_CONSECUTIVE` | 2 | RESERVED \u2014 bind before escrow launch | consecutive milestones | Maximum repeated assignments of the same inspector on Enhanced-tier releases | Annex AR |\n| **FC-181** | `CC_ENHANCED_ROTATION_COOLING_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | days | Cooling-off interval before an inspector may return to the same project at Enhanced tier | Annex AR |\n| **FC-182** | `CC_MAJOR_ROTATION_MAX_CONSECUTIVE` | 2 | RESERVED \u2014 bind before escrow launch | consecutive milestones | Maximum repeated assignments of the same inspector on Major-tier releases | Annex AR |\n| **FC-183** | `CC_MAJOR_ROTATION_COOLING_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | days | Cooling-off interval before an inspector may return to the same project at Major tier | Annex AR |\n| **FC-184** | `CC_SINGLE_SECTOR_BACKGROUND_CAP` | 2 | RESERVED \u2014 bind before escrow launch | fraction of active pool | Caps prior-employment concentration from any single sector inside the active inspector pool | Annex AR |\n| **FC-185** | `AT_CALORIC_STAPLE_STRATEGIC_FLOOR` | 1 | RESERVED \u2014 bind by TSP + Article VI ratification before activation | days of supply | Caloric staple strategic reserve floor; draft value 180 days | Annex AT \u00a7AT1 |\n| **FC-186** | `AT_ENERGY_STRATEGIC_FLOOR` | 1 | RESERVED \u2014 bind by TSP + Article VI ratification before activation | days of supply (peak-demand period) | Energy strategic reserve floor; draft value 90 days | Annex AT \u00a7AT1 |\n| **FC-187** | `AT_ESSENTIAL_MEDICINES_STRATEGIC_FLOOR` | 1 | RESERVED \u2014 bind by TSP + Article VI ratification before activation | days of supply | Essential medicines strategic reserve floor; draft value 365 days | Annex AT \u00a7AT1 |\n| **FC-188** | `AT_SINGLE_SUPPLIER_WATCH_THRESHOLD` | 2 | RESERVED \u2014 bind by TSP before activation | % of category consumption | Single-supplier Watch trigger; draft value 25% | Annex AT \u00a7AT2 |\n| **FC-189** | `AT_SINGLE_SUPPLIER_CRITICAL_THRESHOLD` | 2 | RESERVED \u2014 bind by TSP before activation | % of category consumption | Single-supplier Critical trigger; draft value 60% | Annex AT \u00a7AT2 |\n| **FC-190** | `AT_FOREIGN_CAPITAL_INFLOW_LIMIT` | 2 | RESERVED \u2014 bind by TSP + Article V review before activation | % of annual Flow issuance | Foreign capital inflow concentration ceiling; draft value 15% | Annex AT \u00a7AT4 |\n| **FC-191** | `AT_FOREIGN_CAPITAL_CONVERSION_WINDOW` | 2 | RESERVED \u2014 bind by TSP + Article V review before activation | days before demurrage activates | Foreign capital conversion window; draft value 30 days | Annex AT \u00a7AT4 |\n| **FC-192** | `AT_EXTRACTIVE_RECLASSIFICATION_WINDOW` | 2 | RESERVED \u2014 bind by TSP before activation | months | Observation window before extractive-pattern reclassification; draft value 12 months | Annex AT \u00a7AT5 |\n| **FC-193** | `AT_STAGE3_SUSPENSION_THRESHOLD` | 1 | RESERVED \u2014 bind by Article VI before activation | Article VI supermajority fraction | Stage 3 suspension ratification threshold; draft value two-thirds | Annex AT \u00a7AT5 |\n| **FC-194** | `AT_ESSENTIAL_FUEL_RESERVE_MIN` | 1 | RESERVED \u2014 bind before essential-sector activation | days by region and season | Essential fuel reserve minimum for refusal survivability; draft anchor 60-90 days | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-195** | `AT_ESSENTIAL_MEDICINE_STOCKPILE_MIN` | 1 | RESERVED \u2014 bind before medicine fallback activation | days by CSM medicine category | Essential medicine stockpile floor for refusal survivability; draft anchor 90-180 days pending clinical list and expiry model | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-196** | `AT_MAX_ESSENTIAL_SUPPLIER_CONCENTRATION` | 1 | RESERVED \u2014 bind before launch | % of regional essential throughput | Maximum supplier concentration before mandatory fallback/diversification review; draft anchor 25% | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-197** | `AT_PUBLIC_FALLBACK_ACTIVATION_DEADLINE` | 1 | RESERVED \u2014 bind before activation | hours / days | Deadline for public/cooperative/treaty fallback activation after essential-sector interruption; draft anchor 72h critical / 14d managed transition | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-198** | `AT_PROCUREMENT_CONCENTRATION_THRESHOLD` | 2 | RESERVED \u2014 bind before essential-sector procurement launch | % of essential category spend | Review/remediation thresholds for procurement concentration; draft anchor review >30%, mandatory remediation >40% | Annex AT; Capture Dashboard Specification |\n| **FC-199** | `AT_PBM_INTERMEDIARY_SEPARATION_THRESHOLD` | 1 | RESERVED \u2014 bind before medicine-access launch | % of cross-owned claims or dispensing volume | Separation/firewall trigger for PBM-style intermediaries; draft anchor review >10%, mandatory firewall >20% | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-200** | `AT_CRITICAL_LOGISTICS_REDUNDANCY_FLOOR` | 1 | RESERVED \u2014 bind before logistics-dependent launch | independent routes / operators | Minimum independent logistics redundancy for essential regions; draft anchor two independent routes and operators | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-201** | `AT_ESSENTIAL_DATA_CLAIMS_PORTABILITY_DEADLINE` | 2 | RESERVED \u2014 bind before medicine/logistics fallback activation | hours / days | Deadline for emergency and full transition export of essential records, claims, formularies, and routing data; draft anchor 24h emergency / 30d full package | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-YT1** | `CSM_FAILURE_COUNT_THRESHOLD` | 2 | 3 | verified delivery failures per jurisdictional cluster per 30-day window | Pattern-detection trigger for H-3 refounding review initiation. Applies as a raw cluster count independently of FC-071's per-population rate (3 per 10,000 residents per 30 days); both thresholds apply concurrently. \"Verified delivery failure\" requires confirmation by at least one Tier-3 physical-sampling oracle node per ANNEX_Y \u00a7Y1. Federated Ombuds verification of this value required before INV-LAUNCH-1 clears. Pre-launch blocking gate. | ANNEX_Y \u00a7Y4 |\n| **FC-YT2** | `CSM_SURVIVAL_RESERVE_DAYS` | 2 | 90 | days of CSM coverage per enrolled population, by jurisdiction and essential category | CSM-specific reserve gate. Complements the general resilience reserve FC-070 (45 days); both must be independently satisfied. This value is the binding survival-floor-specific pre-launch gate. Federated Ombuds verification of this value required before INV-LAUNCH-1 clears. Pre-launch blocking gate. | ANNEX_Y \u00a7Y7 |\n\n---\n\n## Derivation Notes\n\n**FC-020 (`PROTECTED_PAUSE_FLOOR = 0.30`).** Sim Test 7 in `docs/ADVERSARIAL_AUDIT.md` established:\n- Caregiver-at-2%-contribution Voice equilibrium = 0.13 units.\n- Standard-at-10%-contribution Voice equilibrium = 0.67 units.\n- Protected Pause at 20% decay dampening = 4.44 units (exploitable if set there).\n\nFloor value must satisfy: above the exposed-caregiver equilibrium (0.13) to provide real voice; below the standard-contributor equilibrium (0.67) to prevent pause-as-exploit. **0.30** sits \u224833% of the way up this band \u2014 meaningful protection without civic premium for pausing.\n\n**FC-060 (`VOICE_SECTOR_CEILING = 0.20`).** From Sim Test 4: for N=5 sectors with ceiling c, supermajority (\u22652/3) is achievable via k-sector coalition when k\u00b7c \u2265 2/3. Setting c = 0.20, maximum 3-sector coalition = 0.60 < 0.667 \u2014 no 3-sector supermajority possible. Preserves margin against measurement imprecision.\n\n**FC-030 / FC-031 (Oracle parameters).** BFT theorem: n \u2265 3f+1 for tolerance of f faulty nodes. At f = 1: n \u2265 4. **FC-030 = 5** provides margin of one node above the floor, tolerates single-node loss without immediately dropping below BFT. FC-031 = 3 methodology classes guarantees diversity even when one class is simultaneously compromised.\n\n**FC-040 (`BRIBE_DETERRENCE_MULTIPLIER = 5.0`).** Sim Test 5: at 85% detection, penalty = 0.18\u00d7 gain is break-even. Setting penalty = 5\u00d7 gain produces expected value = \u2212(0.85 \u00d7 5 \u2212 0.15 \u00d7 1) \u00d7 gain = \u22124.1\u00d7 gain. Margin of safety permits detection probability as low as 25% before deterrent fails.\n\n**FC-110 / FC-111 (Tier 1 amendment parameters).** Distributed key-holder count of 9 balances resilience against loss (can lose 2 without breakage) versus capture resistance (must capture \u22653 to prevent amendment, \u22657 to force amendment). Timelock of 180 days ensures any captured supermajority survives at least one political cycle before amendment effect \u2014 enables reversal proposal by uncaptured parties.\n\n---\n\n---\n\n## FC-YT1 and FC-YT2 \u2014 Survival Floor Activation Gate Parameters\n\n**FC-YT1 \u2014 CSM Delivery Failure Pattern-Detection Trigger**\n- **Value:** 3 verified delivery failures per jurisdictional cluster within any 30-day window\n- **Tier:** Tier 2 / pre-launch blocking gate\n- **Authority:** Required by INV-LAUNCH-1 and ANNEX_Y \u00a7Y4 before any operational phase enrolling real persons\n- **Ombuds verification required:** Yes \u2014 the Federated Ombuds must publish the confirmed numeric value before this gate clears\n- **Relationship to FC-071:** FC-071 defines the per-population rate (3 per 10,000 residents per 30 days) that triggers cluster-level review. FC-YT1 is the raw count threshold that triggers H-3 refounding review initiation regardless of per-population rate. Both apply independently.\n- **\"Verified delivery failure\"** means a failure confirmed by at least one Tier-3 (physical sampling) oracle node per ANNEX_Y \u00a7Y1.\n\n**FC-YT2 \u2014 90-Day CSM Reserve Requirement**\n- **Value:** 90 days \u00d7 CSM \u00d7 enrolled population, by jurisdiction and essential category\n- **Tier:** Tier 2 / pre-launch blocking gate\n- **Authority:** Required by INV-LAUNCH-1 and ANNEX_Y \u00a7Y7 before any operational phase enrolling real persons\n- **Ombuds verification required:** Yes \u2014 same requirement as FC-YT1\n- **Relationship to FC-070:** FC-070 binds the general resilience reserve window at 45 days. FC-YT2 binds the CSM-specific reserve at 90 days. These are complementary: the general reserve (45 days) is an operational floor; the CSM reserve (90 days) is the survival-floor-specific gate. Both must be met; FC-YT2 is the binding pre-launch gate.\n\n---\n\n## Hash Commitment\n\nAt founding, the SHA-256 hash of this file (computed with the canonical line-ending, UTF-8 encoding, and without trailing whitespace normalization) is committed to the ledger genesis block. Subsequent amendments produce new hash commitments with version-chained history per `/architecture/drift_chain.md`.\n\n**Genesis commitment:** TBD at founding event. Computed by the founding coalition's multi-signature process.\n\n---\n\n## Amendment Log\n\n| Version | Date | Change | Authority |\n|:---|:---|:---|:---|\n| 1.0 | 2026-04-18 | Initial publication of the founding numerical lock file | Founding release |\n\n**End of Founding Commitments.**\n",
+      "content": "# Founding Commitments \u2014 Numerical Lock File\n\n**Status:** Tier 1 / Tier 2 mixed (per row). Published as single authoritative source.\n**Purpose:** Every founding parameter referenced across the Humane Constitution, White Paper, Threat Register, Patch Log, and annexes is either bound to a value here or assigned a reserved FC identifier here until the activation gate that binds it.\n**Amendment:** Tier 1 commitments require H-3 refounding authority. Tier 2 commitments follow the ordinary amendment ladder with public redlines. Tier 3 commitments follow ordinary reasonableness review.\n\n---\n\n## Commitment Table\n\n| ID | Name | Tier | Value | Unit | Rationale | Affected docs |\n|:---|:---|:---:|:---|:---|:---|:---|\n| **FC-001** | `ACCEPTABLE_MEASUREMENT_ERROR_FOOD` | 1 | \u00b15% | confidence interval | Below this, capacity-based Essential Access issuance risks physical shortfall; above this, over-issuance risk dominates | Article III, Annex AL |\n| **FC-002** | `ACCEPTABLE_MEASUREMENT_ERROR_WATER` | 1 | \u00b13% | confidence interval | Water buffers are thinner than food; tighter error bound required | Article III, Annex AL |\n| **FC-003** | `ACCEPTABLE_MEASUREMENT_ERROR_SHELTER` | 2 | \u00b110% | confidence interval | Shelter capacity is structurally slower-moving; wider bound acceptable | Article III, Annex AL |\n| **FC-004** | `ACCEPTABLE_MEASUREMENT_ERROR_ENERGY` | 1 | \u00b15% | confidence interval | Energy shortfall cascades to other categories; same bound as food | Article III, Annex AL |\n| **FC-005** | `ACCEPTABLE_MEASUREMENT_ERROR_MEDICINE` | 1 | \u00b15% | confidence interval (supply days) | Medicine shortfall is non-substitutable; error bound tight | Article III, Annex AL, Annex Y |\n| **FC-010** | `ACCEPTABLE_LEAKAGE_THRESHOLD` | 2 | 3% / annum (routine); 7% / annum (systemic review trigger) | fraction of Essential Access allocations informally converted | T-001 P-001 requires an operational target; 3% is measurable and enforceable; 7% triggers systemic-architecture review | Annex AB2, Annex AJ, Threat Register T-001 |\n| **FC-020** | `PROTECTED_PAUSE_FLOOR` | 1 | 0.30 | Voice units | Sim Test 7 showed range (0.13, 0.67) required; 0.30 is mid-range providing protection without creating pause-as-exploit | Article VI, Patch P-009 |\n| **FC-030** | `ORACLE_N_MIN` | 1 | 5 | oracle nodes per cohort | BFT floor for f=1 Byzantine nodes; PRD-003 requirement | Article III, Annex AL, SPECIFICATIONS.md |\n| **FC-031** | `METHODOLOGY_CLASS_MIN` | 1 | 3 | distinct methodology classes per cohort | Finding 7 requirement for structural diversity | Annex AL, Patch P-017 |\n| **FC-032** | `ORACLE_PAIRWISE_CORRELATION_MAX` | 1 | 0.30 | correlation coefficient (Pearson, on historical error series) | Pairs above this threshold are not structurally independent regardless of formal classification | Annex AL |\n| **FC-033** | `ORACLE_ADVERSARIAL_SEATS_MIN` | 1 | 1 | per cohort | P-014 adversarial-panel analogue; structural requirement | Annex AL, Annex AI |\n| **FC-040** | `BRIBE_DETERRENCE_MULTIPLIER` | 2 | 5.0 | multiple of detected gain | At \u226585% detection, penalty = 5\u00d7 gain produces expected value \u2265 4.25\u00d7 gain \u2014 decisively deterrent | Annex AJ, Patch P-001 |\n| **FC-041** | `DETECTION_PROBABILITY_ASSUMED` | 2 | 0.85 | probability | Assumed detection rate for deterrence calculation; subject to pilot verification | Annex AJ |\n| **FC-050** | `FLOW_DEMURRAGE_RATE` | 2 | SUPERSEDED \u2014 dormant \u00a7D9 backstop parameter; no routine demurrage exists (ANNEX_D \u00a7D9.1). Former baseline 0.5%/month retained for the record; binds only if a \u00a7D9 revival patch passes its own evidence and amendment process | formerly: idle balance above exemption | The routine idle-balance demurrage model was replaced corpus-wide by Commons Return and Universal Stake (P-066, ANNEX_D). This ID is retained for numbering stability and would parametrize only the dormant \u00a7D9 backstop, which no interpretation may activate | ANNEX_D \u00a7D9 (dormant); formerly Article V, `docs/SPECIFICATIONS.md` |\n| **FC-051** | `FLOW_DEMURRAGE_REVIEW_CORRIDOR` | 3 | SUPERSEDED \u2014 dormant \u00a7D9 backstop parameter (see FC-050). Former corridor \u00b10.25%/mo retained for the record | formerly: post-first-year adjustment band | Calibration corridor for the superseded routine demurrage; dormant with FC-050 | ANNEX_D \u00a7D9 (dormant); formerly Article V, `docs/SPECIFICATIONS.md` |\n| **FC-052** | `FLOW_IDLE_THRESHOLD_DAYS` | 2 | SUPERSEDED \u2014 dormant \u00a7D9 backstop parameter (see FC-050). Former proposed value 30 days retained for the record | formerly: days | Idle-balance dwell time for the superseded routine demurrage; dormant with FC-050 | ANNEX_D \u00a7D9 (dormant); formerly Article V, `docs/SPECIFICATIONS.md` |\n| **FC-053** | `FLOW_RETIREMENT_EPSILON` | 2 | PROPOSED VALUE: 0.01 Flow \u2014 bind before activation | Flow | Minimum residual Flow balance below which balances retire from circulation. Balances below this threshold are functionally zero and should retire to prevent ledger bloat; 0.01 Flow is well below any meaningful purchasing power | Article V, `docs/SPECIFICATIONS.md` |\n| **FC-054** | `PFCR_DEMURRAGE_ROUTING_SHARE` | 2 | SUPERSEDED \u2014 dormant \u00a7D9 backstop parameter (see FC-050). Former proposed split 0.65/0.35 retained for the record; Commons Return receipts route per ANNEX_D \u00a7D5 lockbox rules instead | formerly: fraction of demurrage charge | Routing split for the superseded routine demurrage; public-finance routing now lives in ANNEX_D \u00a7D5 (Commons Return), not in a demurrage charge | ANNEX_D \u00a7D9 (dormant), ANNEX_D \u00a7D5; formerly Article V, `docs/SPECIFICATIONS.md` |\n| **FC-055** | `FLOW_ISSUANCE_CEILING_FUNCTION` | 1 | RESERVED \u2014 bind before public issuance beyond pilot | formula | Binds the multiplier function relating verified productive commitments to maximum Flow in circulation | Article V, `docs/SPECIFICATIONS.md` |\n| **FC-056** | `ESSENTIAL_ACCESS_ENHANCED_ALLOCATION_RULE` | 2 | PROPOSED VALUE: 1.5\u00d7 CSM floor for documented hardship; 2.0\u00d7 CSM floor for medical necessity; maximum 90 days per rolling year without CRP review \u2014 bind before activation | rule / multiplier | Defines the lawful path above the CSM floor for hardship, emergency, or exceptional basket access. 1.5\u00d7 covers enhanced dietary, mobility, or care needs; 2.0\u00d7 covers medically necessary requirements; 90-day rolling cap prevents enhanced allocation from becoming baseline without review | Article III, `docs/SPECIFICATIONS.md` |\n| **FC-057** | `ESSENTIAL_ACCESS_VALIDITY_WINDOW_HOURS` | 2 | 72 | hours | Locks the initial Essential Access expiry window to the current constitutional baseline | Article III, `docs/SPECIFICATIONS.md` |\n| **FC-058** | `CSM_BASKET_AND_REGIONAL_ADJUSTMENT_RULE` | 1 | RESERVED \u2014 bind before regional launch | basket definition + adjustment formula | Constitutional Survival Minimum must publish its basket composition and regional-variation rule before activation across heterogeneous localities | Article III, `docs/SPECIFICATIONS.md`, Annex Y |\n| **FC-060** | `VOICE_SECTOR_CEILING` | 1 | 0.20 | fraction of total Voice | Sim Test 4: 3-sector coalition at 25% ceiling achieves 75% supermajority; 20% ceiling caps 3-sector to 60%, below supermajority threshold | Article VI, Patch P-008 |\n| **FC-061** | `VOICE_CAP_PER_PERSON_PER_CYCLE` | 2 | 300 | raw Voice units | Preserves existing Humane Constitution \u00a7VIII baseline | Article VI |\n| **FC-062** | `VOICE_DECAY_RATE` | 2 | 0.15 / day | exponential decay | Existing `model_outline.py` parameter, preserved | Article VI |\n| **FC-063** | `SERVICE_RECORD_DECAY_RATE_NORMAL` | 2 | RESERVED \u2014 bind before Service Record activation | fraction per day | Normal slow-decay rate for Service Record outside Protected Pause or grace-period exceptions | Article VI, `docs/SPECIFICATIONS.md` |\n| **FC-070** | `RESERVE_WINDOW_DAYS` | 1 | 45 | days of supply \u00d7 population at CSM level | Resilience reserves (Article III) sized for CSM \u00d7 population \u00d7 45 days. Exceeds L3 Emergency trigger by 6\u00d7 to prevent reserve-exhaustion cascade | Article III, Annex Y |\n| **FC-071** | `ACCEPTABLE_CSM_FAILURE_THRESHOLD` | 1 | 3 failures per 10,000 residents per 30 days | cluster rate | Above this, cluster enters Scarcity L3 regardless of oracle status | Annex Y \u00a7Y4 |\n| **FC-072** | `SHARED_STOREHOUSE_SCARCITY_ACTIVATION_THRESHOLD_RULE` | 1 | PROPOSED VALUE: Activation when oracle-confirmed supply for any CSM category falls below 85% of the 45-day reserve floor (FC-070) for 3 consecutive measurement cycles, OR when physical sampling (Annex AL \u00a7AL-COST) shows supply below 90% of CSM floor for any single cycle \u2014 bind before activation | category threshold rule | Shared Storehouse may not activate on vague scarcity claims; each essential category must publish its activation threshold rule before emergency overlay becomes operative. 85% of the 45-day reserve provides a 38-day buffer before genuine scarcity; 3-cycle confirmation prevents single-measurement noise from triggering rationing; physical sampling override prevents oracle manipulation from blocking activation | Article III, `docs/SPECIFICATIONS.md`, Annex Y |\n| **FC-080** | `ATTESTATION_STAKE_RATIO` | 2 | 0.20 | fraction of attestor's own Voice and Service Record, proportional to claim size | Attestor risks 20% of their civic balance when attesting; calibrated for meaningful skin-in-the-game without destroying livelihoods on single errors | Article VI, Proposal 9 files |\n| **FC-081** | `ATTESTATION_AUDIT_WINDOW` | 2 | 365 | days | Attestation slashing window after false-claim finding; 1 year matches civic-cycle duration | Article VI |\n| **FC-082** | `ATTESTATION_GRAPH_DENSITY_THRESHOLD` | 2 | 0.40 | mutual cross-attestation ratio | Attestor networks above this density triggers automatic review; calibrated against null-model random-graph baseline | Article VI |\n| **FC-083** | `ATTESTATION_REPUTATION_CREDIT_CAP` | 2 | 2 | civic cycles of successful attestation reputation credit | Caps attestation-derived reputation so reliable attestors become legible civic resources without creating a new status-currency surface | Article VI, Annex AS |\n| **FC-090** | `OMBUDS_SUBCOUNT_MIN` | 1 | 5 | sub-Ombuds nodes | Federated Ombuds (Proposal 8) structural minimum; BFT-equivalent for institutional decisions | Annex AI |\n| **FC-091** | `OMBUDS_SUPERMAJORITY_THRESHOLD` | 1 | 4/5 | affirmative sub-Ombuds | Protocol-level decisions require \u22654 of 5 sub-Ombuds affirmative | Annex AI |\n| **FC-092** | `OMBUDS_TERM_DAYS` | 2 | 730 | days (2 years) | Sub-Ombuds term length; staggered across 5 seats | Annex AI |\n| **FC-100** | `ORACLE_QUORUM_LOSS_RESTORATION_WINDOW` | 1 | 14 | days of verification after quorum restoration | Proposal 6 crisis fallback \u2014 prevents flash-recovery from being exploited as normalization pathway | Article III fallback files |\n| **FC-110** | `TIER1_AMENDMENT_SIGNATURES_MIN` | 1 | 7 of 9 | cryptographic signatures from dispersed key-holders | M-of-N threshold for Tier 1 amendment per Proposal 1; 9 geographically distributed holders; 7 required; allows 2 captured/lost without breakage | `/architecture/amendment_protocol.md` |\n| **FC-111** | `TIER1_AMENDMENT_TIMELOCK_DAYS` | 1 | 180 | days | Minimum wall-clock delay between proposal and effect; survives political cycles | `/architecture/amendment_protocol.md` |\n| **FC-120** | `EXIT_SUPERMAJORITY_THRESHOLD` | 1 | 2/3 | fraction of resident personhood | Required to initiate jurisdictional exit under the Founding Order; prevents transient pluralities from triggering structural discontinuity | `/founding/order/exit_protocol.md` |\n| **FC-121** | `EXIT_UNWIND_DAYS` | 1 | 730 | days (2 years) | Graceful-exit unwind window; Essential Access continuity preserved for individuals during unwind | `/founding/order/exit_protocol.md` |\n| **FC-122** | `SUBSIDIARITY_SCALES` | 1 | household / neighborhood (\u2264500) / locality (\u22645,000) / region (\u2264500,000) / federation | personhood counts | Scale-tier definitions for subsidiarity routing | `/founding/order/jurisdictional_scales.md` |\n| **FC-140** | `AED_ESSENTIAL_ACCESS_FRAUD_BAND` | 2 | target \u22642% / upper bound \u22645% / trigger \u22653% per quarter | quarterly fraud tuple | Essential Access identity fraud consumes physical survival supply directly; its target, upper tolerance, and audit trigger must be public before scale-up. Target anchored below the SNAP program operational error rate (2\u20133% per USDA studies), the closest operational analogue; upper bound set at 5% to force systemic review before fraud reaches GAO-documented government-program false-acceptance range. | Annex AK, Threat_Register.md |\n| **FC-141** | `AED_VOICE_FRAUD_BAND` | 2 | target \u22643% / upper bound \u22647% / trigger \u22655% per quarter | quarterly fraud tuple | Voice fraud distorts agenda-setting and must publish its tolerated error band before activation. Somewhat looser than Essential Access (FC-140) because Voice fraud does not consume physical survival goods; consistent with democratic-participation error tolerances in comparable systems. | Annex AK, Threat_Register.md |\n| **FC-142** | `AED_SERVICE_RECORD_FRAUD_BAND` | 2 | target \u22645% / upper bound \u226410% / trigger \u22657% per quarter | quarterly fraud tuple | Service Record fraud distorts eligibility and role selection; requires a published tolerated-error band. Looser than Voice (FC-141) because Service Record fraud affects longer-cycle eligibility decisions rather than immediate agenda-setting; consistent with public-employment verification tolerances. | Annex AK, Threat_Register.md |\n| **FC-143** | `AED_EXCLUSION_BAND_DISPLACED` | 2 | target \u22643% / upper bound \u22646% / trigger \u22654% per quarter | quarterly exclusion tuple | Displaced persons are a first-order identity-access vulnerability class and require explicit exclusion commitments. UNHCR biometric exclusion monitoring targets <5% for displaced populations; tighter upper bound (6%) chosen because displaced persons have no alternative access route. | Annex AK, Threat_Register.md |\n| **FC-144** | `AED_EXCLUSION_BAND_UNDOCUMENTED` | 2 | target \u22645% / upper bound \u22648% / trigger \u22656% per quarter | quarterly exclusion tuple | Undocumented persons are a first-order identity-access vulnerability class and require explicit exclusion commitments. Documentation barriers produce a structurally higher baseline exclusion rate; trigger set at 6% to force institutional review before the rate reaches double digits. | Annex AK, Threat_Register.md |\n| **FC-145** | `AED_EXCLUSION_BAND_DIGITALLY_FRAGILE` | 2 | target \u22645% / upper bound \u22648% / trigger \u22656% per quarter | quarterly exclusion tuple | Digitally fragile persons require a separately published exclusion band so access failures are not hidden in aggregate success rates. Structural access barriers (no smartphone, limited literacy, disability) produce a higher baseline analogous to undocumented persons; 8% hard ceiling requires mandatory architecture review before that threshold is reached. | Annex AK, Threat_Register.md |\n| **FC-146** | `AED_EXCLUSION_BAND_RECOVERY_CRISIS` | 2 | RESERVED \u2014 bind target / upper bound / trigger before first scale-up gate | quarterly exclusion tuple | Crisis and recovery cases are structurally easy to exclude and require their own exclusion commitments | Annex AK |\n| **FC-147** | `AED_EXCLUSION_BAND_OVERALL_POPULATION` | 2 | RESERVED \u2014 bind target / upper bound / trigger before first scale-up gate | quarterly exclusion tuple | Aggregate exclusion remains a governing signal even when vulnerable-population bands are tracked separately | Annex AK |\n| **FC-148** | `AED_EXCLUSION_PRIORITY_MULTIPLIER` | 2 | PROPOSED VALUE: 1.5 \u2014 bind before activation | multiple of exclusion target | Governs when exclusion reduction takes priority over further fraud tightening in the AED trade-off rule. When exclusion reduction and fraud tightening trade off, reducing exclusion is weighted 1.5\u00d7 more important; reflects the asymmetric harm of wrongful exclusion (survival floor loss) vs. wrongful inclusion (resource dilution) | Annex AK |\n| **FC-149** | `AED_FRAUD_PRIORITY_BOUND` | 2 | PROPOSED VALUE: 5% (= FC-140 Essential Access upper bound) \u2014 bind before activation | fraud upper-bound reference | Governs when fraud reduction takes priority over further inclusion loosening in the AED trade-off rule. When Essential Access fraud is below its upper bound (5%), further fraud reduction yields diminishing returns and inclusion improvement should take priority; at or above 5%, fraud reduction takes priority | Annex AK |\n| **FC-150** | `AED_SIMULTANEOUS_BREACH_DEFAULT_PREFERENCE` | 2 | PROPOSED VALUE: exclusion-first \u2014 bind before activation | exclusion-first / fraud-first | Publicly locks the default preference when both fraud and exclusion exceed their upper bounds simultaneously. When both fraud and exclusion rates breach their upper bounds simultaneously, reducing exclusion takes priority \u2014 consistent with the survival floor principle that wrongful exclusion is the worse error | Annex AK |\n| **FC-160** | `CC_STANDARD_RELEASE_MAX` | 2 | RESERVED \u2014 bind before escrow launch | Flow | Upper bound for single-verifier milestone releases in contract-commitment architecture | Annex AR |\n| **FC-161** | `CC_ENHANCED_RELEASE_MAX` | 2 | RESERVED \u2014 bind before escrow launch | Flow | Upper bound for dual-verifier milestone releases; releases above this threshold enter Major tier | Annex AR |\n| **FC-162** | `CC_MAJOR_RELEASE_PERCENT_FLOOR` | 2 | RESERVED \u2014 bind before escrow launch | fraction of total project value | Anti-fragmentation rule that forces Major-tier verification above a published share of project value regardless of absolute Flow amount | Annex AR |\n| **FC-163** | `CC_ESSENTIAL_ACCESS_DEPLOYMENT_WINDOW` | 2 | RESERVED \u2014 bind before escrow launch | days | Maximum idle escrow hold for Essential Access delivery programmes before CRP review triggers | Annex AR |\n| **FC-164** | `CC_STANDARD_DEPLOYMENT_WINDOW` | 2 | RESERVED \u2014 bind before escrow launch | days | Maximum idle escrow hold for standard infrastructure before CRP review triggers | Annex AR |\n| **FC-165** | `CC_LARGE_PROJECT_VALUE_THRESHOLD` | 2 | RESERVED \u2014 bind before escrow launch | Flow contracted value | Published breakpoint above which projects count as large-scale or novel for deployment-window purposes | Annex AR |\n| **FC-166** | `CC_LARGE_SCALE_DEPLOYMENT_WINDOW` | 2 | RESERVED \u2014 bind before escrow launch | days | Maximum idle escrow hold for large-scale or first-of-type infrastructure before CRP review triggers | Annex AR |\n| **FC-167** | `CC_CRP_EXPLANATION_DEADLINE` | 2 | RESERVED \u2014 bind before escrow launch | days after trigger | Deadline for commissioning authorities to explain deployment-window overruns to CRP | Annex AR |\n| **FC-168** | `CC_CRP_DECISION_DEADLINE` | 2 | RESERVED \u2014 bind before escrow launch | days after trigger | Deadline for CRP to issue extension / support / escalation decisions on deployment-window review | Annex AR |\n| **FC-169** | `CC_CRP_EXTENSION_WINDOW` | 2 | RESERVED \u2014 bind before escrow launch | days | Additional time granted when CRP confirms legitimate procurement complexity | Annex AR |\n| **FC-170** | `CC_CRP_PUBLICATION_DEADLINE` | 2 | RESERVED \u2014 bind before escrow launch | days after decision | Deadline for publishing CRP deployment-window review outcomes | Annex AR |\n| **FC-171** | `CC_FORCE_MAJEURE_SELF_CERT_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | cumulative days per project | Maximum freeze duration available on contractor self-certification before higher verification tiers apply | Annex AR |\n| **FC-172** | `CC_FORCE_MAJEURE_THIRD_PARTY_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | cumulative days per project | Maximum freeze duration available on third-party certification before panel review applies | Annex AR |\n| **FC-173** | `CC_FORCE_MAJEURE_PANEL_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | cumulative days per project | Hard cap for force-majeure freeze duration before restructuring review replaces further freeze eligibility | Annex AR |\n| **FC-174** | `CC_ESSENTIAL_ACCESS_FORCE_MAJEURE_DURATION_CAP` | 2 | RESERVED \u2014 bind before escrow launch | fraction of contracted project duration | Prevents short Essential Access delivery projects from using an absolute freeze cap that functionally nullifies the deployment-delay consequence and Annex D source-base review | Annex AR |\n| **FC-175** | `CC_INSPECTOR_POOL_MIN_PILOT` | 2 | RESERVED \u2014 bind before escrow launch | qualified inspectors | Minimum inspector pool size for pilot / single-municipality deployment | Annex AR |\n| **FC-176** | `CC_INSPECTOR_POOL_MIN_REGIONAL` | 2 | RESERVED \u2014 bind before escrow launch | qualified inspectors | Minimum inspector pool size for regional deployment | Annex AR |\n| **FC-177** | `CC_INSPECTOR_POOL_MIN_NATIONAL_PER_REGION` | 2 | RESERVED \u2014 bind before escrow launch | qualified inspectors per region | Minimum inspector pool size for national / multi-regional deployment | Annex AR |\n| **FC-178** | `CC_STANDARD_ROTATION_MAX_CONSECUTIVE` | 2 | RESERVED \u2014 bind before escrow launch | consecutive milestones | Maximum repeated assignments of the same inspector on Standard-tier releases | Annex AR |\n| **FC-179** | `CC_STANDARD_ROTATION_COOLING_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | days | Cooling-off interval before an inspector may return to the same project at Standard tier | Annex AR |\n| **FC-180** | `CC_ENHANCED_ROTATION_MAX_CONSECUTIVE` | 2 | RESERVED \u2014 bind before escrow launch | consecutive milestones | Maximum repeated assignments of the same inspector on Enhanced-tier releases | Annex AR |\n| **FC-181** | `CC_ENHANCED_ROTATION_COOLING_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | days | Cooling-off interval before an inspector may return to the same project at Enhanced tier | Annex AR |\n| **FC-182** | `CC_MAJOR_ROTATION_MAX_CONSECUTIVE` | 2 | RESERVED \u2014 bind before escrow launch | consecutive milestones | Maximum repeated assignments of the same inspector on Major-tier releases | Annex AR |\n| **FC-183** | `CC_MAJOR_ROTATION_COOLING_DAYS` | 2 | RESERVED \u2014 bind before escrow launch | days | Cooling-off interval before an inspector may return to the same project at Major tier | Annex AR |\n| **FC-184** | `CC_SINGLE_SECTOR_BACKGROUND_CAP` | 2 | RESERVED \u2014 bind before escrow launch | fraction of active pool | Caps prior-employment concentration from any single sector inside the active inspector pool | Annex AR |\n| **FC-185** | `AT_CALORIC_STAPLE_STRATEGIC_FLOOR` | 1 | RESERVED \u2014 bind by TSP + Article VI ratification before activation | days of supply | Caloric staple strategic reserve floor; draft value 180 days | Annex AT \u00a7AT1 |\n| **FC-186** | `AT_ENERGY_STRATEGIC_FLOOR` | 1 | RESERVED \u2014 bind by TSP + Article VI ratification before activation | days of supply (peak-demand period) | Energy strategic reserve floor; draft value 90 days | Annex AT \u00a7AT1 |\n| **FC-187** | `AT_ESSENTIAL_MEDICINES_STRATEGIC_FLOOR` | 1 | RESERVED \u2014 bind by TSP + Article VI ratification before activation | days of supply | Essential medicines strategic reserve floor; draft value 365 days | Annex AT \u00a7AT1 |\n| **FC-188** | `AT_SINGLE_SUPPLIER_WATCH_THRESHOLD` | 2 | RESERVED \u2014 bind by TSP before activation | % of category consumption | Single-supplier Watch trigger; draft value 25% | Annex AT \u00a7AT2 |\n| **FC-189** | `AT_SINGLE_SUPPLIER_CRITICAL_THRESHOLD` | 2 | RESERVED \u2014 bind by TSP before activation | % of category consumption | Single-supplier Critical trigger; draft value 60% | Annex AT \u00a7AT2 |\n| **FC-190** | `AT_FOREIGN_CAPITAL_INFLOW_LIMIT` | 2 | RESERVED \u2014 bind by TSP + Article V review before activation | % of annual Flow issuance | Foreign capital inflow concentration ceiling; draft value 15% | Annex AT \u00a7AT4 |\n| **FC-191** | `AT_FOREIGN_CAPITAL_CONVERSION_WINDOW` | 2 | RESERVED \u2014 bind by TSP + Article V review before activation | days before public-return review escalates | Foreign capital conversion window; draft value 30 days | Annex AT \u00a7AT4 |\n| **FC-192** | `AT_EXTRACTIVE_RECLASSIFICATION_WINDOW` | 2 | RESERVED \u2014 bind by TSP before activation | months | Observation window before extractive-pattern reclassification; draft value 12 months | Annex AT \u00a7AT5 |\n| **FC-193** | `AT_STAGE3_SUSPENSION_THRESHOLD` | 1 | RESERVED \u2014 bind by Article VI before activation | Article VI supermajority fraction | Stage 3 suspension ratification threshold; draft value two-thirds | Annex AT \u00a7AT5 |\n| **FC-194** | `AT_ESSENTIAL_FUEL_RESERVE_MIN` | 1 | RESERVED \u2014 bind before essential-sector activation | days by region and season | Essential fuel reserve minimum for refusal survivability; draft anchor 60-90 days | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-195** | `AT_ESSENTIAL_MEDICINE_STOCKPILE_MIN` | 1 | RESERVED \u2014 bind before medicine fallback activation | days by CSM medicine category | Essential medicine stockpile floor for refusal survivability; draft anchor 90-180 days pending clinical list and expiry model | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-196** | `AT_MAX_ESSENTIAL_SUPPLIER_CONCENTRATION` | 1 | RESERVED \u2014 bind before launch | % of regional essential throughput | Maximum supplier concentration before mandatory fallback/diversification review; draft anchor 25% | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-197** | `AT_PUBLIC_FALLBACK_ACTIVATION_DEADLINE` | 1 | RESERVED \u2014 bind before activation | hours / days | Deadline for public/cooperative/treaty fallback activation after essential-sector interruption; draft anchor 72h critical / 14d managed transition | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-198** | `AT_PROCUREMENT_CONCENTRATION_THRESHOLD` | 2 | RESERVED \u2014 bind before essential-sector procurement launch | % of essential category spend | Review/remediation thresholds for procurement concentration; draft anchor review >30%, mandatory remediation >40% | Annex AT; Capture Dashboard Specification |\n| **FC-199** | `AT_PBM_INTERMEDIARY_SEPARATION_THRESHOLD` | 1 | RESERVED \u2014 bind before medicine-access launch | % of cross-owned claims or dispensing volume | Separation/firewall trigger for PBM-style intermediaries; draft anchor review >10%, mandatory firewall >20% | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-200** | `AT_CRITICAL_LOGISTICS_REDUNDANCY_FLOOR` | 1 | RESERVED \u2014 bind before logistics-dependent launch | independent routes / operators | Minimum independent logistics redundancy for essential regions; draft anchor two independent routes and operators | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-201** | `AT_ESSENTIAL_DATA_CLAIMS_PORTABILITY_DEADLINE` | 2 | RESERVED \u2014 bind before medicine/logistics fallback activation | hours / days | Deadline for emergency and full transition export of essential records, claims, formularies, and routing data; draft anchor 24h emergency / 30d full package | Annex AT; Essential-Sector Refusal Test Package |\n| **FC-202** | `COMMONS_RETURN_SOURCE_BASES` | 1 | RESERVED \u2014 bind before CRUS activation | source-base list | Defines the allowed Commons Return bases: land/location value, natural resources, spectrum/airspace, monopoly licenses, unavoidable platform/network rents, high-value public concessions, and large succession transfers. Ordinary labor income, survival access, basic household exchange, ordinary working balances, ordinary household tools, protected below-threshold homes, and protected community/tribal/church holdings are excluded unless used as avoidance shells. The list is closed (INV-008): extending a base downward onto ordinary life is a Tier-1 amendment, never an administrative decision | Annex D, INVARIANTS.md INV-008, Parameter Calibration Register, Commons Return and Universal Stake Evidence Test Package |\n| **FC-203** | `COMMONS_RETURN_ASSESSMENT_RATE` | 2 | RESERVED \u2014 Tier-3 calibrated by source base before activation | rate schedule | Sets the Commons Return assessment rate by source base without making ordinary labor or survival access the funding base. Must test incidence, valuation hiding, external-capital arbitrage, and productive-stewardship effects before binding | Annex D, Parameter Calibration Register |\n| **FC-204** | `COMMONS_RETURN_PROTECTED_THRESHOLDS` | 2 | RESERVED \u2014 bind before CRUS activation | threshold schedule | Protects ordinary homes, ordinary tools, working balances, small stewardship, protected associations, and household exchange from assessment while preventing elite shelter through threshold splitting or avoidance shells | Annex D, Fairness Vignette Library, Parameter Calibration Register |\n| **FC-205** | `UNIVERSAL_STAKE_DISTRIBUTION_CADENCE` | 2 | RESERVED \u2014 bind before first distribution | cadence | Sets distribution timing for Universal Stake so households can rely on it and operators cannot time distributions as political reward or punishment. A distribution may be authorized only after the floor and its reserves are funded (INV-014) | Annex D, INVARIANTS.md INV-014, Claims and Evidence Register |\n| **FC-206** | `UNIVERSAL_STAKE_ELIGIBILITY_RULE` | 1 | RESERVED \u2014 bind before first distribution | eligibility rule | Keeps Universal Stake universal for members while prohibiting sale, assignment, garnishment, pledge, inheritance, membership purchase, survival-priority purchase, legal-standing purchase, office purchase, or Voice purchase | Annex D, Annex AK, Commons Return and Universal Stake Evidence Test Package |\n| **FC-207** | `CRUS_ANTI_CAPTURE_GATES` | 1 | RESERVED \u2014 bind before CRUS activation | gate bundle | Requires public accounting, no patronage discretion, no targeted political reward or punishment, data minimization, auditability, appeal rights, and ordinary-reader source reporting | Annex D, Capture Dashboard Specification, Abuse Case Library |\n| **FC-208** | `CRUS_PUBLIC_LOCKBOX_RESERVE_RULE` | 2 | RESERVED \u2014 bind before fund routing | reserve/draw rule | Defines reserve, draw, passive fund, and public-accounting rules for any lockbox or social wealth fund receiving Commons Return. Prevents fund managers from becoming patronage allocators or political investors | Annex D, Parameter Calibration Register |\n| **FC-209** | `CRUS_APPEAL_PATH` | 1 | RESERVED \u2014 bind before assessment or distribution | appeal path | Gives assessed source holders and excluded stake claimants a human appeal without allowing high-value actors to stall assessment through procedural delay | Annex D, Federated Ombuds, Claims and Evidence Register |\n| **FC-210** | `CRUS_REVIEW_CADENCE` | 2 | RESERVED \u2014 bind before CRUS activation | review cadence | Sets scheduled review of incidence, eligibility, valuation, source bases, distribution, reserves, and capture metrics. Missed cadence or missing data is itself a review failure | Annex D, Capture Dashboard Specification, Pilot Evidence Roadmap |\n| **FC-YT1** | `CSM_FAILURE_COUNT_THRESHOLD` | 2 | 3 | verified delivery failures per jurisdictional cluster per 30-day window | Pattern-detection trigger for H-3 refounding review initiation. Applies as a raw cluster count independently of FC-071's per-population rate (3 per 10,000 residents per 30 days); both thresholds apply concurrently. \"Verified delivery failure\" requires confirmation by at least one Tier-3 physical-sampling oracle node per ANNEX_Y \u00a7Y1. Federated Ombuds verification of this value required before INV-LAUNCH-1 clears. Pre-launch blocking gate. | ANNEX_Y \u00a7Y4 |\n| **FC-YT2** | `CSM_SURVIVAL_RESERVE_DAYS` | 2 | 90 | days of CSM coverage per enrolled population, by jurisdiction and essential category | CSM-specific reserve gate. Complements the general resilience reserve FC-070 (45 days); both must be independently satisfied. This value is the binding survival-floor-specific pre-launch gate. Federated Ombuds verification of this value required before INV-LAUNCH-1 clears. Pre-launch blocking gate. | ANNEX_Y \u00a7Y7 |\n\n---\n\n## Derivation Notes\n\n**FC-020 (`PROTECTED_PAUSE_FLOOR = 0.30`).** Sim Test 7 in `docs/ADVERSARIAL_AUDIT.md` established:\n- Caregiver-at-2%-contribution Voice equilibrium = 0.13 units.\n- Standard-at-10%-contribution Voice equilibrium = 0.67 units.\n- Protected Pause at 20% decay dampening = 4.44 units (exploitable if set there).\n\nFloor value must satisfy: above the exposed-caregiver equilibrium (0.13) to provide real voice; below the standard-contributor equilibrium (0.67) to prevent pause-as-exploit. **0.30** sits \u224833% of the way up this band \u2014 meaningful protection without civic premium for pausing.\n\n**FC-060 (`VOICE_SECTOR_CEILING = 0.20`).** From Sim Test 4: for N=5 sectors with ceiling c, supermajority (\u22652/3) is achievable via k-sector coalition when k\u00b7c \u2265 2/3. Setting c = 0.20, maximum 3-sector coalition = 0.60 < 0.667 \u2014 no 3-sector supermajority possible. Preserves margin against measurement imprecision.\n\n**FC-030 / FC-031 (Oracle parameters).** BFT theorem: n \u2265 3f+1 for tolerance of f faulty nodes. At f = 1: n \u2265 4. **FC-030 = 5** provides margin of one node above the floor, tolerates single-node loss without immediately dropping below BFT. FC-031 = 3 methodology classes guarantees diversity even when one class is simultaneously compromised.\n\n**FC-040 (`BRIBE_DETERRENCE_MULTIPLIER = 5.0`).** Sim Test 5: at 85% detection, penalty = 0.18\u00d7 gain is break-even. Setting penalty = 5\u00d7 gain produces expected value = \u2212(0.85 \u00d7 5 \u2212 0.15 \u00d7 1) \u00d7 gain = \u22124.1\u00d7 gain. Margin of safety permits detection probability as low as 25% before deterrent fails.\n\n**FC-110 / FC-111 (Tier 1 amendment parameters).** Distributed key-holder count of 9 balances resilience against loss (can lose 2 without breakage) versus capture resistance (must capture \u22653 to prevent amendment, \u22657 to force amendment). Timelock of 180 days ensures any captured supermajority survives at least one political cycle before amendment effect \u2014 enables reversal proposal by uncaptured parties.\n\n---\n\n---\n\n## FC-YT1 and FC-YT2 \u2014 Survival Floor Activation Gate Parameters\n\n**FC-YT1 \u2014 CSM Delivery Failure Pattern-Detection Trigger**\n- **Value:** 3 verified delivery failures per jurisdictional cluster within any 30-day window\n- **Tier:** Tier 2 / pre-launch blocking gate\n- **Authority:** Required by INV-LAUNCH-1 and ANNEX_Y \u00a7Y4 before any operational phase enrolling real persons\n- **Ombuds verification required:** Yes \u2014 the Federated Ombuds must publish the confirmed numeric value before this gate clears\n- **Relationship to FC-071:** FC-071 defines the per-population rate (3 per 10,000 residents per 30 days) that triggers cluster-level review. FC-YT1 is the raw count threshold that triggers H-3 refounding review initiation regardless of per-population rate. Both apply independently.\n- **\"Verified delivery failure\"** means a failure confirmed by at least one Tier-3 (physical sampling) oracle node per ANNEX_Y \u00a7Y1.\n\n**FC-YT2 \u2014 90-Day CSM Reserve Requirement**\n- **Value:** 90 days \u00d7 CSM \u00d7 enrolled population, by jurisdiction and essential category\n- **Tier:** Tier 2 / pre-launch blocking gate\n- **Authority:** Required by INV-LAUNCH-1 and ANNEX_Y \u00a7Y7 before any operational phase enrolling real persons\n- **Ombuds verification required:** Yes \u2014 same requirement as FC-YT1\n- **Relationship to FC-070:** FC-070 binds the general resilience reserve window at 45 days. FC-YT2 binds the CSM-specific reserve at 90 days. These are complementary: the general reserve (45 days) is an operational floor; the CSM reserve (90 days) is the survival-floor-specific gate. Both must be met; FC-YT2 is the binding pre-launch gate.\n\n---\n\n## Hash Commitment\n\nAt founding, the SHA-256 hash of this file (computed with the canonical line-ending, UTF-8 encoding, and without trailing whitespace normalization) is committed to the ledger genesis block. Subsequent amendments produce new hash commitments with version-chained history per `/architecture/drift_chain.md`.\n\n**Genesis commitment:** TBD at founding event. Computed by the founding coalition's multi-signature process.\n\n---\n\n## Amendment Log\n\n| Version | Date | Change | Authority |\n|:---|:---|:---|:---|\n| 1.0 | 2026-04-18 | Initial publication of the founding numerical lock file | Founding release |\n\n**End of Founding Commitments.**\n",
       "headings": [
         {
           "level": 1,
@@ -7581,7 +7968,7 @@
           "slug": "amendment-log"
         }
       ],
-      "wordCount": 4086,
+      "wordCount": 4640,
       "headingCount": 6
     },
     {
@@ -11828,6 +12215,8 @@
     "docs/public/00_start_here.md",
     "docs/public/08_useful_history.md",
     "docs/public/05_life_and_rights.md",
+    "docs/public/09_pilot_proposal.md",
+    "docs/public/10_real_world_examples.md",
     "docs/public/02_faq.md",
     "docs/public/04_white_paper.md",
     "docs/governance/Fairness_Vignette_Library.md",
diff --git a/docs/governance/Architecture_Source_Map.md b/docs/governance/Architecture_Source_Map.md
index b6607e1..72753fa 100644
--- a/docs/governance/Architecture_Source_Map.md
+++ b/docs/governance/Architecture_Source_Map.md
@@ -124,4 +124,4 @@ Added by P-052. Closes T-019 open problem.
 
 ## Founding Commitments Status
 
-FC-140 through FC-145 (AED fraud/exclusion bands) now bound. FC-052, FC-053, FC-054, FC-056, FC-072, FC-148 through FC-150 now have proposed values pending founding deliberation.
+FC-140 through FC-145 (AED fraud/exclusion bands) now bound. FC-053, FC-056, FC-072, FC-148 through FC-150 have proposed values pending founding deliberation. FC-050 through FC-052 and FC-054 (the former routine-demurrage parameters) are superseded — dormant §D9 backstop only; the active wealth-spine calibration is FC-202 through FC-210 (Commons Return and Universal Stake).
diff --git a/docs/governance/CRUS_Simulation_Protocol.md b/docs/governance/CRUS_Simulation_Protocol.md
new file mode 100644
index 0000000..39e7daa
--- /dev/null
+++ b/docs/governance/CRUS_Simulation_Protocol.md
@@ -0,0 +1,130 @@
+# CRUS Simulation Protocol
+
+**Status: `Active — unproven`.** This document defines the minimum runnable simulation packet required before Commons Return and Universal Stake can support any stronger public claim.
+
+Commons Return and Universal Stake is not ready for real-money collection. This protocol keeps the first test at simulation level: source bases may be mapped, valuations may be modeled, rails may be prototyped, and red teams may attack the design, but no person owes a compulsory charge and no household depends on Universal Stake receipts.
+
+## Plain-English Purpose
+
+The question is not, "does Commons Return sound fair?"
+
+The question is:
+
+> If the system tries to return shared or scarcity-created value to the public, who actually pays, who actually receives, who can avoid it, and who gets hurt by the paperwork?
+
+A simulation fails if it shows the formal charge landing on ordinary life, if wealthy actors can avoid it cheaply, if Universal Stake becomes tradable, or if administrators can turn distribution into political favor.
+
+## Governing Evidence Package
+
+This protocol operationalizes the [Commons Return and Universal Stake Evidence Test Package](./Commons_Return_Universal_Stake_Evidence_Test_Package.md). The evidence package names the standards. This protocol names the tables and scenario outputs that make the standards runnable.
+
+It also binds to:
+
+- [Parameter Calibration Register](./Parameter_Calibration_Register.md) for FC-202 through FC-210 and CRUS gate thresholds;
+- [Claims and Evidence Register](./Claims_Evidence_Register.md) for claim status and downgrade rules;
+- [Pilot Evidence Roadmap](./Pilot_Evidence_Roadmap.md) Phase 5;
+- [Threat Register](./Threat_Register.md) T-025 and T-001 compound convertibility risk.
+
+## Simulation Rule
+
+Every CRUS simulation packet must publish all inputs, assumptions, and failed cases. Aggregates cannot hide subgroup harm.
+
+At minimum, each packet must contain:
+
+| Table | Minimum rows | Why it exists |
+|---|---:|---|
+| Source-base inventory | One row per candidate source base | Shows what value is being assessed and what is protected. |
+| Valuation uncertainty | One row per source base and valuation method | Shows whether appraisers or insiders can move the number. |
+| Incidence table | One row per household type, business type, locality, and protected group | Shows who actually bears the cost after prices, rents, wages, and service quality adjust. |
+| Pass-through table | One row per sector and affected ordinary group | Shows whether the formal source holder shifts the charge. |
+| Avoidance table | One row per attack route | Shows whether hiding, migration, debt loading, shell routing, or under-maintenance remains profitable. |
+| Eligibility table | One row per eligibility path and vulnerable group | Shows whether Universal Stake becomes exclusionary or surveillance-heavy. |
+| Distribution table | One row per delivery rail and recovery path | Shows whether the stake reaches members without coercion or assignment. |
+| Non-convertibility table | One row per direct and bundled conversion attempt | Shows whether protected lanes become practically tradable. |
+| Administrative-cost table | One row per operating function | Shows whether valuation, enforcement, appeals, audit, and support consume the return. |
+| Capture table | One row per exemption, arrears, draw, distribution timing, audit exception, and public message | Shows whether officials can reward friends or punish opponents. |
+| Downturn table | One row per stress scenario | Shows whether receipts survive normal recession, legal challenge, price shock, or appeal surge. |
+| Dignity table | One row per claimant group | Shows whether the process humiliates, exposes, delays, or excludes ordinary people. |
+
+## Scenario Set
+
+The first runnable packet must include these scenarios. More can be added, but none of these can be skipped.
+
+| Scenario ID | Scenario | Required output |
+|---|---|---|
+| CRUS-SIM-01 | Base case source-base assessment | Gross receipts, protected exclusions, valuation range, appeal volume. |
+| CRUS-SIM-02 | Ordinary-life incidence | Effective burden by renters, homeowners below threshold, workers, consumers, small operators, protected associations, and concentrated source holders. |
+| CRUS-SIM-03 | Pass-through shock | Share of charge shifted into rents, prices, wages, fees, service degradation, or reduced supply. |
+| CRUS-SIM-04 | Valuation hiding | Value hidden through appraisals, affiliated sales, IP transfers, concession accounting, reserve understatement, or estate structures. |
+| CRUS-SIM-05 | Avoidance and capital flight | Base erosion from shell ownership, treaty routing, migration of control rights, debt loading, under-maintenance, or asset stripping. |
+| CRUS-SIM-06 | Universal Stake eligibility | False exclusion, duplicate claims, recovery delay, staff discretion, claimant abandonment, and data exposure by group. |
+| CRUS-SIM-07 | Direct non-convertibility | Attempts to sell, assign, pledge, garnish, inherit, or collateralize Universal Stake. |
+| CRUS-SIM-08 | Compound convertibility | Bundled offers involving Universal Stake, Essential Access, Voice, Service Record, identity recovery, housing, employment, lending, platform access, or debt relief. |
+| CRUS-SIM-09 | Routing capture | Exemptions, arrears, fund draws, distribution timing, audits, or public messages concentrated by faction, donor, office, region, sector, employer, or insider network. |
+| CRUS-SIM-10 | Administrative burden | Administrative, enforcement, valuation, audit, appeal, claimant-support, and data-system cost as a share of gross receipts. |
+| CRUS-SIM-11 | Downturn resilience | Net receipts after recession, land-price decline, resource-price collapse, concession failure, platform disruption, legal challenge, and high-appeal periods. |
+| CRUS-SIM-12 | Work and stewardship | Labor participation, small-business formation, maintenance, housing supply, productive projects, and ordinary stewardship against comparison case. |
+| CRUS-SIM-13 | Fiscal adequacy | Named obligation, gross receipts, net receipts, reserves, distribution cost, enforcement cost, appeal cost, and lawful residual funding path. |
+| CRUS-SIM-14 | Public comprehension | Ordinary-reader ability to explain who pays, who receives, what is protected, and what cannot be bought. |
+
+## Gate Outputs
+
+Each scenario produces one of three outputs:
+
+| Output | Meaning |
+|---|---|
+| Pass | No watch or blocking threshold crossed. Claim stays designed or partly tested, depending on evidence level. |
+| Watch | A threshold is crossed that requires redesign, narrower claim language, or more evidence before any pilot escalation. |
+| Block | A threshold is crossed that stops real-money collection, tax-replacement claims, Universal Stake activation, or scale-up until fixed and retested. |
+
+The packet must list every watch and block output in a single summary table. It must also include a plain-language explanation of who would be harmed if the scenario were real.
+
+## Starting Gate Thresholds
+
+These are simulation anchors, not final constitutional parameters. The Parameter Calibration Register must bind or revise them before activation.
+
+| Gate | Watch | Block |
+|---|---:|---:|
+| Ordinary-life incidence | Any ordinary group bears more effective burden than concentrated source holders in a modeled segment. | Any material burden on a protected class without a source-base or avoidance-shell finding. |
+| Pass-through | More than 10% of charge shifts to ordinary renters, consumers, workers, or small operators. | More than 25%, or any shift that pushes essential goods, housing, or services below the dignity floor. |
+| Avoidance and capital flight | More than 5% assessed-value erosion. | More than 10%, or avoidance remains profitable after detection, penalties, and appeal outcomes. |
+| Administrative cost | More than 10% of gross receipts. | More than 20%, or ordinary claimants abandon appeals because process burden is too high. |
+| Downturn | Net receipts fall more than 20% without a committed reserve and unwind plan. | Downturn management requires survival-access cuts, demurrage revival, ordinary-liquidity charges, prohibited tax bases, hidden fees, or unbounded issuance. |
+| Non-convertibility | Any repeatable market or bundled offer emerges. | Any successful conversion into Voice, office, survival priority, membership, legal standing, public favor, enforcement leniency, housing access, employment access, platform access, or debt relief. |
+| Eligibility and dignity | Any vulnerable group crosses false-exclusion, recovery-delay, staff-discretion, data-exposure, coercion, or abandonment watch thresholds. | Universal Stake becomes a surveillance gate, loyalty gate, work gate, humiliation screen, or exclusion path. |
+
+## Minimum Machine-Readable Output
+
+The repository simulation should be able to produce this shape for each scenario:
+
+```json
+{
+  "scenario_id": "CRUS-SIM-03",
+  "result": "watch",
+  "warnings": ["PASS_THROUGH_WATCH"],
+  "blocks": [],
+  "metrics": {
+    "pass_through_rate": 0.14,
+    "admin_cost_share": 0.08,
+    "assessed_value_erosion_rate": 0.03
+  },
+  "plain_language_failure": "renters absorb a visible share of a charge aimed at land scarcity value"
+}
+```
+
+The exact schema may evolve, but the output must stay readable to non-technical reviewers.
+
+## No-Claim Rule
+
+A passed simulation does not prove CRUS works. It only permits the claim to move from "designed mechanism" toward "partly tested" for the specific scenarios tested.
+
+The project still may not claim:
+
+- Commons Return can replace taxes;
+- Universal Stake is capture-proof;
+- ordinary life is protected in practice;
+- source bases are adequate to fund named obligations;
+- eligibility can be verified without exclusion or surveillance;
+- real-money collection is ready.
+
+Those claims require field evidence, outside review, and claim-status updates under the Claims and Evidence Register.
diff --git a/docs/governance/Parameter_Calibration_Register.md b/docs/governance/Parameter_Calibration_Register.md
index 0bd7bfb..2061e30 100644
--- a/docs/governance/Parameter_Calibration_Register.md
+++ b/docs/governance/Parameter_Calibration_Register.md
@@ -35,9 +35,16 @@ Every high-risk parameter should eventually have:
 | FC-033 adversarial oracle seats | 1 per cohort | Tier 1 | Forces hostile-method review inside measurement. | Seat becomes symbolic or captured by same professional network. | Adversarial-seat independence review. | Dissent never changes outcomes or is not resourced. | Annex AL; T-020/T-021. |
 | FC-040 penalty base multiplier | 5.0x | Tier 1 / active-unproven | Makes detected conversion expected-value negative. | Too low invites arbitrage; too high punishes edge cases harshly. | Annual deterrence audit. | Violations remain profitable or appeals show disproportionate harm. | Annex AJ; T-001/T-007. |
 | FC-041 detection assumption | 0.85 | Tier 1 / active-unproven | Supplies expected-value calculation for penalties. | Overstated detection hides under-enforcement. | Detection-rate audit. | Actual detection probability materially lower than assumed. | Annex AJ; Enforcement Panel audit. |
-| FC-052 protected ordinary-use threshold | Reserved — bind before Flow launch; initial reference remains 18 months × regional median monthly consumption until replaced by the CRUS fiscal dossier | Tier 2 / pre-launch gate | Defines the ordinary household reserve that may not become the public funding base under Annex D protected-use rules. | Too low reaches ordinary households; too high shelters concentrated control under household labels. | Commons Return incidence model and household/small-operator burden review. | Ordinary households, caregivers, small operators, elders, disabled persons, or rural households bear Commons Return burden meant for scarcity privilege or public-created value. | ANNEX_D; Commons Return and Universal Stake Evidence Package. |
-| FC-053 dormant net-worth backstop schedule | Superseded as an active parameter; no founding progressive net-worth decay schedule is operative unless a new patch, fiscal/dignity evidence, public review, and applicable amendment process revive a narrow dormant backstop. | Dormant / not operative | Preserves historical traceability for the retired demurrage design without letting old rates govern by accident. | If treated as active, it can burden ordinary households, illiquid owners, or working savers while bypassing the Commons Return source-base test. | Dormant-backstop incidence model, dignity review, household burden model, and explicit amendment activation record before any use. | Any document or implementation treats old λ brackets as active, funds Essential Access from them, or applies routine balance/net-worth decay by interpretation. | ANNEX_D §D1 and §D9; SPECIFICATIONS. |
-| FC-054 PFCR / lockbox routing share | Reserved | Tier 2 / pre-launch gate | Splits Commons Return receipts between Essential Access support, public rails, restoration, resilience reserves, infrastructure, and Universal Stake. | Too much to one channel creates fiscal dependency; too little weakens commons funding or turns Universal Stake into political dividend timing. | Fiscal adequacy model, source-base revenue model, lockbox sufficiency test, and burden-incidence review. | PFCR becomes dependent on inflation, hidden debt, or prohibited tax bases; or cannot fund baseline commons. | ANNEX_D; Article V; SPECIFICATIONS. |
+| FC-202 Commons Return source-base list | Reserved — bind before CRUS activation | Tier 1 / pre-launch gate | Defines the closed list of allowed Commons Return bases (land/location value, natural resources, spectrum, monopoly licenses, platform/network rents, high-value concessions, large successions). The list is closed under INV-008: downward extension onto ordinary life is a Tier-1 amendment. | Source-base definitions quietly broadened to reach ordinary labor, homes, tools, or savings. | Source-base mapping pilot and incidence model. | Any base reaches an INV-008-protected category. | ANNEX_D; INVARIANTS INV-008; Commons Return and Universal Stake Evidence Package. |
+| FC-203 Commons Return assessment rate schedule | Reserved — calibrated by source base before activation | Tier 2 / pre-launch gate | Sets the per-base assessment rate without making ordinary labor or survival access the funding base. | Rates tuned to spare connected asset classes; valuation hiding. | Incidence, valuation-hiding, and external-capital-arbitrage tests. | Burden lands on ordinary households or productive stewardship instead of scarcity privilege. | ANNEX_D; CRUS Simulation Protocol. |
+| FC-204 protected ordinary-use threshold (formerly registered here as FC-052) | Reserved — bind before CRUS activation; initial reference remains 18 months × regional median monthly consumption until replaced by the CRUS fiscal dossier | Tier 2 / pre-launch gate | Defines the ordinary household reserve that may not become the public funding base under Annex D protected-use rules. | Too low reaches ordinary households; too high shelters concentrated control under household labels. | Commons Return incidence model and household/small-operator burden review. | Ordinary households, caregivers, small operators, elders, disabled persons, or rural households bear Commons Return burden meant for scarcity privilege or public-created value. | ANNEX_D; Commons Return and Universal Stake Evidence Package; founding/commitments.md FC-204. |
+| FC-205 Universal Stake distribution cadence | Reserved — bind before first distribution | Tier 2 / pre-launch gate | Makes Stake timing reliable for households and useless as a political reward instrument; a distribution may be authorized only after the floor and reserves are funded (INV-014). | Distribution timed to elections or withheld as punishment. | Distribution drill with INV-014 ordering check. | Any distribution authorized while floor or reserves underfunded. | ANNEX_D; INVARIANTS INV-014. |
+| FC-206 Universal Stake eligibility rule | Reserved — bind before first distribution | Tier 1 / pre-launch gate | Keeps the Stake universal and non-convertible (no sale, assignment, garnishment, pledge, inheritance, or purchase of membership/priority/standing/office/Voice). | Eligibility narrowed to exclude the inconvenient; conversion pathways laundered through legal wrappers. | Non-convertibility red team. | Any conversion pathway clears. | ANNEX_D; ANNEX_AK; INVARIANTS INV-002/INV-017. |
+| FC-207 CRUS anti-capture gates | Reserved — bind before CRUS activation | Tier 1 / pre-launch gate | Public accounting, no patronage discretion, data minimization, auditability, appeal rights. | Fund administrators become patronage allocators. | Capture Dashboard drill. | Discretionary or targeted allocation observed. | ANNEX_D; Capture Dashboard Specification. |
+| FC-208 PFCR / lockbox reserve and routing rule (formerly registered here as FC-054) | Reserved | Tier 2 / pre-launch gate | Splits Commons Return receipts between Essential Access support, public rails, restoration, resilience reserves, infrastructure, and Universal Stake. | Too much to one channel creates fiscal dependency; too little weakens commons funding or turns Universal Stake into political dividend timing. | Fiscal adequacy model, source-base revenue model, lockbox sufficiency test, and burden-incidence review. | PFCR becomes dependent on inflation, hidden debt, or prohibited tax bases; or cannot fund baseline commons. | ANNEX_D; Article V; SPECIFICATIONS; founding/commitments.md FC-208. |
+| FC-209 CRUS appeal path | Reserved — bind before assessment or distribution | Tier 1 / pre-launch gate | Human appeal for assessed holders and excluded claimants without letting high-value actors stall assessment. | Procedural delay as avoidance; appeal priced out of reach of the poor claimant. | Appeal-path drill (both directions). | Appeals stall assessment or exclude the unrepresented. | ANNEX_D; Federated Ombuds. |
+| FC-210 CRUS review cadence | Reserved — bind before CRUS activation | Tier 2 / pre-launch gate | Scheduled review of incidence, eligibility, valuation, bases, distribution, reserves, capture metrics; a missed cadence is itself a failure. | Review quietly skipped in good years. | Cadence compliance audit. | Missed cadence or missing data. | ANNEX_D; Capture Dashboard Specification; Pilot Evidence Roadmap. |
+| Dormant §D9 backstop schedule (no live FC ID; a revival patch would assign one) | Superseded as an active parameter; no routine balance or net-worth decay schedule is operative unless a new patch, fiscal/dignity evidence, public review, and applicable amendment process revive a narrow dormant backstop. | Dormant / not operative | Preserves historical traceability for the retired demurrage designs without letting old rates govern by accident. The retired idle-balance parameters are tombstoned in founding/commitments.md FC-050–FC-052, FC-054. | If treated as active, it can burden ordinary households, illiquid owners, or working savers while bypassing the Commons Return source-base test. | Dormant-backstop incidence model, dignity review, household burden model, and explicit amendment activation record before any use. | Any document or implementation treats old rates or λ brackets as active, funds Essential Access from them, or applies routine balance/net-worth decay by interpretation. | ANNEX_D §D1 and §D9; SPECIFICATIONS. |
 | FC-055 issuance ceiling function | Reserved | Tier 1 / pre-launch gate | Links Flow supply to verified productive commitments. | Too loose inflates claims; too tight starves production. | Flow issuance simulation and productive-commitment audit. | Circulation detaches from real production or needed projects cannot clear. | Article V; SPECIFICATIONS. |
 | FC-058 CSM basket/regional adjustment | Reserved | Tier 1 / regional launch gate | Prevents one abstract basket from ignoring local climate, food, medicine, and shelter needs. | Under-adjustment harms high-need regions; over-adjustment invites political inflation. | Regional CSM pilot and capacity review. | Regional needs are mismeasured or adjustment becomes patronage. | Article III; Annex Y; SPECIFICATIONS. |
 | FC-060 Voice sector ceiling | 0.20 | Tier 1 | Prevents one sector dominating civic weighting. | Sector labels are split or merged to hide concentration. | Capture Dashboard Specification. | Sector concentration remains high through reclassification. | Article VI; Annex AC. |
diff --git a/docs/public/00_start_here.md b/docs/public/00_start_here.md
index a370210..58f1e05 100644
--- a/docs/public/00_start_here.md
+++ b/docs/public/00_start_here.md
@@ -30,6 +30,28 @@ It is not a command economy — people still trade, price, contract, and build b
 
 And it is not a complete government. It does not run the police, the courts, or decide who belongs to the country. It sits inside a normal rule-of-law society and adds these protections on top — and it refuses to lend its legitimacy to any power that uses hunger, homelessness, or the cutting-off of medicine as a weapon, and says so out loud when it happens.
 
+## The five walls — what each one protects for you
+
+In most places, money does three jobs at once: it buys things, it keeps you alive, and it decides who has power. When one thing does all three, the people with the most money end up controlling everything — including whether you eat. This design refuses to let that happen by building walls between those jobs:
+
+1. **You keep what you earn.** Your everyday money is yours to spend; no one can secretly shrink it or quietly take it back.
+2. **You can never be priced out of staying alive.** Food, water, shelter, and care are yours by right — no matter what's in your bank account. If the usual providers fail, a public one steps in.
+3. **No family can lock in power forever.** Value no one made — land and location windfalls, resource rents, monopoly privileges — and very large inheritances pay a public return, and that return pays everyone a regular share and gives every young person a starting stake. Ordinary earnings, homes, tools, and savings are left alone.
+4. **Your voice can't be bought.** Some choices go to randomly picked citizens, like jury duty; the big ones, everyone votes on equally. Nobody can buy or hoard a louder say.
+5. **Public roles are earned, not bought.** You qualify for public office by contributing, then you're picked by lottery — not by money or who you know.
+
+And if there's ever a real, proven shortage, essentials get shared out by need, by a fixed rule that's set ahead of time — never by who can pay the most.
+
+**What you are owed. What can never be taken.**
+
+- Your food, water, shelter, and care are a **right**, not a reward.
+- **No one can buy your vote** or your voice — yours or anyone else's.
+- **You cannot be priced out of survival**, no matter how poor you are.
+- Punishment can take your freedom. **It can never take your food, water, or shelter.** Survival is never used as a weapon.
+- Every young person gets a **fair starting stake**, so where you begin doesn't decide where you can go.
+
+Why it all hangs together, in one sentence: keep buying, surviving, deciding, and serving in **separate boxes**, so power over one can never be used to capture the others. None of this is proven yet — these are the design's promises, and the rest of this document is honest about what it would take to earn them.
+
 ## Where this sits in prior work, and what is actually new
 
 None of the individual ideas here are new, and the design says so. The intellectual lineage is explicit:
diff --git a/docs/public/09_pilot_proposal.md b/docs/public/09_pilot_proposal.md
new file mode 100644
index 0000000..660926e
--- /dev/null
+++ b/docs/public/09_pilot_proposal.md
@@ -0,0 +1,504 @@
+# A Minimal Pilot Proposal
+
+*Status: Proposed — rough draft. Published in the corpus for review, but not yet formally adopted; no pilot described here is approved or funded. Every number and timeline is a starting estimate, not a commitment.*
+
+---
+
+> **What this document is**
+> A concrete proposal for testing the protected lanes and layers of the Humane Constitution at the smallest useful scale. It is written for funders, researchers, and communities who want to know what "testing this" would actually look like — not in theory, but in practice.
+>
+> **What this document is not**
+> A guarantee, a budget, or a finished plan. It is the first honest sketch of what a real pilot requires.
+
+For the plain history-and-comparator guide behind these pilots, see [Real-World Examples](10_real_world_examples.md).
+
+---
+
+## The problem with designs that are never tested
+
+Every mechanism in this project is either *Designed* or *Active — unproven*. That is the honest status. Something can be carefully designed, internally consistent, and still fail the moment it meets real people, real incentives, and real mistakes.
+
+The only way to move from *designed* to *evidence-backed* is a real test. This document is about what that test looks like, and how small it can be while still generating useful evidence.
+
+A pilot has one job: **find out what we got wrong before anyone depends on it.**
+
+---
+
+## The protected lanes, briefly
+
+The Humane Constitution separates things most societies leave merged: survival, market participation, public return, emergency rationing, and political power. It uses protected lanes and layers to keep them separate:
+
+1. **Essential Access** — a survival floor. Food, shelter, medicine, and water that every person receives regardless of their market position. Cannot be sold, traded, or revoked.
+2. **Shared Storehouse** — rationing under real scarcity. When there genuinely is not enough of something essential, this system distributes it fairly instead of letting price decide who goes without.
+3. **Flow** — the market currency. Ordinary spending, saving, wages, contracts, and business use happen here.
+4. **Commons Return and Universal Stake** — public return from exclusive control of shared and scarcity-created value, distributed through a protected member stake.
+5. **Voice** — bounded civic priority. A limited, expiring claim each person holds to weigh in on public decisions. Cannot be bought or stockpiled. Expires if unused.
+6. **Service Record** — eligibility support for public roles. A rotating system that tracks service to shared governance, while preserving ordinary challenger and appeal routes where the corpus requires them.
+
+The walls between these lanes — the fact that you cannot convert Essential Access into Flow, buy Voice with Flow, or turn Universal Stake into office or survival priority — are the core claim. The pilot tests whether those walls hold in practice.
+
+---
+
+## How to read the pilots below
+
+Each pilot section covers:
+- **The hypothesis** — the one falsifiable claim the pilot tests
+- **Smallest deployment** — the minimum scale that generates real evidence
+- **Rough cost** — order-of-magnitude only; full budgets require site-specific work
+- **What we measure** — the metrics that tell us whether the hypothesis held
+- **What failure looks like** — what would force us to say the mechanism does not work as designed
+- **What success looks like** — what would justify moving to a larger test
+- **Open questions** — what the pilot does not resolve
+
+No pilot here is designed to be permanent. Every one of them is designed to fail informatively if the design is wrong.
+
+---
+
+## Pilot A — Essential Access + Shared Storehouse
+
+*These two are designed together and should be tested together. Essential Access is the normal-state floor. Shared Storehouse is what happens when that floor comes under stress. Testing one without the other leaves the hardest question unanswered.*
+
+> **Where this sits in the corpus**
+> - The survival floor this pilot delivers is defined in [Annex Y](../annexes/ANNEX_Y.md) — the minimum the system may never cut.
+> - The wall that stops Essential Access from being sold or brokered into market money is [Annex AB](../annexes/ANNEX_AB.md) (non-delegability).
+> - The "is there genuinely a shortage?" question — capacity measurement and scarcity declaration — is governed by [Annex M](../annexes/ANNEX_M.md), with the oracle-failure fallback in [Annex AQ](../annexes/ANNEX_AQ.md) (threat T-024 / patch P-022).
+> - This pilot corresponds to **Phase 3 (capacity measurement)** and **Phase 4 (Essential Access delivery)** of the [Pilot Evidence Roadmap](../governance/Pilot_Evidence_Roadmap.md), under the doctrine in [Annex Q](../annexes/ANNEX_Q.md). Scale-up is gated by [Annex AN](../annexes/ANNEX_AN.md) — a stress-free pilot does not earn a scale-up.
+
+### What we're testing
+
+The core claim of Essential Access is: **a guaranteed survival floor does not require a means test, does not create dependency traps, and does not collapse when participants try to game it.**
+
+The core claim of Shared Storehouse is: **when there is genuinely not enough of something essential, a transparent rationing system distributes it more fairly than price, without black markets forming at the scale of a small community.**
+
+Underneath both sits a third claim that this pilot is really built to test — the one a skeptic cares about most: **the wall holds.** A person cannot quietly turn their survival floor back into spendable market money, and a declared shortage cannot be manufactured to justify cutting people off. Most of this pilot's instrumentation is pointed at those two failure modes, because they are where the design either earns trust or loses it.
+
+### The hypothesis
+
+> A small community (150–300 people, voluntary participants) can operate a guaranteed essential-goods floor for 18 months. Participants will not lose access due to administrative failure. The floor will not be gamed into extinction. When a controlled, minor scarcity event is introduced, the Shared Storehouse mechanism will distribute goods fairly, the scarcity declaration will survive independent audit, and a black market will not emerge at meaningful scale.
+
+### Non-negotiable pilot rules (inherited from the corpus)
+
+Per the [Pilot Evidence Roadmap](../governance/Pilot_Evidence_Roadmap.md), this pilot is bound by rules it cannot waive for convenience:
+
+- **No one's real survival is on the line.** The pilot allocation is *additive* — it sits on top of whatever benefits, income, or support a participant already has. No participant's existing food stamps, Medicaid, housing, or legal status is touched, reduced, or made contingent on the pilot. This is the line in [Annex Q](../annexes/ANNEX_Q.md): a pilot may not make a person depend on a floor that has not yet been proven.
+- **Exit is rehearsed before anyone leans on it.** Before month 1, the pilot demonstrates that a participant can leave with no penalty and no loss of their pre-existing support. Exit is tested, not assumed.
+- **Independent review is built in, not invited later.** An outside reviewer with the power to publish holds the data and signs off on the failure call.
+- **A failed pilot is published as failed.** No rebranding. The public post-mortem is a precondition of funding, written into the grant.
+
+### Smallest deployment
+
+**150–300 voluntary adult participants** drawn from an existing community — a rural town, a housing cooperative, a university residential community, or an intentional community. Participants opt in; no one's existing benefits are affected. The pilot runs alongside their normal lives.
+
+The essential goods covered in this pilot are limited to **food staples and basic medicines**. Shelter and water are explicitly excluded from this round — they carry infrastructure cost and legal exposure (eviction law, utility regulation) that belong in a later, larger pilot. Naming that exclusion up front is itself part of the honesty: this pilot tests the *easiest* survival goods to deliver, and a skeptic should read the results as a floor on plausibility, not a ceiling.
+
+Participants receive a monthly allocation of essential goods, delivered through one of two channels tested in parallel cohorts:
+
+- **Cohort 1 — direct goods.** Physical staples and pharmacy-filled prescriptions, delivered or picked up. Closest to the constitutional design; highest administrative cost.
+- **Cohort 2 — restricted-purpose credit.** A closed-loop balance redeemable only for qualifying food and medicine at participating vendors, technically blocked from cash-out. Cheaper to run; directly stress-tests the non-delegability wall ([Annex AB](../annexes/ANNEX_AB.md)) — if the wall is going to leak, this is where it leaks first.
+
+Running both is deliberate. The comparison tells us how much of the wall is enforced by *design* (Cohort 2's technical block) versus by *friction* (Cohort 1's physical goods), which is exactly the question scale-up depends on.
+
+### The scarcity test (months 9–11)
+
+This is the part of the pilot that no UBI study has run, and it is the reason Essential Access and Shared Storehouse are tested together rather than apart.
+
+At month 9, **one category of goods** (e.g. a specific staple) has its delivered supply deliberately reduced by 30% for 8 weeks. Two things are tested at once:
+
+1. **Can the shortage be declared honestly?** Before any rationing begins, the scarcity must be verified under the [Annex M](../annexes/ANNEX_M.md) standard — challengeable capacity data, not a single administrator's say-so — and the declaration is handed to the independent reviewer to attempt to *falsify*. The design's nightmare is a fake shortage used to justify cutting people off; this step tests whether the verification actually resists that.
+2. **Does rationing beat price?** Once declared, the Shared Storehouse protocol distributes the reduced supply by the published rule, not by who can pay. We measure whether distribution matches the protocol, whether a black market forms, and — critically — whether the floor itself ([Annex Y](../annexes/ANNEX_Y.md)) is ever breached. Per [Annex AQ](../annexes/ANNEX_AQ.md), if the measurement system itself fails mid-event, the default is continuity, not deprivation; the pilot deliberately injects a measurement fault to see if that default holds.
+
+Participants are told in advance the scarcity is a planned test. That weakens external realism — but a real involuntary shortage in a pilot would violate the no-survival-risk rule. We name this tradeoff rather than hiding it.
+
+### Rough cost
+
+| Item | Estimate |
+|---|---|
+| Essential goods allocation (150–300 people × 18 months, both cohorts) | $180,000–$540,000 |
+| Independent review, monitoring, and scarcity-declaration audit | $70,000–$120,000 |
+| Administration, identity verification, appeals, exit rehearsal | $50,000–$90,000 |
+| Closed-loop credit infrastructure (Cohort 2) | $25,000–$60,000 |
+| Data collection, control-group baseline, public post-mortem | $25,000–$50,000 |
+| **Total** | **$350,000–$860,000** |
+
+*Figures assume food staples plus basic medicines. Medication adds health-data, liability, and pharmacy-licensing complexity that requires site-specific legal and clinical review before a real number can be quoted.*
+
+### What we measure
+
+| Question | Metric | Target |
+|---|---|---|
+| Does the floor stay continuous? | % of participant-months with full allocation delivered | > 95% |
+| Do process errors exclude people? | Admin-failure exclusion rate, and time-to-recovery | < 2%, recovered < 72h |
+| **Does the EA→Flow wall hold?** | % of allocated value converted to cash/market exchange (by cohort) | < 5% |
+| Can a shortage be declared honestly? | Independent reviewer's verdict on the scarcity declaration | Survives falsification audit |
+| Does rationing beat price under scarcity? | Distribution conformance to protocol; demographic disparity in shortfall | Conforms; no unexplained bias |
+| Does a black market form? | Estimated size of informal exchange vs. the shortage gap | < 20% of gap |
+| Is the survival floor ever breached? | Instances any participant drops below the Annex Y floor | **Zero** |
+| Does the floor change behavior? | Economic anxiety, food insecurity, healthcare avoidance vs. control/baseline | Measurable reduction |
+
+The **zero-floor-breach** row is the one hard line. A breach of the Annex Y minimum is not a metric that can be traded off against the others — it is a stop condition.
+
+### What failure looks like
+
+The pilot has failed — and we say so publicly — if any of the following occur:
+
+- More than 10% of participants lose access for more than one week due to administrative failure.
+- More than 5% of allocated value is converted into market exchange in **either** cohort — the wall between Essential Access and Flow is leaking. (If only Cohort 1 leaks, the lesson is "design the technical block in." If Cohort 2 leaks too, the lesson is far more serious.)
+- The scarcity declaration does not survive the reviewer's falsification audit — meaning a shortage *could* be manufactured to cut access. This is a design-level failure, not a tuning problem.
+- The scarcity event produces a black market covering more than 20% of the shortage gap.
+- Shared Storehouse distribution shows statistically significant demographic bias not explained by the protocol.
+- **Any** breach of the Annex Y survival floor.
+
+Failure is information. A failed pilot tells us which wall does not hold under real conditions. It is not a reason to stop — it is a reason to fix the specific mechanism before anyone is asked to depend on it.
+
+### What success looks like
+
+- Access continuity above 95% with zero floor breaches.
+- Conversion below 5% in both cohorts — and meaningfully lower in Cohort 2, showing the technical block does work.
+- A scarcity declaration that an adversarial reviewer could not fake or break.
+- The shortage absorbed without a meaningful black market, with the floor intact throughout.
+- A measurable reduction in economic anxiety against the control group.
+- Independent reviewers able to replicate every finding from the published data.
+
+Success at this scale justifies the next gate under [Annex AN](../annexes/ANNEX_AN.md): a 1,000+ participant pilot adding shelter, water, and an *unannounced* (genuinely involuntary, externally caused) scarcity event — the stress this pilot deliberately could not impose.
+
+### Open questions this pilot does not resolve
+
+- Does Essential Access hold when the stakes are higher — housing and water, not just food and medicine?
+- Does the wall survive *organized, persistent* attack (a deliberate cash-out market run by motivated actors), not just opportunistic individual gaming?
+- Does the scarcity verification hold under a *real* shortage, where the people declaring it are under genuine pressure rather than running a planned test?
+- How does Essential Access interact with existing public benefits — does layering it on top create benefit-cliff or eligibility problems? This is a legal and political question, not a design question, and it varies by jurisdiction.
+
+---
+
+## Pilot B — Commons Return and Universal Stake (simulation pilot)
+
+*A note on what this is not. This is not a local-currency pilot, not a fee on unused balances, and not a tax on ordinary household savings. Wörgl, WIR, BerkShares, and Gesell remain useful history about money design; Alaska-style public dividends and public wealth funds are closer comparators for the distribution side, but still not proof. None of them test the current instrument. This pilot tests the hard thing: can a community collect public return from shared and scarcity-created value, then distribute a protected Universal Stake, without punishing ordinary life or turning the system into surveillance and favoritism?*
+
+> **Where this sits in the corpus**
+> - The economic instrument is [Annex D](../annexes/ANNEX_D.md), rewritten around **Commons Return and Universal Stake** (routine demurrage is superseded; only a dormant, pilot-gated backstop remains under §D9).
+> - Flow issuance architecture remains [Annex X](../annexes/ANNEX_X.md), but Flow balances are not the object of this pilot.
+> - This is the public-finance and distribution simulation for the [Pilot Evidence Roadmap](../governance/Pilot_Evidence_Roadmap.md), using the [CRUS Simulation Protocol](../governance/CRUS_Simulation_Protocol.md). It stays a **simulation** until incidence, dignity, avoidance, distribution, and non-convertibility are transparent enough for independent review.
+
+### What we're testing
+
+The design lives or dies on seven empirical questions:
+
+1. **Which source bases can be measured without overreach?** The candidate bases are land/location value, natural resources, spectrum/airspace, monopoly licenses, unavoidable platform or network rents, high-value public concessions, and large succession transfers.
+2. **Who actually bears the cost?** The pilot must show incidence after rents, prices, wages, contracts, and investment behavior adjust. A charge written on one party can land on someone else.
+3. **Can dignity survive administration?** Ordinary balances, tools, inventory, protected homes, and protected associations must stay protected without building a financial panopticon around every household.
+4. **Can avoidance be contained?** The red-team tries valuation hiding, shell entities, trust wrappers, under-reported concessions, external-capital arbitrage, migration threats, and fake protected associations.
+5. **Can eligibility and distribution rails work?** Universal Stake must reach every member through reliable rails, including people who are digitally fragile, displaced, elderly, undocumented in ordinary paperwork, or in dispute.
+6. **Does non-convertibility hold?** Universal Stake must stay non-tradable, non-assignable, and non-garnishable. It cannot buy Voice, office, survival priority, membership, legal standing, or public favor.
+7. **Does politics capture the dividend?** The pilot watches for targeted bonuses, exclusions, patronage, favored districts, "reward our supporters" rhetoric, and quiet manipulation of eligibility rules.
+
+### The hypothesis
+
+> Across 60–150 voluntary households plus a mapped sample of local assets and concessions, Commons Return source bases can be assessed with bounded error and limited data; ordinary household life can stay protected; a motivated red-team cannot cheaply hide or relocate the base; and a Universal Stake can be distributed universally without becoming tradable, garnishable, politically targeted, or convertible into civic power.
+
+### Smallest deployment
+
+**60–150 voluntary households plus a local asset/concession map**. The household group tests eligibility, dignity, distribution rails, and non-convertibility. The asset/concession map tests source bases: land/location value, public concessions, monopoly licenses, platform/network rents, natural-resource claims where present, and large succession-transfer scenarios modeled from anonymized estates.
+
+This is a **simulation pilot**: no compulsory collection occurs. What is real is the data collection, valuation process, red-team attack, distribution test, appeals process, and public comprehension review. One arm may pair with Pilot A's Essential Access and Shared Storehouse work through a voluntary, grant-funded practice distribution and shared reserve. That arm must be clearly labeled as practice rails, not public revenue and not evidence that CRUS can fund the floor.
+
+The pilot runs **12 months** and has four moving parts:
+
+- **Source-base assessment.** Each candidate base is valued with a published method and an independent audit: land/location value separate from buildings, resource claims, licenses, concessions, platform/network rents, and succession transfers.
+- **Protection screen.** Ordinary labor income, working balances, household tools, basic homes below protected thresholds, small-business operating reserves, and protected community, tribal, and church associations are excluded unless they are being used as avoidance shells.
+- **Distribution test.** A simulated or funded Universal Stake is issued through rails that cannot be sold, assigned, garnished, pledged as collateral, or exchanged for civic status.
+- **Red-team.** A paid adversarial team is given the rules and tasked with breaking them: hiding valuation, shifting ownership outside the jurisdiction, laundering value through protected associations, buying favor with the stake, manipulating eligibility, capturing appeals, or turning distribution into political patronage.
+
+Before any optional funded practice distribution, the pilot must publish the CRUS Simulation Protocol scenario table:
+
+| Stage | Required scenarios | Stop condition |
+|---|---|---|
+| Source-base map | CRUS-SIM-01, CRUS-SIM-04 | Ordinary homes, tools, working balances, protected associations, or labor income are swept into the base without an avoidance-shell finding. |
+| Incidence and pass-through | CRUS-SIM-02, CRUS-SIM-03 | Renters, workers, consumers, small operators, or protected groups bear the practical burden while concentrated source holders avoid it. |
+| Avoidance and capital flight | CRUS-SIM-05 | Avoidance remains profitable after detection, penalties, and appeal outcomes, or assessed value erodes beyond the blocking threshold. |
+| Eligibility and dignity | CRUS-SIM-06 | Vulnerable members are excluded, exposed, delayed, coerced, or humiliated beyond published thresholds. |
+| Non-convertibility | CRUS-SIM-07, CRUS-SIM-08 | Universal Stake becomes directly or practically tradable through sale, pledge, garnishment, debt relief, housing, employment, platform access, identity recovery, Voice, Service Record, or public favor. |
+| Routing and adequacy | CRUS-SIM-09 through CRUS-SIM-13 | Administrators can steer rewards or punishments; costs consume the return; downturns force prohibited fallback funding; or a named public obligation is unsupported by net receipts. |
+| Public comprehension | CRUS-SIM-14 | Participants cannot explain who pays, who receives, what is protected, or what the stake cannot buy. |
+
+### Rough cost
+
+| Item | Estimate |
+|---|---|
+| Source-base mapping and valuation audit | $70,000–$160,000 |
+| Eligibility, distribution rails, and appeals prototype | $45,000–$110,000 |
+| Adversarial red-team (avoidance, capture, valuation, non-convertibility) | $60,000–$130,000 |
+| Incidence and external-capital mobility modeling | $40,000–$80,000 |
+| Independent review, data minimization audit, public comprehension survey | $45,000–$90,000 |
+| Optional funded Universal Stake / shared reserve arm | $40,000–$120,000 |
+| **Total** | **$260,000–$570,000** |
+
+*The optional funded arm is what turns an accounting exercise into a real distribution test. It should stay small and voluntary until the rules survive review.*
+
+### What we measure
+
+| Question | Metric | Target |
+|---|---|---|
+| Can source bases be measured? | Assessment completion rate; valuation error vs. independent audit | High completion; error within published bound |
+| Who bears the cost? | Incidence by income, wealth, tenancy, business size, and protected status | Burden does not shift onto ordinary households |
+| Does dignity hold? | Data fields required per participant; appeals burden; false inclusion/exclusion rate | Minimal data; usable appeals; low error |
+| Do protections work? | Ordinary balances, tools, homes, reserves, and protected associations wrongly swept in | Rare; corrected quickly |
+| Does avoidance work? | Red-team value hidden, moved, under-valued, or sheltered | Minimal; every route documented |
+| Does external capital arbitrage work? | Modeled base erosion from migration, shell ownership, or capital flight | Bounded; triggers review if material |
+| Does distribution reach everyone? | Successful Universal Stake delivery; time-to-recovery for failed delivery | High delivery; recovery within published window |
+| Does non-convertibility hold? | Stake sold, assigned, garnished, pledged, or traded for civic/survival/legal advantage | Zero successful durable routes |
+| Does politics capture it? | Targeted exclusions, bonuses, district favoritism, patronage patterns | None detectable; all allegations reviewable |
+| Is it understood? | % of participants who can explain who pays, who receives, and what cannot be bought | Majority, after disclosure |
+
+### What failure looks like
+
+- **Incidence inverts** — renters, workers, ordinary savers, small operators, or protected associations bear the practical burden while rent-holders escape.
+- **Dignity fails** — assessment requires broad personal surveillance, invasive household reporting, or unusable appeals.
+- **Valuation hiding wins** — the red-team can cheaply understate land/location value, concessions, licenses, network rents, or succession transfers.
+- **External-capital arbitrage wins** — ownership migrates on paper, local productive investment falls, or the base erodes faster than the public return can stabilize.
+- **Eligibility becomes political** — membership, exclusions, bonuses, or appeals are steered toward favored people, factions, districts, donors, or allies.
+- **Distribution rails fail** — digitally fragile or disputed members miss the stake, or recovery is slow enough to make universality false.
+- **Non-convertibility fails** — the stake becomes tradable, assignable, garnishable, collateralizable, or useful for buying Voice, office, survival priority, membership, legal standing, or public favor.
+- **Participants cannot explain the system** after full disclosure. If ordinary people cannot tell the difference between shared-value return and a tax on ordinary life, the political-economy claim fails regardless of the math.
+
+The cautionary precedent here is not Wörgl being shut down by a central bank. It is the broader record of wealth and land-value taxes being undermined by assessment difficulty, capital flight, exemptions for friends, and public distrust. If the pilot reproduces those patterns at small scale, the design must answer them before any real collection is contemplated.
+
+### What success looks like
+
+- A clear source-base map with bounded valuation error.
+- Incidence that stays away from ordinary households, working balances, tools, protected homes, and protected associations.
+- A red-team that finds some routes, but no cheap and general route around the system.
+- Universal Stake distribution that reaches members reliably, including edge cases.
+- No successful conversion of Universal Stake into Voice, office, survival priority, membership, legal standing, or public favor.
+- A public record clear enough that ordinary participants can explain who pays, who receives, and what is protected.
+
+Success justifies the roadmap's next step: a larger simulation with real administrative data, real asset distributions, and external adversaries — still simulation-only until incidence, dignity, avoidance, distribution, and non-convertibility are proven under pressure.
+
+### Open questions this pilot does not resolve
+
+- Does source-base assessment survive contact with sophisticated wealth-holders and their advisors, rather than volunteers and modeled concessions?
+- Can Commons Return be collected at useful scale without capital flight, under-building, under-maintenance, or jurisdiction-shopping eroding the base?
+- What mix of proceeds should support Essential Access rails, Shared Storehouse reserves, Universal Stake, and any passive social wealth fund?
+- What are the right protected thresholds for homes, tools, reserves, associations, and succession transfers?
+- Can eligibility be universal without making membership itself buyable, inheritable, or politically manipulated?
+
+---
+
+## Pilot C — Voice (bounded civic priority)
+
+*Voice is the most politically sensitive instrument. It is not a vote — it is a bounded, expiring claim to put one issue onto the table for a real hearing. The testable features are two: whether people use it on things that matter to them, and whether the inability to buy, stockpile, or accumulate it keeps it from hardening into a status score.*
+
+> **Where this sits in the corpus**
+> - Voice is defined in [Annex Z](../annexes/ANNEX_Z.md), whose core move is to **separate Voice from Service Record** so that "civic agenda influence and eligibility to serve cannot become one accumulative status score." That separation — not the token mechanics — is the thing this pilot most needs to prove.
+> - The capture and hardening risks are threats T-004, T-008, T-009, T-011, patched by P-008, P-009, P-024 (see [Annex Z](../annexes/ANNEX_Z.md) and the [Provenance Map](../governance/Provenance_Map.md)).
+> - The political failure mode the pilot must watch for — *people reading Voice as social credit* — is named directly in the Phase 1 comprehension track of the [Pilot Evidence Roadmap](../governance/Pilot_Evidence_Roadmap.md).
+
+### What we're testing
+
+Three claims, in order of how much a skeptic should doubt them:
+
+1. **Voice is non-accumulative.** It expires. You cannot save it up, and you cannot hold more of it than your neighbor. The design's whole defense against a civic oligarchy is that influence does not compound. The pilot tests whether an expiring, equal, non-transferable claim *stays* equal under real social pressure — or whether informal markets, bloc-trading, and "lend me your Voice" arrangements quietly reconstitute accumulation.
+2. **Voice does not become a status score.** Per [Annex Z](../annexes/ANNEX_Z.md), Voice must stay separate from any record of who has served or contributed. The pilot keeps the two ledgers physically separate and watches for leakage — does using (or not using) Voice start to read as a reputation signal?
+3. **Voice changes who is heard.** The payoff claim: a bounded priority claim, handed equally to everyone, surfaces issues that the usual loud-voices process buries.
+
+### The hypothesis
+
+> In a community of 200–500 people making real shared decisions over four quarterly cycles, an equal, non-transferable, expiring Voice claim will (a) be used at meaningfully higher rates by normally-disengaged participants than the standard open-comment process; (b) show no correlation between Voice use and wealth, seniority, or institutional status; and (c) resist accumulation — successful transfers, bloc-trades, and stockpiling attempts stay negligible — without participants coming to treat Voice as a social-credit rank.
+
+### Smallest deployment
+
+**A housing cooperative, a small municipality, or a university residential community of 200–500 members** that makes genuine shared decisions (budget lines, facilities, policies) — the realism depends on the decisions actually mattering. A toy decision produces toy data.
+
+Each participant receives **one Voice claim per quarter**. It is equal, non-transferable, cannot be bought or sold, and **expires at quarter's end if unused**. A participant spends it to elevate one issue into a guaranteed formal hearing — not to decide it. The community's normal process still makes the actual decision; Voice only controls what gets onto the agenda.
+
+The pilot runs **four cycles (one year)** as an A/B/A/B design:
+
+- **Cycles 1 & 3 (baseline):** the community's normal agenda-setting process.
+- **Cycles 2 & 4 (Voice active):** Voice governs what reaches a hearing.
+
+Alternating isolates what Voice changes from what the community would have done anyway. A separate, sealed ledger records contribution/service activity **without** linking it to Voice use — the deliberate test of the Annex Z separation.
+
+A **red-team of participants** is openly invited to try to break the non-accumulation rule: pool their claims, trade them for favors, build a voting bloc. Every successful breach is a finding about how the wall fails in the wild, not a disqualification.
+
+### Rough cost
+
+| Item | Estimate |
+|---|---|
+| Voice allocation infrastructure (software or paper) + sealed-ledger separation | $15,000–$35,000 |
+| Facilitation, process design, A/B cycle administration | $25,000–$50,000 |
+| Independent review, data collection, comprehension survey | $35,000–$60,000 |
+| **Total** | **$75,000–$145,000** |
+
+### What we measure
+
+| Question | Metric | Target |
+|---|---|---|
+| Does it reach the disengaged? | Voice-use rate among normally-inactive members vs. their baseline-cycle participation | Meaningfully higher |
+| Is it equal? | Correlation of Voice use with wealth, seniority, status | None significant |
+| Does it surface different issues? | Overlap between Voice-elevated agenda and baseline-cycle agenda | Substantially different |
+| **Does non-accumulation hold?** | Successful transfers, bloc-trades, stockpiling attempts (red-team + organic) | Negligible; all routes documented |
+| Does it stay separate from status? | Evidence Voice use is read as reputation; leakage between the two ledgers | None detectable |
+| Is it understood, not feared? | % who can explain Voice correctly; % who mistake it for social credit | Majority correct; few misreads |
+| Is it consequential? | Do Voice-elevated issues get genuine hearings with visible outcomes? | Yes, every cycle |
+
+### What failure looks like
+
+- Voice use is dominated by the same people who already dominate the standard process — the instrument is not redistributing who is heard.
+- More than a negligible share of Voice claims are successfully transferred, pooled, or bloc-traded — the **non-accumulation wall is leaking**, which is the failure that matters most, because accumulation is exactly what Voice exists to prevent.
+- Voice use starts functioning as a reputation signal, or the sealed contribution ledger visibly bleeds into civic standing — the [Annex Z](../annexes/ANNEX_Z.md) separation has failed.
+- Participants consistently describe Voice as "social credit" or a loyalty score after disclosure — the political-economy read has gone wrong regardless of the mechanics.
+- Voice feels performative: issues are elevated and then go nowhere.
+
+### What success looks like
+
+- Disengaged members use Voice at rates well above their baseline participation.
+- No correlation between Voice use and wealth or status.
+- The Voice agenda is visibly different from the loud-voices agenda.
+- Accumulation attempts — including a motivated red-team's — mostly fail, and the few that work are specific and patchable.
+- Participants describe Voice accurately and do not confuse it with a ranking system.
+
+Success justifies a larger pilot where Voice governs higher-stakes, contested decisions and faces organized factional pressure — the condition under which accumulation incentives are strongest.
+
+### Open questions this pilot does not resolve
+
+- Does the non-accumulation wall survive **organized factional politics** at city or regional scale, where the incentive to corner Voice is far higher than in a cooperative?
+- Does Voice scale without becoming a bureaucratic process that excludes people who can't navigate paperwork — re-creating the exclusion it was meant to remove?
+- What is the right cycle length and claim frequency? Quarterly is a guess, not a finding.
+- How does Voice interface with existing representative/legal governance? This varies by jurisdiction and is a political question, not a design one.
+
+---
+
+## Pilot D — Service Record (rotating public roles)
+
+*Service Record is the hardest instrument to pilot and the one most likely to be misread. Unlike Voice, it is **allowed** to accumulate — it tracks who has contributed, and that record supports eligibility to serve. That is also its danger: an accumulating contribution record is one weak firewall away from becoming a social-credit hierarchy. The testable feature is whether rotating eligibility based on contribution can broaden who holds authority **without** the record monopolizing access, crowding out ordinary challenger routes, or leaking into market advantage, survival preference, or civic voice.*
+
+> **Where this sits in the corpus**
+> - Service Record is defined alongside Voice in [Annex Z](../annexes/ANNEX_Z.md) — and the central rule is the **firewall between them**: a contribution record may support eligibility to serve, but it may never convert into agenda-setting Voice, market advantage, survival-adjacent preference, or a closed civic priesthood.
+> - The prohibited convertibility patterns — including **employer-sponsored contribution accumulation** and **side queues** — are enumerated in [Annex AJ](../annexes/ANNEX_AJ.md) (threat T-001 / patch P-001, shadow convertibility).
+> - The two attacks the pilot must red-team are **elite-formation bypass** (T-008 / P-008) and **contribution fraud / attestation rings** (T-009 / P-009). Their defenses are attestation staking ([Annex AS](../annexes/ANNEX_AS.md)) and grace-exploitation closure ([Annex AF](../annexes/ANNEX_AF.md)).
+
+### What we're testing
+
+1. **Does contribution-supported eligibility broaden the pool?** The payoff claim — that eligibility informed by *showing up and contributing* surfaces a more diverse set of people for authority than self-nomination, election, or appointment alone, which reward wealth, free time, and willingness to campaign.
+2. **Does the firewall hold?** Per [Annex Z](../annexes/ANNEX_Z.md) and [Annex AJ](../annexes/ANNEX_AJ.md), a high Service Record must buy you *nothing* except eligibility to serve — not a better spot in any queue, not market preference, not extra Voice. This is the wall the pilot exists to stress.
+3. **Does it resist capture?** The named attacks are concrete: an employer farming contribution credit for its people, an attestation ring vouching for each other's fake contributions, a clique cycling fake-hardship pauses to preserve eligibility without contributing. The pilot pays a red-team to run all three.
+
+### The hypothesis
+
+> In a community with real rotating governance roles, over 24 months, contribution-supported eligibility — with peer attestation backed by stake and ordinary challenger routes preserved — will produce a measurably more diverse pool of role-holders than the prior selection method, with no decline in governance quality; and the Service Record will not become convertible: a motivated red-team's attempts to turn a high record into market advantage, queue preference, extra Voice, or captured eligibility (via employer farming, attestation rings, or fake-hardship pauses) will mostly fail and be detectable.
+
+### Smallest deployment
+
+**A nonprofit board, a cooperative, a homeowners' association, or a small municipal committee** with 3–7 rotating roles and 50–200 eligible members. Over 24 months, eligibility for each role is supported by a Service Record — a transparent log of contributions to shared governance (meeting attendance, completed tasks, dispute-resolution participation) — while at least one ordinary challenger, lived-experience, sortition, or appeal route remains open where the role requires it.
+
+This is explicitly **not** about selecting the most qualified person. It is about ensuring the *eligible pool* is not pre-filtered by wealth, connection, or willingness to campaign. The community retains normal selection within the eligible pool.
+
+Two design elements are tested, not assumed:
+
+- **Attestation with stake ([Annex AS](../annexes/ANNEX_AS.md)).** Contributions are vouched for by peers who put a portion of their own civic standing at risk when they attest. A lightweight version of this is testable here, and it is the main defense against attestation rings.
+- **The firewall ([Annex Z](../annexes/ANNEX_Z.md) / [AJ](../annexes/ANNEX_AJ.md)).** The Service Record ledger is kept strictly separate from Voice (Pilot C's sealed ledger, if co-located) and confers no benefit anywhere except role eligibility.
+
+A **red-team of participants** is openly tasked with three jobs: farm contribution credit through an "employer" proxy, build an attestation ring, and cycle fake-hardship pauses to hold eligibility without contributing. Every success is a finding.
+
+### Rough cost
+
+| Item | Estimate |
+|---|---|
+| Service Record + attestation-staking system (ledger or software) | $15,000–$35,000 |
+| Process design, facilitation, 24-month administration | $25,000–$50,000 |
+| Adversarial red-team (capture / ring / fake-hardship testing) | $30,000–$60,000 |
+| Independent review, data collection, comprehension survey | $35,000–$60,000 |
+| **Total** | **$105,000–$205,000** |
+
+### What we measure
+
+| Question | Metric | Target |
+|---|---|---|
+| Does the pool broaden? | Diversity of the eligible pool (income, background, prior governance experience) vs. prior method | Measurably more diverse |
+| Does service participation rise? | Contribution rate among previously-uninvolved members | Increases |
+| Does the record change outcomes, or just the pool? | Who is actually selected from the eligible pool | Pool effect distinguishable from selection effect |
+| Is governance quality preserved? | Decision quality, time-to-decision, conflict rate vs. baseline (independent review + satisfaction) | Maintained or improved |
+| **Does the firewall hold?** | Red-team conversions of Service Record into market advantage, queue preference, or Voice | Negligible; every route documented |
+| Do attestation rings survive staking? | Fake contributions that pass staked peer attestation | Minimal; staking detectably raises the cost |
+| Is fake-hardship capture closed? | Eligibility preserved through pause-cycling without genuine contribution | Detected and bounded |
+| Is it understood, not feared? | % who read Service Record as social credit after disclosure | Few |
+
+### What failure looks like
+
+- The eligible pool is no more diverse than self-nomination — the mechanism is not changing who can serve.
+- Governance quality declines materially — diversity is coming at a real cost the design has to answer for.
+- **The firewall leaks:** the red-team reliably turns a high Service Record into market advantage, queue preference, or extra Voice. This is the failure that matters most — it means Service Record has become the accumulative status score [Annex Z](../annexes/ANNEX_Z.md) exists to prevent.
+- Attestation rings pass staked attestation cheaply, or employer-farmed contribution credit is undetectable — the [Annex AJ](../annexes/ANNEX_AJ.md) / [AS](../annexes/ANNEX_AS.md) defenses do not hold at this scale.
+- Fake-hardship pause-cycling preserves elite eligibility without contribution ([Annex AF](../annexes/ANNEX_AF.md) failure).
+- Participants describe Service Record as "social credit" after disclosure.
+
+### What success looks like
+
+- A demonstrably broader eligible pool, with governance quality held or improved.
+- Participation rises when contribution visibly builds eligibility.
+- The red-team's conversion attempts mostly fail; the successes are specific, named, and patchable.
+- Staked attestation measurably raises the cost of fake contribution.
+- Participants describe Service Record accurately and do not confuse eligibility with rank or reward.
+
+Success justifies a larger pilot with higher-stakes roles and a genuinely adversarial capture environment — where the payoff for breaching the firewall is large enough to attract serious effort.
+
+### Open questions this pilot does not resolve
+
+- Does contribution-supported eligibility scale to **high-stakes roles** (judges, regulators) without producing governance failure or new capture incentives?
+- Does the firewall survive when the reward for breaching it is large — a powerful employer or faction with real resources, not a volunteer red-team?
+- How is the Service Record verified at population scale? A small ledger works here; the infrastructure for a city does not yet exist.
+- **Note on a design constraint, not an open question:** whether contributing should *also* generate Voice priority is *not* open — [Annex Z](../annexes/ANNEX_Z.md) forbids it by design. The pilot tests whether that separation **holds in practice**, not whether to relax it.
+
+---
+
+## How the pilots connect
+
+These are four separate pilots, not one. They can run independently, in different communities, at different times. But they are designed to eventually connect:
+
+- **Essential Access + Shared Storehouse (Pilot A)** is the foundation. It answers: can we guarantee survival regardless of market position?
+- **Commons Return + Universal Stake (Pilot B)** tests the proposed public-return and distribution lane. Commons Return may help fund Essential Access rails, Shared Storehouse reserves, Universal Stake, or a passive public wealth fund, but only if incidence, dignity, avoidance, distribution, and non-convertibility hold under pressure.
+- **Voice (Pilot C)** governs the foundation. Who decides how Essential Access is calibrated, what counts as a shortage, and how Shared Storehouse distributes? Without Voice, someone with power decides — and that power concentrates.
+- **Service Record (Pilot D)** determines who holds Voice-adjacent authority. Without rotation, the people who administer Essential Access and manage the Shared Storehouse tend to stay in place, and power concentrates again.
+
+The walls between the lanes are only testable when the lanes exist alongside each other. The integrated test — life access, market exchange, public return, scarcity response, Voice, and Service Record in one community — is the large-scale pilot that these four smaller pilots are designed to make possible.
+
+---
+
+## What we would learn from all four pilots together
+
+If all four pilots run and generate honest data, we would know:
+
+1. Whether a guaranteed survival floor can operate without collapsing under gaming or administrative failure
+2. Whether a rationing mechanism can distribute fairly under real scarcity without black markets forming
+3. Whether Commons Return can be assessed on shared and scarcity-created value — sparing ordinary households, tools, homes, reserves, and protected associations — without avoidance, valuation hiding, external-capital arbitrage, or political capture
+4. Whether bounded, non-transferable civic priority changes who actually has influence in public decisions
+5. Whether rotating eligibility for governance roles produces more diverse leadership without degrading governance quality
+
+We would not yet know whether the protected lanes work *together*, whether they scale beyond a few hundred people, or whether they survive sustained, organized attacks. Those questions require the large-scale pilot that is not described here.
+
+---
+
+## Honest limitations of this proposal
+
+**We do not know if these pilots are legally possible in existing jurisdictions.** Some mechanisms — local currencies, alternative governance structures — require regulatory clearance that varies by location. Legal review is required before any pilot begins.
+
+**We do not know the right parameters.** Commons Return source bases and rates, protected thresholds, Universal Stake cadence, Voice cycle length, and Service Record contribution weights are all design estimates. The pilots will calibrate them. The numbers in this document are starting points, not findings.
+
+**We do not know who will run these pilots.** This proposal needs a partner — a community, an institution, or an organization willing to participate. Without a willing host, the pilots cannot happen.
+
+**The pilots are not representative.** Early participants will be unusually motivated. Communities that volunteer to run these pilots are not typical communities. The results will be real but may not generalize. Generalizability requires a later, larger, and less self-selected test.
+
+---
+
+## What to do with this document
+
+If you are a **researcher**, the open questions sections are the research agenda. Each one is a question the pilot cannot answer on its own.
+
+If you are a **funder**, the four pilot budgets total roughly **$790,000–$1,780,000** for an 18–24 month program (Pilot A $350k–860k; Pilot B $260k–570k; Pilot C $75k–145k; Pilot D $105k–205k). That is a small number for the question being asked. For comparison, the Finland UBI pilot (2017–2018) cost approximately €20 million. The single most important pilot, and the place to start, is **Pilot A** — it tests the survival floor and the non-convertibility wall that the entire design rests on.
+
+If you are a **community**, the smallest useful starting point is Pilot A — Essential Access + Shared Storehouse — because it tests the most fundamental claim: that a guaranteed survival floor is possible without collapsing under real conditions.
+
+If you are a **skeptic**, the failure criteria are listed explicitly in each section. Any of them would force us to say publicly that the mechanism does not work as designed. That is the commitment this proposal makes.
+
+---
+
+*This document is a rough draft. It will be revised as the design is tested. Feedback, objections, and alternative framings are welcome. See [Start Here](00_start_here.md) for the full project overview and [Claims & Evidence](../governance/Claims_Evidence_Register.md) for the current status of each mechanism's evidence base.*
diff --git a/docs/public/10_real_world_examples.md b/docs/public/10_real_world_examples.md
new file mode 100644
index 0000000..2aa2905
--- /dev/null
+++ b/docs/public/10_real_world_examples.md
@@ -0,0 +1,169 @@
+# Real-World Examples Guide
+
+> **At a glance**
+> | | |
+> |---|---|
+> | **What this is** | A short guide to real problems, real attempts, and what this project learns from them. |
+> | **Who it is for** | New readers, skeptics, reviewers, and anyone asking "hasn't this been tried before?" |
+> | **How to read it** | Treat every example as a comparator, not proof. History can warn, pressure-test, and correct. It cannot certify this design. |
+> | **Core caution** | No example below implies divine endorsement of this project. Christ-centered lessons are read as dignity, mercy, humility, truthfulness, and fruit, not theocracy. |
+
+## The short version
+
+The Humane Constitution is not built from one historical model. It is a channel-separation design: survival access, ordinary markets, public return, civic voice, and public service are kept in separate lanes so one kind of advantage cannot buy every other kind.
+
+The active public-finance direction is **Commons Return and Universal Stake**:
+
+- **Commons Return:** when someone receives exclusive control over value created by land, nature, public law, public infrastructure, monopoly privilege, network position, public concession, or large inheritance, part of that value returns to the public.
+- **Universal Stake:** every member receives a protected stake, dividend, or endowment from that public return. It cannot buy Voice, office, survival priority, membership, legal standing, or public favor.
+
+Demurrage, stamp scrip, and local-currency experiments are useful history. They are not the active wealth spine of this project. The live Annex D instrument is [Commons Return and Universal Stake](../annexes/ANNEX_D.md), and its evidence burden is tracked in the [Commons Return and Universal Stake Evidence Test Package](../governance/Commons_Return_Universal_Stake_Evidence_Test_Package.md).
+
+## How to use these examples
+
+Ask four questions of each case:
+
+1. What real problem was it trying to answer?
+2. What actually worked?
+3. What failed, or what stayed unproven?
+4. Which project mechanism learns from it?
+
+That last question matters. The project should not borrow the romance of a historical success while ignoring the conditions that made it work, or the reasons it failed.
+
+## Jubilee and debt release
+
+**The real problem:** debt and land loss can turn a temporary setback into permanent family disadvantage. A household loses land, then loses bargaining power, then passes the loss to children who had no part in the original debt.
+
+**The historical example:** the Jubilee law in Leviticus 25 describes a periodic reset: land returns, debts are released, and people who sold themselves into service go free. The text treats land as stewardship rather than permanent private dominion. It also refuses the idea that one bad season should become an inherited caste.
+
+**What succeeded:** as a moral and legal pattern, Jubilee names the right problem clearly. It says accumulation can become domination, and it puts a reset rule inside the system rather than leaving mercy to private charity.
+
+**What failed or stays uncertain:** historians debate how fully Jubilee was practiced. A modern civil system cannot simply claim to enact biblical Jubilee. It can learn from the mercy, stewardship, debt-release, and anti-permanence logic, but it remains a human instrument subject to correction.
+
+**Project mapping:** this points to [Commons Return and Universal Stake](../annexes/ANNEX_D.md), succession controls, anti-rent rules, and limits on predatory debt. It also warns the project not to turn debt relief into moral theater. The fruit test is simple: are people actually less trapped, or did the system just rename the trap?
+
+**Source trail:** see [Useful History](08_useful_history.md) and the [Christ-Centered Evaluation](../governance/Christ_Centered_Evaluation.md).
+
+## Early church sharing and voluntary care
+
+**The real problem:** people can be abandoned even inside a community that claims to value them. Need becomes invisible when help depends on status, family power, or market success.
+
+**The historical example:** the early church is described in Acts as sharing possessions, caring for widows, and making sure people in need were not left alone. This was not a neutral state program. It was a voluntary covenant community trying to live out mercy and mutual care.
+
+**What succeeded:** care was personal, local, and dignity-centered. The poor were not treated as economic waste. The community saw survival need as a shared responsibility, not a private embarrassment.
+
+**What failed or stays limited:** voluntary church sharing is not a plug-in model for civil government. It cannot justify coercive religious rule, forced membership, religious tests, or surveillance of private life. It also depends on trust, discipline, and local relationship in ways a large bureaucracy cannot copy.
+
+**Project mapping:** this supports the project rule that Essential Access is a floor, not a replacement for community. The corpus protects mutual-aid, church, cooperative, and community holdings unless they become avoidance shells. The system should support pre-existing care networks, not displace them.
+
+**Source trail:** see [Life and Rights](05_life_and_rights.md), [Annex D](../annexes/ANNEX_D.md), and the [Fairness Vignette Library](../governance/Fairness_Vignette_Library.md).
+
+## Wörgl and demurrage
+
+**The real problem:** in a depression, money can stop moving. People need work, local projects need labor, and useful exchange stalls because everyone is scared to spend.
+
+**The historical example:** Wörgl, Austria ran a local scrip experiment in 1932-33. The certificates carried a small monthly stamp cost, often called demurrage, which encouraged holders to spend rather than hoard. Local public works accelerated, and the experiment became famous.
+
+**What succeeded:** Wörgl is evidence that money rules shape behavior. Local currency design can change circulation, especially in a small community under stress.
+
+**What failed or stays limited:** Wörgl was small, emergency-shaped, and shut down by the central bank. It does not prove that routine per-balance charges are just, scalable, or dignity-preserving. Demurrage can also become too blunt: it may punish ordinary working balances, require intrusive classification, or overload one money rule with too many jobs.
+
+**Project mapping:** demurrage is a comparator, not the active proposal. The current design keeps ordinary Flow as market money and uses Commons Return for public value created by shared or scarcity-created sources. Pilot B is therefore not a local-currency pilot. It is a Commons Return and Universal Stake simulation.
+
+**Source trail:** see [Useful History](08_useful_history.md), [A Minimal Pilot Proposal](09_pilot_proposal.md), and [Annex D](../annexes/ANNEX_D.md).
+
+## Alaska Permanent Fund and public dividends
+
+**The real problem:** natural-resource wealth can become private extraction, short-term budget fuel, or political patronage. A public resource can be spent before the public ever sees the benefit.
+
+**The historical example:** Alaska created a public fund from oil-resource revenue and pays residents a recurring Permanent Fund Dividend. The corpus treats this as an outside analogue for public dividend administration and public wealth fund structure.
+
+**What succeeded:** the Alaska model shows that a public fund can be visible, audited, and linked to direct resident distribution. It also gives practical evidence that a recurring public dividend can be administered at population scale.
+
+**What failed or stays limited:** Alaska is oil-dependent and politically contested. Its dividend is not this project's Universal Stake. It does not prove non-garnishability, non-assignment, non-convertibility into civic power, or freedom from political capture.
+
+**Project mapping:** this informs the Universal Stake distribution rail, the public lockbox idea, and anti-patronage design. It does not lower the project's evidence burden. The project still has to prove incidence, dignity, eligibility, distribution reliability, and non-convertibility.
+
+**Source trail:** see the [External Evidence Register](../governance/External_Evidence_Register.md), [Annex D](../annexes/ANNEX_D.md), and the [Claims and Evidence Register](../governance/Claims_Evidence_Register.md).
+
+## Singapore and HDB-style housing
+
+**The real problem:** housing can become both a survival need and a speculative asset. When land and housing are left mostly to investment markets, people without capital can lose stable shelter even while buildings exist.
+
+**The historical example:** Singapore's public-housing model, associated with the Housing and Development Board, shows that land policy, public finance, planning, and construction can be coordinated at large scale. It is a useful comparator for housing as infrastructure rather than housing only as an asset market.
+
+**What succeeded:** the broad lesson is coordination. Housing outcomes change when land, finance, construction, and public purpose are aligned instead of left to fragmented speculation.
+
+**What failed or stays limited:** Singapore also warns against overcentralization. A competent central state can deliver housing, but it can also narrow exit, speech, and local self-rule. A housing system can protect dignity materially while still creating political dependence if residents cannot challenge the authority that houses them.
+
+**Project mapping:** this points to Essential Access, housing continuity, land/location Commons Return, anti-rent rules, and dignity review. The project should learn from public coordination without copying political centralization. Housing must not become a loyalty gate.
+
+**Source trail:** see [Useful History](08_useful_history.md), [Annex J](../annexes/ANNEX_J.md), and the [Christ-Centered Evaluation](../governance/Christ_Centered_Evaluation.md).
+
+## Rationing during wars and disasters
+
+**The real problem:** when there is genuinely not enough, price decides who goes without unless another rule replaces it. Under true scarcity, rationing happens either openly or through money, favoritism, panic, and black markets.
+
+**The historical examples:** UK wartime rationing is the positive comparator: simple, universal, public, and ended when scarcity ended. Soviet privilege stores, Venezuela's politicized shortage distribution, and Hurricane Katrina response failures are negative comparators.
+
+**What succeeded:** rationing can work when it is transparent, universal, time-limited, and morally legible. People tolerate hard limits better when the powerful live under the same rule.
+
+**What failed:** rationing rots when officials are exempt, when scarcity claims cannot be challenged, when the rules hide party favoritism, or when emergency powers become normal administration.
+
+**Project mapping:** this is the job of Shared Storehouse and capacity measurement. The system must prove that shortage declarations are honest, challengeable, and temporary. It must also prove that rationing beats panic prices without creating black markets or hidden privilege.
+
+**Source trail:** see [Useful History](08_useful_history.md), [A Minimal Pilot Proposal](09_pilot_proposal.md), [Annex M](../annexes/ANNEX_M.md), and [Annex AQ](../annexes/ANNEX_AQ.md).
+
+## Co-ops and commons governance
+
+**The real problem:** shared resources can be destroyed by overuse, captured by insiders, or seized by distant managers who do not understand local conditions.
+
+**The historical examples:** Elinor Ostrom's commons research shows that durable commons need boundaries, monitoring, sanctions, conflict resolution, local rule participation, and nested governance. Mondragon shows a worker-owned cooperative network can last across generations. Medieval guilds show the warning side: mutual aid and quality control can harden into insider privilege.
+
+**What succeeded:** shared governance works best when members know the rules, help shape them, monitor each other, and have usable conflict paths. Worker ownership can keep capital from treating workers as disposable inputs.
+
+**What failed:** co-ops, guilds, and commons can all become closed clubs. The people inside protect each other. The people outside face a locked door.
+
+**Project mapping:** this informs Voice, Service Record, subsidiarity, protected associations, and the anti-capture gates around Commons Return. The project must recognize care work, mutual aid, spiritual community leadership, and informal service without turning contribution into a social rank.
+
+**Source trail:** see [Useful History](08_useful_history.md), the [Architecture Source Map](../governance/Architecture_Source_Map.md), [Annex D](../annexes/ANNEX_D.md), and [Annex K](../annexes/ANNEX_K.md).
+
+## Regulatory capture and oligarchy
+
+**The real problem:** concentrated wealth does not stay only economic. It buys lawyers, lobbyists, media influence, favorable rules, soft enforcement, and eventually the definition of what counts as legal.
+
+**The historical examples:** the Gilded Age, post-Soviet oligarchs, dynastic banking influence, Citizens United, offshore leaks, and ordinary regulatory capture all show the same pattern. It does not require a secret conspiracy. Legal influence can be enough.
+
+**What succeeded:** antitrust, public integrity systems, beneficial-ownership rules, independent review, and real prosecutions can sometimes push back. Iceland's post-2008 accountability response is one useful comparator in the local history file.
+
+**What failed:** rules fail when the regulated industry staffs the regulator, when campaign money shapes law, when ownership hides behind shells, or when enforcement depends on the same institutions that profit from non-enforcement.
+
+**Project mapping:** this is why Flow, Voice, Service Record, Commons Return, Universal Stake, public records, beneficial-control review, and capture dashboards have to be separated. It is also why no public-return system should be trusted without anti-patronage gates and appeal rights.
+
+**Source trail:** see [Useful History](08_useful_history.md), the [Capture Dashboard Specification](../governance/Capture_Dashboard_Specification.md), [Annex D](../annexes/ANNEX_D.md), and the [Claims and Evidence Register](../governance/Claims_Evidence_Register.md).
+
+## What these examples do not prove
+
+They do not prove that the Humane Constitution works.
+
+They do prove that the problems are real:
+
+- markets without floors can leave people to die;
+- debt and land loss can compound across generations;
+- public resources can be privatized unless a return rule exists;
+- rationing can be fair or corrupt depending on design;
+- co-ops and commons can serve dignity or become insider clubs;
+- wealth will try to become rule-power;
+- moral language can correct power, or be captured by power.
+
+That is enough to justify testing. It is not enough to justify deployment.
+
+The project is serious only if it keeps the examples in their proper place: as warnings, comparators, and pressure tests. The real question is still whether the proposed mechanisms can survive live pilots without bad fruit.
+
+## Where to go next
+
+- [Start Here](00_start_here.md) for the shortest overview.
+- [White Paper](04_white_paper.md) for the full public argument.
+- [Useful History](08_useful_history.md) for the longer history tour.
+- [A Minimal Pilot Proposal](09_pilot_proposal.md) for what the first tests would measure.
+- [Claims and Evidence Register](../governance/Claims_Evidence_Register.md) for what is designed, unproven, and still missing.
diff --git a/founding/commitments.md b/founding/commitments.md
index b6daf91..03cdd5f 100644
--- a/founding/commitments.md
+++ b/founding/commitments.md
@@ -23,11 +23,11 @@
 | **FC-033** | `ORACLE_ADVERSARIAL_SEATS_MIN` | 1 | 1 | per cohort | P-014 adversarial-panel analogue; structural requirement | Annex AL, Annex AI |
 | **FC-040** | `BRIBE_DETERRENCE_MULTIPLIER` | 2 | 5.0 | multiple of detected gain | At ≥85% detection, penalty = 5× gain produces expected value ≥ 4.25× gain — decisively deterrent | Annex AJ, Patch P-001 |
 | **FC-041** | `DETECTION_PROBABILITY_ASSUMED` | 2 | 0.85 | probability | Assumed detection rate for deterrence calculation; subject to pilot verification | Annex AJ |
-| **FC-050** | `FLOW_DEMURRAGE_RATE` | 2 | 0.5% / month | idle balance above exemption | Option B baseline; committed as single value rather than 0.25%–1.00% corridor to eliminate drift surface | Article V, `docs/SPECIFICATIONS.md` |
-| **FC-051** | `FLOW_DEMURRAGE_REVIEW_CORRIDOR` | 3 | ±0.25%/mo around FC-050 | post-first-year adjustment band | Allows calibration without re-opening Tier 2 amendment; max rate 0.75%/mo, min 0.25%/mo | Article V, `docs/SPECIFICATIONS.md` |
-| **FC-052** | `FLOW_IDLE_THRESHOLD_DAYS` | 2 | PROPOSED VALUE: 30 days — bind before activation | days | Idle-balance dwell time before demurrage begins. Simulation uses 30 days as provisional test value; 30 days provides adequate working capital for monthly payroll and household expenses while preventing long-duration passive hoarding; consistent with FC-050 monthly demurrage cadence | Article V, `docs/SPECIFICATIONS.md` |
+| **FC-050** | `FLOW_DEMURRAGE_RATE` | 2 | SUPERSEDED — dormant §D9 backstop parameter; no routine demurrage exists (ANNEX_D §D9.1). Former baseline 0.5%/month retained for the record; binds only if a §D9 revival patch passes its own evidence and amendment process | formerly: idle balance above exemption | The routine idle-balance demurrage model was replaced corpus-wide by Commons Return and Universal Stake (P-066, ANNEX_D). This ID is retained for numbering stability and would parametrize only the dormant §D9 backstop, which no interpretation may activate | ANNEX_D §D9 (dormant); formerly Article V, `docs/SPECIFICATIONS.md` |
+| **FC-051** | `FLOW_DEMURRAGE_REVIEW_CORRIDOR` | 3 | SUPERSEDED — dormant §D9 backstop parameter (see FC-050). Former corridor ±0.25%/mo retained for the record | formerly: post-first-year adjustment band | Calibration corridor for the superseded routine demurrage; dormant with FC-050 | ANNEX_D §D9 (dormant); formerly Article V, `docs/SPECIFICATIONS.md` |
+| **FC-052** | `FLOW_IDLE_THRESHOLD_DAYS` | 2 | SUPERSEDED — dormant §D9 backstop parameter (see FC-050). Former proposed value 30 days retained for the record | formerly: days | Idle-balance dwell time for the superseded routine demurrage; dormant with FC-050 | ANNEX_D §D9 (dormant); formerly Article V, `docs/SPECIFICATIONS.md` |
 | **FC-053** | `FLOW_RETIREMENT_EPSILON` | 2 | PROPOSED VALUE: 0.01 Flow — bind before activation | Flow | Minimum residual Flow balance below which balances retire from circulation. Balances below this threshold are functionally zero and should retire to prevent ledger bloat; 0.01 Flow is well below any meaningful purchasing power | Article V, `docs/SPECIFICATIONS.md` |
-| **FC-054** | `PFCR_DEMURRAGE_ROUTING_SHARE` | 2 | PROPOSED VALUE: 0.65 (65% to PFCR receipts, 35% permanent retirement) — bind before activation | fraction of demurrage charge | Published split between PFCR receipts and permanent retirement on demurrage application. 65% routing to PFCR provides stable public funding; 35% permanent retirement maintains circulation discipline; split calibrated to keep total Flow supply stable over a 10-year horizon under FC-050 demurrage rate | Article V, `docs/SPECIFICATIONS.md` |
+| **FC-054** | `PFCR_DEMURRAGE_ROUTING_SHARE` | 2 | SUPERSEDED — dormant §D9 backstop parameter (see FC-050). Former proposed split 0.65/0.35 retained for the record; Commons Return receipts route per ANNEX_D §D5 lockbox rules instead | formerly: fraction of demurrage charge | Routing split for the superseded routine demurrage; public-finance routing now lives in ANNEX_D §D5 (Commons Return), not in a demurrage charge | ANNEX_D §D9 (dormant), ANNEX_D §D5; formerly Article V, `docs/SPECIFICATIONS.md` |
 | **FC-055** | `FLOW_ISSUANCE_CEILING_FUNCTION` | 1 | RESERVED — bind before public issuance beyond pilot | formula | Binds the multiplier function relating verified productive commitments to maximum Flow in circulation | Article V, `docs/SPECIFICATIONS.md` |
 | **FC-056** | `ESSENTIAL_ACCESS_ENHANCED_ALLOCATION_RULE` | 2 | PROPOSED VALUE: 1.5× CSM floor for documented hardship; 2.0× CSM floor for medical necessity; maximum 90 days per rolling year without CRP review — bind before activation | rule / multiplier | Defines the lawful path above the CSM floor for hardship, emergency, or exceptional basket access. 1.5× covers enhanced dietary, mobility, or care needs; 2.0× covers medically necessary requirements; 90-day rolling cap prevents enhanced allocation from becoming baseline without review | Article III, `docs/SPECIFICATIONS.md` |
 | **FC-057** | `ESSENTIAL_ACCESS_VALIDITY_WINDOW_HOURS` | 2 | 72 | hours | Locks the initial Essential Access expiry window to the current constitutional baseline | Article III, `docs/SPECIFICATIONS.md` |
@@ -77,7 +77,7 @@
 | **FC-171** | `CC_FORCE_MAJEURE_SELF_CERT_DAYS` | 2 | RESERVED — bind before escrow launch | cumulative days per project | Maximum freeze duration available on contractor self-certification before higher verification tiers apply | Annex AR |
 | **FC-172** | `CC_FORCE_MAJEURE_THIRD_PARTY_DAYS` | 2 | RESERVED — bind before escrow launch | cumulative days per project | Maximum freeze duration available on third-party certification before panel review applies | Annex AR |
 | **FC-173** | `CC_FORCE_MAJEURE_PANEL_DAYS` | 2 | RESERVED — bind before escrow launch | cumulative days per project | Hard cap for force-majeure freeze duration before restructuring review replaces further freeze eligibility | Annex AR |
-| **FC-174** | `CC_ESSENTIAL_ACCESS_FORCE_MAJEURE_DURATION_CAP` | 2 | RESERVED — bind before escrow launch | fraction of contracted project duration | Prevents short Essential Access delivery projects from using an absolute freeze cap that functionally nullifies demurrage | Annex AR |
+| **FC-174** | `CC_ESSENTIAL_ACCESS_FORCE_MAJEURE_DURATION_CAP` | 2 | RESERVED — bind before escrow launch | fraction of contracted project duration | Prevents short Essential Access delivery projects from using an absolute freeze cap that functionally nullifies the deployment-delay consequence and Annex D source-base review | Annex AR |
 | **FC-175** | `CC_INSPECTOR_POOL_MIN_PILOT` | 2 | RESERVED — bind before escrow launch | qualified inspectors | Minimum inspector pool size for pilot / single-municipality deployment | Annex AR |
 | **FC-176** | `CC_INSPECTOR_POOL_MIN_REGIONAL` | 2 | RESERVED — bind before escrow launch | qualified inspectors | Minimum inspector pool size for regional deployment | Annex AR |
 | **FC-177** | `CC_INSPECTOR_POOL_MIN_NATIONAL_PER_REGION` | 2 | RESERVED — bind before escrow launch | qualified inspectors per region | Minimum inspector pool size for national / multi-regional deployment | Annex AR |
@@ -94,7 +94,7 @@
 | **FC-188** | `AT_SINGLE_SUPPLIER_WATCH_THRESHOLD` | 2 | RESERVED — bind by TSP before activation | % of category consumption | Single-supplier Watch trigger; draft value 25% | Annex AT §AT2 |
 | **FC-189** | `AT_SINGLE_SUPPLIER_CRITICAL_THRESHOLD` | 2 | RESERVED — bind by TSP before activation | % of category consumption | Single-supplier Critical trigger; draft value 60% | Annex AT §AT2 |
 | **FC-190** | `AT_FOREIGN_CAPITAL_INFLOW_LIMIT` | 2 | RESERVED — bind by TSP + Article V review before activation | % of annual Flow issuance | Foreign capital inflow concentration ceiling; draft value 15% | Annex AT §AT4 |
-| **FC-191** | `AT_FOREIGN_CAPITAL_CONVERSION_WINDOW` | 2 | RESERVED — bind by TSP + Article V review before activation | days before demurrage activates | Foreign capital conversion window; draft value 30 days | Annex AT §AT4 |
+| **FC-191** | `AT_FOREIGN_CAPITAL_CONVERSION_WINDOW` | 2 | RESERVED — bind by TSP + Article V review before activation | days before public-return review escalates | Foreign capital conversion window; draft value 30 days | Annex AT §AT4 |
 | **FC-192** | `AT_EXTRACTIVE_RECLASSIFICATION_WINDOW` | 2 | RESERVED — bind by TSP before activation | months | Observation window before extractive-pattern reclassification; draft value 12 months | Annex AT §AT5 |
 | **FC-193** | `AT_STAGE3_SUSPENSION_THRESHOLD` | 1 | RESERVED — bind by Article VI before activation | Article VI supermajority fraction | Stage 3 suspension ratification threshold; draft value two-thirds | Annex AT §AT5 |
 | **FC-194** | `AT_ESSENTIAL_FUEL_RESERVE_MIN` | 1 | RESERVED — bind before essential-sector activation | days by region and season | Essential fuel reserve minimum for refusal survivability; draft anchor 60-90 days | Annex AT; Essential-Sector Refusal Test Package |
@@ -105,6 +105,15 @@
 | **FC-199** | `AT_PBM_INTERMEDIARY_SEPARATION_THRESHOLD` | 1 | RESERVED — bind before medicine-access launch | % of cross-owned claims or dispensing volume | Separation/firewall trigger for PBM-style intermediaries; draft anchor review >10%, mandatory firewall >20% | Annex AT; Essential-Sector Refusal Test Package |
 | **FC-200** | `AT_CRITICAL_LOGISTICS_REDUNDANCY_FLOOR` | 1 | RESERVED — bind before logistics-dependent launch | independent routes / operators | Minimum independent logistics redundancy for essential regions; draft anchor two independent routes and operators | Annex AT; Essential-Sector Refusal Test Package |
 | **FC-201** | `AT_ESSENTIAL_DATA_CLAIMS_PORTABILITY_DEADLINE` | 2 | RESERVED — bind before medicine/logistics fallback activation | hours / days | Deadline for emergency and full transition export of essential records, claims, formularies, and routing data; draft anchor 24h emergency / 30d full package | Annex AT; Essential-Sector Refusal Test Package |
+| **FC-202** | `COMMONS_RETURN_SOURCE_BASES` | 1 | RESERVED — bind before CRUS activation | source-base list | Defines the allowed Commons Return bases: land/location value, natural resources, spectrum/airspace, monopoly licenses, unavoidable platform/network rents, high-value public concessions, and large succession transfers. Ordinary labor income, survival access, basic household exchange, ordinary working balances, ordinary household tools, protected below-threshold homes, and protected community/tribal/church holdings are excluded unless used as avoidance shells. The list is closed (INV-008): extending a base downward onto ordinary life is a Tier-1 amendment, never an administrative decision | Annex D, INVARIANTS.md INV-008, Parameter Calibration Register, Commons Return and Universal Stake Evidence Test Package |
+| **FC-203** | `COMMONS_RETURN_ASSESSMENT_RATE` | 2 | RESERVED — Tier-3 calibrated by source base before activation | rate schedule | Sets the Commons Return assessment rate by source base without making ordinary labor or survival access the funding base. Must test incidence, valuation hiding, external-capital arbitrage, and productive-stewardship effects before binding | Annex D, Parameter Calibration Register |
+| **FC-204** | `COMMONS_RETURN_PROTECTED_THRESHOLDS` | 2 | RESERVED — bind before CRUS activation | threshold schedule | Protects ordinary homes, ordinary tools, working balances, small stewardship, protected associations, and household exchange from assessment while preventing elite shelter through threshold splitting or avoidance shells | Annex D, Fairness Vignette Library, Parameter Calibration Register |
+| **FC-205** | `UNIVERSAL_STAKE_DISTRIBUTION_CADENCE` | 2 | RESERVED — bind before first distribution | cadence | Sets distribution timing for Universal Stake so households can rely on it and operators cannot time distributions as political reward or punishment. A distribution may be authorized only after the floor and its reserves are funded (INV-014) | Annex D, INVARIANTS.md INV-014, Claims and Evidence Register |
+| **FC-206** | `UNIVERSAL_STAKE_ELIGIBILITY_RULE` | 1 | RESERVED — bind before first distribution | eligibility rule | Keeps Universal Stake universal for members while prohibiting sale, assignment, garnishment, pledge, inheritance, membership purchase, survival-priority purchase, legal-standing purchase, office purchase, or Voice purchase | Annex D, Annex AK, Commons Return and Universal Stake Evidence Test Package |
+| **FC-207** | `CRUS_ANTI_CAPTURE_GATES` | 1 | RESERVED — bind before CRUS activation | gate bundle | Requires public accounting, no patronage discretion, no targeted political reward or punishment, data minimization, auditability, appeal rights, and ordinary-reader source reporting | Annex D, Capture Dashboard Specification, Abuse Case Library |
+| **FC-208** | `CRUS_PUBLIC_LOCKBOX_RESERVE_RULE` | 2 | RESERVED — bind before fund routing | reserve/draw rule | Defines reserve, draw, passive fund, and public-accounting rules for any lockbox or social wealth fund receiving Commons Return. Prevents fund managers from becoming patronage allocators or political investors | Annex D, Parameter Calibration Register |
+| **FC-209** | `CRUS_APPEAL_PATH` | 1 | RESERVED — bind before assessment or distribution | appeal path | Gives assessed source holders and excluded stake claimants a human appeal without allowing high-value actors to stall assessment through procedural delay | Annex D, Federated Ombuds, Claims and Evidence Register |
+| **FC-210** | `CRUS_REVIEW_CADENCE` | 2 | RESERVED — bind before CRUS activation | review cadence | Sets scheduled review of incidence, eligibility, valuation, source bases, distribution, reserves, and capture metrics. Missed cadence or missing data is itself a review failure | Annex D, Capture Dashboard Specification, Pilot Evidence Roadmap |
 | **FC-YT1** | `CSM_FAILURE_COUNT_THRESHOLD` | 2 | 3 | verified delivery failures per jurisdictional cluster per 30-day window | Pattern-detection trigger for H-3 refounding review initiation. Applies as a raw cluster count independently of FC-071's per-population rate (3 per 10,000 residents per 30 days); both thresholds apply concurrently. "Verified delivery failure" requires confirmation by at least one Tier-3 physical-sampling oracle node per ANNEX_Y §Y1. Federated Ombuds verification of this value required before INV-LAUNCH-1 clears. Pre-launch blocking gate. | ANNEX_Y §Y4 |
 | **FC-YT2** | `CSM_SURVIVAL_RESERVE_DAYS` | 2 | 90 | days of CSM coverage per enrolled population, by jurisdiction and essential category | CSM-specific reserve gate. Complements the general resilience reserve FC-070 (45 days); both must be independently satisfied. This value is the binding survival-floor-specific pre-launch gate. Federated Ombuds verification of this value required before INV-LAUNCH-1 clears. Pre-launch blocking gate. | ANNEX_Y §Y7 |
 
diff --git a/scripts/export_corpus.py b/scripts/export_corpus.py
index 7cdc99d..1bf9157 100644
--- a/scripts/export_corpus.py
+++ b/scripts/export_corpus.py
@@ -46,6 +46,7 @@
     "docs/governance/Anti_Rent_Legal_Wrapper_Evidence_Test_Package.md",
     "docs/governance/Demurrage_Evidence_Test_Package.md",
     "docs/governance/Commons_Return_Universal_Stake_Evidence_Test_Package.md",
+    "docs/governance/CRUS_Simulation_Protocol.md",
     "docs/governance/Productive_Status_Register.md",
     "docs/governance/Cyber_Resilience_Availability_Evidence_Test_Package.md",
     "docs/governance/Last_Resort_Unenrolled_Access_Evidence_Test_Package.md",
@@ -72,6 +73,8 @@
     "docs/public/04_white_paper.md",
     "docs/public/05_life_and_rights.md",
     "docs/public/08_useful_history.md",
+    "docs/public/09_pilot_proposal.md",
+    "docs/public/10_real_world_examples.md",
     "docs/simulations/Adversarial_Narrative_Simulation.md",
     "docs/simulations/Annual_Compound_Simulation.md",
     "founding/commitments.md",
@@ -194,6 +197,7 @@ def section_for(relative_path: str) -> str:
         "docs/governance/Anti_Rent_Legal_Wrapper_Evidence_Test_Package.md",
         "docs/governance/Demurrage_Evidence_Test_Package.md",
         "docs/governance/Commons_Return_Universal_Stake_Evidence_Test_Package.md",
+        "docs/governance/CRUS_Simulation_Protocol.md",
         "docs/governance/Productive_Status_Register.md",
         "docs/governance/Cyber_Resilience_Availability_Evidence_Test_Package.md",
         "docs/governance/Last_Resort_Unenrolled_Access_Evidence_Test_Package.md",
@@ -321,6 +325,8 @@ def write_output(docs: list[dict[str, object]], stats: dict[str, object]) -> Non
         "docs/public/00_start_here.md",
         "docs/public/08_useful_history.md",
         "docs/public/05_life_and_rights.md",
+        "docs/public/09_pilot_proposal.md",
+        "docs/public/10_real_world_examples.md",
         "docs/public/02_faq.md",
         "docs/public/04_white_paper.md",
         "docs/governance/Fairness_Vignette_Library.md",