diff --git a/app/public/generated/corpus.json b/app/public/generated/corpus.json
index 262bef9..61cf762 100644
--- a/app/public/generated/corpus.json
+++ b/app/public/generated/corpus.json
@@ -10,9 +10,9 @@
     "commitmentCount": 106,
     "reservedCommitmentCount": 56,
     "threatCount": 33,
-    "patchCount": 73,
+    "patchCount": 74,
     "validatorStatus": "pass",
-    "buildStamp": "corpus-651485fefad4"
+    "buildStamp": "corpus-703ef9f19ef9"
   },
   "docs": [
     {
@@ -1493,7 +1493,7 @@
       "status": "",
       "statusBucket": "reference",
       "summary": "Rule. The patch log is not a substitute for the constitution. The Humane Constitution holds the law-like text; the patch log explains how and why the hardening evolved.",
-      "content": "# Patch Log\n\n**Running change ledger aligned to the Humane Constitution \u00b7 Current through P-073 (P-071 reserved)**\n\n---\n\n**Purpose.** This log records the hardening changes introduced during the current cycle and keeps a traceable link between threats, mitigations, introduced risks, and remaining open questions.\n\n**Rule.** The patch log is not a substitute for the constitution. The Humane Constitution holds the law-like text; the patch log explains how and why the hardening evolved.\n\n**Patch status convention:** \n- **ACTIVE** = adopted into the document set and awaiting simulation/tuning; not evidence-backed proof. \n- **SUPERSEDED** = replaced by a later patch. \n- **PROPOSED** = designed but not yet accepted into the Humane Constitution.\n- **RETIRED** = intentionally removed.\n\n**Evidence discipline.** A patch can be well designed and still fail in contact with identity errors, measurement lag, legal wrappers, institutional self-protection, or founding politics. Do not treat `ACTIVE` or `PROPOSED` as `RESOLVED`; evidence-backed resolution belongs in the Claims and Evidence Register and the relevant Threat Register residual-risk update.\n\n---\n\n## Patch Inventory\n\n| Patch ID | Related Threat | Status | Priority | Core Change |\n| :--- | :--- | :--- | :--- | :--- |\n| P-001 | T-001 | **ACTIVE** | Critical | Contain shadow convertibility through friction, detection, and broker-focused enforcement. |\n| P-002 | T-004 | **ACTIVE** | Critical | Stabilize incentives with nonlinear reward architecture and anti-gaming design. |\n| P-003 | T-002 | **ACTIVE** | Critical | Replace single-gate identity with differential assurance and recovery-safe continuity. |\n| P-004 | T-007 | **ACTIVE** | Critical | Stop semantic capture through definition governance and anti-laundering rules. |\n| P-005 | T-005 | **ACTIVE** | Critical | Governance throughput: tiered CRP queues, throughput floor, emergency re-declaration. |\n| P-006 | T-006 | **ACTIVE** | Critical | Measurement lag: sentinel mandate, PCRP first-responder authority, Shared Storehouse unwind symmetry. |\n| P-008 | T-008 | **PROPOSED** | High | Elite formation: legibility audit, diversity mandates, verification independence, cohort cooling. PROPOSED and superseded for operative authority by P-025 (Federated Ombuds constitution); P-025 is the live ACTIVE control for T-008. |\n| P-009 | T-009 | **ACTIVE** | Med-High | Grace exploitation: graduated renewal, cross-quarter history, collusion detection, Service Record slow-decay. |\n| P-011 | T-011 | **ACTIVE** | Critical | Narrative hardening: RPCP, pre-committed failure doctrine, CFRL, adversarial narrative simulation. |\n| P-012 | T-012\u2013T-015 | **ACTIVE** | Critical | Interface hardening: oracle independence, categorical throughput floors, deadlock protocol, demand-context flag. |\n| P-013 | T-016 | **ACTIVE** | Critical | FAP integrity: representativeness standard, deadlock timeline, audit epistemic independence, anti-gaming Tier 2. |\n| P-014 | T-017 | **ACTIVE** | Critical | Bootstrap activation: one-time founding instrument for P-013 activation only. |\n| P-015 | T-018 / T-019 | **ACTIVE** | High | PCRP attack surface: false-trigger escalation path, exhaustion alert, manufactured flag assessment. |\n| P-016 | T-002 | **PROPOSED** | Critical | Identity asymmetric error doctrine: quantified fraud/exclusion rate targets, Tier 2 founding commitment. Remains PROPOSED / pre-ratification until founding adoption and pilot-calibrated rate confirmation; FC-140 through FC-145 have bound starting values, while FC-146 through FC-150 remain pre-launch commitments. |\n| P-017 | T-020 / T-021 | **ACTIVE** | Critical | Oracle epistemological and algorithmic independence: methodology-class diversity, AI supply chain transparency, physical ground-truth requirement. Numerical floors (N\u22655, \u22653 classes, \u22640.30 pairwise correlation, \u22651 adversarial seat) bound in `/founding/commitments.md` FC-030/FC-031/FC-032/FC-033. |\n| P-018 | T-022 | **PROPOSED** | Critical | Electoral cycle resilience: entrenchment ladder, Essential Access floor minimum persistence, administrative hollowing triggers, transition continuity protocol. |\n| P-019 | T-023 | **ACTIVE** | Med-High | Pilot external validity gate: stress-condition pilot requirement, red-team challenge window, crisis simulation mandate. |\n| P-020 | T-017 | **ACTIVE** | Critical | Founding window extension: 60-day pre-activation disclosure, oppose-coalition adversarial member nomination. |\n| P-021 | \u2014 | **ACTIVE** | High | Register disclosure protocol: bifurcation into public and restricted versions; operational security for detection thresholds. |\n| P-022 | T-024 | **ACTIVE** | Critical | Shared Storehouse oracle-failure fallback: conservative hold, 48h REB first-responder window, 72h governance handoff, FC-100 14-day restoration verification, reconciliation review. Annex AQ ACTIVE. |\n| P-023 | T-025 | **ACTIVE** | High | Capital-deployment shelter capture: contract-commitment architecture, milestone escrow, verified physical deliverables, and no protected-capital label without deployment. |\n| P-024 | T-009 / TR-07 / T-018 | **ACTIVE** | Critical | Attestation-at-risk stake mechanism: FC-080 stake ratio, FC-081 audit window, FC-082 graph density threshold, slashed-stake redistribution, graph-density safe harbor for legitimate close-knit communities. Annex AS. |\n| P-025 | T-008 | **ACTIVE** | Critical | Federated Ombuds constitution: 5 sub-Ombuds (FC-090), 4-of-5 Plenum supermajority (FC-091), 730-day staggered terms (FC-092), Oversight Assembly (7 members, 5-of-7), structural-dispersal criteria, Concentration Response. Annex AI rewritten. Supersedes single-commissioner draft. |\n| P-026 | T-026 / T-027 | **ACTIVE** | Critical | Founding Order \u2014 Subsidiarity, Consent & Exit: smallest-scale default with three-prong competence test; affirmative consent events at 2/3 supermajority (FC-120); 730-day graceful exit unwind (FC-121) with Essential Access continuity preserved; five-scale hierarchy (FC-122: household/neighborhood \u2264500/locality \u22645,000/region \u2264500,000/federation); re-entry symmetric, no penalty. `/founding/order/` directory. |\n| P-027 | T-005 / T-008 | **ACTIVE** | Critical | Structural consolidation into one Founding Order and seven Articles of Constitutional Order. Rights and execution unified under Article I; Essential Access and delivery unified under Article IV; markets, housing, enterprise, and PFCR unified under Article V; Voice, Service Record, and deliberation unified under Article VI; transparency and environmental scanning unified under Article VII. |\n| P-029 | T-016 | **ACTIVE** | Critical | Public Finance & Commons Revenue (PFCR): structural non-tax public funding, Commons Return source-base receipts, public banking rails as infrastructure, and anti-hidden-debt discipline. |\n| P-030 | PRD-004 | **ACTIVE** | Critical | Protocol-only money creation + household finance boundaries: no private Flow creation, no compounding household ordinary-life debt, no survival-floor securitization. |\n| P-031 | PRD-009 | **ACTIVE** | Critical | Anti-dynasty ownership: count-through beneficial ownership, trust prohibition for extractive continuity, succession limited to continuity and stewardship. |\n| P-032 | PRD-009 | **ACTIVE** | High | Stewardship ownership rule: land, housing, and enterprise rights may not become perpetual passive extraction claims. |\n| P-033 | PRD-008 | **ACTIVE** | High | Worker-owned and mission-locked enterprise preference: financing, procurement, and succession pathways structurally favor stewardship forms over absentee control. |\n| P-034 | T-016 / INV-007 | **ACTIVE** | Critical | Two-key architectural precondition for Tier-1-touching patches: adversarial panel attestation required before FAP intake; FAP reviewer cannot override absence; Beer S3* independence enforced; Buterin defection penalty specified. Annex AV. |\n| P-035 | \u2014 | **ACTIVE** | High | Founding group corrigibility clause + epistemic humility statement in Preamble and \u00a70A. |\n| P-036 | \u2014 | **ACTIVE** | High | Keyholder servanthood duty + replacement mechanism for self-interested keyholders (Article I). |\n| P-037 | \u2014 | **ACTIVE** | High | Identity-serves-person clause with triennial review and sunset requirement on secondary data use (Article II). |\n| P-038 | T-006 | **ACTIVE** | High | Community challenge path for capacity measurement figures with 14-day published response (Article III). |\n| P-039 | \u2014 | **ACTIVE** | High | Explicit protection for pre-existing mutual aid, family, and religious care networks; Article IV as floor not monopoly (Article IV). |\n| P-040 | \u2014 | **ACTIVE** | High | Housing cap pastoral revision (remove cold \"regardless\" language); structural humility closing clause added to Article V. |\n| P-041 | T-008 | **ACTIVE** | High | Biennial recognized-contribution audit to include invisible and pastoral work; 180-day correction requirement (Article VI). |\n| P-042 | \u2014 | **ACTIVE** | High | Low-barrier community alert pathway with 30-day acknowledgment and 90-day review trigger (Article VII). |\n| P-043 | Multiple | ACTIVE | High | Logical-analysis corpus corrections \u2014 documentary, amendment architecture, definitions, placeholder fill |\n| P-044 | Multiple | ACTIVE | High | Threat-strengthening batch \u2014 T-001/T-002/T-004/T-005/T-007/T-018/T-019 mitigation gaps closed |\n| P-045 | T-001 / T-002 / T-004 / T-007 / IC-004 | **ACTIVE** | Critical | Threat-mitigation batch \u2014 threshold derivation, asymmetric exclusion review, contribution floor, protected-term seed list, dignity-only continuity mode (threats remain Active \u2014 unproven; nothing marked Resolved) |\n| P-046 | Multiple | **ACTIVE** | Critical | Evidence and capture hardening \u2014 seven proof artifacts, drift audit, parameter calibration, abuse cases, evidence ladder, founding dossier, and capture dashboard |\n| P-047 | T-025 / T-026 / T-027 / external dependency capture | **ACTIVE** | Critical | Essential-sector conglomerate transition \u2014 profitable compliant path, refusal survivability tests, public fallback capacity, and numeric evidence anchors |\n| P-048 | T-025 / T-026 / T-027 / external dependency capture | **ACTIVE** | Critical | Essential-sector refusal test package \u2014 sector drills, FC-194 through FC-201 calibration rows, Annex AT receiver/licensing triggers, public explainer, and evidence-source expansion |\n| P-049 | Multiple evidence-gap bridges | **ACTIVE** | High | Cross-register bridge pass \u2014 aligns Hardening Queue, Open Problems, Pilot Roadmap, Public Readiness, README, and evidence-gap language with founding artifact status and essential-sector refusal testing |\n| P-050 | T-028 | **ACTIVE** | Critical | Compliant Alternative Supplier Pre-Registration (CASP): mandatory pre-registration of backup suppliers with automatic-activation contracts before essential-sector procurement renewal; gap-window calculation requirement; adversarial observation requirement for drill-secure classification. ANNEX_AT \u00a7AT6.6. |\n| P-051 | T-022 | **ACTIVE** | Critical | Constitutional Integrity Panel (CIP): 7-member independent body with staggered terms, constitutionally fixed funding (0.01% of annual Flow issuance), multi-body appointment preventing governing-coalition control, 5-of-7 quorum for Tier 1 ratification, automatic review triggers for institutional vacancy or publication lapses. ANNEX_AM \u00a7AM8. |\n| P-052 | T-019 | **ACTIVE** | High | Federated Ombuds deliberate-manufacture standard: pre-committed 4-criterion assessment (timing, proportionality, prior-basis, knowledge), 24-hour Plenum decision window, asymmetric default favoring PCRP activation when evidence is inconclusive, manufactured-flag referral to Enforcement Panel. ANNEX_AI \u00a74.12. |\n| P-053 | Insider retaliation / reporter protection | **ACTIVE** | Critical | Whistleblower Protection and Anti-Retaliation Protocol: administrative freeze on respondent write-access from filing; automatic escalation of retaliatory modifications; 45-day \"under review\" cap; restoration on exoneration. ANNEX_AW; Article VII reporter-protection clause. |\n| P-054 | Identity disclosure as safety vector | **ACTIVE** | Critical | Confidential Enrollment and Safety-Identity Protocol: cryptographically sealed identity for safety-compromised persons; address-blind delivery; 30-day emergency enrollment; 72-hour token for undocumented persons; sealed-record governance. ANNEX_AX; Article II safety-shielded enrollment clause. |\n| P-055 | Delivery gap between guarantee and operation | **ACTIVE** | Critical | Delivery Sufficiency Standard: four operational conditions (path exists, accessible, monitored, accountable party); Delivery Sufficiency Register published quarterly; seven founding-population entries; cross-boundary delivery accounting. ANNEX_AY; Article IV delivery-sufficiency obligation. |\n| P-056 | T-002 / INV-001 | **PROPOSED** | Critical | Open-Access Survival Floor (Two-Tier Identity Model): separates non-duplication (required for CSM) from identity verification (required only for above-floor services and civic instruments). Defines Tier 0 (open-access/pseudonymous survival floor) and Tier 1 (identity-gated services). Establishes civic accountability norm: the system trusts citizens because there is enough for everyone. Aggregate anomaly detection replaces individual surveillance at the survival tier. Token mechanism specification delegated to ANNEX_AZ \u00a7AZ2 as a pre-operational prerequisite. ANNEX_AK \u00a7AK8. |\n| P-057 | ACL-011 / ACL-010 | **PROPOSED** | High | Pilot Site Selection Criteria: required, disqualifying, and preferred characteristics for pilot town site selection; Phase 1 capital reference ranges ($15\u201322M); site selection process with adversarial panel member approval requirement. |\n| P-058 | T-016 / constitutional void | **PROPOSED** | High | Jurisdiction Interface Clause: three-layer jurisdiction interface (RAC mediation \u2192 external courts \u2192 federal floor); matters governed by external law enumerated; pre-enrollment 7-day grace window; retaliation prohibition; filing assistance obligation. |\n| P-059 | ACL-010 / dignity-floor leverage | **PROPOSED** | Critical | Vulnerable Population Consent Protocol (VPCP): ICA structure (civil-society nominated, 50% peer specialists, adverse-finding authority); VPCP-001 through VPCP-008 rules; 30-day cooling-off; teach-back verification as founding team obligation; non-waivable exit rights (60-day housing, 90-day healthcare, no clawback); pre-recruitment prerequisites gate. |\n| P-060 | ACL-005 / founding keyholder capture | **PROPOSED** | Critical | Founding Team Composition Standard: composition floor (FT-1 through FT-4); 9-seat keyholder allocation with distributed nomination (Seats 3\u20138 via civil-society organizations approved by adversarial panel member); founder sunset rules (FS-1 through FS-7); Perpetual Humility Review with Humility Declaration. |\n| P-061 | ACL-007 / Power-Wealth Convergence | **PROPOSED** | Critical | Founding Capital Framework: phase targets ($15\u201322M / $35\u201355M / $60\u201390M); 20%/30% funder concentration limits; Capital Steward independent fiduciary; constitutional primacy clause (non-negotiable in all funding agreements); government walk-away rule (4 trigger conditions); CLT land structure; wind-down reserve (6 months EA pre-funded). |\n| P-062 | ACL-011 / ACL-010 | **PROPOSED** | High | Pilot Timeline Framework: five-track parallel structure (Founding Legitimacy, Site Acquisition, Design/Permitting, Construction, Recruitment); three enrollment windows with hard prerequisites; critical-path gates (A2 at Month 8, D2 at Month 26\u201330, INV-LAUNCH-1 clearance); failure contingency requiring Resident Transition Protocol before Cohort 1 occupancy. |\n| P-064 | T-028 | **ACTIVE** | Critical | Compliance-Masked Refusal Hardening: treats lawful-looking obstruction as refusal when formal compliance hides CSM delivery degradation, patient-continuity failure, data/control-system lockout, PBM access friction, standards delay, affiliate fallback capture, workforce poaching, legal delay, or concession pressure. |\n| P-065 | T-022 | **ACTIVE** | Critical | CIP Vacancy-Starvation Hardening: appointment deadlines, fallback nomination, void mass appointments, below-quorum self-repair limits, publication-channel fallback, missed Ombuds-report suspension, conduct-only hollowing triggers, servant-authority and relief-first limits. |\n| P-066 | T-029 | **ACTIVE** | Critical | Commons Return and Universal Stake Fiscal Sustainability Gate: replaces routine progressive net-worth demurrage as active wealth spine, registers fiscal/debasement risk, requires costed public-finance model, source-base revenue testing, remaining-tax disclosure, incidence review, lockbox sufficiency, and scale-blocking fiscal adequacy gate. |\n| P-067 | T-030 | **ACTIVE** | Critical | Cyber Resilience and Availability Gate: registers ransomware, key-compromise, regional-outage, offline-continuity, supply-chain, and public-status failure as a distinct threat to survival-floor delivery. |\n| P-068 | T-031 | **ACTIVE** | Critical | Last-Resort Unenrolled Access Gate: registers the risk that a person who cannot enroll, hold a wallet, or use digital credentials still cannot reach the survival floor; requires no-credential, trusted-intermediary, analog-reconciliation, abuse/diversion, and dignity-interview tests before universality claims. |\n| P-069 | T-032 | **ACTIVE** | Critical | Monitoring Repurposing Gate: registers the risk that protective monitoring becomes surveillance or coercive control; requires purpose register, purpose-creep red team, linkability test, office-separation drill, individual-flag appeal drill, retention audit, and coercive-use scenario. |\n| P-070 | T-033 | **ACTIVE** | Critical | Founding Legitimacy Prerequisite Definition Gate: reconciles consent thresholds, defines admissible non-coercive consent evidence, defines independent civil-society reviewer qualification, and blocks Gate A until consent and review are independently evidenced. |\n| P-072 | T-025 | **PROPOSED** | High | Productive Status Register: one canonical \"productive\" determination shared by Flow issuance (ANNEX_X) and the Commons Return exemption (ANNEX_D \u00a7D3), with settle-forward escrow closing the temporal double-dip. Remains PROPOSED / pilot-gated until its evidence test passes; binds nothing until then. |\n| P-073 | structural \u2014 no threat row | **ACTIVE** | High | Framework-first intake (anti-accretion rule): FAP intake gate requiring any new mechanism to extend the most general existing instrument for its protective function or carry a published justification; published return record with adversarial-panel escalation; simplicity presumption bounded by independence count and protected-person path equivalence. Amends Acceptance_Protocol.md. |\n\n---\n\n## Reserved / Never-Assigned Patch IDs\n\nThese IDs do not appear in the inventory above. They are recorded here so a reader can distinguish a deliberately skipped number from a lost or missing patch. Mirrors the \"Retired and Reserved IDs\" table in the Threat Register.\n\n| Patch ID | Status | Reason |\n| :--- | :--- | :--- |\n| P-007 | **RESERVED** | Reserved at numbering; never assigned a patch. The threat work that would have occupied this slot was absorbed into adjacent patches before formal sequencing. No design exists under this ID. |\n| P-010 | **RESERVED** | Reserved at numbering; never assigned a patch. No design exists under this ID. |\n| P-028 | **RESERVED** | Reserved at numbering; never assigned a patch. The economic-governance integration that would have followed P-027 was consolidated into the P-029 through P-033 batch. No standalone design exists under this ID. |\n| P-063 | **DRAFT-ONLY** | Reserved for the P-063 v15 review packet. It is explicitly not corpus-registered, not adopted into Annex D, and not part of the active Patch Log inventory. |\n| P-071 | **RESERVED** | Reserved for the Harberger/COST shadow-assessment proposal (`docs/superpowers/specs/2026-06-09-commons-return-should-fixes-redline.md`), which is held as a proposal and not incorporated. The number is reserved so cross-references in the pending-proposal redlines stay stable; no design is incorporated under this ID. |\n\n---\n\n## P-029 through P-033 \u2014 Economic Governance Integration\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-029 | T-016 / public-funding architecture | **ACTIVE** | Critical | constitutional fiscal redesign |\n| P-030 | PRD-004 | **ACTIVE** | Critical | monetary + retail-finance boundary |\n| P-031 | PRD-009 | **ACTIVE** | Critical | ownership + succession + anti-circumvention |\n| P-032 | PRD-009 | **ACTIVE** | High | constitutional ownership standard |\n| P-033 | PRD-008 | **ACTIVE** | High | enterprise-preference and succession design |\n\n### P-029 \u2014 Public Finance & Commons Revenue (PFCR)\n\n**Constitutional text:** [ANNEX_X.md \u00a7 X8](../annexes/ANNEX_X.md)\n\n- **Introduced design:** replaces the former catch-all resilience funding model with a dedicated public-funding function. PFCR funds public operations through Commons Return source-base receipts, commons and land-use charges, scarce-license and gateway fees, and bounded public issuance tied to real public production.\n- **Clauses integrated:** no taxes on survival access, ordinary labor, or basic household exchange; public banking rails funded as infrastructure; postal-bank/public-bank option; anti-hidden-debt rules; source-by-source public reporting.\n- **Dependencies:** Commons Return source-base methodology, asset-equivalence review, gateway registry, and budget transparency stack.\n- **New risks introduced:** fiscal dependence on poorly calibrated Commons Return, source-base valuation, or gateway flows; naming disputes over what counts as a prohibited tax. Mitigated by judicial review trigger, source registry, and P-066 fiscal adequacy gate.\n\n### P-030 \u2014 Protocol-Only Money Creation and Household Finance Boundaries\n\n**Constitutional text:** [ANNEX_X.md](../annexes/ANNEX_X.md)\n\n- **Introduced design:** only protocol-authorized issuance bodies may create Flow or Flow-equivalent purchasing power. Private institutions may lend existing Flow, but may not create new Flow, deposit substitutes, or debt-expanded currency-like claims.\n- **Clauses integrated:** compounding interest prohibited on household ordinary-life debt; no securitization of survival-linked household claims; no revolving survival traps; public retail banking floor on the common rail.\n- **Dependencies:** retail-rail charter, prudential supervision of licensed providers, and public option continuity.\n- **New risks introduced:** shadow-credit attempts outside the chartered rail, and pressure to relabel hidden fees as service charges. Mitigated by common-rail enforcement and anti-equivalence review.\n\n### P-031 \u2014 Anti-Dynasty Ownership\n\n**Constitutional text:** [ANNEX_J.md \u00a7 R1\u2013R2](../annexes/ANNEX_J.md)\n\n- **Introduced design:** beneficial ownership always counts through to natural persons or mission-locked/community bodies. Perpetual trusts, shell chains, and equivalent structures may not preserve extractive control across generations.\n- **Clauses integrated:** family continuity protected in modest form, but dynastic landlordism, absentee succession structures, and perpetual extractive wrappers are prohibited.\n- **Dependencies:** beneficial-ownership registry, succession review rules, and housing / enterprise stewardship standards.\n- **New risks introduced:** harder succession planning for legitimate family continuity cases. Mitigated by explicit continuity allowances for homes, tools, dependents, and mission-locked stewardship bodies.\n\n### P-032 \u2014 Stewardship Ownership Standard\n\n**Constitutional text:** [ANNEX_J.md \u00a7 R1\u2013R2](../annexes/ANNEX_J.md)\n\n- **Introduced design:** ownership across land, housing, and enterprise is reframed as stewardship rather than a perpetual tribute right. Capital may be rewarded for risk and contribution, but not for endless passive extraction from necessity or labor.\n- **Clauses integrated:** bounded capital claims, anti-rent use-right logic, and judicially reviewable passive-extraction prohibitions.\n- **Dependencies:** housing and commons use-right enforcement, capital-instrument redesign, and ACC / anti-monopoly enforcement.\n- **New risks introduced:** valuation disputes around what counts as productive stewardship. Mitigated by published criteria, appeal paths, and mission-lock documentation.\n\n### P-033 \u2014 Worker-Owned and Mission-Locked Enterprise Preference\n\n**Constitutional text:** [ANNEX_J.md \u00a7 R1](../annexes/ANNEX_J.md)\n\n- **Introduced design:** worker-owned, cooperative, and mission-locked firms receive structural preference in PFCR-backed finance, procurement, retained-earnings treatment, worker buyout pathways, and founder-exit conversion rules.\n- **Clauses integrated:** natural monopolies moved to a separate regulated-utility track; outside capital claims must be capped, redeemable, sunset, or otherwise bounded.\n- **Dependencies:** procurement rules, cooperative finance tools, public venture / buyout facilities, and utility-governance charter.\n- **New risks introduced:** preferential treatment could be gamed by sham cooperatives. Mitigated by governance-proof requirements, payout constraints, and beneficial-ownership transparency.\n\n---\n\n### P-034 \u2014 Two-Key Architectural Precondition for Tier-1 Invariant Enforcement\n\n**Threat addressed:** T-016 / INV-007  \n**Audit finding:** PRD-001 / Phase 1 Article I adversarial audit; confirmed still open in Phase 4 follow-up check  \n**Status:** ACTIVE | **Priority:** Critical | **Annex:** AV (Acceptance_Protocol.md \u00a7Structural Precondition Gate)\n\n**Constitutional text:** [ANNEX_AV.md](../annexes/ANNEX_AV.md)\n\n**Problem diagnosed:**  \nThe prior INV-007 enforcement relied on a single FAP reviewer checking patch proposals against INVARIANTS.md before intake. This is a single point of failure: a captured, compromised, or mistaken reviewer can admit a Tier-1-touching proposal simply by not flagging the violation. The Beer VSM logic gate test (Phase 1) confirmed this: the normative model collapses to `defect \u2192 bypass` because the reviewer is both S3 (operational control) and the entire S3* (audit channel). A single captured actor voids all seven invariants simultaneously.\n\n**Introduced design \u2014 two-key architectural precondition (Annex AV):**\n- Any patch tagged `modifies_tier1=True` must carry cryptographic attestation from the standing adversarial panel member before FAP intake opens.\n- The FAP reviewer's authority is explicitly scoped to exclude the ability to waive or override the absence of attestation.\n- The adversarial panel member is nominated by the oppose-coalition body (AH2.3), not the founding coalition \u2014 structurally independent of FAP administration.\n- Defection penalty: improper admission attestation \u2192 permanent removal + forfeiture of seat to oppose-coalition nominating body + public defection finding. Honest attestation (including rejections) carries no penalty. The payoff matrix favors honest behavior.\n\n**Beer VSM fix:** S3* (adversarial panel attestation) is now structurally independent of S3 (FAP reviewer). Collapsing S3* into S3 is architecturally impossible \u2014 the adversarial panel member holds a key the FAP reviewer does not control.\n\n**Buterin incentive alignment fix:** Defection (improper admission) is costly (removal + public record). Honesty is safe. The reviewer incentive is also corrected: a reviewer who admits a proposal that lacks attestation has acted outside their authority \u2014 no benefit accrues, only liability.\n\n**Clauses integrated:** INV-007 mechanical boundary (amended), INVARIANTS.md \u00a7Invariant Violation Detection (precondition block added), Acceptance_Protocol.md \u00a7AV1\u2013AV6, Annex AV \u00a7AV7\u2013AV10 operational procedure.\n\n**Dependencies:** Adversarial panel member must be seated (per AH2.3) before any `modifies_tier1=True` proposal may be submitted. P-034 becomes operational the moment the adversarial panel member's key is registered.\n\n**New risks introduced:**\n- If the adversarial panel member seat goes vacant, no Tier-1-touching proposals can advance. Mitigated: vacancy is observable and not covert; it is a conservative failure mode (proposals stall, not wrongly admitted).\n- Oppose-coalition nominating body could itself be captured. Mitigated: AH2.3 qualifications exclude organizations with funding relationships with the founding coalition; three-year lookback applies.\n\n**Residual risk (acknowledged):** The adversarial panel member can be defected through external pressure not covered by the internal penalty structure (coercion, external blackmail). This is documented as a known residual rather than a resolved problem. Physical-world coercion cannot be fully eliminated by protocol design; conservative failure mode (panel member refuses to attest rather than attesting fraudulently) is the design target.\n\n## P-001 through P-004 \u2014 Core Convertibility Controls\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-001 | T-001 | **ACTIVE** | Critical | structural + behavioral detection + targeted enforcement. |\n\n### P-001 \u2014 Shadow Convertibility Containment\n\n**Constitutional text:** [ANNEX_AB.md \u00a7 AB2](../annexes/ANNEX_AB.md)\n\n- **Introduced design:** Essential Access-only channels, non-delegable redemption, context-locking where proportionate, anomaly detection, broker targeting, and an explicit leakage-tolerance concept.\n- **Clauses to integrate:** Essential Access Exclusivity, Non-Delegable Consumption, Leakage Tolerance, Broker-Focused Enforcement.\n- **Dependencies:** identity assurance, coercion reporting pathways, and sufficiently accurate essential-supply management.\n- **New risks introduced:** over-surveillance, false positives, user friction, and migration of abuse into proxy-identity channels.\n- **Residual risk:** small-scale favors and informal pooling remain acceptable if they do not scale into arbitrage infrastructure.\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-002 | T-004 | **ACTIVE** | Critical | economic + behavioral + contribution architecture. |\n\n### P-002 \u2014 Incentive System Stabilization\n\n**Constitutional text:** [ANNEX_AB.md \u00a7 AB3](../annexes/ANNEX_AB.md)\n\n- **Evidence package:** [Service Record Misuse Evidence Test Package](./Service_Record_Misuse_Evidence_Test_Package.md)\n- **Introduced design:** nonlinear reward curves, multi-channel rewards (Flow, civic standing, status/recognition), opportunity access, time/flexibility rewards, and anti-gaming contribution assessment.\n- **Clauses to integrate:** Incentive Nonlinearity, Multi-Channel Reward, Outcome-Based Contribution, Anti-Gaming Contribution.\n- **Dependencies:** identity attribution, contribution verification, and governance rules for how civic standing can matter without becoming coercive privilege.\n- **New risks introduced:** status hierarchy, burnout optimization, and domain bias toward easier-to-measure work.\n- **Residual risk:** optimization behavior remains, but the design goal is to align it with contribution rather than suppress it.\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-003 | T-002 | **ACTIVE** | Critical | structural + security + continuity protection. |\n\n### P-003 \u2014 Identity System Hardening\n\n**Constitutional text:** [ANNEX_AB.md \u00a7 AB4](../annexes/ANNEX_AB.md)\n\n- **Evidence package:** [Identity and Recovery Evidence Test Package](./Identity_Recovery_Evidence_Test_Package.md)\n- **Introduced design:** four assurance tiers (survival floor, provisional, core, civic activation), multi-evidence thresholding, no single universal credential, hardened recovery, anti-Sybil controls, and no-survival-lockout under uncertainty.\n- **Clauses to integrate:** Identity Adversarial Reality, Differential Assurance, Recovery Safety, No Master Credential, Identity Failure Continuity.\n- **Dependencies:** appeals architecture, ombuds/advocate pathways, and clear separation between verification and monitoring.\n- **New risks introduced:** complexity, onboarding friction, and slower recovery for legitimate edge cases if poorly implemented.\n- **Residual risk:** low-level fraud remains possible and should be contained rather than denied in theory.\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-004 | T-007 | **ACTIVE** | Critical | governance + constitutional anti-capture control. |\n\n### P-004 \u2014 Definition Drift Protection\n\n**Constitutional text:** [ANNEX_AB.md \u00a7 AB5](../annexes/ANNEX_AB.md)\n\n- **Introduced design:** protected term classes, semantic effect test, worked-example requirement, public definition registry, upward classification default, and anti-laundering control across code, vendor, and standards layers.\n- **Clauses to integrate:** Definition Integrity, Semantic Effect, Upward Classification Default, Worked Example Requirement, Definition Registry, Anti-Laundering.\n- **Dependencies:** classification authority, change-control process, and review capacity.\n- **New risks introduced:** process friction, slower iteration, and semantic bureaucracy if overbuilt.\n- **Residual risk:** subtle drift can still occur unless registry, examples, and challenge windows are actually used.\n\n---\n\n## P-005 through P-012 \u2014 Governance and Operational Resilience\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-005 | T-005 | **ACTIVE** | Critical | structural + procedural + monitoring |\n\n### P-005 \u2014 Governance Throughput Hardening\n\n**Constitutional text:** [ANNEX_AC.md \u00a7 AC1](../annexes/ANNEX_AC.md)\n\n- **Change type:** structural + procedural + monitoring.\n- **Introduced design:** CRP dual-queue separation (constitutional vs. operational); minimum operational throughput floor (5 priority decisions per quarter, non-blockable by constitutional challenges); sequential emergency re-declaration cap (2 consecutive quarters max, requires independent audit and public justification to extend); intake throttle with priority scoring (impact \u00d7 urgency \u00d7 reversibility; Voice-signal for urgency; overflow is public); cross-quarter interim authorization bridge (Ombuds + 1 rotating CRP member + regional exec; scope-locked to emergency declaration; provisional only; cannot narrow Essential Access access or touch constitutional matters); decision quality audit metrics (alternatives-presented ratio, reversal rate, minority dissent rate); [Ambitious] real-time throughput dashboard with auto-escalation trigger.\n- **Clauses to integrate:** CRP Dual-Queue Separation; Minimum Throughput Floor; Sequential Emergency Cap; Intake Throttle and Priority Scoring; Cross-Quarter Interim Bridge; Decision Quality Metrics. See Annex AC1.\n- **Dependencies:** Annex L (CRP sub-panel composition); Annex T (simulation mandate extension); Article V compliance matrix; Level 3\u20134 emergency cascade table.\n- **New risks introduced:** Operational sub-panel capture if composition predictable; interim bridge scope creep; priority scoring gaming; [ambitious] throughput dashboard exposure of vulnerability windows (mitigated by 48-hour publication lag).\n- **Residual risk:** Throughput theater remains hard to detect. Patient actor can operate within throughput floors while maintaining effective paralysis through distributed delay across proposals.\n- **Compound linkages:** T-005 \u00d7 T-006 (PCRP window synchronization); T-005 \u00d7 T-008 (PCRP authority as new power locus); T-005 \u00d7 T-001 (paralysis extends cadence exploit windows).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-006 | T-006 | **ACTIVE** | Critical | structural + authority definition + measurement architecture |\n\n### P-006 \u2014 Measurement Lag and Supply Shock Hardening\n\n**Constitutional text:** [ANNEX_AC.md \u00a7 AC2](../annexes/ANNEX_AC.md)\n\n- **Change type:** structural + authority definition + measurement architecture.\n- **Introduced design:** Sentinel indicator mandate \u2014 every slow-audit essential category requires a faster low-fidelity signal; max lag by volatility class (48h high / 7d medium / 30d low). Pre-Confirmation Response Protocol (PCRP) \u2014 defined first-responder authority (Regional Executive Body, joint activation); permitted: 70% above-baseline issuance reduction, reserve release, expedited oracle review (survival floor issuance stays 100%); prohibited: full Shared Storehouse, survival floor narrowing, other categories, beyond 72h without oracle confirmation; false-trigger tracking \u2014 3 false activations per 4 quarters triggers mandatory independent audit. Shared Storehouse unwind symmetry \u2014 recovery fast-track mirrors PCRP; conservative bias applies to activation, not prolonged restriction after recovery. Cadence-adjusted U8 bridge \u2014 48-hour trigger for high-volatility categories; 7-day retained for medium-volatility. [Ambitious] Essential Access redemption velocity as native sentinel (150% spike threshold). [Ambitious] Cross-category demand surge detector.\n- **Clauses to integrate:** Sentinel Indicator Mandate; PCRP; PCRP Scope Definition (protected term under P-004); Shared Storehouse Unwind Symmetry; Cadence-Adjusted U8 Bridge. See Annex AC2.\n- **Dependencies:** Regional Executive Body formally constituted with joint-activation rules. Essential Access ledger redemption velocity in privacy-preserving aggregate form. Annex M extended with cadence floors. Annex U8 modified.\n- **New risks introduced:** PCRP soft-power weaponization; two-source corroboration gaming; recovery fast-track exploit via manufactured sentinel signals; [ambitious] Essential Access velocity oracle suppression gaming (mitigated by anomaly detection on suppression patterns).\n- **Residual risk:** Inter-cycle gap is compressed not eliminated. 'Supply shock' must be a protected term under P-004 with worked examples to prevent scope creep.\n- **Compound linkages:** T-006 \u00d7 T-001 (cadence windows = black market opportunity); T-006 \u00d7 T-005 (PCRP window synchronization); T-006 \u00d7 T-008 (PCRP authority at REB = elite formation risk).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-008 | T-008 | **PROPOSED** | High | structural + measurement + institutional design |\n\n### P-008 \u2014 Bureaucratic Elite Formation Hardening\n\n**Constitutional text:** [ANNEX_AC.md \u00a7 AC3](../annexes/ANNEX_AC.md)\n\n- **Status basis:** **PROPOSED.** P-008 is designed but was not accepted as the operative authority for T-008. P-025 (Federated Ombuds constitution) supersedes it and is the live ACTIVE control \u2014 see SPECIFICATIONS.md \u00a74.3, which records that P-008 is PROPOSED and P-025 is the operative ACTIVE authority for the 20% sector ceiling. The legibility-audit, diversity, verification-independence, and cohort-cooling designs below are retained as design reference; their operative enforcement runs through P-025.\n- **Evidence package:** [Service Record Misuse Evidence Test Package](./Service_Record_Misuse_Evidence_Test_Package.md)\n- **Change type:** structural + measurement + institutional design.\n- **Introduced design:** Legibility gap audit \u2014 quarterly Article VI reporting tracks verification approval rate, evidence burden, appeals rate, and abandonment rate by contribution category; 20-point disparity triggers independent process audit (not by incumbent verifier pool). Service Record sector ceiling specification mandate \u2014 max 25% per sector, max 35% per identifiable institutional-origin cluster in any Service Record-governed service pool; specified at founding as precondition under Annex N. Epistemic diversity requirement \u2014 three-axis standard (institutional origin \u226430%, contribution-type diversity \u226530% informal/care, geography \u226525% non-urban-dense) for all oversight bodies >5 members; pool design requirement. Verification independence rule \u2014 verifiers cannot review claims in own primary contribution category; applies to mid-range and above claims. Cooling-off cohort rule \u2014 cohort tracking by Ombuds Office; max 2 cohort members sharing review authority over same subject simultaneously. [Ambitious] Qualification standard governance \u2014 competence criteria added to P-004 protected terms registry; standard-setting body must include \u226540% from non-qualifying backgrounds. [Ambitious] Real-time concentration dashboard.\n- **Clauses to integrate:** Legibility Gap Audit; Service Record Sector Ceiling Specification (founding precondition Annex N); Epistemic Diversity Requirement; Verification Independence Rule; Cooling-Off Cohort Rule; Qualification Standard Governance (P-004 extension); Concentration Dashboard. See Annex AC3.\n- **Dependencies:** Service Record sector ceilings specified at founding (pre-CRP constitution). Article VI U7 extended for verifier category independence. P-004 protected terms registry extended. Pool-depth health metrics added to Article VII.\n- **New risks introduced:** Epistemic diversity pool-depth constraint interacts with P-005 throughput vulnerability. Verification independence adds legitimate friction to high-impact claims. Cohort tracking system is a power locus if Ombuds Office itself captured. [Ambitious] concentration dashboard gaming below thresholds (mitigated by 30-day data lag).\n- **Residual risk:** Class formation through informal social networks has no hard control. Open question: Ombuds Office carries three load-bearing functions (cohort tracking, legibility audit, diversity certification) \u2014 if Ombuds becomes an elite formation site all three are compromised. Who audits the auditors of elite formation?\n- **Compound linkages:** T-008 \u00d7 T-011 (elite formation creates narrative attack surface; P-008 dashboard provides defense evidence base); T-008 \u00d7 T-005 (PCRP authority concentration); T-008 \u00d7 T-006 (PCRP regional bodies subject to elite formation).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-011 | T-011 | **ACTIVE** | Critical | communication architecture + transparency + pre-commitment |\n\n### P-011 \u2014 Narrative Attack Surface Hardening\n\n**Constitutional text:** [ANNEX_AD.md](../annexes/ANNEX_AD.md)\n\n- **Change type:** communication architecture + transparency + pre-commitment doctrine.\n- **Introduced design:** Rapid Public Communication Protocol (RPCP) \u2014 4-hour structured template for any public-visibility operational event; covers what happened, system response, access status, next steps; does not replace 7-day post-mortem; pre-authorized publication authority required. Pre-committed failure communication doctrine \u2014 published pre-launch document acknowledging expected failures (PCRP false triggers, oracle disputes, Shared Storehouse activations, enforcement errors, measurement uncertainty) with containment mechanisms; converts failures from surprises to acknowledged expected events. Citizen-Facing Rights Layer (CFRL) \u2014 one page, 8th-grade level, pre-launch, translated; governed as P-004 protected specification. Adversarial Narrative Simulation \u2014 added to Annex T annual mandate; hostile framing team publishes simulated attack; system responds within 4 hours; report published. Hostile Frame Pre-emption Registry \u2014 top 10 mischaracterizations with accurate rebuttals and Article VII evidence; updated quarterly; published as 'Common Misunderstandings.' [Ambitious] Narrative Health Dashboard \u2014 public understanding accuracy surveys, hostile framing prevalence index, RPCP response time metric; Level 1 watch auto-trigger. [Ambitious] Pre-Launch Narrative Audit \u2014 independent adversarial audit by communications professionals; findings and mitigations published simultaneously.\n- **Clauses to integrate:** RPCP; Pre-Committed Failure Doctrine; CFRL (P-004 protected spec); Adversarial Narrative Simulation (Annex T extension); Hostile Frame Registry. See Annex AD.\n- **Dependencies:** Operative elite-formation controls are prerequisite for elite formation narrative rebuttal \u2014 these run through P-025 (ACTIVE), the operative authority for T-008, since P-008 is PROPOSED. Article VII infrastructure must support 4-hour publication SLA. White Paper sync required before launch (AD6). CFRL added to P-004 protected terms registry.\n- **New risks introduced:** Pre-committed failure document weaponized to prime failure expectation \u2014 mitigated by simultaneous publication of containment mechanisms. CFRL creates false certainty \u2014 mitigated by 'Humane Constitution governs' disclaimer. ANS report as hostile playbook \u2014 mitigated by publishing after exercise completion. Hostile frame registry amplifies framings \u2014 mitigated by 'common misunderstandings' framing.\n- **Residual risk:** Narrative defense is bounded by actual system performance. No communication architecture survives sustained failure. Pre-launch framing window (18+ months before launch) cannot be closed by protocol \u2014 only by early CFRL and pre-commitment doctrine deployment.\n- **Compound linkages:** T-011 \u00d7 T-008 (elite formation is factual hook for 'captured by professionals' narrative; P-008 concentration dashboard is the counter-narrative evidence base). T-011 \u00d7 T-006 (PCRP false triggers are the highest-visibility predictable failure). T-011 \u00d7 T-005 (governance paralysis generates narrative events).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-012 | T-012/013/014/015 | **ACTIVE** | Critical | structural + protocol + measurement |\n\n### P-012 \u2014 Interface Hardening and Deadlock Prevention\n\n**Constitutional text:** [ANNEX_AE.md \u00a7 AE2.1\u2013AE2.4](../annexes/ANNEX_AE.md)\n\n- **Change type:** structural + protocol + measurement architecture.\n- **Introduced design:** PCRP oracle independence requirement \u2014 two-source corroboration must use structurally independent measurement systems; manipulated oracle counts as one source regardless of downstream channels; single-source PCRP activates at reduced scope with Ombuds co-certification. Categorical throughput minimums \u2014 P-005 floor amended from single aggregate to 5 categorical minimums (identity, supply, enforcement, governance, unreserved); single category capped at 3 of 5 slots. Emergency deadlock resolution protocol \u2014 auto-declaration when mandatory decision is blocked by 2+ valid processes; 3-member arbitration panel within 6 hours; survival floor bridge unconditional; scope freeze; mandatory root-cause review. Demand-context flag for Essential Access velocity oracle \u2014 discount applied during Flow enforcement actions, mass re-verification campaigns, or regional defection; Ombuds co-certification required for PCRP. RPCP contested-status template \u2014 separates physical event from legal characterization during active CRP review. Cumulative procedural drift trigger \u2014 extends P-004 to 20 Tier 3 decisions in 8 quarters reducing Tier 2/1 decision space; triggers mandatory CRP cumulative review.\n- **Clauses to integrate:** AE2.1\u2013AE2.6. Amends AC1.2 (throughput floor), AC2.2 (PCRP), AD1 (RPCP), AB5 (P-004 drift).\n- **Dependencies:** operational demand-context register (new data feed); RPCP contested-status template library extension; CRP cumulative review procedure.\n- **New risks introduced:** Deadlock panel engineered as bypass route \u2014 bad actors deliberately trigger triple-block to force panel arbitration. Demand-context flag delays legitimate PCRP during enforcement periods. Categorical floor gaming \u2014 proposals reframed to occupy minimum category slots. Cumulative drift review weaponized against legitimate operational evolution.\n- **Residual risk:** Second-generation deadlock has no defined resolution beyond Level 5 structural review. T-009 (Grace Exploitation Loop) remains OPEN and is the next hardening target.\n- **Compound linkages:** All of T-012/013/014/015 inter-linked through PCRP, throughput floor, and deadlock protocol.\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-009 | T-009 | **ACTIVE** | Med-High | behavioral + verification + structural |\n\n### P-009 \u2014 Grace Exploitation Loop Hardening\n\n**Constitutional text:** [ANNEX_AF.md](../annexes/ANNEX_AF.md)\n\n- **Evidence package:** [Service Record Misuse Evidence Test Package](./Service_Record_Misuse_Evidence_Test_Package.md)\n- **Change type:** behavioral + verification architecture + structural.\n- **Introduced design:** Graduated renewal intensity \u2014 first activation lightweight; first renewal structured; second renewal mid-intensity with support service confirmation; third+ renewal high-intensity independent panel. All qualifying hardship approved under any standard. Cross-quarter history review \u2014 full pause history assessed at every renewal; category switching flagged for elevated scrutiny at next renewal. Hardship attestation collusion detection \u2014 P-002 analytics extended to hardship networks; detects mutual pairs, star clusters, temporal clustering; community-disaster safe harbor for 2 quarters on oracle-verified regional emergency. Service Record slow-decay at 20% of normal rate during pause \u2014 Voice freeze unchanged; 4-quarter pause produces ~8% Service Record loss (negligible); 12-quarter rotation produces ~22% loss (drains high-impact threshold). Service pool pause-saturation monitoring \u2014 >20% simultaneous pause triggers pool-health alert and review; never bars individual activation. [Ambitious] Capability development pathway \u2014 up to 15% quarterly Service Record earnable through pause-appropriate stewardship during pause. [Ambitious] T-009 \u00d7 P-008 explicit closure \u2014 paused cohort members count toward P-008 cohort cooling concurrent maximum; active members accommodate, not paused person.\n- **Clauses to integrate:** AF1\u2013AF7. Annex K4 amended (graduated renewal; Service Record slow-decay). P-002 analytics extended (AF3). AC3.5 amended (AF7). Article VII dashboard extended (AF5).\n- **Dependencies:** P-002 collusion analytics infrastructure extended to hardship attestation graph. Service Record slow-decay rate requires Article VI / Annex K4 protocol-level calibration. P-011 CFRL must communicate graduated renewal clearly before launch. [Ambitious] P-004 registry: 'pause-appropriate stewardship' as protected term. [Ambitious] P-008 AC3.5 amended per AF7.\n- **New risks introduced:** Graduated renewal deters genuine long-term hardship if perceived as punitive \u2014 mitigated by CFRL communication and calibration. Service Record slow-decay may deter activation \u2014 mitigated by clear communication and negligible 4-quarter loss. Community-disaster safe harbor exploitable by manufactured disaster claims \u2014 mitigated by oracle verification requirement. Pool saturation monitoring creates perverse incentive against legitimate pause at bad timing \u2014 mitigated by review-only trigger.\n- **Residual risk:** Involuntary unemployment category remains most exploitable \u2014 disproof requires intrusive investigation incompatible with non-surveillance commitment. Accept as contained leakage: graduate renewal intensity is the best available control. Low-level 1-2 quarter grace exploitation is acceptable system leakage \u2014 the cost of genuinely frictionless access for legitimate hardship.\n- **Compound linkages:** T-009 \u00d7 T-008 (primary bypass route for P-008 controls \u2014 AF7 addresses it at design level; evidence remains pending); T-009 \u00d7 T-011 (graduated renewal must be communicated through CFRL or becomes narrative attack surface).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-013 | T-016 | **ACTIVE** | Critical | structural + governance + audit architecture |\n\n### P-013 \u2014 Formal Acceptance Process Integrity\n\n**Constitutional text:** [ANNEX_AG.md](../annexes/ANNEX_AG.md)\n\n- **Change type:** structural + governance + audit architecture.\n- **Introduced design:** Pilot representativeness standard \u2014 pilot region requires published 4-dimension assessment; >1 favorable dimension requires second stress-tested region; single favorable region = PILOT only, not ACTIVE. Deadlock resolution timeline \u2014 30d negotiation, 60d published mediation, day 61 CRP binding ruling (14-day SLA); substitute review if CRP is party. Audit epistemic independence \u2014 4-year institutional affiliation bar; domain-diversity requirement; adversarial audit member for I=5 patches (multi-member team, no veto). Anti-gaming constitutional upgrade \u2014 evidence waiver prohibition reclassified Tier 2; urgency bypass now requires H-2 amendment process. Stagnation documentation quality \u2014 3-question review (accurate? progress? resolvable?); structural obstacles trigger bootstrap review not continued documentation. [Ambitious] Bootstrap Resolution Protocol \u2014 minimum viable bootstrap micro-patch for circular dependencies; 2-authority expedited sign-off; auto-sunset; P-008 legibility gap audit as first bootstrap candidate. [Ambitious] FAP concentration controls \u2014 cohort cooling on sign-off cluster; audit body meets AC3.3 diversity standard; independent Article VII monitoring (not Ombuds-managed).\n- **Clauses to integrate:** AG1\u2013AG7. FAP document amended directly. Anti-gaming rules reclassified Tier 2 (H-2 required for amendment). Representativeness criteria added to P-004 protected terms registry.\n- **Dependencies:** P-005 categorical floor extended to include FAP deadlock resolution slot. P-004 protected terms registry extended for representativeness criteria. P-008 AC3.3 epistemic diversity standard referenced for audit body. Article VII AC3.7 concentration dashboard extended for FAP sign-off cluster. Independent concentration monitoring (not Ombuds) required before FAP becomes operative.\n- **New risks introduced:** Two-region pilot requirement increases cost and time; 'close enough' stress-tested region designation risk (mitigated by published representativeness assessment). 60-day deadlock window creates operational gap (mitigated by Annex C-6 emergency patching remaining available as separate pathway). Adversarial auditor produces hostile reports (mitigated by multi-member team). [Ambitious] Bootstrap micro-patch normalized as general bypass channel (mitigated by 2-authority sign-off, survival floor requirement, auto-sunset). [Ambitious] FAP concentration controls risk infinite regress (mitigated by self-executing Article VII publication).\n- **Residual risk:** Evidence farming in stress-tested pilot region remains possible if representativeness assessment criteria are gamed at the definition stage \u2014 criteria require P-004 protection. Deadlock resolution creates new CRP workload at day 61; if CRP is congested (T-005 risk), the deadline may not be met \u2014 P-005 categorical floor must include FAP deadlock as a guaranteed slot. At root: the FAP cannot be made exploitation-proof without being made unusable. P-013 accepts this and chooses calibrated friction over either extreme.\n- **Compound linkages:** T-016 \u00d7 T-005 (deadlock resolution congests CRP; P-005 floor must accommodate). T-016 \u00d7 T-008 (audit capture via intellectual-cousin exploit \u2014 mitigated by AG3). T-016 \u00d7 T-011 (stagnation of critical patches is narrative attack: 'the system cannot fix itself').\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-014 | T-017 | **ACTIVE** | Critical | founding governance + one-time exception |\n\n### P-014 \u2014 P-013 Bootstrap Activation (One-Time Founding Instrument)\n\n**Constitutional text:** [ANNEX_AH.md \u00a7 AH1\u2013AH7](../annexes/ANNEX_AH.md)\n\n**Special status.** P-014 is not a standing patch. It is a one-time founding instrument. It has no standing effect after P-013 reaches ACTIVE. It closes permanently upon P-013 activation.\n\n- **Nature:** One-time founding instrument, not a standing patch. Closes permanently upon P-013 ACTIVE.\n- **Change type:** founding governance + constitutional one-time exception.\n- **Introduced design:** 5-stage process: (1) Pre-activation disclosure \u2014 60-day minimum public challenge window (extended by P-020; see ANNEX_AH.md \u00a7AH2); circular dependency analysis published; founding exception statement from Threat Register Owner; panel composition disclosed before sign-off. (2) Heightened 5-member panel \u2014 Threat Register Owner, 1 CRP reserve member (lot-drawn, not involved in P-013 design), 1 external systems reviewer from outside design-team domain, 1 Ombuds officer, 1 public-interest advocate (lot-drawn). All attest no 5-year affiliation with design team (externally verified). Adversarial member required; dissent published. 4/5 votes required. (3) Substitute evidence \u2014 desk review of 3+ real-world analogue cases; adversarial red-team analysis; scope-limitation certification; sunset compatibility check. (4) Activation and permanent sealing \u2014 P-013 ACTIVE; P-014 closes permanently; full activation record published; non-precedent statement embedded with Tier 2 protection; P-006 and P-009 immediately enter the Formal Acceptance Protocol pilot stage. (5) Post-activation audit within 90 days \u2014 using P-013's own now-operative standards; adversarial member required; if compromised \u2192 P-013 suspended and re-submitted through the now-operative Formal Acceptance Protocol.\n- **Non-precedent statement (Tier 2 protected):** 'P-014 was invoked once, for P-013 only, because no other process was available. It may not be cited as authority for any future activation, exception, or urgency bypass. Any invocation of P-014 logic for any purpose requires H-2 amendment process.'\n- **Clauses to integrate:** AH1\u2013AH7. Annex N/U2 as constitutional anchor.\n- **New risks introduced:** Founding panel subject to capture during pre-activation window (mitigated by 60-day minimum disclosure, lot-drawing, external conflict verification, adversarial member, and the Founding Legitimacy Dossier). Post-activation audit finding of compromise suspends P-013 \u2014 creates a window where the Formal Acceptance Protocol is operative but its governing patch is suspended (mitigated by the prior Formal Acceptance Protocol fallback during suspension; suspension published immediately). Pre-activation disclosure creates a hostile narrative window (mitigated by framing as transparency demonstration).\n- **Residual risk:** Desk review cases may be selected to confirm rather than challenge P-013 \u2014 adversarial member's case selection is the primary control; cases published for independent scrutiny. Second-order self-reference if post-activation audit finds compromise \u2014 accepted as less circular than the original bootstrap problem.\n- **Auto-close clause:** P-014 closes permanently upon P-013 ACTIVE status. No re-opening, no emergency extension, no analogical application. This clause is Tier 2 protected.\n- **Compound linkages:** T-017 \u00d7 T-016 (bootstrap paradox is the exploit surface T-016 bad actors use for indefinite delay of P-013). T-017 \u00d7 T-011 (bootstrap paradox is a narrative attack surface \u2014 P-014 pre-activation disclosure converts it into a transparency demonstration).\n\n---\n\n## P-013 through P-025 \u2014 Founding Mechanics and Attack Surface Closure\n\n*Red-team hardening cycle. Addresses T-018 through T-023 and closes residual risks identified in T-001, T-002, T-017, and the register's own operational security posture.*\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-015 | T-018 / T-019 | **ACTIVE** | High | structural + protocol + escalation path |\n\n### P-015 \u2014 PCRP Attack Surface Hardening\n\n**Constitutional text:** [ANNEX_AP.md](../annexes/ANNEX_AP.md)\n\n- **Change type:** structural + protocol + escalation path.\n- **Addresses:** T-018 (False-Trigger Exhaustion Attack), T-019 (Demand-Context Flag Suppression Attack).\n- **Introduced design:**\n  - *False-trigger escalation path (T-018):* False PCRP triggers accompanied by oracle manipulation evidence or coordination timing signatures do not count toward the 3-trigger audit cap \u2014 they escalate immediately to the enforcement track with formal investigation. Cap reset is available via independent audit finding of deliberate manipulation. A \"trigger exhaustion alert\" fires when 2 of 3 cap slots are consumed within a single quarter, prompting pre-emptive review before the third activation.\n  - *Demand-context manufactured flag assessment (T-019):* Ombuds co-certification during demand-context periods must include an explicit assessment of whether the triggering enforcement action was manufactured or strategically timed; this assessment is a required step with a defined 4-hour timeline, not an optional judgment. A cross-register timing monitor flags any enforcement action initiated within 48 hours of sentinel indicator movement \u2014 this does not block the enforcement action but elevates scrutiny on any resulting demand-context flag. If Ombuds finds deliberate flag manufacture, the demand-context designation is lifted and PCRP activation proceeds at standard scope.\n  - *Ombuds constitution pre-condition:* Annex AI (Federated Ombuds constitution) specifies explicit authority, decision criteria, and the 4-hour determination timeline for manufactured-flag assessments. **Annex AI is a pre-launch blocking gate \u2014 P-015 is not operative until at least four of five sub-Ombuds are appointed, challenged, and seated, and the Ombuds Oversight Assembly is seated.**\n- **Clauses to integrate:** AP1\u2013AP4. Amends AC2.3 (false-trigger cap rules). Amends AE2.4 (demand-context Ombuds certification procedure). See Annex AI for full Ombuds mandate and independence requirements.\n- **Dependencies:** Federated Ombuds formally constituted per Annex AI (at least four of five sub-Ombuds seated, Oversight Assembly seated, manufactured-flag criteria published). P-006 PCRP false-trigger tracking infrastructure operative. P-012 demand-context flag register operative. Cross-register timing monitor (Annex AI Section 3.3) technically implemented and tested.\n- **New risks introduced:** False-trigger escalation path can be weaponized in reverse \u2014 a genuine false trigger attributed to manipulation to avoid the audit cap. Mitigated by: escalation requires two independent evidence types (oracle manipulation evidence AND timing cluster), not a single officer judgment. Manufactured-flag assessment timeline (4 hours) creates pressure that could produce errors; mitigated by conservative default (maintain demand-context designation while assessment runs, but PCRP can activate at reduced scope with single-source authorization).\n- **Residual risk:** Real-time distinction between genuine oracle failure and engineered false trigger remains unreliable; escalation path applies retroactively. Low-level demand-context flag suppression using a genuinely valid enforcement action remains possible \u2014 accepted as operational leakage below detection threshold.\n- **Compound linkages:** T-018 \u00d7 T-019 (compound PCRP attack \u2014 both simultaneously executed is highest-risk scenario; P-015 must address the compound case explicitly). T-018 \u00d7 T-013 (audit load from false-trigger investigation consumes CRP capacity).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-016 | T-002 | **PROPOSED** | Critical | constitutional commitment + quantified doctrine |\n\n### P-016 \u2014 Identity Asymmetric Error Doctrine\n\n**Constitutional text:** [ANNEX_AK.md](../annexes/ANNEX_AK.md)\n\n- **Change type:** constitutional commitment + quantified doctrine.\n- **Status basis:** **PROPOSED / pre-ratification** for deploy-state; **designed, needs evidence** for maturity. Annex AK is incorporated as the live design candidate, but P-016 is not evidence-backed and not ratified into a founding until the founding coalition adopts the doctrine, confirms pilot-calibrated rates, and binds remaining FC values.\n- **Addresses:** T-002 \u2014 calibrating fraud tolerance without making the system unusable for vulnerable populations. Extends P-003.\n- **Introduced design:** The founding coalition must publish and formally adopt an **Asymmetric Error Doctrine** (AED) as a Tier 2 founding commitment before deployment. The AED must specify:\n  - (a) Maximum acceptable fraud rate per instrument tier (Essential Access, Voice, Service Record) \u2014 expressed as a percentage of enrolled population per quarter, with confidence interval.\n  - (b) Maximum acceptable exclusion rate for vulnerable populations (displaced, undocumented, digitally fragile persons) per tier \u2014 expressed as a percentage of estimated vulnerable population.\n  - (c) The review trigger when either rate is exceeded \u2014 automatic publication and independent audit within 30 days.\n  - (d) The decision rule when the two error types trade off: when reducing fraud exclusion would increase vulnerable-population exclusion by more than a specified ratio, the exclusion reduction takes priority unless the fraud rate exceeds a specified ceiling.\n  - (e) Annual recalibration review by an independent panel with at least one member from a vulnerable-population advocacy organization.\n- **Clauses to integrate:** AK1\u2013AK5. Annex B (identity architecture) extended. AED added to P-004 protected terms registry. Founding preconditions checklist extended (Annex N).\n- **Dependencies:** Identity system operational data required for calibration. AED is therefore a Tier 2 design commitment at founding: FC-140 through FC-145 have bound starting values, FC-146 through FC-150 remain pre-launch commitments, and all values must be tested before scale-up. The commitment to publish and honor the doctrine is the founding obligation; passing the evidence gates is the scale-up obligation.\n- **New risks introduced:** Quantified targets create goodhart's-law gaming \u2014 operators optimize to the metric rather than the underlying goal. Mitigated by: AED specifies both rates and requires independent measurement (not self-reported). Published targets also create narrative attack surface (\"the system allows X% fraud\"). Mitigated by: pre-committed publication converts this from a vulnerability into a transparency demonstration consistent with P-011.\n- **Residual risk:** Some exclusion is structurally unavoidable with any identity system. The AED does not solve this; it makes the trade-off explicit and governable rather than implicit and subject to political manipulation.\n- **Compound linkages:** T-002 \u00d7 T-011 (AED publication is a narrative attack surface \u2014 simultaneously the correct response). T-002 \u00d7 T-008 (vulnerable population exclusion rates must be tracked independently from the same bodies that operate the identity system \u2014 Ombuds Office or equivalent).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-017 | T-020 / T-021 | **ACTIVE** | Critical | measurement architecture + accreditation + supply-chain transparency |\n\n### P-017 \u2014 Oracle Epistemological and Algorithmic Independence\n\n**Status: ACTIVE (promoted 2026-04-18 via Proposal 3 close-out).** Numerical floors bound in `/founding/commitments.md` FC-030 (N\u22655), FC-031 (\u22653 methodology classes), FC-032 (pairwise correlation \u22640.30), FC-033 (\u22651 adversarial seat), FC-100 (14-day quorum-loss restoration window). Annex AL promoted to ACTIVE with its former founding-parameter slots fully bound.\n\n**Constitutional text:** [ANNEX_AL.md](../annexes/ANNEX_AL.md)\n\n- **Change type:** measurement architecture + accreditation standards + supply-chain transparency.\n- **Addresses:** T-020 (Epistemological Oracle Capture), T-021 (Algorithmic Oracle Capture).\n- **Introduced design:**\n  - *Methodology-class diversity mandate (T-020):* RCS accreditation must include at least one measurement node per high-volatility essential category using a fundamentally different methodology class (e.g., community-based participatory research vs. institutional statistical modeling vs. independent physical sampling). The specific methodology classes are defined as a P-004 protected term (Annex AL \u2014 \"methodology class\" definition with worked examples).\n  - *Methodological divergence signal (T-020):* Systematic divergence between methodology classes is a first-order sentinel indicator requiring investigation, not an anomaly requiring suppression. A divergence above a defined threshold triggers an independent methodological review before that category can be used for Shared Storehouse activation.\n  - *Standards-funding transparency (T-020):* Any RCS-accredited node must disclose funding sources for the methodological standards it relies on, with a three-year lookback. Funding from parties with material interest in oracle outputs triggers additional scrutiny.\n  - *Anti-monoculture review trigger (T-020):* If three or more oracle nodes rely on the same standards body for a given category, an independent methodological review is required before that category can be used for Shared Storehouse activation.\n  - *AI supply chain transparency (T-021):* Any oracle node using ML or AI components must disclose model provenance, training data sources, and any shared upstream dependencies with other oracle nodes. This disclosure is published and part of the independence certification.\n  - *Algorithmic independence certification (T-021):* Oracle independence audit must include explicit verification that no two corroborating oracle nodes share a common upstream AI model, training dataset, or fine-tuning pipeline, and that formally independent nodes are not producing same-direction material errors that evade FC-032 pairwise-correlation checks.\n  - *Physical ground-truth requirement (T-021):* At least one measurement node per high-volatility category must use direct physical sampling (not model-derived estimates) as its primary measurement method.\n- **Clauses to integrate:** AL1\u2013AL7. Annex M (oracle architecture) extended. \"Methodology class\" and \"algorithmic independence\" added to P-004 protected terms registry per Annex AL. RCS accreditation standards document updated.\n- **Dependencies:** Annex AL (methodology-class definitions) published and initial methodology-class registry populated before first oracle set is accredited. **Annex AL is a pre-launch blocking gate \u2014 P-017 is not operative until the methodology-class registry is published and the standards-body concentration tracking system is built.** P-004 protected terms registry must be operative. Oracle independence audit capacity must include algorithmic supply chain review \u2014 new capability requirement. Physical sampling for high-volatility categories requires resource commitment from founding coalition.\n- **New risks introduced:** Methodology-class diversity requirement increases oracle system cost and coordination complexity. Physical sampling is expensive; cost pressure may produce under-investment that weakens the ground-truth requirement over time \u2014 addressed by Article VII publication of sampling frequency and method per category. AI supply chain disclosure creates competitive sensitivity concerns for oracle node operators \u2014 mitigated by: disclosure is to auditors, not publicly; methodology-level information is published but not proprietary implementation details.\n- **Residual risk:** Defining \"fundamentally different methodology class\" is subject to T-007 definition drift. Pairwise correlation alone can miss directional bias, so Annex AL now requires direction-of-error review and adversarial-seat certification before activation votes. Small pilot populations can also overclaim independence; Cohort 1 requires a small-population oracle plan if below 500 persons. Annex AL Sections 1 and 2 are P-004 protected; Sections 3 and 4 are updated through annual audit (Annex AL Section 5). The annual review panel must include an adversarial methodologist whose role is to find exploitation paths in the current definitions.\n- **Compound linkages:** T-020 \u00d7 T-021 (both target oracle epistemological foundations; P-017 addresses both). T-020 \u00d7 T-012 (structural oracle independence is necessary but not sufficient; P-017 adds the epistemological layer). T-020 \u00d7 T-008 (epistemic monoculture in oracle methodology parallels elite formation in oversight \u2014 P-008 and P-017 share the diversity-mandate logic).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-018 | T-022 | **PROPOSED** | Critical | constitutional architecture + political durability |\n\n### P-018 \u2014 Electoral Cycle Resilience\n\n**Constitutional text:** [ANNEX_AM.md](../annexes/ANNEX_AM.md)\n\n- **Change type:** constitutional architecture + political durability + transition protocol.\n- **Addresses:** T-022 (Electoral Cycle Capture).\n- **Introduced design:**\n  - *Entrenchment ladder (direct repeal route):* Tier 1 invariants require not just a legislative supermajority but concurrent ratification by an independent constitutional body. The constitutional body's composition must be specified at founding such that it cannot be reconstituted entirely by the governing coalition within a single electoral term.\n  - *Essential Access floor minimum persistence (administrative hollowing route):* A minimum Essential Access floor \u2014 defined at founding as 70% of the founding basket \u2014 is constitutionally self-executing: it does not require legislative appropriation and cannot be suspended by executive action. This floor persists through any governing coalition transition unless repealed via the full Tier 1 amendment process.\n  - *Administrative hollowing triggers:* If a founding institution is unfilled for more than 90 days, or post-mortem publication lapses for more than 30 days, or oracle accreditation count drops below a specified minimum, an automatic constitutional review is triggered that does not require the governing coalition's initiation. The review is initiated by the constitutional body and is self-executing.\n  - *Transition continuity protocol:* When a new governing coalition takes office, a mandatory 180-day transition audit is required before any changes to Tier 2 or Tier 1 provisions. The audit is conducted by the constitutional body, not the incoming government. During the 180-day window, no Tier 2 or higher changes may be made except through emergency deadlock resolution (P-012 AE2.3).\n  - *Treaty override protection (jurisdictional fragmentation route):* International agreements that require modification to the non-convertibility architecture trigger a mandatory Tier 2 impact assessment before ratification. An agreement that would produce cumulative Tier 2 impact (by T-007/P-012 cumulative drift trigger standards) requires the full Tier 2 amendment process for each applicable provision.\n- **Clauses to integrate:** AM1\u2013AM6. Tier 1 amendment process modified (Annex A). Essential Access floor persistence clause added to Article IV. Administrative hollowing triggers added to the Article VII dashboard as auto-publication requirements. Transition continuity protocol added to the operational layer.\n- **Dependencies:** Independent constitutional body formally constituted at founding with staggered terms and confirmed independence from governing coalition appointment. Essential Access floor minimum definition requires RCS capacity confirmation.\n- **New risks introduced:** Self-executing Essential Access floor minimum requires RCS capacity to be maintained regardless of political will \u2014 if oracle system degrades, the self-executing floor has no measurement basis. Mitigated by: oracle degradation itself triggers an administrative hollowing review. Transition continuity audit creates 180-day governance window \u2014 addressed by: audit has a defined 30-day maximum scope for routine transitions; extensions require independent authorization.\n- **Residual risk:** A government with sufficient political will and supermajority can repeal constitutional entrenchment. The designed defense buys time and raises political cost; it cannot prevent determined repeal. Ultimate residual risk: protocol durability depends on political culture. No design can substitute for a political culture that values the commitments.\n- **Compound linkages:** T-022 \u00d7 T-011 (hostile electoral success often follows narrative attack \u2014 P-011 and P-018 are jointly necessary). T-022 \u00d7 T-008 (elite formation inside institutions may assist administrative hollowing by a hostile government). T-022 \u00d7 T-017 (T-022 success produces a new bootstrap problem \u2014 recursive T-017). T-022 \u00d7 T-016 (hostile government can capture FAP sign-off authorities).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-019 | T-023 | **ACTIVE** | Med-High | evidence architecture + scale-up gating |\n\n### P-019 \u2014 Pilot External Validity Gate\n\n**Constitutional text:** [ANNEX_AN.md](../annexes/ANNEX_AN.md)\n\n- **Change type:** evidence architecture + scale-up gating + simulation mandate.\n- **Addresses:** T-023 (Pilot External Validity Collapse).\n- **Introduced design:**\n  - *Stress-condition pilot gate:* Scale-up approval requires the pilot evidence record to include at least one each of: an economic stress event (recession, significant unemployment spike, or supply price shock affecting the pilot region); a compound supply disruption (two or more essential categories simultaneously below adequate levels); and documented operation during a formal political opposition campaign against the system. Where a condition could not be tested in the pilot, the evidence record must include: (a) explicit documentation of why it could not be tested; (b) a designated substitute evidence source (e.g., analogous case from another jurisdiction, red-team analysis); (c) a residual-risk statement acknowledging the gap; and (d) a post-scale monitoring commitment specific to the untested condition.\n  - *Red-team challenge window (T-016 companion):* Before any scale-up vote, a mandatory 30-day adversarial challenge window allows independent reviewers to contest the external validity of the evidence base. Challengers must have access to the full evidence record, not just the summary. Responses to challenges are published before the vote.\n  - *Crisis simulation mandate:* The Annual Compound Simulation must include at least one compound-crisis scenario not previously simulated before each scale-up gate. The talent drain scenario and civic legibility scenario fulfill this requirement for the first scale-up gate only.\n- **Clauses to integrate:** AN1\u2013AN5. FAP (Formal Acceptance Protocol) extended \u2014 scale-up gate conditions added to evidence requirements. Annex T (simulation mandate) extended. P-013 representativeness standard cross-referenced (stress-condition pilot is a representativeness requirement).\n- **Dependencies:** Annual Compound Simulation must be updated to include new scenarios before each scale-up gate. Red-team challenge window requires independent reviewer access infrastructure.\n- **New risks introduced:** Stress-condition requirement may delay scale-up indefinitely if adverse conditions do not occur in the pilot region within a reasonable window. Mitigated by: substitute evidence pathway is explicitly available; the requirement is for good-faith engagement with external validity, not for a manufactured crisis. Red-team challenge window creates a blocking mechanism \u2014 mitigated by: challengers must propose specific residual-risk mitigations, not merely object.\n- **Residual risk:** Some external validity gaps cannot be filled by any pilot. A deliberately engineered crisis to satisfy the stress-condition requirement would satisfy the letter but not the spirit of P-019. Ultimate residual risk: the evidence base for a system of this scale will always be incomplete.\n- **Compound linkages:** T-023 \u00d7 T-016 (honest insufficient pilot is the complement to dishonest evidence farming \u2014 both require evidence quality controls). T-023 \u00d7 T-011 (scale-up failure after smooth pilot is a maximum-impact narrative attack). T-023 \u00d7 T-022 (hostile electoral challenge is one of the hardest conditions to include in a controlled pilot; substitute evidence pathway must address this explicitly).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-020 | T-017 | **ACTIVE** | Critical | founding governance + window extension |\n\n### P-020 \u2014 Founding Window Extension\n\n**Constitutional text:** [ANNEX_AH.md \u00a7 AH2.1\u2013AH2.4](../annexes/ANNEX_AH.md)\n\n- **Change type:** founding governance amendment \u2014 extends P-014 Annex AH.\n- **Addresses:** T-017 residual risk \u2014 14-day pre-activation disclosure window is insufficient for independent critique to organize against a coordinated founding capture attempt.\n- **Introduced design (Annex AH2, amending AH1):**\n  - *60-day pre-activation disclosure (replacing 14-day):* The P-014 pre-activation challenge window is extended from 14 days to 60 days minimum. The 60-day clock begins when the circular dependency analysis, founding exception statement, and panel composition are simultaneously published. No stage of P-014 may proceed until the 60-day window closes with no unresolved structural objections requiring response.\n  - *Oppose-coalition adversarial member nomination:* The adversarial panel member required by P-014 may not be appointed by the same nominating process as the other four panel members. The adversarial member must be nominated by a body that is structurally opposed to or independent from the founding coalition's interests \u2014 specifically: (a) a civil liberties or human rights organization not affiliated with the founding coalition; (b) a registered opposition political party or civic organization; or (c) an independent academic institution with no material funding relationship with founding coalition members. The nominating body's selection rationale must be published as part of the founding record.\n  - *Objection response requirement:* Any structural objection submitted during the 60-day window that identifies a specific P-013 standard not met by the P-014 process must receive a written response from the founding panel before the window closes. Unresponded objections extend the window by 14 days, non-cumulatively.\n- **Non-precedent statement (extends AH1 Tier 2 protection):** 'P-020 amends P-014. The 60-day window and oppose-coalition nomination are P-014 requirements only. They do not set a precedent for other patch activations, emergency processes, or governance decisions. Any invocation of P-020 logic for any other purpose requires H-2 amendment process.'\n- **Clauses to integrate:** AH2.1\u2013AH2.4. P-014 founding checklist extended. Annex N founding preconditions updated.\n- **Dependencies:** Oppose-coalition nominating body must be identified before P-014 stage 1 begins. 60-day window requires that the founding timeline allow for this \u2014 founding planning should budget 90 days for the P-014 process from first public disclosure to panel sign-off.\n- **New risks introduced:** 60-day window provides more time for coordinated opposition to manufacture procedural objections that are technically valid but strategically motivated. Mitigated by: objection response requirement specifies that only structural objections (identifying a specific P-013 standard not met) require response; procedural objections without structural grounding do not extend the window. Oppose-coalition nomination process requires identifying a legitimate opposition body \u2014 in contexts without organized opposition, this may be difficult. Mitigated by: the three pathways (civil liberties org, opposition party, academic institution) provide alternatives.\n- **Residual risk:** A 60-day window with published panel composition still allows founding panel capture if the oppose-coalition nomination process is itself captured. Ultimate residual: founding legitimacy depends on the quality of the political culture and civil society present at the founding moment. No procedural design fully compensates for absent civil society.\n- **Compound linkages:** T-017 \u00d7 T-022 (T-022 attack recurs as T-017 after a successful dismantling \u2014 P-020 hardened founding reduces risk of both initial capture and post-T-022 refounding capture). T-017 \u00d7 T-011 (60-day public window converts founding moment into sustained transparency demonstration).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-021 | \u2014 | **ACTIVE** | High | register architecture + disclosure policy |\n\n### P-021 \u2014 Register Disclosure Protocol\n\n**Constitutional text:** [ANNEX_AO.md](../annexes/ANNEX_AO.md)\n\n- **Change type:** register architecture + operational security + transparency calibration.\n- **Addresses:** Open threat register as attack surface \u2014 the current register publishes specific detection thresholds, timing windows, and exploit paths that constitute an operational manual for sophisticated attackers. This is not a new threat ID (the vulnerability is architectural, not a distinct attack class); it is a structural change to how the register is maintained.\n- **Introduced design:** The register is bifurcated into:\n  - *Public Register:* Threat categories, mechanisms (described at class level, not with specific thresholds), mitigation approaches, residual risks, risk scores, and compound linkages. The public register is published in the open GitHub repository and is the primary accountability and transparency artifact. The current `Threat_Register.md` is the public register.\n  - *Restricted Register Annex:* Specific detection thresholds (e.g., exact trigger counts and time windows), precise timing windows for exploitation, operational detection patterns and signatures, and calibration data used to set automated alerts. The Restricted Annex is available to: credentialed auditors under NDA; adversarial panel members in the P-013/P-014 acceptance process; the constitutional review body; and Ombuds Office staff. It is not published publicly. It is version-controlled privately with access logs.\n  - *Consistency requirement:* Both versions must be updated simultaneously. Any discrepancy between the public and restricted versions triggers a T-007 definition-drift review. The restricted version is the authoritative operational document; the public version is the transparency artifact.\n  - *Reclassification review:* Annually, the Threat Register Owner reviews whether any restricted-version content can be declassified to the public version (because the window of operational sensitivity has passed) or whether any public-version content should be reclassified to restricted (because specific operational details have been added).\n- **Clauses to integrate:** AO1\u2013AO5. Annex AO (Register Disclosure Protocol) \u2014 see `docs/annexes/ANNEX_AO.md`. P-004 protected terms registry: 'restricted annex' and 'public register' defined.\n- **Dependencies:** Restricted Annex infrastructure (private version-controlled repository with access controls) must be established before P-021 is operative. Threat Register Owner role must be formally constituted with authority to manage both versions.\n- **New risks introduced:** Bifurcation creates an accountability gap \u2014 the public cannot verify that the restricted version is consistent with stated mitigations. Mitigated by: credentialed auditors can access restricted version and publish a consistency attestation (not the content) annually. Restricted version existence itself creates an information asymmetry that could be used to claim mitigations are more robust than they are. Mitigated by: consistency attestation is published; any disclosed gap between public claims and restricted reality is a T-007 event.\n- **Residual risk:** The bifurcation design assumes that restricted content stays restricted. Leaks are possible. The design accepts this and treats the restricted version as reducing adversarial advantage, not eliminating it \u2014 full security through obscurity is not the goal.\n- **Compound linkages:** P-021 \u00d7 T-011 (restricted register removes some transparency \u2014 P-021 must be communicated publicly as a deliberate operational security choice, not a transparency failure, or it becomes a narrative attack surface).\n\n---\n\n## P-022 through P-023 \u2014 Operational Gap Closure\n\n*Operational gap closure (P-022) and design-discussion registration (P-023).*\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-022 | T-024 | **ACTIVE** | Critical | protocol + authority definition + FC-100 restoration verification + reconciliation |\n\n### P-022 \u2014 Shared Storehouse Oracle-Failure Fallback Protocol\n\n**Status: ACTIVE (promoted 2026-04-18 via Proposal 6 close-out).** FC-100 `ORACLE_QUORUM_LOSS_RESTORATION_WINDOW` = 14 days bound in `/founding/commitments.md`. Annex AQ promoted to ACTIVE with full protocol detail, survival floor unconditionality confirmed, Reconciliation Review specified.\n\n**Constitutional text:** [ANNEX_AQ.md](../annexes/ANNEX_AQ.md)\n\n- **Change type:** protocol + authority definition + oracle reconciliation procedure.\n- **Addresses:** T-024 (Shared Storehouse Oracle-Failure During Active Rationing) \u2014 the operational void where Shared Storehouse is active and the oracle system fails, loses quorum, or enters an unresolvable dispute with no defined decision path.\n- **Introduced design:**\n  - *Conservative hold default:* When the oracle system loses quorum or enters an unresolvable dispute while Shared Storehouse is active, Shared Storehouse holds at its current activation level. No escalation. No expansion to new categories. No automatic lapse. The conservative hold is the designed default \u2014 not doing nothing, but doing the least-harm thing until authority is restored.\n  - *48-hour REB first-responder window:* The Regional Executive Body (REB), using its existing P-006 first-responder authority, may issue a provisional continuation or provisional lapse within 48 hours of oracle failure based on non-oracle physical indicators: distribution fill rates, vendor inventory reports, and logistics data. The REB decision is published immediately with the full evidence base. The REB may not expand Shared Storehouse scope under this authority \u2014 only hold or begin a managed lapse. Expansion requires oracle quorum.\n  - *72-hour governance handoff:* If the oracle system is not restored within 72 hours of failure, the matter transfers to the emergency deadlock resolution protocol (P-012 AE2.3) for a binding decision. The 3-member arbitration panel has authority to issue a time-bound Shared Storehouse continuation or staged lapse. The survival floor bridge (P-012 AE2.3) is unconditional throughout oracle failure \u2014 Essential Access baseline access is never contingent on oracle availability.\n  - *Oracle restoration reconciliation:* When the oracle system begins restoration, a mandatory 24-hour preliminary reconciliation notice names restored-node status, unresolved discrepancies, and any provisional REB decision that appears inconsistent with restored readings. After the 14-day FC-100 verification window, a final Reconciliation Review is published within 7 days with root-cause analysis. Persistent REB-oracle divergence triggers an independent review of the non-oracle physical indicator methodology.\n  - *Deliberate-failure escalation:* If oracle failure during active Shared Storehouse is found to be deliberately engineered (oracle manipulation evidence per T-012/T-018), the matter escalates immediately to enforcement \u2014 the conservative hold and first-responder window both continue, but the investigation runs in parallel without waiting for oracle restoration.\n- **Clauses to integrate:** AQ1\u2013AQ5. Amends Annex U (Shared Storehouse termination and continuation procedures). Amends AC2 (P-006 PCRP/REB authority \u2014 Shared Storehouse oracle failure is a distinct REB authority from PCRP). Article VII dashboard extended: oracle status must include a live Shared Storehouse-active indicator so oracle failure during active Shared Storehouse is publicly visible in real time.\n- **Dependencies:** REB formally constituted with defined authority for non-oracle physical indicator assessments. Non-oracle physical indicator methodology must be published and reviewed annually. P-012 AE2.3 emergency deadlock protocol must be operative before P-022 is operative.\n- **New risks introduced:** REB use of non-oracle physical indicators creates a soft-oracle channel not subject to the independence requirements of the main oracle system. Mitigated by: (1) REB authority under P-022 is explicitly scoped to hold-or-lapse decisions only \u2014 no scope expansion; (2) REB decisions are published immediately with evidence base; (3) reconciliation review after oracle restoration creates accountability for REB accuracy; (4) the non-oracle indicator methodology is published and periodically reviewed. Risk: consistent REB-oracle agreement could be engineered by an adversary who also controls the physical indicator sources. Mitigated by: physical indicators (fill rates, inventory reports) are collected from distributed vendor networks \u2014 harder to simultaneously compromise than a concentrated oracle system.\n- **Residual risk:** A deliberate oracle failure timed to active Shared Storehouse, combined with physical indicator manipulation, could force a harmful REB decision during the 48-hour window. This is the highest-consequence compound attack on the Shared Storehouse system. The 72-hour governance handoff provides a backstop, but 72 hours of incorrect Shared Storehouse operation during a genuine shortage is a real harm. Accepted as the best available outcome given the operational constraint that a governance decision cannot be made faster than the arbitration panel can convene.\n- **Compound linkages:** T-024 \u00d7 T-006 (P-022 extends P-006 to cover oracle failure during Shared Storehouse \u2014 P-006 covers measurement lag; P-022 covers measurement absence). T-024 \u00d7 T-014 (triple deadlock during Shared Storehouse oracle failure is the worst-case scenario \u2014 survival floor bridge must be explicitly unconditional regardless of deadlock status). T-024 \u00d7 T-018 (deliberate false-trigger exhaustion designed to overlap with active Shared Storehouse is the highest-risk T-018 compound).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-023 | T-025 | **ACTIVE** | High | Contract-commitment architecture / protected-capital shelter control |\n\n### P-023 \u2014 Contract-Commitment Architecture (Protected-Capital Shelter Control)\n\n- **Status:** ACTIVE\n\n**Constitutional text:** [ANNEX_AR.md](../annexes/ANNEX_AR.md)\n\n- **Evidence package:** [Commons Return and Universal Stake Evidence Test Package](./Commons_Return_Universal_Stake_Evidence_Test_Package.md), plus Annex AR project-finance simulation and procurement red team.\n- **Threat addressed:** T-025 (Investment and Capital-Deployment Shelter Capture).\n- **Direction adopted:** Direction B \u2014 deployment-speed architecture. Investment-channel exemptions are removed entirely. Genuine long-horizon capital needs are served by contract-commitment architecture; protected-capital status requires real deployment, public accounting, and source-base review where Commons Return is implicated.\n- **Red-team pre-analysis:** Ten attack vectors identified and resolved before this patch was written. Vectors: (1) escrow control ambiguity, (2) milestone definition gaming, (3) \"working capital\" as new exemption label, (4) advance procurement rebranded as hoarding, (5) subcontractor chain gaming, (6) essential-sector carve-out pressure, (7) multi-jurisdiction pooling ambiguity, (8) force majeure as wedge for permanent exemptions, (9) sector definitional creep, (10) milestone oracle capture. All resolved in patch rules below.\n\n**P-023.1 \u2014 Zero Shelter Principle**\nNo entity, sector, or project type receives protected-capital shelter by label. The investment-channel exemption architecture from the original P-002 design is deprecated. The concept of \"investment-channel status\" is removed. No project account, escrow window, term pool, infrastructure label, or public-benefit designation may shield idle control from deployment review or Annex D source-base review.\n\n**P-023.2 \u2014 Contract-Commitment Architecture**\nLong-horizon projects are financed through milestone escrow:\n- The commissioning authority deposits Flow into an independent escrow account at project initiation.\n- Deployment-window review, public reporting, and Annex D source-base review apply to escrowed Flow. The commissioning authority bears accountability for delay, creating institutional incentive for timely contracting and completion.\n- Flow is released to the contractor only upon independently verified milestone completion.\n- The contractor holds only current working capital. Protected-capital shelter is unavailable without verified physical deployment.\n\n**P-023.3 \u2014 Independent Escrow Agent**\nEscrow accounts are administered by an independent escrow agent designated by the CRP. The contractor, any entity in the contractor's supply chain, and any entity with a financial interest in the project's outcome may not administer, co-administer, or materially influence the escrow account.\n\n**P-023.4 \u2014 Output Milestone Standard**\nMilestones eligible to trigger escrow releases must satisfy all of the following:\n- Physical deliverables only \u2014 no process milestones, no self-certified planning stages, no administrative completions.\n- Independently inspected and certified by a rotating inspector pool; the contractor does not select inspectors. Pool is administered by the escrow agent under P-017 oracle-independence standards.\n- Defined at contract signing and P-004-locked. No renegotiation of milestone definitions after contract execution.\n- High-value releases (above the threshold defined in Annex AR) require multiple independent verifiers and physical inspection with full audit trail.\n\n**P-023.5 \u2014 Procurement Clarification**\nAdvance procurement of materials means actual purchase: Flow exits the contractor's hands at the transaction. Holding Flow \"in reserve for future procurement\" without a bound deliverable is protected-capital sheltering and receives no protective treatment. Supply chain uncertainty is addressed through competitive procurement, staged purchasing, and futures commitments \u2014 not indefinite balance reserves.\n\n**P-023.6 \u2014 Universal Scope**\nP-023 applies at every tier of the supply chain: prime contractors, subcontractors, sub-subcontractors, and all entities receiving Flow for project work are subject to the same architecture. There is no sector-specific carve-out. Eligibility for contract-commitment structure is determined by deliverable characteristics (verifiable physical milestones + commissioning authority), not sector identity.\n\n**P-023.7 \u2014 Mandatory Deployment Timeline (Commissioning Authorities)**\nCommissioning authorities must contract idle escrowed funds within the deployment window defined in Annex AR. Funds held beyond this window without active contracting trigger mandatory CRP review. Review and publication continue regardless of whether any dormant backstop has been activated. This is an accountability mechanism, not an exemption.\n\n**P-023.8 \u2014 Multi-Jurisdiction Lead Authority**\nFor projects with multiple commissioning authorities pooling Flow, a lead authority must be designated at contract signing. The lead authority bears accountability for pooled escrow delay, publication, and review. Internal cost-sharing between participating authorities is a private arrangement; external accountability runs through the lead authority only.\n\n**P-023.9 \u2014 Force Majeure Escrow Freeze**\nVerified external delays may trigger a temporary freeze of deployment-delay consequences:\n- Qualifying events: permitting delays attributable to regulatory bodies outside the project's control; certified supply chain disruptions (independent third-party certification required); declared natural disasters.\n- Process: contractor applies with documented evidence; an independent assessment panel certifies the external cause and its temporal scope. Panel composition and selection use P-017 oracle-independence standards.\n- Effect: deployment-delay consequences on the affected escrow account are paused for the certified duration only.\n- Limits: freeze is time-limited to the verified external condition; total cumulative freeze time per project is capped at the period defined in Annex AR; freeze does not stack across overlapping events.\n- Gaming deterrent: misrepresentation in a freeze application is an audit trigger and grounds for contractor disqualification from future escrow eligibility.\n\n**P-023.10 \u2014 P-004 Protected Terms**\nThe following terms are added to the P-004 protected vocabulary: *milestone*, *physical deliverable*, *commissioning authority*, *independent escrow agent*, *force majeure* (for protocol purposes), *lead authority*, *verified external delay*, *deployment window*. Definitions may not be modified without a Tier 2 (H-2) amendment.\n\n- **Risk introduced:** (1) Force majeure certification panel is a new oracle \u2014 capture target per T-020/T-021; mitigated by P-017 independence requirements. (2) Mandatory deployment timelines may pressure commissioning authorities to rush contracting rather than hold idle; mitigated by requiring contracts to pass standard procurement integrity checks before they satisfy the timeline. (3) Inspector pool is a new oracle; mitigated by rotating pool under P-017 standards and escrow-agent administration. (4) P-023.4 output-only milestone standard may be challenged as too rigid for novel infrastructure categories; mitigated by P-004 protection \u2014 any redefinition requires H-2 amendment, raising the cost of definitional drift.\n- **Annex:** AR (contract-commitment architecture specification \u2014 high-value release thresholds, deployment window periods, force majeure cumulative freeze cap, inspector pool governance, escrow agent designation process).\n- **Compound linkages:** T-025 \u00d7 T-001 resolved (no investment-channel exemptions means no above-ledger boundary manipulation through exemption classification). T-025 \u00d7 T-007 mitigated (P-004 protection on all P-023.10 terms). T-025 \u00d7 T-008 mitigated (no classification to capture \u2014 sector identity is irrelevant to escrow eligibility).\n\n---\n\n## Operating Rules for the Patch Log\n\n- Every future patch must reference a threat ID and specify the new risk it creates.\n- If a patch only exists in the log and not in the Humane Constitution, it is not yet operative.\n- If a patch changes public explanation, the white paper and technical reference must be synced in the same cycle.\n- When a patch materially changes user experience or institutional authority, the diagram set must be updated too.\n- **PROPOSED** patches become ACTIVE only after formal Humane Constitution integration and oversight sign-off.\n- If two patches conflict, the conflict belongs in the patch log and must be resolved explicitly in the Humane Constitution.\n\n---\n\n## Current Threat/Patch Linkage\n\nThis table is the single source of truth for threat\u2192patch traceability. It covers every patch in the current inventory through P-073. Reserved IDs (P-007, P-010, P-028, P-071) and the draft-only P-063 review packet are listed in the Reserved / Never-Assigned Patch IDs table above. \"Multiple\" has been replaced with enumerated threat (or PRD-/IC-/INV-/ACL-) references throughout; patches with no standalone threat row are marked \"structural \u2014 no threat row.\"\n\n| Threat ID | Patch ID | Status | Master Reference |\n| :--- | :--- | :--- | :--- |\n| T-001 | P-001 | **ACTIVE** | Annex AB |\n| T-004 | P-002 | **ACTIVE** | Annex AB |\n| T-002 | P-003 | **ACTIVE** | Annex AB |\n| T-007 | P-004 | **ACTIVE** | Annex AB |\n| T-005 | P-005 | **ACTIVE** | Annex AC1 |\n| T-006 | P-006 | **ACTIVE** | Annex AC2 |\n| T-008 | P-008 | ACTIVE | Annex AC3 (operative authority superseded by P-025 ACTIVE) |\n| T-009 | P-009 | **ACTIVE** | Annex AF |\n| T-011 | P-011 | **ACTIVE** | Annex AD |\n| T-012\u2013T-015 | P-012 | **ACTIVE** | Annex AE |\n| T-016 | P-013 | **ACTIVE** | Annex AG |\n| T-017 | P-014 | **ACTIVE** | Annex AH |\n| T-018 / T-019 | P-015 | **ACTIVE** | Annex AP \u00b7 Annex AI |\n| T-002 | P-016 | ACTIVE | Annex AK (P-016 is pre-ratification design) |\n| T-020 / T-021 | P-017 | **ACTIVE** | Annex AL \u00b7 FC-030/031/032/033/100 |\n| P-018 | T-022 supplement | **PROPOSED** | Annex AM |\n| T-023 | P-019 | **ACTIVE** | Annex AN |\n| T-017 | P-020 | **ACTIVE** | Annex AH2 |\n| structural \u2014 no threat row (register disclosure protocol) | P-021 | **ACTIVE** | Annex AO |\n| T-024 | P-022 | **ACTIVE** | Annex AQ \u00b7 FC-100 |\n| T-025 | P-023 | **ACTIVE** | Annex AR |\n| T-009 / TR-07 / T-018 | P-024 | **ACTIVE** | Annex AS \u00b7 FC-080/081/082 |\n| T-008 | P-025 | **ACTIVE** | Annex AI \u00b7 FC-090/091/092 |\n| T-026 / T-027 | P-026 | **ACTIVE** | `founding/order/` \u00b7 FC-120/121/122 |\n| T-005 / T-008 | P-027 | **ACTIVE** | `Humane_Constitution.md` \u00b7 `docs/public/04_white_paper.md` |\n| T-016 (public-funding architecture) | P-029 | **ACTIVE** | Annex X \u00a7X8 |\n| PRD-004 | P-030 | **ACTIVE** | Annex X |\n| PRD-009 | P-031 | **ACTIVE** | Annex J \u00a7R1\u2013R2 |\n| PRD-009 | P-032 | **ACTIVE** | Annex J |\n| PRD-008 | P-033 | **ACTIVE** | Annex J |\n| T-016 / INV-007 | P-034 | **ACTIVE** | Annex AV |\n| structural \u2014 no threat row (corrigibility/humility clause) | P-035 | **ACTIVE** | Preamble \u00b7 \u00a70A |\n| structural \u2014 no threat row (keyholder servanthood duty) | P-036 | **ACTIVE** | Article I |\n| structural \u2014 no threat row (identity-serves-person clause) | P-037 | **ACTIVE** | Article II |\n| T-006 | P-038 | **ACTIVE** | Article III |\n| structural \u2014 no threat row (mutual-aid/family/religious protection) | P-039 | **ACTIVE** | Article IV |\n| structural \u2014 no threat row (housing-cap pastoral revision) | P-040 | **ACTIVE** | Article V |\n| T-008 | P-041 | **ACTIVE** | Article VI |\n| structural \u2014 no threat row (community alert pathway) | P-042 | **ACTIVE** | Article VII |\n| T-001 / T-002 / T-004 / T-007 | P-043 | **ACTIVE** | ANNEX_AH \u00b7 ANNEX_Y \u00b7 INVARIANTS \u00b7 SPECIFICATIONS |\n| T-001 / T-002 / T-004 / T-005 / T-007 / T-018 / T-019 | P-044 | **ACTIVE** | ANNEX_AI \u00b7 ANNEX_AP \u00b7 ANNEX_AB \u00b7 ANNEX_AK \u00b7 ANNEX_Y |\n| T-001 / T-002 / T-004 / T-007 / IC-004 | P-045 | **ACTIVE** | ANNEX_AB \u00b7 ANNEX_AK \u00b7 ANNEX_AH \u00a7AH5.1 |\n| T-001 / T-002 / T-007 / T-008 / T-016 (evidence + capture hardening) | P-046 | **ACTIVE** | evidence artifacts \u00b7 capture dashboard |\n| T-025 / T-026 / T-027 (external dependency capture) | P-047 | **ACTIVE** | Annex AT |\n| T-025 / T-026 / T-027 (external dependency capture) | P-048 | **ACTIVE** | Annex AT \u00b7 FC-194\u2013FC-201 |\n| T-025 / T-026 / T-027 (cross-register evidence-gap bridge) | P-049 | **ACTIVE** | Hardening Queue \u00b7 Open Problems \u00b7 Pilot Roadmap \u00b7 README |\n| T-028 | P-050 | **ACTIVE** | ANNEX_AT \u00a7AT6.6 |\n| T-022 | P-051 | **ACTIVE** | ANNEX_AM \u00a7AM8 |\n| T-019 | P-052 | **ACTIVE** | ANNEX_AI \u00a74.12 |\n| Insider retaliation / reporter protection | P-053 | **ACTIVE** | ANNEX_AW \u00b7 Article VII |\n| Identity disclosure as safety vector | P-054 | **ACTIVE** | ANNEX_AX \u00b7 Article II |\n| Delivery gap between guarantee and operation | P-055 | **ACTIVE** | ANNEX_AY \u00b7 Article IV |\n| INV-001 support (identity-related; active identity controls remain P-003/P-016) | P-056 | PROPOSED | ANNEX_AK \u00a7AK8 \u00b7 ANNEX_AZ \u00a7AZ2 |\n| ACL-011 / ACL-010 | P-057 | **PROPOSED** | Pilot site selection criteria |\n| constitutional void support \u2014 no standalone threat row | P-058 | PROPOSED | Jurisdiction Interface Clause |\n| ACL-010 / dignity-floor leverage | P-059 | **PROPOSED** | Vulnerable_Population_Consent_Protocol.md |\n| ACL-005 / founding keyholder capture | P-060 | **PROPOSED** | Founding Team Composition Standard |\n| ACL-007 / Power-Wealth Convergence | P-061 | **PROPOSED** | Founding Capital Framework |\n| ACL-011 / ACL-010 | P-062 | **PROPOSED** | Pilot Timeline Framework |\n| T-028 | P-064 | **ACTIVE** | Essential-Sector Refusal Test Package \u00b7 Capture Dashboard Specification \u00b7 Threat Resolution Matrix \u00b7 Pilot Evidence Roadmap |\n| T-022 | P-065 | **ACTIVE** | ANNEX_AM \u00a7AM3/\u00a7AM8.5\u2013AM8.7 \u00b7 amendment_protocol.md \u00a73 \u00b7 Capture Dashboard Specification \u00b7 Pilot Evidence Roadmap |\n| T-029 | P-066 | **ACTIVE** | ANNEX_D \u00b7 Commons Return and Universal Stake Evidence Test Package \u00b7 Threat Register \u00b7 Claims and Evidence Register |\n| T-030 | P-067 | **ACTIVE** | Cyber Resilience and Availability Evidence Test Package \u00b7 Threat Register \u00b7 Pilot Evidence Roadmap |\n| T-031 | P-068 | **ACTIVE** | Last-Resort Unenrolled Access Evidence Test Package \u00b7 ANNEX_AZ \u00b7 ANNEX_AY |\n| T-032 | P-069 | **ACTIVE** | Monitoring Repurposing Evidence Test Package \u00b7 Annex C \u00b7 Capture Dashboard Specification |\n| T-033 | P-070 | **ACTIVE** | Founding Consent and Civil-Society Review Evidence Test Package \u00b7 Founding Legitimacy Dossier |\n| P-072 | T-025 supplement | **PROPOSED** | Productive Status Register (operative T-025 control remains P-023 ACTIVE) |\n| structural \u2014 no threat row (anti-accretion intake gate) | P-073 | **ACTIVE** | Acceptance_Protocol.md Framework-First Intake |\n\n---\n\n## P-024 \u2014 Attestation-at-Risk Stake Mechanism\n\n### P-024 \u2014 Attestation-at-Risk Stake Mechanism\n\n- **Status:** ACTIVE (promoted 2026-04-25 via Annex AS ratification). FC-080 stake ratio, FC-081 audit window, FC-082 graph density threshold bound in `/founding/commitments.md`.\n\n**Constitutional text:** [ANNEX_AS.md](../annexes/ANNEX_AS.md)\n\n- **Evidence package:** [Service Record Misuse Evidence Test Package](./Service_Record_Misuse_Evidence_Test_Package.md)\n- **Threat addressed:** T-009 (Coordinated False-Positive Suppression), TR-07 (Attestor Collusion), T-018 (Deliberate False-Trigger Exhaustion).\n- **Direction adopted:** Attestors who certify a claim bear skin-in-the-game exposure proportional to the claim's downstream consequence. A slashing schedule fires automatically when a certified claim is later disconfirmed by oracle quorum; redistribution routes slashed stake to the claimant harmed (where identifiable) and to a system integrity reserve.\n- **Introduced design:**\n  - *FC-080 stake ratio:* Every attestation above the materiality threshold requires the attesting node to place a stake equal to at least the ratio defined in FC-080. Stake is denominated in the attestor's civic balance \u2014 Service Record for contribution, hardship, and identity attestations; Voice where the attestation directly supports a Voice allocation \u2014 and is locked, not spent, during the audit window.\n  - *FC-081 audit window:* Attestations remain auditable for the window defined in FC-081. Within this window any subsequent oracle measurement that contradicts the attested claim by more than the permitted variance triggers an automated slash-and-redistribute event. The audit window is the same for all attestation classes; no class-specific extension may be granted without a Tier 2 (H-2) amendment.\n  - *FC-082 graph density threshold:* A graph-density safe harbor protects attestations made by tightly connected communities (cooperatives, mutual-aid networks, family units) from slash penalties that would arise purely from the structural density of their social graph, not from factual error. Attestations above the FC-082 density threshold are flagged for manual review rather than automatic slashing; the Ombuds Duty Sub-Ombuds has 48 hours to certify the density basis before slashing is released. This prevents T-018 attacks that exploit normal community solidarity as evidence of collusion.\n  - *Slashed-stake redistribution:* Slashed civic stake is routed according to Annex AS \u00a73: whistleblower share, restitution to a harmed subject where identifiable, Article VII enforcement maintenance fund, and a small retired share. No slashed stake returns to the attesting node or its affiliated entities.\n  - *False-claim escalation:* Where slashing evidence reaches the threshold defined in Annex AS \u00a75, the Ombuds Plenum receives a formal referral. A finding of deliberate false attestation (not merely mistaken attestation) triggers disqualification from attestation roles for the period specified in Annex AS \u00a76. Deliberate false-trigger exhaustion (T-018 use of P-024 to drain legitimate attestors) is an aggravated finding with an extended disqualification period.\n- **Clauses integrated:** AS1\u2013AS6. Amends Annex U (adds attestation-stake exposure to bypass-closure layer). Article VII dashboard extended: real-time attestation-stake exposure by class and pending audit-window count are public indicators.\n- **Dependencies:** Independent escrow agent (P-023.3) operative. Oracle quorum system (P-017) operative with at least three independent oracle seats. Ombuds federation (P-025) seated at \u22654 sub-Ombuds before density-threshold manual review is operative. FC-080/081/082 values bound before any attestation-bearing transaction is accepted.\n- **New risks introduced:** (1) Stake requirement may chill legitimate attestation by resource-constrained community members \u2014 mitigated by FC-080 materiality threshold (low-value attestations are stake-exempt) and by graph-density safe harbor. (2) Automated slashing on oracle contradiction may fire incorrectly if oracle error precedes attestation error \u2014 mitigated by 48-hour Ombuds review gate at FC-082 density flag and by audit-window appeals process in Annex AS \u00a74. (3) Slashed-stake redistribution route to integrity reserve creates an incentive for the CRP to manufacture slash events \u2014 mitigated by Ombuds oversight of all slash events above the Annex AS \u00a75 threshold.\n- **Residual risk:** A coordinated oracle-and-attestor compromise that defeats both systems simultaneously remains the highest-risk failure mode. The graph-density safe harbor narrows the T-018 attack surface but cannot eliminate it if the adversary controls both oracle quorum and attestation review.\n- **Compound linkages:** T-009 \u00d7 T-018 (coordinated false-positive suppression paired with deliberate exhaustion is the canonical dual-threat; P-024 raises the cost of both by making attestation financially painful to corrupt). TR-07 \u00d7 P-017 (attestor collusion is detectable via oracle contradiction; P-017 oracle independence is a prerequisite for P-024 slash events to be trustworthy). T-018 \u00d7 FC-082 (density safe harbor is the primary T-018 surface \u2014 its threshold value is the key calibration parameter; see Annex AS \u00a73).\n- **Annex:** AS (attestation-at-risk stake mechanism \u2014 stake ratio schedule, audit window protocol, graph-density threshold methodology, slash-and-redistribute event specification, escalation thresholds, disqualification periods).\n\n---\n\n## P-025 through P-027 \u2014 Ombuds, Founding Order, and Consolidation\n\n### P-025 \u2014 Federated Ombuds Constitution\n\n**Constitutional text:** [ANNEX_AI.md](../annexes/ANNEX_AI.md)\n\n- **Introduced design:** Single-commissioner Ombuds replaced with a five-node federation. Each sub-Ombuds is structurally dispersed along at least four of five dimensions (jurisdictional, institutional-origin, funding, infrastructure, personnel-recruitment). Operational decisions are handled by a rotating Duty Sub-Ombuds; protocol-level decisions require a 4-of-5 Plenum supermajority (FC-091). Staggered 730-day terms (FC-092) with two-consecutive-term limit. Oversight Assembly of 7 members (5-of-7 threshold) certifies structural dispersal annually and activates Concentration Response on loss of dispersal.\n- **Clauses to integrate:** Full rewrite of Annex AI (previously PROPOSED single-commissioner draft) to Annex AI ACTIVE federated constitution. References from the Humane Constitution, Threat Register, and other annexes read through to the federation acting per \u00a73 (operational vs protocol-level classes).\n- **Load-bearing integrations:**\n  - **Proposal 1** \u2014 Tier 1 Amendment Integrity Report (Plenum 4-of-5 within 60 days of signature registration under `/architecture/amendment_protocol.md`).\n  - **Proposal 3** \u2014 Adversarial oracle seat certification (Annex AL \u00a73.3).\n  - **Proposal 6** \u2014 Arbitration panel seat on Annex AQ \u00a73 Shared Storehouse oracle-failure arbitration.\n  - **Proposal 7** \u2014 Enforcement Panel appeals on Annex AJ \u00a74 penalty determinations.\n  - **Proposal 9** \u2014 Final adjudication of Annex AS attestation false-claim findings and stake-slashing classification.\n- **Dependencies:** At least four sub-Ombuds seated before any Ombuds-dependent function is operative (\u00a72.1 pre-launch gate). Oversight Assembly seated with \u22655 of 7 before first Plenum vote. Duty rotation schedule published for first 90 days before operational activation. Federation secretariat built before operational activation.\n- **New risks introduced:** Duty rotation scheduling is itself a power locus (mitigated by published-in-advance rotation, non-party-choice rule). Five-node federation increases coordination cost on time-sensitive operational decisions (mitigated by operational/protocol-level bifurcation in \u00a73.1). Plenum deadlock (2 of 5 or 3 of 5) may stall matters (mitigated by conservative-default rule in \u00a73.3 \u2014 deadlock favours protection).\n- **Residual risk:** Structural-dispersal criteria can be met formally while capture is achieved through informal coordination (mitigated by Oversight Assembly \u00a75.1 institutional-health reporting; voting-pattern concentration is a published metric). Oversight Assembly itself can be captured at small scale (mitigated by \u00a75.4 meta-capture controls).\n- **Compound linkages:** P-025 \u00d7 P-008 (federation closes the T-008 open question \u2014 \"who audits the auditors of elite formation?\" \u2014 by making the auditor a federation subject to its own dispersal rule); P-025 \u00d7 P-015 (Ombuds-dependent PCRP flag determinations now robust to single-node capture); P-025 \u00d7 P-017 (methodology-class adversarial seat certification now clears 4-of-5 threshold rather than single-commissioner signature); P-025 \u00d7 P-022 (Annex AQ arbitration panel seat rotation is Plenum-certified).\n- **Auto-close clause:** P-025 is standing. It does not auto-close. Changes to the federation structure (FC-090, FC-091, FC-092) require Tier 1 amendment (7-of-9, 180-day timelock).\n\n---\n\n## P-026 \u2014 Founding Order Detail\n\n### P-026 \u2014 Founding Order: Subsidiarity, Consent & Exit\n\n**Constitutional text:** [Founding Order](../../founding/order/README.md)\n\n- **Introduced design:** The protocol acquires a foundational scale-and-consent layer beneath the operational articles. The Founding Order defines *who* consents to be governed, *at what scale*, and *how they withdraw*. Six files under `/founding/order/` cover: (1) README orientation, (2) five-tier scale hierarchy (FC-122: household / neighborhood \u2264500 / locality \u22645,000 / region \u2264500,000 / federation), (3) three-prong subsidiarity competence test (informational, adjudicative, externality-containment) with default-against-escalation rule, (4) affirmative consent protocol (2/3 supermajority, 90-day notice, 60-day deliberation, roll-call, 2/3 minimum participation), (5) exit protocol (FC-120 2/3 supermajority, FC-121 730-day graceful unwind with Essential Access continuity, no exit tax, no forfeiture, T-026 Exit Denial enforcement), (6) re-entry protocol (procedurally symmetric, no penalty, 365-day floor between cycles).\n- **Clauses to integrate:** Humane Constitution \u00a70 Founding Order paragraph; every operational article reads through the Founding Order (smallest-competent-scale default).\n- **Load-bearing integrations:**\n  - Federated Ombuds (Annex AI \u00a73.2 challenge process; \u00a73.4 automatic Plenum convocation on exit denial).\n  - Annex AJ \u00a74 severity 3 (Institutional) penalties for Exit Denial violations.\n  - CSM (Annex Y) as the single Tier 1 exception that binds regardless of consent.\n  - Architectural enforcement layer (Proposal 1) locks FC-120/121/122 under Tier 1 process.\n- **Dependencies:** Federated Ombuds seated (four of five sub-Ombuds) before any Founding Order challenge procedure is operative. Drift chain must support federation-scope expansion and contraction events. Scale registry (household through federation) must be initialized at founding.\n- **New risks introduced:** Re-entry 365-day floor could be gamed through individual-personhood cycling (mitigated by individual consent being distinct from unit consent, with the floor applying only to unit cycles). Exit-cost asymmetry \u2014 the 730-day unwind is generous for the unit but introduces a period of dual-authority \u2014 could produce enforcement ambiguity (mitigated by published unwind schedule and Ombuds oversight).\n- **Residual risk:** Subsidiarity is an aggregate property; any single decision's escalation may look reasonable while the cumulative drift toward federation-scale venue is substantial. Aggregate monitoring via the Ombuds \u00a74.3 federation-decision-concentration report is the mitigation \u2014 a threshold breach is itself a T-027 trigger.\n- **Compound linkages:** P-026 \u00d7 P-025 (Ombuds is the Founding Order enforcement organ \u2014 subsidiarity and exit both depend on Ombuds independence); P-026 \u00d7 P-018 (Essential Access-floor-persistence clause is reinforced by Essential Access continuity preservation during the 730-day unwind); P-026 \u00d7 P-008 (exit right structurally constrains elite formation \u2014 elites cannot form a federation they cannot lose).\n- **Auto-close clause:** P-026 is standing. Changes to FC-120/121/122 and the no-exit-tax rule require Tier 1 amendment (7-of-9, 180-day timelock). Strengthening (shorter unwind, lower supermajority) is Tier 2.\n\n---\n\n## P-027 \u2014 Constitutional Consolidation Detail\n\n### P-027 \u2014 Founding Order and Seven-Article Structural Consolidation\n\n**Constitutional text:** [Humane_Constitution.md \u00a7 III](../constitution/Humane_Constitution.md)\n\n- **Introduced design:** the constitutional architecture is consolidated into one Founding Order and seven Articles of Constitutional Order. Rights and rule-bound execution live together in Article I. Essential Access and delivery live together in Article IV. Flow, housing and commons use-rights, enterprise, and PFCR live together in Article V. Voice, Service Record, contribution recognition, and deliberation live together in Article VI. Transparency and environmental scanning live together in Article VII.\n- **Clauses integrated:** Humane Constitution \u00a7III rewritten around the final constitutional structure; White Paper \u00a74 aligned to the same article model.\n- **Load-bearing integrations:**\n  - **P-026** \u2014 the Founding Order establishes the scale, consent, and exit foundation across the full architecture.\n  - **Proposal 1** \u2014 the architectural enforcement layer remains bound to Article I rights protections.\n  - **P-017** \u2014 oracle requirements (N\u22655, three methodology classes, adversarial seat) remain anchored in Article III Physics & Reserves.\n  - **P-024** \u2014 attestation stake integrates with Article VI contribution recognition.\n  - **P-029 through P-033** \u2014 PFCR, anti-dynasty, stewardship ownership, and enterprise-governance architecture remain integrated inside Article V.\n- **Dependencies:** downstream annexes, simulations, and support docs must stay aligned to the final article structure and instrument names.\n- **New risks introduced:** Article V now concentrates more of the economic surface under one constitutional home. Mitigation: explicit internal boundaries between Flow, housing and commons use-rights, enterprise, and PFCR, plus public interface definitions and audit visibility.\n- **Residual risk:** future edits that blur article boundaries can recreate the fragmentation or overlap this consolidation removed. Mitigation: the constitutional article interfaces in Humane Constitution \u00a7III remain authoritative.\n- **Compound linkages:** P-027 \u00d7 P-026 (the Founding Order supplies the constitutional foundation); P-027 \u00d7 P-017 (Article III inherits the oracle hardening); P-027 \u00d7 P-029 (PFCR remains inside Article V instead of becoming a detached fiscal system); P-027 \u00d7 P-008 (fewer institutional homes reduce elite-formation surface area).\n- **Auto-close clause:** P-027 is standing. Any change to the number of constitutional articles or to the existence of the Founding Order requires Tier 1 amendment (7-of-9, 180-day timelock). Content within the articles may be amended by ordinary process subject to the existing Tier classifications of each clause.\n\n---\n\n### P-035 \u2014 Founding Group Corrigibility and Epistemic Humility\n\n**Threat addressed:** founding group capture / Babel-risk (structural overconfidence)\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Philosophical Preamble (closing paragraph) and \u00a70A (Moral Scope, Spiritual Limits, and Stewardship Orientation)\n\n**Problem diagnosed:**\nThe Preamble's statement \"If it is wrong, people should be able to show where\" is passive \u2014 it does not explicitly subject the founding group to the same corrigibility requirements it names for administrators. The rhetorical confidence of the document can imply that the design team has solved a problem that only ongoing moral community and dependence on God can sustain. This creates Babel-risk: a system that trusts its own architecture more than it trusts the communities and the God it claims to serve.\n\n**Introduced design:**\n- Preamble: explicit statement that founders are not exempt from the failures named in the document; the founding group must be the first to submit to correction.\n- \u00a70A: explicit statement that the system does not claim to reflect the mind of God; it reflects fallible human judgment that remains open to correction.\n\n**New risks introduced:**\n- Overly humble framing could be exploited to argue that all constitutional protections are provisional. Mitigated: the epistemic humility clauses apply to the founders' judgment about design, not to the dignity floor itself (separately protected by Tier 1 amendment requirements).\n\n**Residual risk:** Founding group may still exercise disproportionate influence during the founding window. The corrigibility clause is a normative commitment, not a structural enforcement mechanism. Structural enforcement is addressed by P-036.\n\n---\n\n### P-036 \u2014 Keyholder Servanthood Duty\n\n**Threat addressed:** amendment lock capture by founding group\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article I \u2014 Rights & Rules (Hard locks section)\n\n**Problem diagnosed:**\nThe 7-of-9 amendment lock protects the dignity floor from bad changes. But the same lock also protects the founders' judgment about what the dignity floor contains. If keyholders act in self-interest \u2014 delaying replacement of founding-era text, blocking challenges to their own authority \u2014 the lock becomes a tool of entrenchment rather than protection.\n\n**Introduced design:**\nExplicit constitutional statement that keyholder authority is custodial, not proprietary; keyholders may not use the lock to entrench founding group power; a qualified independent review body may petition for keyholder replacement when self-interest is demonstrated.\n\n**Dependencies:** The independent review body referenced here is the Federated Ombuds structure defined under P-025.\n\n**New risks introduced:**\n- \"Demonstrable self-interest\" requires interpretation. Mitigated: determination is made by the Federated Ombuds (P-025), not by the keyholders themselves.\n\n**Residual risk:** External pressure on keyholders (coercion, blackmail) is not addressed by internal accountability mechanisms. See P-034 residual risk for the same limitation.\n\n---\n\n### P-037 \u2014 Identity Serves the Person\n\n**Threat addressed:** identity system creep / surveillance expansion\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article II \u2014 Personhood, Identity & Continuity\n\n**Problem diagnosed:**\nAny identity system faces institutional pressure to expand verification requirements, cross-reference databases, and build behavioral profiles over time. Without a mandatory review cycle, \"minimum data for minimum access\" tends to expand into a comprehensive scoring regime.\n\n**Introduced design:**\nMandatory triennial review of identity data use; secondary use requires Article VI deliberative authorization with a published sunset date that cannot be made permanent by administrative action alone.\n\n**New risks introduced:**\n- Review cycles could be gamed or delayed. Mitigated: triennial requirement is constitutional; delay beyond the cycle is a reportable failure under Article VII.\n\n**Residual risk:** Administrative pressure to expand identity data use will recur in each review cycle. The review requirement creates a forcing function but does not eliminate the pressure.\n\n---\n\n### P-038 \u2014 Community Voice in Measurement\n\n**Threat addressed:** T-006 (oracle institutional blindness / measurement capture)\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article III \u2014 Real Capacity & Reserves\n\n**Problem diagnosed:**\nThe oracle quorum defends against manipulation but not against shared institutional blindness \u2014 the systematic tendency of measurement systems to reflect the assumptions of the institutions that design them rather than the lived reality of affected communities.\n\n**Introduced design:**\nConstitutional community challenge path: written submission to oracle quorum, mandatory 14-day published response, challenge submissions published alongside official figures.\n\n**Dependencies:** Oracle quorum publication infrastructure must support community submission intake and co-publication.\n\n**New risks introduced:**\n- Challenge system could be flooded with bad-faith submissions. Mitigated: prima facie threshold for mandatory response.\n\n**Residual risk:** Communities with less documentation capacity will use the challenge path less. Outreach and accessibility design are required \u2014 not addressed by this patch alone.\n\n---\n\n### P-039 \u2014 Protection of Pre-Existing Care Networks\n\n**Threat addressed:** institutional crowding-out of voluntary community\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article IV \u2014 Survival\n\n**Problem diagnosed:**\nA comprehensive constitutional delivery floor for survival essentials can inadvertently displace the mutual aid groups, religious food pantries, family networks, and neighborhood care structures that communities depend on \u2014 especially when the delivery system fails.\n\n**Introduced design:**\nConstitutional statement that Article IV is a floor not a monopoly; explicit duty to support pre-existing care networks; affirmation that the constitutional floor protects the conditions for voluntary generosity rather than replacing it.\n\n**New risks introduced:**\n- \"Must not displace\" is a normative commitment difficult to enforce mechanically. Mitigated: Article VII warning system can measure whether voluntary care networks are growing or shrinking post-implementation.\n\n**Residual risk:** Economic logic of consolidated delivery systems tends to crowd out smaller providers regardless of constitutional intent. Periodic measurement and active funding of voluntary-sector infrastructure are required.\n\n---\n\n### P-040 \u2014 Article V Housing Cap Pastoral Revision and Structural Humility\n\n**Threat addressed:** household penalization; Babel-risk structural overconfidence\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article V \u2014 Markets, Commons & Public Finance (housing allocation section; closing paragraph)\n\n**Problem diagnosed:**\n(1) The phrase \"regardless of household composition decisions\" treated a resource constraint as though it were a judgment about family structure. Large families, multigenerational households, and care-intensive arrangements may find the cap hostile if applied without a pastoral presumption of accommodation.\n(2) Article V's closing paragraph presented the five-instrument architecture with confidence that the design prevents exploitation. This exceeds what human institutions can reliably deliver.\n\n**Introduced design:**\n(1) Housing cap language revised: \"fiscal guarantee\" framing retained; pastoral review with strong presumption of accommodation added; \"mercy before procedure\" standard stated.\n(2) Structural humility closing paragraph added: names the limits of structural engineering and requires ongoing community paths to name and correct exploitation.\n\n**New risks introduced:**\n- \"Strong presumption of accommodation\" may be interpreted to override the cap entirely. Mitigated: \"fiscal guarantee\" framing preserved \u2014 the commons does not owe unlimited expansion; the review process applies mercy within real resource constraints.\n\n**Residual risk:** Review panels may apply \"mercy before procedure\" inconsistently across communities. Published review criteria and appeals paths are the mitigation; this patch adds the normative standard.\n\n---\n\n### P-041 \u2014 Recognized-Contribution Audit Requirement\n\n**Threat addressed:** T-008 (elite / professional-contributor capture of civic layer)\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article VI \u2014 Voice, Service Record & Public Decisions (Contribution and capability section)\n\n**Problem diagnosed:**\n\"Verified contribution\" as the basis for civic standing creates systematic pressure to perform contribution in legible, verifiable ways. Contributions that resist easy documentation \u2014 informal care, spiritual leadership, mutual aid, neighborhood presence, parenting \u2014 will be consistently underrepresented in the Service Record eligible pool.\n\n**Introduced design:**\nMandatory biennial audit of the recognized-contribution definition; explicit constitutional statement that informal, spiritual, and pastoral contributions must not be excluded by documentary difficulty alone; 180-day correction requirement when gaps are found.\n\n**Dependencies:** Audit body must be independent of the civic administration it is reviewing \u2014 consistent with Article VII independence requirements.\n\n**New risks introduced:**\n- \"Effect on human flourishing\" as a measurement criterion is harder to verify than documented hours. Mitigated: the audit requirement is about the framework definition, not individual claims.\n\n**Residual risk:** The gap between the ideal (invisible work recognized) and the operational (verification required) will persist. The audit creates a forcing function for closing it over time.\n\n---\n\n### P-042 \u2014 Community Alert Pathway\n\n**Threat addressed:** institutional capture of warning function; prophetic voices blocked\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article VII \u2014 Public Records & Warning Systems\n\n**Problem diagnosed:**\nArticle VII's warning function is defined, funded, and structured by the same apparatus it is meant to watch. Communities affected by systemic failures often see them earlier and more accurately than institutional reviewers \u2014 but currently have no constitutionally protected path to name them.\n\n**Introduced design:**\nConstitutionally protected community alert pathway: low-barrier, optionally anonymous, accessible without legal representation; 30-day acknowledgment requirement; 90-day formal review trigger for prima facie systemic failures; refusal to acknowledge or review is itself a reportable failure.\n\n**Dependencies:** Article VII independence requirement applies \u2014 the body managing community alerts must not be the same body whose performance is being reported.\n\n**New risks introduced:**\n- Alert pathway could be used for political harassment or coordinated false-flag campaigns. Mitigated: prima facie threshold for mandatory review; anonymous alerts published but not automatically elevated without threshold evidence.\n\n**Residual risk:** Power asymmetry between institutional reviewers and community reporters will persist. The pathway lowers the barrier; it does not equalize resources for evidence-gathering.\n\n---\n\n### P-043 \u2014 Logical-Analysis Corpus Corrections\n\n**Threat addressed:** T-001, T-002, T-004, T-007, T-generic (amendment capture, definitional ambiguity, status misrepresentation)\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** ANNEX_AH.md, ANNEX_Y.md, INVARIANTS.md, SPECIFICATIONS.md, Humane_Constitution.md, Patch_Log.md, Threat_Register.md\n\n**Problem diagnosed:**\nSystematic logical analysis identified 18 issues across the corpus: 4 critical (including a Tier 1 amendment architecture paradox and a literal unfilled placeholder), 11 major (internal contradictions, definitional gaps, inconsistent status reporting), and 3 minor (structural tensions and epistemological inconsistencies).\n\n**Introduced design:**\n\n- **ANNEX_AH.md \u00a7AH2 header** \u2014 Updated heading from \"14 Days\" to \"60 Days minimum, per P-020 amendment.\" Heading was not updated when P-020 extended the window.\n- **Patch_Log.md P-014 entry** \u2014 Added parenthetical noting P-020 extended the 14-day challenge window to 60 days minimum.\n- **Threat_Register.md Complete Register Summary** \u2014 Corrected T-001, T-002, T-004, T-007 status from ACTIVE to Active \u2014 unproven to match the dashboard and individual entries.\n- **INVARIANTS.md INV-007** \u2014 Resolved the Tier 1 amendment paradox. \"Unamendable by any in-system process\" is replaced with precise language: Tier 1 is changeable only via the Tier 1 process (7-of-9 keyholder signatures + 180-day timelock, FC-110/FC-111). FC-110 and FC-111 are themselves Tier 1 protected. Changes to the amendment mechanism require H-3 refounding authority. P-014 is permanently closed.\n- **SPECIFICATIONS.md \u00a73.4** \u2014 Replaced \"full constitutional refounding under P-014 procedure\" with Tier 1 amendment process language and H-3 refounding authority reference.\n- **ANNEX_Y.md \u00a7Y5** \u2014 Added: H-3 refounding authority is a full constitutional convention, superseding the closed P-014.\n- **ANNEX_Y.md \u00a7Y4** \u2014 Filled the literal `[ACCEPTABLE_CSM_FAILURE_THRESHOLD]` bracket placeholder with provisional value: 3 verified delivery failures (FC-YT1, pre-launch blocking gate, must be confirmed before operational activation).\n- **SPECIFICATIONS.md \u00a73.3** \u2014 Added caregiver/dependent carve-out to the non-transferability rule, making it consistent with the Constitution's household pooling and delegated spend authority provisions.\n- **SPECIFICATIONS.md \u00a74.2** \u2014 Replaced \"two separate rules\" bridging note with an integration formula: the 300-unit issuance ceiling sets the quarterly stock; the 100-unit weight table caps each individual deployment draw. Sequential constraints, not competing ones.\n- **SPECIFICATIONS.md \u00a74.3** \u2014 Fixed sector ceiling arithmetic justification: reframed from Voice supermajority to Service Record governance panel concentration. Added note that P-008 is PROPOSED and P-025 is the operative ACTIVE authority for the 20% ceiling.\n- **SPECIFICATIONS.md \u00a78** \u2014 Added pre-launch blocking gates note to the Parameter Summary, clarifying that reserved parameters are not design gaps.\n- **Humane_Constitution.md Article V** \u2014 Added operational definitions of \"compounding interest\" (capitalisation-based, includes fee-equivalent traps) and \"household ordinary-life debt\" (personal/family purposes; excludes enterprise debt and voluntary investment instruments).\n- **Humane_Constitution.md Philosophical Preamble** \u2014 Added produced/shared value working test: three concrete examples (land labour, software, enterprise) and an appeal path reference.\n- **Humane_Constitution.md Founding Order** \u2014 Added dignity floor delivery obligation: 2% PFCR cross-boundary allocation minimum, published accounting of unmet commitments in adjacent non-consenting communities.\n\n**New risks introduced:**\n- The provisional CSM failure threshold (3 failures) requires founding commitment confirmation. If not confirmed before activation, the threshold remains provisional \u2014 which is by design (pre-launch blocking gate).\n\n**Residual risk:** Issues 4 (bootstrap circularity), 8 (silence tension), 12 (single-source philosophy), and 18 (structural vs. moral sufficiency tension) are acknowledged as honest philosophical tensions named in the corpus. They are not resolved by this patch; they are monitored as open interpretive questions.\n\n---\n\n### P-044 \u2014 Threat-Strengthening Batch\n\n**Status:** ACTIVE  \n**Date:** 2026-05-02  \n**Related threats:** T-001, T-002, T-004, T-005, T-007, T-018, T-019  \n**Core change:** Close mitigation gaps identified by systematic threat survey. Tighten Active \u2014 unproven threats with open gaps, add missing evidentiary standards, and fill operational voids in audit timelines and authority chains.\n\n**Changes included in this patch:**\n\n- **ANNEX_AI.md \u00a74.1** \u2014 Reproduced the T-019 three-criterion evidentiary standards inline (replacing a dangling \"incorporated by reference\" to a deleted prior section). Standards now specify: timing proximity (72-hour window, heightened scrutiny only), proportionality anomaly (disproportionate scope relative to documented need), no documented operational basis (contemporaneous record within 4-hour window). Three-tier outcome logic: all three \u2192 deliberate manufacture; two \u2192 provisional with 48-hour extension; one \u2192 logged only. Conservative default: flag stays active during pendency.\n- **ANNEX_AP.md \u00a7AP1** \u2014 Added cap-reset audit procedure: Federated Ombuds as responsible authority; 7-day open window; 30-day findings deadline; evidentiary standard (clear and convincing evidence); cap-counter freeze during audit; two outcome paths (reset to zero or count unchanged). Closes T-018 cap-reset void.\n- **ANNEX_AB.md \u00a7AB2** \u2014 Added FC-010 calibration methodology requirement: Article VII annual audit must publish the empirical/modelling basis for leakage thresholds, revision triggers, and methodology changes. Thresholds not documented in a published audit are not valid enforcement baselines. (T-001)\n- **ANNEX_AB.md \u00a7AB3** \u2014 Added invisible-work backstop: P-041 biennial recognized-contribution audit named as enforcement backstop for \u00a7AB3; findings requiring correction must be incorporated within 180 days; deficient contribution scores suspended from Voice/Service Record inputs until corrected. (T-004)\n- **ANNEX_AB.md \u00a7AB5** \u2014 Added registry administration clause: Federated Ombuds as custodian; no unilateral definition authority; Tier 2 amendment pathway; annual public review window; prima facie disputes forwarded to CRP. (T-007)\n- **ANNEX_AK.md** \u2014 Promoted the AED commitment architecture and later superseded FC-140 anchors. Current FC-140 values are target \u22642%, upper bound \u22645%, trigger \u22653% per quarter; see `/founding/commitments.md` and the Parameter Calibration Register. (T-002 / P-016)\n- **README.md** \u2014 Updated stale patch counts: 31\u219240 total, 16\u219225 active (two locations).\n- **ANNEX_Y.md \u00a7Y7** \u2014 Filled `[RESERVE_WINDOW_DAYS]` placeholder with provisional value: 90 days (FC-YT2, pre-launch blocking gate).\n- **CLAUDE.md** \u2014 Corrected \"Provenance_Map.md is planned\" \u2192 \"serves as\" (file already exists).\n- **Patch_Log.md P-005** \u2014 Advanced from PROPOSED \u2192 ACTIVE: ANNEX_AC1 design is complete; residual risks (sub-panel capture, throughput theater) are acknowledged and monitored.\n\n**New risks introduced:** This batch promoted statuses and bound provisional fraud-rate anchors, and that introduces residual risk. (1) Premature reliance \u2014 readers may treat the promoted statuses (e.g. P-005 advanced to ACTIVE) as field-tested rather than designed-and-monitored. (2) Parameter confusion \u2014 later FC-140 values supersede this batch's older anchor language and may still be mistaken for proven or evidence-backed thresholds. (3) Calibration drift \u2014 anchors set before pilot confirmation can drift or be quietly normalized as \"the number\" before any pilot evidence validates them. Mitigated by: the parameter register, pre-launch blocking gates, and the residual-risk note below.\n\n**Residual risk:** FC-140 through FC-145 have bound starting values, while FC-146 through FC-150 remain pre-launch commitments pending pilot data and founding adoption. P-016 remains PROPOSED / pre-ratification until the founding coalition confirms rate targets after first-year pilot evidence.\n\n---\n\n### P-045 \u2014 Threat-Mitigation Batch\n\n**Threats addressed:** T-001, T-002, T-004, T-007, IC-004  \n**Status:** ACTIVE | **Priority:** Critical  \n**Date:** 2026-05-02\n\n**Constitutional text:** ANNEX_AB.md (\u00a7AB2, \u00a7AB3, \u00a7AB5), ANNEX_AK.md (\u00a77, \u00a78), ANNEX_AH.md (\u00a7AH5.1)\n\n**Problem diagnosed:**\nFive critical threats remained at Active \u2014 unproven status with specific unresolved gaps: T-001 lacked threshold derivation logic (arbitrary numbers); T-002 had no procedural protection for excluded persons before rate targets are formally bound; T-004 had no enumerated floor for invisible/care work; T-007's registry started empty (first-mover capture window); IC-004 had no recovery path after P-013 suspension.\n\n**Introduced design:**\n\n- **ANNEX_AB.md \u00a7AB2** \u2014 Added enforcement-capacity derivation formula: FC-010 thresholds are derived from minimum detectable enforcement rate (N \u00f7 P). FC-010 3% = 2\u00d7 min-detectable rate; 7% = 5% supply-harm threshold. Audit participation designated as a qualified civic duty; resourcing limitations cannot justify raising thresholds. (T-001)\n- **ANNEX_AB.md \u00a7AB3** \u2014 Added enumerated contribution floor: six founding categories (primary caregiving, elder care, mutual aid, spiritual community leadership, unpaid household management, informal health work) with burden reversal. Self-attestation accepted; disproof burden on system. Extension via Tier 2; removal requires Tier 1 + impact assessment. (T-004)\n- **ANNEX_AB.md \u00a7AB5** \u2014 Added founding seed list: 14 Tier 2 protected terms (survival, survival floor, personhood, Essential Access, Flow, Voice, Service Record, non-convertibility, coercion, scarcity, contribution, identity, dignity, capacity) locked at founding. Adversarial review requirement before ratification. (T-007)\n- **ANNEX_AK.md \u00a77** \u2014 Added Asymmetric Default Rule: system bears burden of proof for all exclusion decisions; independent time-bounded review (14-day deadline) required before any Essential Access exclusion is final; exclusions without timely determination automatically reversed. (T-002)\n- **ANNEX_AK.md \u00a78** \u2014 Added Independent Identity Auditor mandate: quarterly public reports on fraud/exclusion rates per tier and vulnerable category; absence-of-data is a reportable failure; two consecutive quarters without data triggers Federated Ombuds referral; IIA appointment/removal requires Tier 2 amendment. (T-002)\n- **ANNEX_AH.md \u00a7AH5.1** \u2014 Replaced IC-004 governance-gap note with Dignity-Only Continuity Mode specification: CSM continues; governance suspended; 180-day trigger opens re-founding petition window (500 joint signatories to submit; 1,000 attestations to advance); P-014 non-precedent status unaffected; CSM floor cannot be suspended. (IC-004)\n\n**New risks introduced:**\n- The founding seed list authors own the semantic baseline permanently \u2014 mitigated by the mandatory adversarial review requirement before ratification.\n- The 14-day independent review deadline for identity exclusions requires review infrastructure to be operational at launch \u2014 this is a pre-launch blocking gate.\n- The 180-day dignity-only continuity period may be too long for urgent governance needs \u2014 mitigated by the automatic petition window at 180 days and the Federated Ombuds continuing to operate throughout.\n\n**Residual risk:** T-001, T-002, T-004, and T-007 remain Active \u2014 unproven pending pilot data confirmation. IC-004 is Active \u2014 unproven \u2014 the governance gap is now specified with a fallback mechanism but has not been field-tested.\n\n---\n\n### P-046 \u2014 Evidence and Capture Hardening Suite\n\n**Threats addressed:** Multiple control-plane and evidence-status risks, including T-005, T-008, T-016, T-017, T-022, T-023, T-025, T-026, T-027, and implementation-drift risk.\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-04\n\n**Constitutional text:** [Humane_Constitution.md \u00a70 and Article VII](../constitution/Humane_Constitution.md); [INVARIANTS.md \u00a7 Invariant Violation Detection](../constitution/INVARIANTS.md); [Acceptance_Protocol.md \u00a7 Pre-Launch Blocking Gates](../constitution/Acceptance_Protocol.md); [ANNEX_AH.md \u00a7 AH2](../annexes/ANNEX_AH.md); [ANNEX_C.md \u00a7 C-3/C-5](../annexes/ANNEX_C.md); [ANNEX_AO.md Part 1/2](../annexes/ANNEX_AO.md)\n\n**Problem diagnosed:**\nThe project had strong mechanisms and evidence packages, but seven proof surfaces remained too implicit: implementation drift, collapse-state traceability, parameter calibration, capture metrics, reusable abuse patterns, claim-evidence levels, and founding legitimacy. Without explicit artifacts, public language could outrun proof and technical compliance could be mistaken for legitimate activation.\n\n**Introduced design:**\n\n- **Implementation Drift Audit Package** \u2014 adds tests for reproducible hashes, append-only log behavior, publication-channel divergence, startup refusal, key custody, timelock response, and supply-chain bypass.\n- **Collapse-State Crosswalk** \u2014 maps every threat to Survival-Trade Bind, Power-Wealth Convergence, Static-Advantage Loop, and control-plane failure.\n- **Parameter Calibration Register** \u2014 tracks high-risk FC values, current status, rationale, capture route, evidence needed, revision trigger, and governing documents.\n- **Capture Dashboard Specification** \u2014 defines privacy-preserving public indicators for civic role concentration, Ombuds independence, definition capture, procurement/legal-wrapper capture, identity gatekeeping, and implementation drift.\n- **Abuse Case Library** \u2014 introduces reusable bad-actor patterns so patch intake and closure must test against plausible corruption routes and false reassurances.\n- **Evidence Ladder** \u2014 defines claim-strength levels, upgrade rules, downgrade rules, and forbidden status jumps.\n- **Founding Legitimacy Dossier** \u2014 defines the evidence burden for founding authority: scope, conflicts, notice, deliberation, consent, objections, exit rehearsal, dignity-floor non-coercion, founder sunset, and independent review.\n- **Architecture files** \u2014 implementation binding and drift chain now distinguish Tier 1 state hashing from implementation attestation records.\n- **Constitution and invariants** \u2014 added narrow cross-references making founding legitimacy and implementation drift public evidence duties.\n\n**New risks introduced:**\n- The new registries can become bureaucratic compliance artifacts if not tied to real tests. Mitigated by Evidence Ladder downgrade rules and Abuse Case Library false-reassurance fields.\n- Capture dashboards can become ranking tools. Mitigated by Article VII privacy language and dashboard rule that ordinary persons may not be ranked.\n- Implementation attestations can create false technical confidence. Mitigated by explicit claim boundaries in the Implementation Drift Audit Package.\n\n**Residual risk:** These upgrades make proof obligations clearer; they do not prove the system works. The highest residual risks remain founding consent theater, keyholder social capture, dashboard gaming, parameter arbitrariness, and technically valid but hostile amendment.\n\n---\n\n### P-047 \u2014 Essential-Sector Conglomerate Transition\n\n**Threats addressed:** T-025, T-026, T-027, T-028, external dependency capture, procurement capture, medicine-access capture, and essential-sector refusal risk.\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-04\n\n**Constitutional text:** [ANNEX_AT.md \u00a7 AT6.5 and AT8](../annexes/ANNEX_AT.md); [Capture_Dashboard_Specification.md \u00a7 Money, Procurement, And Legal Wrapper Capture](./Capture_Dashboard_Specification.md); [Conglomerate_Transition_Dossier.md](./Conglomerate_Transition_Dossier.md)\n\n**Problem diagnosed:**\nThe external-trade and anti-rent architecture named supply-chain dependency, public-return/source-base capture, and legal-wrapper risk, but it did not yet explain how incumbent oil, energy, medicine, logistics, and PBM-style medicine-access conglomerates would operate under the system. Without a sector-specific transition doctrine, the project risked relying on moral persuasion while firms with essential chokepoints could rationally leave, litigate, lobby, retaliate, or route control through foreign affiliates.\n\n**Introduced design:**\n\n- **Conglomerate Transition Dossier** \u2014 defines the operating rule: firms may earn Flow for verified production, reliability, transition work, innovation, and public-interest delivery; they may not convert survival chokepoints into rule authority or survival leverage.\n- **Numeric evidence anchors** \u2014 records real-world scale indicators: energy investment, fossil dependence, petroleum import/export flows, PBM prescription concentration, health spending, public procurement scale, lobbying spend, and beneficial-ownership risk.\n- **Sector models** \u2014 distinguishes oil/fossil firms, energy utilities/grid operators, and medicine manufacturers/PBMs, with allowed activity, prohibited leverage, compliant incentives, and refusal fallback.\n- **Refusal survivability tests** \u2014 requires largest-supplier exit modeling, reserve drawdown duration, medicine stockpile audit, compliant-bidder count, beneficial-owner trace, lobbying/capture exposure, and public fallback capacity before stronger claims.\n- **Annex AT interface** \u2014 adds AT6.5 so essential-sector conglomerates are treated as survival-leverage actors when their refusal, litigation, patent hold, supply-chain delay, or standards-body campaign can materially impair the CSM floor.\n- **Capture dashboard additions** \u2014 adds essential-sector refusal exposure and lobbying/capture exposure by contract value.\n\n**New risks introduced:**\n- Public procurement could overpay incumbents to keep them inside the system, creating disguised bailouts. Mitigated by compliant-margin tests, public fallback modeling, and beneficial-owner trace requirements.\n- Refusal drills could reveal sensitive supply-chain weaknesses. Mitigated by public class-level reporting with restricted operational detail where disclosure would improve attack execution.\n- Regulated utility treatment could entrench incumbents. Mitigated by performance metrics, public receiver authority, distributed/community fallback, and capture dashboard review.\n\n**Residual risk:** This patch makes the hard bargain explicit; it does not prove that fallback capacity can be built fast enough. The largest unresolved question is numeric: how many days can people keep eating, heating, traveling, communicating, and receiving medicine if the largest incumbent in a category says no?\n\n---\n\n### P-048 \u2014 Essential-Sector Refusal Operationalization\n\n**Threats addressed:** T-025, T-026, T-027, T-028, external dependency capture, medicine-access capture, grid/logistics chokepoint risk, and essential-sector refusal leverage.\n**Patch relation:** Operationalizes P-047.\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-04\n\n**Constitutional text:** [ANNEX_AT.md \u00a7 AT2.4 and AT6.5](../annexes/ANNEX_AT.md); [Parameter_Calibration_Register.md \u00a7 Seed Register](./Parameter_Calibration_Register.md); [Essential_Sector_Refusal_Test_Package.md](./Essential_Sector_Refusal_Test_Package.md); [05_life_and_rights.md](../public/05_life_and_rights.md)\n\n**Problem diagnosed:**\nP-047 defined the essential-sector conglomerate transition doctrine, but the project still needed operational drills, parameter rows, tighter Annex AT triggers, public-facing explanation, and a broader evidence pass for medicine patents, shortages, grid bottlenecks, fossil transition risk, and utility regulation.\n\n**Introduced design:**\n\n- **Essential-Sector Refusal Test Package** \u2014 adds largest oil/fuel supplier exit, largest medicine supplier/PBM refusal, and largest grid/logistics delay drills, with reserve drawdown, fallback capacity, compliant-bidder count, capture exposure, evidence packet, pass/fail, and residual-risk requirements.\n- **FC-194 through FC-201** \u2014 adds reserved/draft calibration rows for essential fuel reserves, medicine stockpiles, supplier concentration, public fallback deadlines, procurement concentration, PBM/intermediary separation, logistics redundancy, and essential data/claims portability.\n- **Annex AT tightening** \u2014 defines foreign-affiliate routing, survival-leverage actors, public receiver authority, and compulsory licensing/public manufacturing triggers for CSM-designated medicines.\n- **Public explainer** \u2014 adds \"How Big Companies Work Here\" for non-technical readers: profit remains allowed; hostage power does not.\n- **External evidence expansion** \u2014 adds sources for pharma patent-listing/evergreening risk, drug shortages, transformer/grid supply-chain bottlenecks, fossil transition/stranded-asset exposure, and utility regulation.\n\n**New risks introduced:**\n- Receiver authority and compulsory licensing can be abused if triggered on weak evidence. Mitigated by functional trigger definitions, Article VII publication, compensation/public-use standards, and refusal-drill evidence packets.\n- Public refusal drills can reveal operational weaknesses. Mitigated by class-level public reporting and justified redaction of exploit-enabling details.\n- Parameter draft anchors may be mistaken for proven values. Mitigated by reserved status and the Parameter Calibration Register's revision-trigger discipline.\n\n**Residual risk:** The package makes essential-sector refusal testable; it does not supply the physical reserves, manufacturing capacity, alternate operators, legal judgments, or treaty capacity needed to pass. The decisive future evidence remains sector-by-sector: how long the CSM floor holds when the largest incumbent refuses.\n\n---\n\n### P-049 \u2014 Evidence-Gap Bridge Alignment\n\n**Threats addressed:** Multiple evidence-gap and status-drift risks across founding legitimacy, essential-sector refusal, implementation drift, public readiness, and evidence-register consistency.\n**Status:** ACTIVE | **Priority:** High\n**Date:** 2026-05-04\n\n**Constitutional text:** No new constitutional text. Governance and public-readiness integration only.\n\n**Problem diagnosed:**\nRecent hardening work created stronger test artifacts, but the live dashboards still left some gaps implicit. The Founding Legitimacy Dossier now has an artifact-status register, and the Essential-Sector Refusal Test Package now defines sector drills, but several reader-facing and governance trackers still described the gaps in older, broader language.\n\n**Introduced design:**\n\n- **Hardening Queue alignment** \u2014 connects essential-sector refusal to the dedicated test package and reframes founding legitimacy around artifact production, not only design existence.\n- **Open Problems bridge** \u2014 updates essential-sector and founding rows so required proof points include the newest refusal drills, artifact-status register, medicine/PBM refusal path, grid/logistics delay path, and parameter/capture links.\n- **Pilot Roadmap bridge rules** \u2014 adds explicit Phase 9 and Phase 11 pass boundaries: paper capacity and clean technical integrity cannot substitute for refusal evidence or legitimate founding artifacts.\n- **Public readiness bridge** \u2014 adds plain-language warnings for essential-company refusal and founding-vote theater.\n- **Evidence-gap language** \u2014 narrows source gaps so the project asks for drill outputs and founding artifacts, not only general outside analogies.\n\n**New risks introduced:**\n- Cross-register alignment can create the appearance of progress without real evidence. Mitigated by repeating that these are bridge rules and evidence packets, not passed pilots.\n- More references can increase reader burden. Mitigated by putting the strongest public framing in the Public Readiness Guide and keeping detailed proof duties in governance registers.\n\n**Residual risk:** P-049 improves traceability; it does not close the underlying gaps. The unresolved work remains physical refusal capacity, real founding artifacts, independent review, and pilot evidence.\n\n---\n\n### P-053 \u2014 Whistleblower Protection and Anti-Retaliation Protocol\n\n**Threats addressed:** Insider retaliation risk against community alert reporters and Service Record audit requesters; Priya-type attack path (retaliatory record modification by named respondent before investigation completes).\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-07\n\n**Constitutional text:** [ANNEX_AW.md](../annexes/ANNEX_AW.md); Article VII (reporter protection clause)\n\n**Problem diagnosed:**\nThe community alert pathway (Article VII) and Service Record audit mechanism (Article VI) require ordinary people to name wrongdoing by administrators. Without explicit protection, a corrupt administrator can use their remaining administrative access to modify the reporter's Service Record, flag contributions \"under review,\" and revoke civic eligibility before any investigation completes. The Priya vignette in the Fairness Vignette Library documented this exact attack path. A system that cannot protect its own reporters will quickly teach everyone not to report.\n\n**Introduced design:**\n\n- **Administrative freeze on filing:** named respondents' write access to the reporter's records is automatically suspended from the moment a report is filed.\n- **Automatic escalation of retaliatory actions:** any attempted modification during the protected period is rejected, logged, and escalated to the Federated Ombuds within 24 hours.\n- **\"Under review\" flag governance:** flags require independent reviewer appointment (not self-authorization), evidence-based grounds, 45-day maximum duration, and automatic removal on expiry without finding.\n- **Restoration on exoneration:** retaliatory modifications are reversed; lost civic roles are restored or queued.\n- **Constitutional amendment:** reporter protection clause added to Article VII.\n\n**New risks introduced:**\n- The administrative freeze could be triggered by bad-faith reports. Mitigated by: the freeze affects only write access (not the respondent's own records), bad-faith reports are subject to the same accountability process as any false claim, and the Federated Ombuds reviews the freeze on filing.\n- Coordinated retaliation by multiple actors not individually named. Named as a residual risk in Annex AW \u00a7AW5; monitored through the community alert pathway.\n\n**Residual risk:** Informal retaliation (social pressure, community reputation) cannot be prevented by administrative controls. Culture and enforcement of the broader anti-capture provisions are the only long-term check.\n\n---\n\n### P-054 \u2014 Confidential Enrollment and Safety-Identity Protocol\n\n**Threats addressed:** Identity disclosure as a safety vector for domestic violence survivors, trafficking victims, and persons in safety-compromised situations; Elena-type attack path (wallet identity creates tracking vector for abuser via compromised administrator).\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-07\n\n**Constitutional text:** [ANNEX_AX.md](../annexes/ANNEX_AX.md); Article II (safety-shielded enrollment clause)\n\n**Problem diagnosed:**\nThe one-person-one-wallet requirement links identity to an administrator-visible record. For persons in documented safety situations, this creates a tracking vector for abusers, traffickers, or persecutors who have access to administrative channels. The Elena vignette documented this gap. The existing Asymmetric Error Doctrine (Annex AK) treats this as a calibration problem; P-054 treats it as a safety override \u2014 for persons in documented danger, the safety interest overrides the normal fraud/exclusion calibration.\n\n**Introduced design:**\n\n- **Safety-shielded enrollment pathway:** legal identity linked to wallet through a cryptographically sealed record; all location and identity fields suppressed from administrator-visible database.\n- **Address-blind delivery:** Essential Access delivered through anonymous pickup points, trusted community organizations, or encrypted digital channels without geolocation.\n- **Emergency enrollment:** 30-day temporary access on credible assertion without documentation, with support pathway to full safety-shielded enrollment.\n- **Documentation-free emergency path:** single-use 72-hour tokens for persons with no documentation, with connection to enrollment support organizations.\n- **Sealed record access governance:** sealed records accessible only by court order or Federated Ombuds finding; access requests logged and reported to the enrolled person within 72 hours.\n- **Constitutional amendment:** safety-shielded enrollment clause added to Article II.\n\n**New risks introduced:**\n- Emergency enrollment without documentation could be used for fraud. Mitigated by: 30-day window with transition requirement, the AK fraud-rate monitoring catches aggregate fraud signals, and false safety assertions are subject to accountability.\n- Sealed records could be accessed under pretextual court orders. Mitigated by: access limited to credible fraud investigation (not immigration enforcement or administrative convenience), Ombuds review authority, and notification to the enrolled person on any access request.\n\n**Residual risk:** Persons whose abuser controls their access to enrollment points cannot use this pathway. Long-term immigration or citizenship questions for undocumented persons are not resolved by AX \u2014 Essential Access continuity is provided, not immigration status.\n\n---\n\n### P-055 \u2014 Delivery Sufficiency Standard\n\n**Threats addressed:** Gap between constitutional guarantee of Essential Access and operational delivery for incarcerated persons, non-enrolled communities, persons unable to use digital interfaces, and persons in non-consenting jurisdictions.\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-07\n\n**Constitutional text:** [ANNEX_AY.md](../annexes/ANNEX_AY.md); Article IV (delivery sufficiency obligation clause)\n\n**Problem diagnosed:**\nMultiple vignettes in the Fairness Vignette Library showed that the constitutional guarantee of Essential Access does not translate to operational delivery for several populations (Miriam, Ray, Amara, Yoder Community). The gap between the guarantee and the delivery mechanism was unnamed, untracked, and unaccountable. A constitutional guarantee that does not reach the people it covers is not a guarantee \u2014 it is a statement.\n\n**Introduced design:**\n\n- **Delivery Sufficiency Standard (AY1):** four conditions that must all be met for a population to be considered operationally covered: delivery path exists, is accessible, is monitored, and has an accountable responsible party.\n- **Delivery Sufficiency Register:** quarterly-published accounting of populations not yet meeting the standard, with gap type, current status, commitment, timeline, responsible party, and evidence link.\n- **Founding Register entries:** seven populations entered at founding with open commitments.\n- **Cross-boundary delivery operationalization:** quarterly accounting of the 2% PFCR cross-boundary allocation, flow to intermediary organizations, populations reached, no-enrollment-coercion rule.\n- **Register removal standard:** removal requires responsible party certification, Federated Ombuds independent verification, and published verification \u2014 not just administrative assertion.\n- **Constitutional amendment:** delivery sufficiency obligation clause added to Article IV.\n\n**New risks introduced:**\n- The Register could become a bureaucratic accounting exercise that satisfies the letter while missing the spirit. Mitigated by: the AY1 standard requires accessibility without extraordinary effort (not just existence of a path), and Federated Ombuds escalation authority for missed timelines.\n- Cross-boundary delivery through intermediary organizations could be used to build dependency relationships. Mitigated by: the no-enrollment-coercion rule (\u00a7AY3.3) prohibits conditioning delivery on future enrollment.\n\n**Residual risk:** The Register creates accountability; it does not create capacity. Physical infrastructure, institution enrollment, and intermediary organization funding must follow independently. P-055 makes the gap visible and governed; it does not close the gap operationally.\n\n---\n\n## P-050 through P-052 \u2014 CASP, Constitutional Integrity Panel, and Ombuds Manufacture Standard\n\n### P-050 \u2014 Compliant Alternative Supplier Pre-Registration (CASP)\n\n**Threat addressed:** T-028\n**Status:** ACTIVE | **Priority:** Critical | **Annex:** ANNEX_AT \u00a7AT6.6\n\n- **Introduced design:** Mandatory pre-registration of backup suppliers with automatic-activation contracts before any essential-sector procurement renewal. Procurement authorities must calculate and publish the gap-window \u2014 the period between a primary supplier exit and backup supplier operational readiness \u2014 before each renewal cycle. Any drill classified as drill-secure requires adversarial observation by at least one party outside the procurement authority's organizational chain.\n- **Dependencies:** Essential-sector supplier registry, automatic-activation contract templates approved by the CRP, gap-window calculation methodology published and P-004-protected.\n- **New risks introduced:** Pre-registered backup suppliers could become nominal alternatives with no real capacity. Mitigated by: adversarial observation requirement for drill-secure drills, and gap-window publication creates accountability for calibration accuracy.\n- **Residual risk:** Supplier pre-registration does not guarantee backup capacity is operationally ready in all stress conditions. Gap-window calculation relies on supplier self-reporting, which is subject to optimism bias.\n\n---\n\n### P-051 \u2014 Constitutional Integrity Panel (CIP)\n\n**Threat addressed:** T-022  \n**Status:** ACTIVE | **Priority:** Critical | **Annex:** ANNEX_AM \u00a7AM8\n\n- **Introduced design:** 7-member independent body with staggered terms. Funding is constitutionally fixed at 0.01% of annual Flow issuance \u2014 not subject to legislative appropriation and not reducible by the governing coalition. Appointment requires multi-body sign-off drawn from sources that cannot be simultaneously controlled by a single governing coalition. 5-of-7 quorum required for Tier 1 ratification. Automatic review triggers fire when institutional vacancies exceed 90 days or when mandatory publication lapses exceed 30 days, without requiring the governing coalition to initiate.\n- **Dependencies:** Founding appointment of the initial 7-member panel before constitutional activation. Staggered term schedule published at founding. Flow issuance tracking system for the 0.01% funding calculation.\n- **New risks introduced:** Multi-body appointment requires identifying genuinely independent appointing bodies at founding, which may be difficult in contexts with thin civil society. Mitigated by: P-020 oppose-coalition nomination pathways provide analogous alternatives.\n- **Residual risk:** Constitutional entrenchment of CIP funding can still be dismantled by a sufficiently determined supermajority willing to use the Tier 1 amendment process. The CIP raises the political cost; it does not make repeal impossible.\n\n---\n\n### P-052 \u2014 Federated Ombuds Deliberate-Manufacture Standard\n\n**Threat addressed:** T-019  \n**Status:** ACTIVE | **Priority:** High | **Annex:** ANNEX_AI \u00a74.12\n\n- **Introduced design:** Pre-committed 4-criterion assessment that the Ombuds Plenum must apply when evaluating whether a demand-context flag was deliberately manufactured: (1) timing \u2014 whether the triggering enforcement action was initiated within a sentinel indicator movement window; (2) proportionality \u2014 whether the enforcement action's scope is proportionate to the stated enforcement basis; (3) prior basis \u2014 whether enforcement basis documentation existed before the sentinel indicator moved; (4) knowledge \u2014 whether the enforcing authority had actual or constructive knowledge of sentinel indicator status at initiation. The Plenum must reach a decision within 24 hours. When evidence is inconclusive across all four criteria, the asymmetric default favors PCRP activation rather than flag maintenance. A manufactured-flag finding is automatically referred to the Enforcement Panel, not held within the Ombuds system.\n- **Dependencies:** Federated Ombuds fully constituted per P-025 (\u22654 sub-Ombuds seated). Cross-register timing monitor operative (Annex AI \u00a73.3). Enforcement Panel charter must include manufactured-flag referrals as a defined intake category.\n- **New risks introduced:** 24-hour decision window creates pressure that may produce errors in ambiguous cases. Mitigated by: asymmetric default toward PCRP activation when inconclusive, which is the conservative failure mode.\n- **Residual risk:** The 4-criterion assessment cannot definitively establish intent. A sophisticated actor who sequences enforcement actions to avoid triggering all four criteria simultaneously can manufacture a flag while technically passing the assessment. Accepted as bounded leakage \u2014 the standard raises the operational complexity and coordination cost of deliberate manufacture without eliminating it.\n\n---\n\n### P-056 \u2014 Open-Access Survival Floor (Two-Tier Identity Model)\n\n**Status:** PROPOSED  \n**Tier:** Tier 2  \n**Threat addressed:** T-002 (identity exclusion of vulnerable persons); INV-001 operationalization  \n**Annex:** ANNEX_AK \u00a7AK8  \n**Summary:** Separates non-duplication (required for CSM) from identity verification (required only for above-floor services and civic instruments). Defines Tier 0 (open-access/pseudonymous survival floor) and Tier 1 (identity-gated services). Establishes civic accountability norm: the system trusts citizens because there is enough for everyone. Aggregate anomaly detection replaces individual surveillance at the survival tier. Token mechanism specification delegated to ANNEX_AZ \u00a7AZ2 as a pre-operational prerequisite.\n\n---\n\n### P-057 \u2014 Pilot Site Selection Criteria\n\n**Threat addressed:** Pilot farming (ACL-011), founding consent theater (ACL-010)\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Pilot_Site_Selection_Criteria.md](./Pilot_Site_Selection_Criteria.md)\n\n**Summary:** Defines required, disqualifying, and preferred characteristics for pilot site selection, including Phase 1 capital reference ranges. Prevents friendly-site selection from producing misleading pilot evidence and blocks sites where consent conditions or jurisdictional conflicts cannot be met.\n\n---\n\n### P-058 \u2014 Jurisdiction Interface Clause\n\n**Threat addressed:** Implementation drift (T-016), constitutional void under external law\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Jurisdiction_Interface_Clause.md](./Jurisdiction_Interface_Clause.md)\n\n**Summary:** Establishes three-layer jurisdiction interface; defines RAC as Layer 1; specifies matters governed by external law; pre-enrollment grace window; retaliation prohibition. Ensures the Humane Constitution operates coherently within, alongside, and\u2014where necessary\u2014in tension with external legal systems.\n\n---\n\n### P-059 \u2014 Vulnerable Population Consent Protocol\n\n**Threat addressed:** Founding consent theater (ACL-010), T-027 (dignity floor leverage)\n**Status:** PROPOSED | **Priority:** Critical\n**Creates:** [docs/governance/Vulnerable_Population_Consent_Protocol.md](./Vulnerable_Population_Consent_Protocol.md)\n\n**Summary:** Defines ICA structure, 30-day cooling-off, teach-back verification, non-waivable exit rights, and pre-recruitment prerequisites for VPCP-scope populations (homeless, justice-exiting, unemployed, disability, elder, refugee). Requires ICA staffed and exit support fund pre-capitalized before any VPCP-scope recruitment begins.\n\n---\n\n### P-060 \u2014 Founding Team Composition Standard\n\n**Threat addressed:** Keyholder social capture (ACL-005), bureaucratic elite formation (T-008)\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Founding_Team_Composition_Standard.md](./Founding_Team_Composition_Standard.md)\n\n**Summary:** Defines founding team composition floor, disqualifying conflicts, 9-seat keyholder allocation, founder sunset rules (FS-1 through FS-7), and Perpetual Humility Review. Seats 3\u20138 nominated by civil-society organizations approved by the adversarial panel member, not selected by the founding team.\n\n---\n\n### P-061 \u2014 Founding Capital Framework\n\n**Threat addressed:** Procurement shell capture (ACL-007), power-wealth convergence\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Founding_Capital_Framework.md](./Founding_Capital_Framework.md)\n\n**Summary:** Defines phase capital targets, 20%/30% concentration limits, Capital Steward structure, constitutional primacy clause, government walk-away rule, CLT land structure, and wind-down reserve. Capital Steward must be independent of the founding team; selection precedes first capital commitment.\n\n---\n\n### P-062 \u2014 Pilot Timeline Framework\n\n**Threat addressed:** Pilot farming (ACL-011), founding consent theater (ACL-010)\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Pilot_Timeline_Framework.md](./Pilot_Timeline_Framework.md)\n\n**Summary:** Five-track parallel timeline with critical-path gates; three recruitment windows; phased occupancy sequence; failure contingency requiring Resident Transition Protocol before Cohort 1. Track A (governance/legal), Track B (infrastructure), Track C (capital), Track D (community/consent), Track E (technology) must all clear defined gates before enrollment opens.\n\n---\n\n### P-064 \u2014 Compliance-Masked Refusal Hardening\n\n**Threat addressed:** T-028\n**Status:** ACTIVE | **Priority:** Critical\n\nThe essential-sector refusal package already tested open exit, medicine/PBM refusal, and grid/logistics delay. The remaining P0 gap was subtler: an incumbent can stay formally compliant while degrading actual delivery through slow paperwork, data withholding, PBM access friction, standards-body delay, affiliate fallback capture, workforce poaching, selective regional degradation, litigation, or concession pressure.\n\n- **Introduced design:** Adds compliance-masked refusal as a named refusal lane in the Essential-Sector Refusal Test Package. Formal compliance is no defense when CSM delivery, CASP activation, fallback control transfer, patient continuity, vulnerable-cohort continuity, or reserve activation fails in practice.\n- **Medicine hardening:** Requires complete access paths, not merely alternate suppliers: manufacturer/API, distributor, pharmacy/specialty pharmacy, claims/formulary data, cold chain, prescribing interface, appeal route, and patient-support path. Adds patient-continuity floor and medicine metrics for time-to-fill, missed doses, PA clock breaches, formulary overrides, affiliated routing, substitution harm, and vulnerable-cohort continuity.\n- **Grid/logistics hardening:** Adds hidden compliance variants for partial restoration, standards objections, data migration delay, workforce poaching, affiliate substitution, and regional degradation. Adds transfer-control metrics for dispatch, routing, warehouse, outage, grid, fleet, inventory, credentialing, emergency data access, full operating package access, and workforce independence.\n- **Dashboard integration:** Adds compliance-masked refusal exposure to the Capture Dashboard and threshold anchors. Watch and active-capture-signal thresholds now cover data/control-system export delay, standards obstruction, PBM access friction, affiliate fallback correlation, workforce poaching, legal delay beyond 14 days, concession requests, vulnerable-cohort failure, CASP blockage, and fallback control-transfer failure.\n- **Evidence integration:** Updates T-028 in the Threat Register and Threat Resolution Matrix, Phase 9 of the Pilot Evidence Roadmap, the Claims and Evidence Register, Hardening Queue, Conglomerate Transition Dossier, and Annex AT CASP independence language.\n- **New risks introduced:** The metric can over-classify genuine operational difficulty as strategic refusal. Mitigated by independent clearance for legitimate delay, two-source confirmation for degradation periods under Annex AT, and affected-population evidence rather than inference from paperwork alone.\n- **Residual risk:** Sophisticated incumbents can distribute obstruction below individual thresholds, especially through informal standards influence, contractor labor markets, insurer/lender pressure, and patient-level administrative friction. The control improves detectability; it does not create physical capacity, independent staff, data escrow, or medicine supply by itself.\n\n---\n\n### P-065 \u2014 CIP Vacancy-Starvation Hardening\n\n**Threat addressed:** T-022\n**Status:** ACTIVE | **Priority:** Critical\n\nThe active CIP design made hostile successor hollowing visible but still had a load-bearing failure mode: a successor government could let CIP seats expire, keep the panel below quorum, delay dashboard publication, and then argue that absent ratification could not block later action. This patch makes vacancy itself self-repairing and makes silence a defect, not consent.\n\n- **Introduced design:** CIP vacancies must be published within 7 days. Ordinary appointing sources must transmit a qualified nominee within 30 days; fallback nomination activates at 45 days through the Federated Ombuds Plenum from a public, multi-source shortlist. The fallback path is a repair duty, not a policy-alignment power.\n- **Staggering enforcement:** Appointments that violate the no-more-than-2-seats-per-year rule are void unless tied to death, incapacity, or removal for cause. Void appointments do not count toward quorum, ratification, or review authority.\n- **Below-quorum rule:** Vacancy does not waive concurrent ratification. A below-quorum CIP may publish records, request fallback nomination, preserve evidence, accept objections, and issue interim risk notices, but may not ratify amendments, close AM3 reviews, waive deadlines, approve funding changes, or appoint itself.\n- **Publication and report fallback:** Dashboard failure routes trigger publication through the public amendment log and independent Ombuds channels. A missing Ombuds Tier 1 integrity report procedurally suspends the amendment until the report or fallback review is complete.\n- **Servant-authority limits:** CIP authority is custodial, corrigible, conduct-based, and subject to ordinary challenge. CIP funding is subordinate to immediate Essential Access relief; no review, vacancy, dispute, or funding issue may delay survival-floor activation.\n- **New risks introduced:** Fallback nomination could become a guardian-class formation path if repeated repairs are dominated by the same civil-society or expert networks. Mitigated by public shortlists, multi-source nomination, Article VII publication, non-renewable terms, ordinary challenge rights, and Capture Dashboard monitoring.\n- **Residual risk:** This patch blocks one hollowing route; it cannot prevent lawful democratic repeal or broad institutional culture collapse. The design can make hollowing visible, slow, and contestable; it cannot make human guardians incorruptible.\n\n---\n\n### P-066 \u2014 Commons Return and Universal Stake Fiscal Sustainability Gate\n\n**Threat addressed:** T-029\n**Status:** ACTIVE | **Priority:** Critical\n\nThe previous active economic spine still treated progressive net-worth demurrage as the primary anti-hoarding and commons-funding mechanism. That left two skipped problems: the active annex did not match the accepted Commons Return and Universal Stake direction, and the corpus had no registered threat for the fiscal question beneath every scale claim \u2014 what funds the floor, at what inflation cost, and who actually bears the burden?\n\n- **Introduced design:** Annex D is rebuilt around Commons Return and Universal Stake. Routine progressive net-worth demurrage, idle-money decay, and continuous personal-balance carrying cost are superseded as active policy. Commons Return applies only to named source bases: land/location value, natural resources, scarce licenses, public-infrastructure uplift, network/platform rents, large succession transfers, and external-capital use of protected commons.\n- **Universal Stake:** A protected civic inheritance may distribute a share of Commons Return after Essential Access, resilience reserves, restoration duties, payment rails, and governance operations are funded. It may not buy Voice, Service Record, office, identity priority, Essential Access priority, or review-body eligibility.\n- **Fiscal gate:** T-029 blocks scale claims unless a costed fiscal adequacy model exists. The model must cover Essential Access cost, delivery cost, source-base receipts, Universal Stake formula, administrative cost, inflation/debasement tolerance, transition cost, downside scenarios, burden incidence, and any remaining taxes, fees, or charges.\n- **Honest tax posture:** The patch does not claim taxes are unnecessary. It says Commons Return should narrow the preferred public burden toward public-created and scarcity-created value, while any residual taxes must be named, costed, dignity-screened, and barred from survival access, ordinary labor, basic household exchange, and modest household reserves unless explicitly justified through the fiscal gate.\n- **Evidence integration:** Creates the Commons Return and Universal Stake Evidence Test Package; updates Threat Register, Threat Resolution Matrix, Hardening Queue, Claims and Evidence Register, Open Problems Resolution Docket, Pilot Evidence Roadmap, Capture Dashboard Specification, Annex Directory, Annex Taxonomy, reader prompts, and corpus registration.\n- **New risks introduced:** Commons Return can become valuation bureaucracy, surveillance, political dividend timing, hidden wealth tax, asset-holder avoidance, or downward burden shift. Mitigated only by source-specific bases, protected ordinary use, appeal rights, privacy limits, lockbox accounting, incidence testing, and public \"who pays\" disclosure.\n- **Residual risk:** Commons Return may still be insufficient or volatile. Some taxes or fees may remain necessary during transition or at scale. The control is not proof of fiscal adequacy; it is a scale-blocking discipline until proof exists.\n\n---\n\n### P-067 \u2014 Cyber Resilience and Availability Gate\n\n**Threat addressed:** T-030\n**Status:** ACTIVE | **Priority:** Critical\n\nThe corpus already had controls for implementation drift, tamper evidence, oracle failure, and delivery sufficiency. Those controls did not answer a different question: what happens when ransomware, breached keys, regional network outage, cloud/provider failure, supply-chain compromise, or payment-rail failure makes the survival floor unreachable?\n\n- **Introduced design:** T-030 registers external cyber availability as a distinct threat. The Cyber Resilience and Availability Evidence Test Package requires a critical-service inventory, ransomware continuity drill, key-compromise and emergency-rotation drill, offline/analog continuity drill, regional failover drill, and supply-chain/dashboard integrity drill.\n- **Continuity standard:** Essential Access must remain deliverable through last-known-valid state, manual/offline provider paths, emergency settlement, and public status channels inside the published tolerance. Aggregate restoration is not enough if vulnerable cohorts, rural users, digitally fragile persons, or critical providers remain cut off.\n- **Claim discipline:** Implementation Drift Audit Package remains the evidence home for unauthorized drift and tamper evidence. The cyber package is the evidence home for whether people can still receive food, water, shelter, medicine, transit, and urgent care when digital systems, keys, providers, or networks fail.\n- **New risks introduced:** Offline fallback can become fraud-prone or privacy-invasive; emergency key rotation can concentrate authority; manual provider settlement can become a hidden bailout or coercive choke point. These are residual risks and must be measured in the evidence packet.\n- **Residual risk:** This patch registers the risk and defines the test path. It does not prove cyber resilience, key custody, recovery time, offline continuity, or supply-chain safety.\n\n---\n\n### P-068 \u2014 Last-Resort Unenrolled Access Gate\n\n**Threat addressed:** T-031\n**Status:** ACTIVE | **Priority:** Critical\n\nThe corpus already names the principle: identity is never a condition of survival access. It also contains the pieces: P-054 safety-shielded emergency access, P-055 delivery sufficiency, P-056 Tier 0 design, Annex AK \u00a7AK8, and Annex AZ's pseudonymous token constraints. The missed question is narrower and more concrete: can a person who never enrolls, never holds a credential, never keeps a wallet, and cannot safely become legible still receive the floor?\n\n- **Introduced design:** T-031 registers last-resort unenrolled access as a distinct critical threat rather than hiding it inside ordinary identity recovery. The Last-Resort Unenrolled Access Evidence Test Package requires access-point mapping, no-credential intake drills, trusted-intermediary drills, analog reconciliation privacy tests, abuse/diversion drills, and dignity interviews.\n- **Claim discipline:** P-056 remains the designed Tier 0 architecture. P-068 is the active evidence gate. No document should claim practical universality of Essential Access until this gate has evidence that the last-resort path works for people outside identity and digital infrastructure.\n- **Continuity standard:** The path must work without a phone, app, QR code, card, stable address, biometric, persistent account, future enrollment promise, or identity-disclosing intermediary. Abandonment counts as exclusion.\n- **New risks introduced:** An analog last-resort route can be exploited by organized brokers, captured by intermediaries, gamed by providers, or converted into a shadow registry through reconciliation records. The evidence package requires aggregate controls and privacy review precisely because individual surveillance would defeat the point.\n- **Residual risk:** This patch does not prove the floor is reachable. It makes the proof requirement explicit and blocks universality claims until no-credential and trusted-intermediary routes pass under dignity review.\n\n---\n\n### P-069 \u2014 Monitoring Repurposing Gate\n\n**Threat addressed:** T-032\n**Status:** ACTIVE | **Priority:** Critical\n\nThe corpus already limits several monitoring surfaces: Annex C gives monitored persons notice and appeal, Annex H requires privacy/surveillance notes for amendments, Annex AK restricts Tier 0 monitoring to aggregate anomaly, Annex AY requires privacy-preserving delivery monitoring, and the Capture Dashboard bans ranking ordinary persons. The gap was cross-cutting: the same data required to enforce protection can be repurposed into the coercive surveillance layer the project opposes.\n\n- **Introduced design:** T-032 registers monitoring repurposing as a distinct critical threat. The Monitoring Repurposing Evidence Test Package requires a Monitoring Purpose Register, purpose-creep red team, linkability/re-identification test, office-separation drill, individual-flag appeal drill, data-minimization and retention audit, and coercive-use scenario.\n- **Claim discipline:** No document should claim enforcement monitoring is bounded, non-surveillant, or safe from repurposing until every monitoring stream has a named purpose, minimum-data rule, access role, retention rule, independent reviewer, appeal path, and explicit secondary-use prohibition.\n- **Continuity standard:** Enforcement may monitor power, institutions, route performance, provider continuity, aggregate anomalies, and control-plane health. It may not silently create a general-purpose behavioral graph, location map, risk list, identity dossier, or ranking system for ordinary persons.\n- **New risks introduced:** Tight monitoring limits can reduce fraud detection or delay enforcement; strong auditability can conflict with deletion; aggregation can hide individual harm; raw records can still be pressured by lawful authorities or captured insiders. These are residual risks and must be measured honestly.\n- **Residual risk:** This patch does not prove monitoring is safe. It makes monitoring itself a test subject and blocks anti-surveillance claims until purpose limitation, linkability resistance, office separation, appealability, retention, and coercive-use tests pass.\n\n---\n\n### P-070 \u2014 Founding Legitimacy Prerequisite Definition Gate\n\n**Threat addressed:** T-033\n**Status:** ACTIVE | **Priority:** Critical\n\nThe corpus already names the founding legitimacy problem through T-017, T-022, T-026, T-027, the Founding Order, Annex AH, the Founding Legitimacy Dossier, the Vulnerable Population Consent Protocol, the Founding Team Composition Standard, and the Pilot Timeline Framework. The gap was not absence of concern. The gap was definition: the two Founding Legitimacy Dossier prerequisites, \"consent evidence\" and \"independent civil-society review,\" could not be produced without a public standard for what counted.\n\n- **Introduced design:** Creates the Founding Consent and Civil-Society Review Evidence Test Package. The package reconciles the Dossier's lower consultation threshold with the Founding Order's binding consent act: for activation authority, 2/3 eligible resident-personhood participation and 2/3 eligible resident-personhood affirmative consent govern, with 90-day notice, 60-day deliberation, roll-call-equivalent record, and drift-chain logging.\n- **Consent evidence standard:** Requires consent model, notice record, deliberation record, participation record, threshold certification, opt-out proof, aid-nonconditioning proof, pressure survey, coercion complaint log, and exit-cost report before the Dossier consent-evidence row can reach PRODUCED.\n- **Civil-society review standard:** Requires at least three qualified reviewer categories from an adversarial-panel shortlist after public challenge. Reviewers must pass financial, governance, affected-community accountability, dissent-capacity, conflict-disclosure, and plain-language-publication tests.\n- **Claim discipline:** Gate A does not clear if founders substitute low-turnout consultation, silence, humanitarian-aid acceptance, friendly expert review, funder-adjacent review, or unpublished reviewer findings for consent and independence evidence.\n- **New risks introduced:** A stricter review gate can be used to delay legitimate founding indefinitely or empower a civil-society gatekeeper class. Mitigations are public shortlists, public challenge records, separate reviewer findings, dissent preservation, affected-community accountability, and explicit Gate A failure reasons.\n- **Residual risk:** No evidence packet can prove perfect founding legitimacy. P-070 makes consent and reviewer independence falsifiable before activation; it does not eliminate the bootstrap problem, informal pressure, class capture, or the need for post-activation audit.\n\n---\n\n### P-072 \u2014 Productive Status Register\n\n**Threat addressed:** T-025\n**Status:** PROPOSED | **Priority:** High\n\nThe word \"productive\" unlocks two benefits on two separate tests: Flow issuance against verified productive commitments (ANNEX_X) and the Commons Return exemption for productive working assets (ANNEX_D \u00a7D3, on ANNEX_J's published Article V stewardship standard). P-023 closed the protected-capital shelter inside the contract-commitment architecture; the residual T-025 variant is *cross-instrument and temporal* \u2014 the same activity classified \"productive\" by the looser test claims both benefits, and because Flow mints at commitment start while the exemption is assessed at settlement, an honest determination at T0 can be exited before any reversal clears.\n\n- **Introduced design:** The [Productive Status Register](Productive_Status_Register.md) \u2014 one canonical productive-status determination per commitment/asset against the single published standard, with three structurally separate roles (standard-author, register-adjudicator, benefit issuer; INV-006 incl. the economic-parameter-setting extension); a **settle-forward escrow** under which the \u00a7D3 exemption vests only after the Flow-side commitment is verified to have stayed in productive use through a full settlement period (non-vesting replaces reversal, wages stay protected by no-clawback); a payroll/escrow fast-path so issuance is never blocked on adjudication; an appeal-bound, independently audited determiner; and the rule that status classifies the activity, never the person (INV-003; \u00a7D6 minimum-necessary data).\n- **Claim discipline:** No document may claim the productive double-dip is closed until the register's evidence test passes (double-dip closure in adversarial simulation; no issuance starvation; determiner non-capture; no person-scoring drift). The instrument is `Designed` and pilot-gated; it binds nothing until then.\n- **New risks introduced:** A single register is a new capture target (bounded by the three-way role split, appeal, audit, and the INV-006 recusal extension); escrowed exemptions add settlement-period accounting complexity; the fast-path's provisional status could be farmed below the de-minimis threshold (the escrow still withholds the exemption, so the farm nets nothing).\n- **Residual risk:** Settle-forward closes the modeled timing attack; it does not prove the published stewardship standard itself cannot be captured (that remains ANNEX_J / Article V territory under T-025), and no pilot evidence exists for adjudication throughput at scale.\n\n**Panel-revised before incorporation** (adversarial, Christ-centered, corpus-fit; source: `docs/superpowers/specs/2026-06-09-productive-register-recusal-redline.md`). The companion Fix 2 of that redline \u2014 the INV-006 economic-parameter-setting recusal extension \u2014 is already constitutional (applied with Session 23).\n\n---\n\n### P-073 \u2014 Framework-First Intake (Anti-Accretion Rule)\n\n**Threat addressed:** structural \u2014 no threat row (rule-count inflation as a systemic failure mode)\n**Status:** ACTIVE | **Priority:** High\n\nA full-corpus simplification audit (2026-06-12, three independent single-role reviews) found that the corpus's protective machinery grew by accretion: each threat received its own patch, and patches repeatedly reimplemented mechanisms the corpus had already designed elsewhere \u2014 at audit time, at least eight collusion-detection instances, eight appeal-path machineries, ten near-identical evidence test packages, seven restatements of the data-minimization rule, six overlapping status registries, and forty-seven standing institutions. Every duplicate mechanism is a new capture surface, a new audit obligation, and a new layer of illegibility between an ordinary person and the rules that govern them.\n\n- **Introduced design:** The Framework-First Intake gate in `Acceptance_Protocol.md`: a proposal introducing a mechanism whose protective function an existing mechanism already performs must extend the most general existing instrument or attach a published justification for why extension cannot serve. Returns are judgment calls, so they carry a published return record (void without it), a point-by-point resubmission ratchet, and escalation of contested duplication questions to the standing adversarial panel member. Extensions that add authority, personnel, data collection, or gatekeeping power receive full new-mechanism scrutiny at the higher applicable tier (no laundering). A simplicity presumption favors consolidation and deletion \u2014 bounded so it never blesses independence-reducing mergers (mechanism count, never independence count) and never costs a protected person their path to protection.\n- **Claim discipline:** This gate is process hygiene, not proof of simplicity. No document may claim the corpus is consolidated or minimal until the consolidation program (status spine, appeal spine, evidence framework, data stewardship standard, institutional mergers) actually lands and the rule shows fruit at real intakes.\n- **New risks introduced:** A captured intake could try to use \"duplicate\" as a veto on new protections (bounded by the return record, ratchet, and adversarial escalation); justification-writing could become ritual boilerplate (watched via the technical-review record requirement); the gate itself is one more rule (accepted: it is the rule that makes the next hundred unnecessary, and it creates no office, register, or new process step).\n- **Residual risk:** The gate stops *new* duplication; it does not remove the existing redundancy (that is the consolidation program's job). Its effectiveness is unproven until tested by real proposals; per its own corrigibility clause, evidence that it suppresses needed protections or relocates complexity into justification documents counts against it.\n\n**Panel process:** four independent single-role reviewers (adversarial systems designer, Christ-centered, corpus-fit, minimalist) reviewed the applied diff in parallel; all four returned APPROVE WITH FIXES and every required fix was incorporated (return-record discipline, anti-laundering tier rule, independence-count bound, protected-person clause, corrigibility clause, functional test replacing a closed family list, P-073 provenance). Christ-centered review recorded as Session 25 in `Christ_Centered_Evaluation.md`.\n\n**Consolidation program landings (running record):** 2026-06-12 \u2014 the status spine landed (first program step under this gate): `Status_Model.md` deleted, its vocabulary and edge rules absorbed into the Claims and Evidence Register's Status methodology section (now the canonical status spine); the Hardening Queue stripped of duplicated status tracking (worklist only, references owners); Threat Register restated patch-statuses converted to pointers. Net ~\u221295 lines; vocabulary-definition sites reduced from five to one. Evidence Ladder deliberately retained standalone (it defines evidence *levels*, a different axis, and its level numbers are cited by app code and seven documents). Named follow-ups: Patch Log single-row mini-tables (same-file restatement, checker-covered) and a single convention for Threat Register per-entry Status lines.\n",
+      "content": "# Patch Log\n\n**Running change ledger aligned to the Humane Constitution \u00b7 Current through P-074 (P-071 reserved)**\n\n---\n\n**Purpose.** This log records the hardening changes introduced during the current cycle and keeps a traceable link between threats, mitigations, introduced risks, and remaining open questions.\n\n**Rule.** The patch log is not a substitute for the constitution. The Humane Constitution holds the law-like text; the patch log explains how and why the hardening evolved.\n\n**Patch status convention:** \n- **ACTIVE** = adopted into the document set and awaiting simulation/tuning; not evidence-backed proof. \n- **SUPERSEDED** = replaced by a later patch. \n- **PROPOSED** = designed but not yet accepted into the Humane Constitution.\n- **RETIRED** = intentionally removed.\n\n**Evidence discipline.** A patch can be well designed and still fail in contact with identity errors, measurement lag, legal wrappers, institutional self-protection, or founding politics. Do not treat `ACTIVE` or `PROPOSED` as `RESOLVED`; evidence-backed resolution belongs in the Claims and Evidence Register and the relevant Threat Register residual-risk update.\n\n---\n\n## Patch Inventory\n\n| Patch ID | Related Threat | Status | Priority | Core Change |\n| :--- | :--- | :--- | :--- | :--- |\n| P-001 | T-001 | **ACTIVE** | Critical | Contain shadow convertibility through friction, detection, and broker-focused enforcement. |\n| P-002 | T-004 | **ACTIVE** | Critical | Stabilize incentives with nonlinear reward architecture and anti-gaming design. |\n| P-003 | T-002 | **ACTIVE** | Critical | Replace single-gate identity with differential assurance and recovery-safe continuity. |\n| P-004 | T-007 | **ACTIVE** | Critical | Stop semantic capture through definition governance and anti-laundering rules. |\n| P-005 | T-005 | **ACTIVE** | Critical | Governance throughput: tiered CRP queues, throughput floor, emergency re-declaration. |\n| P-006 | T-006 | **ACTIVE** | Critical | Measurement lag: sentinel mandate, PCRP first-responder authority, Shared Storehouse unwind symmetry. |\n| P-008 | T-008 | **PROPOSED** | High | Elite formation: legibility audit, diversity mandates, verification independence, cohort cooling. PROPOSED and superseded for operative authority by P-025 (Federated Ombuds constitution); P-025 is the live ACTIVE control for T-008. |\n| P-009 | T-009 | **ACTIVE** | Med-High | Grace exploitation: graduated renewal, cross-quarter history, collusion detection, Service Record slow-decay. |\n| P-011 | T-011 | **ACTIVE** | Critical | Narrative hardening: RPCP, pre-committed failure doctrine, CFRL, adversarial narrative simulation. |\n| P-012 | T-012\u2013T-015 | **ACTIVE** | Critical | Interface hardening: oracle independence, categorical throughput floors, deadlock protocol, demand-context flag. |\n| P-013 | T-016 | **ACTIVE** | Critical | FAP integrity: representativeness standard, deadlock timeline, audit epistemic independence, anti-gaming Tier 2. |\n| P-014 | T-017 | **ACTIVE** | Critical | Bootstrap activation: one-time founding instrument for P-013 activation only. |\n| P-015 | T-018 / T-019 | **ACTIVE** | High | PCRP attack surface: false-trigger escalation path, exhaustion alert, manufactured flag assessment. |\n| P-016 | T-002 | **PROPOSED** | Critical | Identity asymmetric error doctrine: quantified fraud/exclusion rate targets, Tier 2 founding commitment. Remains PROPOSED / pre-ratification until founding adoption and pilot-calibrated rate confirmation; FC-140 through FC-145 have bound starting values, while FC-146 through FC-150 remain pre-launch commitments. |\n| P-017 | T-020 / T-021 | **ACTIVE** | Critical | Oracle epistemological and algorithmic independence: methodology-class diversity, AI supply chain transparency, physical ground-truth requirement. Numerical floors (N\u22655, \u22653 classes, \u22640.30 pairwise correlation, \u22651 adversarial seat) bound in `/founding/commitments.md` FC-030/FC-031/FC-032/FC-033. |\n| P-018 | T-022 | **PROPOSED** | Critical | Electoral cycle resilience: entrenchment ladder, Essential Access floor minimum persistence, administrative hollowing triggers, transition continuity protocol. |\n| P-019 | T-023 | **ACTIVE** | Med-High | Pilot external validity gate: stress-condition pilot requirement, red-team challenge window, crisis simulation mandate. |\n| P-020 | T-017 | **ACTIVE** | Critical | Founding window extension: 60-day pre-activation disclosure, oppose-coalition adversarial member nomination. |\n| P-021 | \u2014 | **ACTIVE** | High | Register disclosure protocol: bifurcation into public and restricted versions; operational security for detection thresholds. |\n| P-022 | T-024 | **ACTIVE** | Critical | Shared Storehouse oracle-failure fallback: conservative hold, 48h REB first-responder window, 72h governance handoff, FC-100 14-day restoration verification, reconciliation review. Annex AQ ACTIVE. |\n| P-023 | T-025 | **ACTIVE** | High | Capital-deployment shelter capture: contract-commitment architecture, milestone escrow, verified physical deliverables, and no protected-capital label without deployment. |\n| P-024 | T-009 / TR-07 / T-018 | **ACTIVE** | Critical | Attestation-at-risk stake mechanism: FC-080 stake ratio, FC-081 audit window, FC-082 graph density threshold, slashed-stake redistribution, graph-density safe harbor for legitimate close-knit communities. Annex AS. |\n| P-025 | T-008 | **ACTIVE** | Critical | Federated Ombuds constitution: 5 sub-Ombuds (FC-090), 4-of-5 Plenum supermajority (FC-091), 730-day staggered terms (FC-092), Oversight Assembly (7 members, 5-of-7), structural-dispersal criteria, Concentration Response. Annex AI rewritten. Supersedes single-commissioner draft. |\n| P-026 | T-026 / T-027 | **ACTIVE** | Critical | Founding Order \u2014 Subsidiarity, Consent & Exit: smallest-scale default with three-prong competence test; affirmative consent events at 2/3 supermajority (FC-120); 730-day graceful exit unwind (FC-121) with Essential Access continuity preserved; five-scale hierarchy (FC-122: household/neighborhood \u2264500/locality \u22645,000/region \u2264500,000/federation); re-entry symmetric, no penalty. `/founding/order/` directory. |\n| P-027 | T-005 / T-008 | **ACTIVE** | Critical | Structural consolidation into one Founding Order and seven Articles of Constitutional Order. Rights and execution unified under Article I; Essential Access and delivery unified under Article IV; markets, housing, enterprise, and PFCR unified under Article V; Voice, Service Record, and deliberation unified under Article VI; transparency and environmental scanning unified under Article VII. |\n| P-029 | T-016 | **ACTIVE** | Critical | Public Finance & Commons Revenue (PFCR): structural non-tax public funding, Commons Return source-base receipts, public banking rails as infrastructure, and anti-hidden-debt discipline. |\n| P-030 | PRD-004 | **ACTIVE** | Critical | Protocol-only money creation + household finance boundaries: no private Flow creation, no compounding household ordinary-life debt, no survival-floor securitization. |\n| P-031 | PRD-009 | **ACTIVE** | Critical | Anti-dynasty ownership: count-through beneficial ownership, trust prohibition for extractive continuity, succession limited to continuity and stewardship. |\n| P-032 | PRD-009 | **ACTIVE** | High | Stewardship ownership rule: land, housing, and enterprise rights may not become perpetual passive extraction claims. |\n| P-033 | PRD-008 | **ACTIVE** | High | Worker-owned and mission-locked enterprise preference: financing, procurement, and succession pathways structurally favor stewardship forms over absentee control. |\n| P-034 | T-016 / INV-007 | **ACTIVE** | Critical | Two-key architectural precondition for Tier-1-touching patches: adversarial panel attestation required before FAP intake; FAP reviewer cannot override absence; Beer S3* independence enforced; Buterin defection penalty specified. Annex AV. |\n| P-035 | \u2014 | **ACTIVE** | High | Founding group corrigibility clause + epistemic humility statement in Preamble and \u00a70A. |\n| P-036 | \u2014 | **ACTIVE** | High | Keyholder servanthood duty + replacement mechanism for self-interested keyholders (Article I). |\n| P-037 | \u2014 | **ACTIVE** | High | Identity-serves-person clause with triennial review and sunset requirement on secondary data use (Article II). |\n| P-038 | T-006 | **ACTIVE** | High | Community challenge path for capacity measurement figures with 14-day published response (Article III). |\n| P-039 | \u2014 | **ACTIVE** | High | Explicit protection for pre-existing mutual aid, family, and religious care networks; Article IV as floor not monopoly (Article IV). |\n| P-040 | \u2014 | **ACTIVE** | High | Housing cap pastoral revision (remove cold \"regardless\" language); structural humility closing clause added to Article V. |\n| P-041 | T-008 | **ACTIVE** | High | Biennial recognized-contribution audit to include invisible and pastoral work; 180-day correction requirement (Article VI). |\n| P-042 | \u2014 | **ACTIVE** | High | Low-barrier community alert pathway with 30-day acknowledgment and 90-day review trigger (Article VII). |\n| P-043 | Multiple | ACTIVE | High | Logical-analysis corpus corrections \u2014 documentary, amendment architecture, definitions, placeholder fill |\n| P-044 | Multiple | ACTIVE | High | Threat-strengthening batch \u2014 T-001/T-002/T-004/T-005/T-007/T-018/T-019 mitigation gaps closed |\n| P-045 | T-001 / T-002 / T-004 / T-007 / IC-004 | **ACTIVE** | Critical | Threat-mitigation batch \u2014 threshold derivation, asymmetric exclusion review, contribution floor, protected-term seed list, dignity-only continuity mode (threats remain Active \u2014 unproven; nothing marked Resolved) |\n| P-046 | Multiple | **ACTIVE** | Critical | Evidence and capture hardening \u2014 seven proof artifacts, drift audit, parameter calibration, abuse cases, evidence ladder, founding dossier, and capture dashboard |\n| P-047 | T-025 / T-026 / T-027 / external dependency capture | **ACTIVE** | Critical | Essential-sector conglomerate transition \u2014 profitable compliant path, refusal survivability tests, public fallback capacity, and numeric evidence anchors |\n| P-048 | T-025 / T-026 / T-027 / external dependency capture | **ACTIVE** | Critical | Essential-sector refusal test package \u2014 sector drills, FC-194 through FC-201 calibration rows, Annex AT receiver/licensing triggers, public explainer, and evidence-source expansion |\n| P-049 | Multiple evidence-gap bridges | **ACTIVE** | High | Cross-register bridge pass \u2014 aligns Hardening Queue, Open Problems, Pilot Roadmap, Public Readiness, README, and evidence-gap language with founding artifact status and essential-sector refusal testing |\n| P-050 | T-028 | **ACTIVE** | Critical | Compliant Alternative Supplier Pre-Registration (CASP): mandatory pre-registration of backup suppliers with automatic-activation contracts before essential-sector procurement renewal; gap-window calculation requirement; adversarial observation requirement for drill-secure classification. ANNEX_AT \u00a7AT6.6. |\n| P-051 | T-022 | **ACTIVE** | Critical | Constitutional Integrity Panel (CIP): 7-member independent body with staggered terms, constitutionally fixed funding (0.01% of annual Flow issuance), multi-body appointment preventing governing-coalition control, 5-of-7 quorum for Tier 1 ratification, automatic review triggers for institutional vacancy or publication lapses. ANNEX_AM \u00a7AM8. |\n| P-052 | T-019 | **ACTIVE** | High | Federated Ombuds deliberate-manufacture standard: pre-committed 4-criterion assessment (timing, proportionality, prior-basis, knowledge), 24-hour Plenum decision window, asymmetric default favoring PCRP activation when evidence is inconclusive, manufactured-flag referral to Enforcement Panel. ANNEX_AI \u00a74.12. |\n| P-053 | Insider retaliation / reporter protection | **ACTIVE** | Critical | Whistleblower Protection and Anti-Retaliation Protocol: administrative freeze on respondent write-access from filing; automatic escalation of retaliatory modifications; 45-day \"under review\" cap; restoration on exoneration. ANNEX_AW; Article VII reporter-protection clause. |\n| P-054 | Identity disclosure as safety vector | **ACTIVE** | Critical | Confidential Enrollment and Safety-Identity Protocol: cryptographically sealed identity for safety-compromised persons; address-blind delivery; 30-day emergency enrollment; 72-hour token for undocumented persons; sealed-record governance. ANNEX_AX; Article II safety-shielded enrollment clause. |\n| P-055 | Delivery gap between guarantee and operation | **ACTIVE** | Critical | Delivery Sufficiency Standard: four operational conditions (path exists, accessible, monitored, accountable party); Delivery Sufficiency Register published quarterly; seven founding-population entries; cross-boundary delivery accounting. ANNEX_AY; Article IV delivery-sufficiency obligation. |\n| P-056 | T-002 / INV-001 | **PROPOSED** | Critical | Open-Access Survival Floor (Two-Tier Identity Model): separates non-duplication (required for CSM) from identity verification (required only for above-floor services and civic instruments). Defines Tier 0 (open-access/pseudonymous survival floor) and Tier 1 (identity-gated services). Establishes civic accountability norm: the system trusts citizens because there is enough for everyone. Aggregate anomaly detection replaces individual surveillance at the survival tier. Token mechanism specification delegated to ANNEX_AZ \u00a7AZ2 as a pre-operational prerequisite. ANNEX_AK \u00a7AK8. |\n| P-057 | ACL-011 / ACL-010 | **PROPOSED** | High | Pilot Site Selection Criteria: required, disqualifying, and preferred characteristics for pilot town site selection; Phase 1 capital reference ranges ($15\u201322M); site selection process with adversarial panel member approval requirement. |\n| P-058 | T-016 / constitutional void | **PROPOSED** | High | Jurisdiction Interface Clause: three-layer jurisdiction interface (RAC mediation \u2192 external courts \u2192 federal floor); matters governed by external law enumerated; pre-enrollment 7-day grace window; retaliation prohibition; filing assistance obligation. |\n| P-059 | ACL-010 / dignity-floor leverage | **PROPOSED** | Critical | Vulnerable Population Consent Protocol (VPCP): ICA structure (civil-society nominated, 50% peer specialists, adverse-finding authority); VPCP-001 through VPCP-008 rules; 30-day cooling-off; teach-back verification as founding team obligation; non-waivable exit rights (60-day housing, 90-day healthcare, no clawback); pre-recruitment prerequisites gate. |\n| P-060 | ACL-005 / founding keyholder capture | **PROPOSED** | Critical | Founding Team Composition Standard: composition floor (FT-1 through FT-4); 9-seat keyholder allocation with distributed nomination (Seats 3\u20138 via civil-society organizations approved by adversarial panel member); founder sunset rules (FS-1 through FS-7); Perpetual Humility Review with Humility Declaration. |\n| P-061 | ACL-007 / Power-Wealth Convergence | **PROPOSED** | Critical | Founding Capital Framework: phase targets ($15\u201322M / $35\u201355M / $60\u201390M); 20%/30% funder concentration limits; Capital Steward independent fiduciary; constitutional primacy clause (non-negotiable in all funding agreements); government walk-away rule (4 trigger conditions); CLT land structure; wind-down reserve (6 months EA pre-funded). |\n| P-062 | ACL-011 / ACL-010 | **PROPOSED** | High | Pilot Timeline Framework: five-track parallel structure (Founding Legitimacy, Site Acquisition, Design/Permitting, Construction, Recruitment); three enrollment windows with hard prerequisites; critical-path gates (A2 at Month 8, D2 at Month 26\u201330, INV-LAUNCH-1 clearance); failure contingency requiring Resident Transition Protocol before Cohort 1 occupancy. |\n| P-064 | T-028 | **ACTIVE** | Critical | Compliance-Masked Refusal Hardening: treats lawful-looking obstruction as refusal when formal compliance hides CSM delivery degradation, patient-continuity failure, data/control-system lockout, PBM access friction, standards delay, affiliate fallback capture, workforce poaching, legal delay, or concession pressure. |\n| P-065 | T-022 | **ACTIVE** | Critical | CIP Vacancy-Starvation Hardening: appointment deadlines, fallback nomination, void mass appointments, below-quorum self-repair limits, publication-channel fallback, missed Ombuds-report suspension, conduct-only hollowing triggers, servant-authority and relief-first limits. |\n| P-066 | T-029 | **ACTIVE** | Critical | Commons Return and Universal Stake Fiscal Sustainability Gate: replaces routine progressive net-worth demurrage as active wealth spine, registers fiscal/debasement risk, requires costed public-finance model, source-base revenue testing, remaining-tax disclosure, incidence review, lockbox sufficiency, and scale-blocking fiscal adequacy gate. |\n| P-067 | T-030 | **ACTIVE** | Critical | Cyber Resilience and Availability Gate: registers ransomware, key-compromise, regional-outage, offline-continuity, supply-chain, and public-status failure as a distinct threat to survival-floor delivery. |\n| P-068 | T-031 | **ACTIVE** | Critical | Last-Resort Unenrolled Access Gate: registers the risk that a person who cannot enroll, hold a wallet, or use digital credentials still cannot reach the survival floor; requires no-credential, trusted-intermediary, analog-reconciliation, abuse/diversion, and dignity-interview tests before universality claims. |\n| P-069 | T-032 | **ACTIVE** | Critical | Monitoring Repurposing Gate: registers the risk that protective monitoring becomes surveillance or coercive control; requires purpose register, purpose-creep red team, linkability test, office-separation drill, individual-flag appeal drill, retention audit, and coercive-use scenario. |\n| P-070 | T-033 | **ACTIVE** | Critical | Founding Legitimacy Prerequisite Definition Gate: reconciles consent thresholds, defines admissible non-coercive consent evidence, defines independent civil-society reviewer qualification, and blocks Gate A until consent and review are independently evidenced. |\n| P-072 | T-025 | **PROPOSED** | High | Productive Status Register: one canonical \"productive\" determination shared by Flow issuance (ANNEX_X) and the Commons Return exemption (ANNEX_D \u00a7D3), with settle-forward escrow closing the temporal double-dip. Remains PROPOSED / pilot-gated until its evidence test passes; binds nothing until then. |\n| P-073 | structural \u2014 no threat row | **ACTIVE** | High | Framework-first intake (anti-accretion rule): FAP intake gate requiring any new mechanism to extend the most general existing instrument for its protective function or carry a published justification; published return record with adversarial-panel escalation; simplicity presumption bounded by independence count and protected-person path equivalence. Amends Acceptance_Protocol.md. |\n| P-074 | structural \u2014 no threat row | **ACTIVE** | High | Appeal Spine consolidation: ANNEX_L \u00a7L7 becomes the single canonical appeal procedure (one filing rule, floor + status-quo-ante continue during appeal, one ladder with the Ombuds Plenum kept separate for independence); seven scattered appeal procedures become spine pointers (with ANNEX_I's duplicate clocks and ANNEX_AI \u00a74.8's duplicate window deleted); the ANNEX_AW \u00a7AW3.3 orphan appeal window (RRE-011) is a named follow-up, not yet absorbed. First P-073-mandated consolidation of an entire mechanism family. |\n\n---\n\n## Reserved / Never-Assigned Patch IDs\n\nThese IDs do not appear in the inventory above. They are recorded here so a reader can distinguish a deliberately skipped number from a lost or missing patch. Mirrors the \"Retired and Reserved IDs\" table in the Threat Register.\n\n| Patch ID | Status | Reason |\n| :--- | :--- | :--- |\n| P-007 | **RESERVED** | Reserved at numbering; never assigned a patch. The threat work that would have occupied this slot was absorbed into adjacent patches before formal sequencing. No design exists under this ID. |\n| P-010 | **RESERVED** | Reserved at numbering; never assigned a patch. No design exists under this ID. |\n| P-028 | **RESERVED** | Reserved at numbering; never assigned a patch. The economic-governance integration that would have followed P-027 was consolidated into the P-029 through P-033 batch. No standalone design exists under this ID. |\n| P-063 | **DRAFT-ONLY** | Reserved for the P-063 v15 review packet. It is explicitly not corpus-registered, not adopted into Annex D, and not part of the active Patch Log inventory. |\n| P-071 | **RESERVED** | Reserved for the Harberger/COST shadow-assessment proposal (`docs/superpowers/specs/2026-06-09-commons-return-should-fixes-redline.md`), which is held as a proposal and not incorporated. The number is reserved so cross-references in the pending-proposal redlines stay stable; no design is incorporated under this ID. |\n\n---\n\n## P-029 through P-033 \u2014 Economic Governance Integration\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-029 | T-016 / public-funding architecture | **ACTIVE** | Critical | constitutional fiscal redesign |\n| P-030 | PRD-004 | **ACTIVE** | Critical | monetary + retail-finance boundary |\n| P-031 | PRD-009 | **ACTIVE** | Critical | ownership + succession + anti-circumvention |\n| P-032 | PRD-009 | **ACTIVE** | High | constitutional ownership standard |\n| P-033 | PRD-008 | **ACTIVE** | High | enterprise-preference and succession design |\n\n### P-029 \u2014 Public Finance & Commons Revenue (PFCR)\n\n**Constitutional text:** [ANNEX_X.md \u00a7 X8](../annexes/ANNEX_X.md)\n\n- **Introduced design:** replaces the former catch-all resilience funding model with a dedicated public-funding function. PFCR funds public operations through Commons Return source-base receipts, commons and land-use charges, scarce-license and gateway fees, and bounded public issuance tied to real public production.\n- **Clauses integrated:** no taxes on survival access, ordinary labor, or basic household exchange; public banking rails funded as infrastructure; postal-bank/public-bank option; anti-hidden-debt rules; source-by-source public reporting.\n- **Dependencies:** Commons Return source-base methodology, asset-equivalence review, gateway registry, and budget transparency stack.\n- **New risks introduced:** fiscal dependence on poorly calibrated Commons Return, source-base valuation, or gateway flows; naming disputes over what counts as a prohibited tax. Mitigated by judicial review trigger, source registry, and P-066 fiscal adequacy gate.\n\n### P-030 \u2014 Protocol-Only Money Creation and Household Finance Boundaries\n\n**Constitutional text:** [ANNEX_X.md](../annexes/ANNEX_X.md)\n\n- **Introduced design:** only protocol-authorized issuance bodies may create Flow or Flow-equivalent purchasing power. Private institutions may lend existing Flow, but may not create new Flow, deposit substitutes, or debt-expanded currency-like claims.\n- **Clauses integrated:** compounding interest prohibited on household ordinary-life debt; no securitization of survival-linked household claims; no revolving survival traps; public retail banking floor on the common rail.\n- **Dependencies:** retail-rail charter, prudential supervision of licensed providers, and public option continuity.\n- **New risks introduced:** shadow-credit attempts outside the chartered rail, and pressure to relabel hidden fees as service charges. Mitigated by common-rail enforcement and anti-equivalence review.\n\n### P-031 \u2014 Anti-Dynasty Ownership\n\n**Constitutional text:** [ANNEX_J.md \u00a7 R1\u2013R2](../annexes/ANNEX_J.md)\n\n- **Introduced design:** beneficial ownership always counts through to natural persons or mission-locked/community bodies. Perpetual trusts, shell chains, and equivalent structures may not preserve extractive control across generations.\n- **Clauses integrated:** family continuity protected in modest form, but dynastic landlordism, absentee succession structures, and perpetual extractive wrappers are prohibited.\n- **Dependencies:** beneficial-ownership registry, succession review rules, and housing / enterprise stewardship standards.\n- **New risks introduced:** harder succession planning for legitimate family continuity cases. Mitigated by explicit continuity allowances for homes, tools, dependents, and mission-locked stewardship bodies.\n\n### P-032 \u2014 Stewardship Ownership Standard\n\n**Constitutional text:** [ANNEX_J.md \u00a7 R1\u2013R2](../annexes/ANNEX_J.md)\n\n- **Introduced design:** ownership across land, housing, and enterprise is reframed as stewardship rather than a perpetual tribute right. Capital may be rewarded for risk and contribution, but not for endless passive extraction from necessity or labor.\n- **Clauses integrated:** bounded capital claims, anti-rent use-right logic, and judicially reviewable passive-extraction prohibitions.\n- **Dependencies:** housing and commons use-right enforcement, capital-instrument redesign, and ACC / anti-monopoly enforcement.\n- **New risks introduced:** valuation disputes around what counts as productive stewardship. Mitigated by published criteria, appeal paths, and mission-lock documentation.\n\n### P-033 \u2014 Worker-Owned and Mission-Locked Enterprise Preference\n\n**Constitutional text:** [ANNEX_J.md \u00a7 R1](../annexes/ANNEX_J.md)\n\n- **Introduced design:** worker-owned, cooperative, and mission-locked firms receive structural preference in PFCR-backed finance, procurement, retained-earnings treatment, worker buyout pathways, and founder-exit conversion rules.\n- **Clauses integrated:** natural monopolies moved to a separate regulated-utility track; outside capital claims must be capped, redeemable, sunset, or otherwise bounded.\n- **Dependencies:** procurement rules, cooperative finance tools, public venture / buyout facilities, and utility-governance charter.\n- **New risks introduced:** preferential treatment could be gamed by sham cooperatives. Mitigated by governance-proof requirements, payout constraints, and beneficial-ownership transparency.\n\n---\n\n### P-034 \u2014 Two-Key Architectural Precondition for Tier-1 Invariant Enforcement\n\n**Threat addressed:** T-016 / INV-007  \n**Audit finding:** PRD-001 / Phase 1 Article I adversarial audit; confirmed still open in Phase 4 follow-up check  \n**Status:** ACTIVE | **Priority:** Critical | **Annex:** AV (Acceptance_Protocol.md \u00a7Structural Precondition Gate)\n\n**Constitutional text:** [ANNEX_AV.md](../annexes/ANNEX_AV.md)\n\n**Problem diagnosed:**  \nThe prior INV-007 enforcement relied on a single FAP reviewer checking patch proposals against INVARIANTS.md before intake. This is a single point of failure: a captured, compromised, or mistaken reviewer can admit a Tier-1-touching proposal simply by not flagging the violation. The Beer VSM logic gate test (Phase 1) confirmed this: the normative model collapses to `defect \u2192 bypass` because the reviewer is both S3 (operational control) and the entire S3* (audit channel). A single captured actor voids all seven invariants simultaneously.\n\n**Introduced design \u2014 two-key architectural precondition (Annex AV):**\n- Any patch tagged `modifies_tier1=True` must carry cryptographic attestation from the standing adversarial panel member before FAP intake opens.\n- The FAP reviewer's authority is explicitly scoped to exclude the ability to waive or override the absence of attestation.\n- The adversarial panel member is nominated by the oppose-coalition body (AH2.3), not the founding coalition \u2014 structurally independent of FAP administration.\n- Defection penalty: improper admission attestation \u2192 permanent removal + forfeiture of seat to oppose-coalition nominating body + public defection finding. Honest attestation (including rejections) carries no penalty. The payoff matrix favors honest behavior.\n\n**Beer VSM fix:** S3* (adversarial panel attestation) is now structurally independent of S3 (FAP reviewer). Collapsing S3* into S3 is architecturally impossible \u2014 the adversarial panel member holds a key the FAP reviewer does not control.\n\n**Buterin incentive alignment fix:** Defection (improper admission) is costly (removal + public record). Honesty is safe. The reviewer incentive is also corrected: a reviewer who admits a proposal that lacks attestation has acted outside their authority \u2014 no benefit accrues, only liability.\n\n**Clauses integrated:** INV-007 mechanical boundary (amended), INVARIANTS.md \u00a7Invariant Violation Detection (precondition block added), Acceptance_Protocol.md \u00a7AV1\u2013AV6, Annex AV \u00a7AV7\u2013AV10 operational procedure.\n\n**Dependencies:** Adversarial panel member must be seated (per AH2.3) before any `modifies_tier1=True` proposal may be submitted. P-034 becomes operational the moment the adversarial panel member's key is registered.\n\n**New risks introduced:**\n- If the adversarial panel member seat goes vacant, no Tier-1-touching proposals can advance. Mitigated: vacancy is observable and not covert; it is a conservative failure mode (proposals stall, not wrongly admitted).\n- Oppose-coalition nominating body could itself be captured. Mitigated: AH2.3 qualifications exclude organizations with funding relationships with the founding coalition; three-year lookback applies.\n\n**Residual risk (acknowledged):** The adversarial panel member can be defected through external pressure not covered by the internal penalty structure (coercion, external blackmail). This is documented as a known residual rather than a resolved problem. Physical-world coercion cannot be fully eliminated by protocol design; conservative failure mode (panel member refuses to attest rather than attesting fraudulently) is the design target.\n\n## P-001 through P-004 \u2014 Core Convertibility Controls\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-001 | T-001 | **ACTIVE** | Critical | structural + behavioral detection + targeted enforcement. |\n\n### P-001 \u2014 Shadow Convertibility Containment\n\n**Constitutional text:** [ANNEX_AB.md \u00a7 AB2](../annexes/ANNEX_AB.md)\n\n- **Introduced design:** Essential Access-only channels, non-delegable redemption, context-locking where proportionate, anomaly detection, broker targeting, and an explicit leakage-tolerance concept.\n- **Clauses to integrate:** Essential Access Exclusivity, Non-Delegable Consumption, Leakage Tolerance, Broker-Focused Enforcement.\n- **Dependencies:** identity assurance, coercion reporting pathways, and sufficiently accurate essential-supply management.\n- **New risks introduced:** over-surveillance, false positives, user friction, and migration of abuse into proxy-identity channels.\n- **Residual risk:** small-scale favors and informal pooling remain acceptable if they do not scale into arbitrage infrastructure.\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-002 | T-004 | **ACTIVE** | Critical | economic + behavioral + contribution architecture. |\n\n### P-002 \u2014 Incentive System Stabilization\n\n**Constitutional text:** [ANNEX_AB.md \u00a7 AB3](../annexes/ANNEX_AB.md)\n\n- **Evidence package:** [Service Record Misuse Evidence Test Package](./Service_Record_Misuse_Evidence_Test_Package.md)\n- **Introduced design:** nonlinear reward curves, multi-channel rewards (Flow, civic standing, status/recognition), opportunity access, time/flexibility rewards, and anti-gaming contribution assessment.\n- **Clauses to integrate:** Incentive Nonlinearity, Multi-Channel Reward, Outcome-Based Contribution, Anti-Gaming Contribution.\n- **Dependencies:** identity attribution, contribution verification, and governance rules for how civic standing can matter without becoming coercive privilege.\n- **New risks introduced:** status hierarchy, burnout optimization, and domain bias toward easier-to-measure work.\n- **Residual risk:** optimization behavior remains, but the design goal is to align it with contribution rather than suppress it.\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-003 | T-002 | **ACTIVE** | Critical | structural + security + continuity protection. |\n\n### P-003 \u2014 Identity System Hardening\n\n**Constitutional text:** [ANNEX_AB.md \u00a7 AB4](../annexes/ANNEX_AB.md)\n\n- **Evidence package:** [Identity and Recovery Evidence Test Package](./Identity_Recovery_Evidence_Test_Package.md)\n- **Introduced design:** four assurance tiers (survival floor, provisional, core, civic activation), multi-evidence thresholding, no single universal credential, hardened recovery, anti-Sybil controls, and no-survival-lockout under uncertainty.\n- **Clauses to integrate:** Identity Adversarial Reality, Differential Assurance, Recovery Safety, No Master Credential, Identity Failure Continuity.\n- **Dependencies:** appeals architecture, ombuds/advocate pathways, and clear separation between verification and monitoring.\n- **New risks introduced:** complexity, onboarding friction, and slower recovery for legitimate edge cases if poorly implemented.\n- **Residual risk:** low-level fraud remains possible and should be contained rather than denied in theory.\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-004 | T-007 | **ACTIVE** | Critical | governance + constitutional anti-capture control. |\n\n### P-004 \u2014 Definition Drift Protection\n\n**Constitutional text:** [ANNEX_AB.md \u00a7 AB5](../annexes/ANNEX_AB.md)\n\n- **Introduced design:** protected term classes, semantic effect test, worked-example requirement, public definition registry, upward classification default, and anti-laundering control across code, vendor, and standards layers.\n- **Clauses to integrate:** Definition Integrity, Semantic Effect, Upward Classification Default, Worked Example Requirement, Definition Registry, Anti-Laundering.\n- **Dependencies:** classification authority, change-control process, and review capacity.\n- **New risks introduced:** process friction, slower iteration, and semantic bureaucracy if overbuilt.\n- **Residual risk:** subtle drift can still occur unless registry, examples, and challenge windows are actually used.\n\n---\n\n## P-005 through P-012 \u2014 Governance and Operational Resilience\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-005 | T-005 | **ACTIVE** | Critical | structural + procedural + monitoring |\n\n### P-005 \u2014 Governance Throughput Hardening\n\n**Constitutional text:** [ANNEX_AC.md \u00a7 AC1](../annexes/ANNEX_AC.md)\n\n- **Change type:** structural + procedural + monitoring.\n- **Introduced design:** CRP dual-queue separation (constitutional vs. operational); minimum operational throughput floor (5 priority decisions per quarter, non-blockable by constitutional challenges); sequential emergency re-declaration cap (2 consecutive quarters max, requires independent audit and public justification to extend); intake throttle with priority scoring (impact \u00d7 urgency \u00d7 reversibility; Voice-signal for urgency; overflow is public); cross-quarter interim authorization bridge (Ombuds + 1 rotating CRP member + regional exec; scope-locked to emergency declaration; provisional only; cannot narrow Essential Access access or touch constitutional matters); decision quality audit metrics (alternatives-presented ratio, reversal rate, minority dissent rate); [Ambitious] real-time throughput dashboard with auto-escalation trigger.\n- **Clauses to integrate:** CRP Dual-Queue Separation; Minimum Throughput Floor; Sequential Emergency Cap; Intake Throttle and Priority Scoring; Cross-Quarter Interim Bridge; Decision Quality Metrics. See Annex AC1.\n- **Dependencies:** Annex L (CRP sub-panel composition); Annex T (simulation mandate extension); Article V compliance matrix; Level 3\u20134 emergency cascade table.\n- **New risks introduced:** Operational sub-panel capture if composition predictable; interim bridge scope creep; priority scoring gaming; [ambitious] throughput dashboard exposure of vulnerability windows (mitigated by 48-hour publication lag).\n- **Residual risk:** Throughput theater remains hard to detect. Patient actor can operate within throughput floors while maintaining effective paralysis through distributed delay across proposals.\n- **Compound linkages:** T-005 \u00d7 T-006 (PCRP window synchronization); T-005 \u00d7 T-008 (PCRP authority as new power locus); T-005 \u00d7 T-001 (paralysis extends cadence exploit windows).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-006 | T-006 | **ACTIVE** | Critical | structural + authority definition + measurement architecture |\n\n### P-006 \u2014 Measurement Lag and Supply Shock Hardening\n\n**Constitutional text:** [ANNEX_AC.md \u00a7 AC2](../annexes/ANNEX_AC.md)\n\n- **Change type:** structural + authority definition + measurement architecture.\n- **Introduced design:** Sentinel indicator mandate \u2014 every slow-audit essential category requires a faster low-fidelity signal; max lag by volatility class (48h high / 7d medium / 30d low). Pre-Confirmation Response Protocol (PCRP) \u2014 defined first-responder authority (Regional Executive Body, joint activation); permitted: 70% above-baseline issuance reduction, reserve release, expedited oracle review (survival floor issuance stays 100%); prohibited: full Shared Storehouse, survival floor narrowing, other categories, beyond 72h without oracle confirmation; false-trigger tracking \u2014 3 false activations per 4 quarters triggers mandatory independent audit. Shared Storehouse unwind symmetry \u2014 recovery fast-track mirrors PCRP; conservative bias applies to activation, not prolonged restriction after recovery. Cadence-adjusted U8 bridge \u2014 48-hour trigger for high-volatility categories; 7-day retained for medium-volatility. [Ambitious] Essential Access redemption velocity as native sentinel (150% spike threshold). [Ambitious] Cross-category demand surge detector.\n- **Clauses to integrate:** Sentinel Indicator Mandate; PCRP; PCRP Scope Definition (protected term under P-004); Shared Storehouse Unwind Symmetry; Cadence-Adjusted U8 Bridge. See Annex AC2.\n- **Dependencies:** Regional Executive Body formally constituted with joint-activation rules. Essential Access ledger redemption velocity in privacy-preserving aggregate form. Annex M extended with cadence floors. Annex U8 modified.\n- **New risks introduced:** PCRP soft-power weaponization; two-source corroboration gaming; recovery fast-track exploit via manufactured sentinel signals; [ambitious] Essential Access velocity oracle suppression gaming (mitigated by anomaly detection on suppression patterns).\n- **Residual risk:** Inter-cycle gap is compressed not eliminated. 'Supply shock' must be a protected term under P-004 with worked examples to prevent scope creep.\n- **Compound linkages:** T-006 \u00d7 T-001 (cadence windows = black market opportunity); T-006 \u00d7 T-005 (PCRP window synchronization); T-006 \u00d7 T-008 (PCRP authority at REB = elite formation risk).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-008 | T-008 | **PROPOSED** | High | structural + measurement + institutional design |\n\n### P-008 \u2014 Bureaucratic Elite Formation Hardening\n\n**Constitutional text:** [ANNEX_AC.md \u00a7 AC3](../annexes/ANNEX_AC.md)\n\n- **Status basis:** **PROPOSED.** P-008 is designed but was not accepted as the operative authority for T-008. P-025 (Federated Ombuds constitution) supersedes it and is the live ACTIVE control \u2014 see SPECIFICATIONS.md \u00a74.3, which records that P-008 is PROPOSED and P-025 is the operative ACTIVE authority for the 20% sector ceiling. The legibility-audit, diversity, verification-independence, and cohort-cooling designs below are retained as design reference; their operative enforcement runs through P-025.\n- **Evidence package:** [Service Record Misuse Evidence Test Package](./Service_Record_Misuse_Evidence_Test_Package.md)\n- **Change type:** structural + measurement + institutional design.\n- **Introduced design:** Legibility gap audit \u2014 quarterly Article VI reporting tracks verification approval rate, evidence burden, appeals rate, and abandonment rate by contribution category; 20-point disparity triggers independent process audit (not by incumbent verifier pool). Service Record sector ceiling specification mandate \u2014 max 25% per sector, max 35% per identifiable institutional-origin cluster in any Service Record-governed service pool; specified at founding as precondition under Annex N. Epistemic diversity requirement \u2014 three-axis standard (institutional origin \u226430%, contribution-type diversity \u226530% informal/care, geography \u226525% non-urban-dense) for all oversight bodies >5 members; pool design requirement. Verification independence rule \u2014 verifiers cannot review claims in own primary contribution category; applies to mid-range and above claims. Cooling-off cohort rule \u2014 cohort tracking by Ombuds Office; max 2 cohort members sharing review authority over same subject simultaneously. [Ambitious] Qualification standard governance \u2014 competence criteria added to P-004 protected terms registry; standard-setting body must include \u226540% from non-qualifying backgrounds. [Ambitious] Real-time concentration dashboard.\n- **Clauses to integrate:** Legibility Gap Audit; Service Record Sector Ceiling Specification (founding precondition Annex N); Epistemic Diversity Requirement; Verification Independence Rule; Cooling-Off Cohort Rule; Qualification Standard Governance (P-004 extension); Concentration Dashboard. See Annex AC3.\n- **Dependencies:** Service Record sector ceilings specified at founding (pre-CRP constitution). Article VI U7 extended for verifier category independence. P-004 protected terms registry extended. Pool-depth health metrics added to Article VII.\n- **New risks introduced:** Epistemic diversity pool-depth constraint interacts with P-005 throughput vulnerability. Verification independence adds legitimate friction to high-impact claims. Cohort tracking system is a power locus if Ombuds Office itself captured. [Ambitious] concentration dashboard gaming below thresholds (mitigated by 30-day data lag).\n- **Residual risk:** Class formation through informal social networks has no hard control. Open question: Ombuds Office carries three load-bearing functions (cohort tracking, legibility audit, diversity certification) \u2014 if Ombuds becomes an elite formation site all three are compromised. Who audits the auditors of elite formation?\n- **Compound linkages:** T-008 \u00d7 T-011 (elite formation creates narrative attack surface; P-008 dashboard provides defense evidence base); T-008 \u00d7 T-005 (PCRP authority concentration); T-008 \u00d7 T-006 (PCRP regional bodies subject to elite formation).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-011 | T-011 | **ACTIVE** | Critical | communication architecture + transparency + pre-commitment |\n\n### P-011 \u2014 Narrative Attack Surface Hardening\n\n**Constitutional text:** [ANNEX_AD.md](../annexes/ANNEX_AD.md)\n\n- **Change type:** communication architecture + transparency + pre-commitment doctrine.\n- **Introduced design:** Rapid Public Communication Protocol (RPCP) \u2014 4-hour structured template for any public-visibility operational event; covers what happened, system response, access status, next steps; does not replace 7-day post-mortem; pre-authorized publication authority required. Pre-committed failure communication doctrine \u2014 published pre-launch document acknowledging expected failures (PCRP false triggers, oracle disputes, Shared Storehouse activations, enforcement errors, measurement uncertainty) with containment mechanisms; converts failures from surprises to acknowledged expected events. Citizen-Facing Rights Layer (CFRL) \u2014 one page, 8th-grade level, pre-launch, translated; governed as P-004 protected specification. Adversarial Narrative Simulation \u2014 added to Annex T annual mandate; hostile framing team publishes simulated attack; system responds within 4 hours; report published. Hostile Frame Pre-emption Registry \u2014 top 10 mischaracterizations with accurate rebuttals and Article VII evidence; updated quarterly; published as 'Common Misunderstandings.' [Ambitious] Narrative Health Dashboard \u2014 public understanding accuracy surveys, hostile framing prevalence index, RPCP response time metric; Level 1 watch auto-trigger. [Ambitious] Pre-Launch Narrative Audit \u2014 independent adversarial audit by communications professionals; findings and mitigations published simultaneously.\n- **Clauses to integrate:** RPCP; Pre-Committed Failure Doctrine; CFRL (P-004 protected spec); Adversarial Narrative Simulation (Annex T extension); Hostile Frame Registry. See Annex AD.\n- **Dependencies:** Operative elite-formation controls are prerequisite for elite formation narrative rebuttal \u2014 these run through P-025 (ACTIVE), the operative authority for T-008, since P-008 is PROPOSED. Article VII infrastructure must support 4-hour publication SLA. White Paper sync required before launch (AD6). CFRL added to P-004 protected terms registry.\n- **New risks introduced:** Pre-committed failure document weaponized to prime failure expectation \u2014 mitigated by simultaneous publication of containment mechanisms. CFRL creates false certainty \u2014 mitigated by 'Humane Constitution governs' disclaimer. ANS report as hostile playbook \u2014 mitigated by publishing after exercise completion. Hostile frame registry amplifies framings \u2014 mitigated by 'common misunderstandings' framing.\n- **Residual risk:** Narrative defense is bounded by actual system performance. No communication architecture survives sustained failure. Pre-launch framing window (18+ months before launch) cannot be closed by protocol \u2014 only by early CFRL and pre-commitment doctrine deployment.\n- **Compound linkages:** T-011 \u00d7 T-008 (elite formation is factual hook for 'captured by professionals' narrative; P-008 concentration dashboard is the counter-narrative evidence base). T-011 \u00d7 T-006 (PCRP false triggers are the highest-visibility predictable failure). T-011 \u00d7 T-005 (governance paralysis generates narrative events).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-012 | T-012/013/014/015 | **ACTIVE** | Critical | structural + protocol + measurement |\n\n### P-012 \u2014 Interface Hardening and Deadlock Prevention\n\n**Constitutional text:** [ANNEX_AE.md \u00a7 AE2.1\u2013AE2.4](../annexes/ANNEX_AE.md)\n\n- **Change type:** structural + protocol + measurement architecture.\n- **Introduced design:** PCRP oracle independence requirement \u2014 two-source corroboration must use structurally independent measurement systems; manipulated oracle counts as one source regardless of downstream channels; single-source PCRP activates at reduced scope with Ombuds co-certification. Categorical throughput minimums \u2014 P-005 floor amended from single aggregate to 5 categorical minimums (identity, supply, enforcement, governance, unreserved); single category capped at 3 of 5 slots. Emergency deadlock resolution protocol \u2014 auto-declaration when mandatory decision is blocked by 2+ valid processes; 3-member arbitration panel within 6 hours; survival floor bridge unconditional; scope freeze; mandatory root-cause review. Demand-context flag for Essential Access velocity oracle \u2014 discount applied during Flow enforcement actions, mass re-verification campaigns, or regional defection; Ombuds co-certification required for PCRP. RPCP contested-status template \u2014 separates physical event from legal characterization during active CRP review. Cumulative procedural drift trigger \u2014 extends P-004 to 20 Tier 3 decisions in 8 quarters reducing Tier 2/1 decision space; triggers mandatory CRP cumulative review.\n- **Clauses to integrate:** AE2.1\u2013AE2.6. Amends AC1.2 (throughput floor), AC2.2 (PCRP), AD1 (RPCP), AB5 (P-004 drift).\n- **Dependencies:** operational demand-context register (new data feed); RPCP contested-status template library extension; CRP cumulative review procedure.\n- **New risks introduced:** Deadlock panel engineered as bypass route \u2014 bad actors deliberately trigger triple-block to force panel arbitration. Demand-context flag delays legitimate PCRP during enforcement periods. Categorical floor gaming \u2014 proposals reframed to occupy minimum category slots. Cumulative drift review weaponized against legitimate operational evolution.\n- **Residual risk:** Second-generation deadlock has no defined resolution beyond Level 5 structural review. T-009 (Grace Exploitation Loop) remains OPEN and is the next hardening target.\n- **Compound linkages:** All of T-012/013/014/015 inter-linked through PCRP, throughput floor, and deadlock protocol.\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-009 | T-009 | **ACTIVE** | Med-High | behavioral + verification + structural |\n\n### P-009 \u2014 Grace Exploitation Loop Hardening\n\n**Constitutional text:** [ANNEX_AF.md](../annexes/ANNEX_AF.md)\n\n- **Evidence package:** [Service Record Misuse Evidence Test Package](./Service_Record_Misuse_Evidence_Test_Package.md)\n- **Change type:** behavioral + verification architecture + structural.\n- **Introduced design:** Graduated renewal intensity \u2014 first activation lightweight; first renewal structured; second renewal mid-intensity with support service confirmation; third+ renewal high-intensity independent panel. All qualifying hardship approved under any standard. Cross-quarter history review \u2014 full pause history assessed at every renewal; category switching flagged for elevated scrutiny at next renewal. Hardship attestation collusion detection \u2014 P-002 analytics extended to hardship networks; detects mutual pairs, star clusters, temporal clustering; community-disaster safe harbor for 2 quarters on oracle-verified regional emergency. Service Record slow-decay at 20% of normal rate during pause \u2014 Voice freeze unchanged; 4-quarter pause produces ~8% Service Record loss (negligible); 12-quarter rotation produces ~22% loss (drains high-impact threshold). Service pool pause-saturation monitoring \u2014 >20% simultaneous pause triggers pool-health alert and review; never bars individual activation. [Ambitious] Capability development pathway \u2014 up to 15% quarterly Service Record earnable through pause-appropriate stewardship during pause. [Ambitious] T-009 \u00d7 P-008 explicit closure \u2014 paused cohort members count toward P-008 cohort cooling concurrent maximum; active members accommodate, not paused person.\n- **Clauses to integrate:** AF1\u2013AF7. Annex K4 amended (graduated renewal; Service Record slow-decay). P-002 analytics extended (AF3). AC3.5 amended (AF7). Article VII dashboard extended (AF5).\n- **Dependencies:** P-002 collusion analytics infrastructure extended to hardship attestation graph. Service Record slow-decay rate requires Article VI / Annex K4 protocol-level calibration. P-011 CFRL must communicate graduated renewal clearly before launch. [Ambitious] P-004 registry: 'pause-appropriate stewardship' as protected term. [Ambitious] P-008 AC3.5 amended per AF7.\n- **New risks introduced:** Graduated renewal deters genuine long-term hardship if perceived as punitive \u2014 mitigated by CFRL communication and calibration. Service Record slow-decay may deter activation \u2014 mitigated by clear communication and negligible 4-quarter loss. Community-disaster safe harbor exploitable by manufactured disaster claims \u2014 mitigated by oracle verification requirement. Pool saturation monitoring creates perverse incentive against legitimate pause at bad timing \u2014 mitigated by review-only trigger.\n- **Residual risk:** Involuntary unemployment category remains most exploitable \u2014 disproof requires intrusive investigation incompatible with non-surveillance commitment. Accept as contained leakage: graduate renewal intensity is the best available control. Low-level 1-2 quarter grace exploitation is acceptable system leakage \u2014 the cost of genuinely frictionless access for legitimate hardship.\n- **Compound linkages:** T-009 \u00d7 T-008 (primary bypass route for P-008 controls \u2014 AF7 addresses it at design level; evidence remains pending); T-009 \u00d7 T-011 (graduated renewal must be communicated through CFRL or becomes narrative attack surface).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-013 | T-016 | **ACTIVE** | Critical | structural + governance + audit architecture |\n\n### P-013 \u2014 Formal Acceptance Process Integrity\n\n**Constitutional text:** [ANNEX_AG.md](../annexes/ANNEX_AG.md)\n\n- **Change type:** structural + governance + audit architecture.\n- **Introduced design:** Pilot representativeness standard \u2014 pilot region requires published 4-dimension assessment; >1 favorable dimension requires second stress-tested region; single favorable region = PILOT only, not ACTIVE. Deadlock resolution timeline \u2014 30d negotiation, 60d published mediation, day 61 CRP binding ruling (14-day SLA); substitute review if CRP is party. Audit epistemic independence \u2014 4-year institutional affiliation bar; domain-diversity requirement; adversarial audit member for I=5 patches (multi-member team, no veto). Anti-gaming constitutional upgrade \u2014 evidence waiver prohibition reclassified Tier 2; urgency bypass now requires H-2 amendment process. Stagnation documentation quality \u2014 3-question review (accurate? progress? resolvable?); structural obstacles trigger bootstrap review not continued documentation. [Ambitious] Bootstrap Resolution Protocol \u2014 minimum viable bootstrap micro-patch for circular dependencies; 2-authority expedited sign-off; auto-sunset; P-008 legibility gap audit as first bootstrap candidate. [Ambitious] FAP concentration controls \u2014 cohort cooling on sign-off cluster; audit body meets AC3.3 diversity standard; independent Article VII monitoring (not Ombuds-managed).\n- **Clauses to integrate:** AG1\u2013AG7. FAP document amended directly. Anti-gaming rules reclassified Tier 2 (H-2 required for amendment). Representativeness criteria added to P-004 protected terms registry.\n- **Dependencies:** P-005 categorical floor extended to include FAP deadlock resolution slot. P-004 protected terms registry extended for representativeness criteria. P-008 AC3.3 epistemic diversity standard referenced for audit body. Article VII AC3.7 concentration dashboard extended for FAP sign-off cluster. Independent concentration monitoring (not Ombuds) required before FAP becomes operative.\n- **New risks introduced:** Two-region pilot requirement increases cost and time; 'close enough' stress-tested region designation risk (mitigated by published representativeness assessment). 60-day deadlock window creates operational gap (mitigated by Annex C-6 emergency patching remaining available as separate pathway). Adversarial auditor produces hostile reports (mitigated by multi-member team). [Ambitious] Bootstrap micro-patch normalized as general bypass channel (mitigated by 2-authority sign-off, survival floor requirement, auto-sunset). [Ambitious] FAP concentration controls risk infinite regress (mitigated by self-executing Article VII publication).\n- **Residual risk:** Evidence farming in stress-tested pilot region remains possible if representativeness assessment criteria are gamed at the definition stage \u2014 criteria require P-004 protection. Deadlock resolution creates new CRP workload at day 61; if CRP is congested (T-005 risk), the deadline may not be met \u2014 P-005 categorical floor must include FAP deadlock as a guaranteed slot. At root: the FAP cannot be made exploitation-proof without being made unusable. P-013 accepts this and chooses calibrated friction over either extreme.\n- **Compound linkages:** T-016 \u00d7 T-005 (deadlock resolution congests CRP; P-005 floor must accommodate). T-016 \u00d7 T-008 (audit capture via intellectual-cousin exploit \u2014 mitigated by AG3). T-016 \u00d7 T-011 (stagnation of critical patches is narrative attack: 'the system cannot fix itself').\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-014 | T-017 | **ACTIVE** | Critical | founding governance + one-time exception |\n\n### P-014 \u2014 P-013 Bootstrap Activation (One-Time Founding Instrument)\n\n**Constitutional text:** [ANNEX_AH.md \u00a7 AH1\u2013AH7](../annexes/ANNEX_AH.md)\n\n**Special status.** P-014 is not a standing patch. It is a one-time founding instrument. It has no standing effect after P-013 reaches ACTIVE. It closes permanently upon P-013 activation.\n\n- **Nature:** One-time founding instrument, not a standing patch. Closes permanently upon P-013 ACTIVE.\n- **Change type:** founding governance + constitutional one-time exception.\n- **Introduced design:** 5-stage process: (1) Pre-activation disclosure \u2014 60-day minimum public challenge window (extended by P-020; see ANNEX_AH.md \u00a7AH2); circular dependency analysis published; founding exception statement from Threat Register Owner; panel composition disclosed before sign-off. (2) Heightened 5-member panel \u2014 Threat Register Owner, 1 CRP reserve member (lot-drawn, not involved in P-013 design), 1 external systems reviewer from outside design-team domain, 1 Ombuds officer, 1 public-interest advocate (lot-drawn). All attest no 5-year affiliation with design team (externally verified). Adversarial member required; dissent published. 4/5 votes required. (3) Substitute evidence \u2014 desk review of 3+ real-world analogue cases; adversarial red-team analysis; scope-limitation certification; sunset compatibility check. (4) Activation and permanent sealing \u2014 P-013 ACTIVE; P-014 closes permanently; full activation record published; non-precedent statement embedded with Tier 2 protection; P-006 and P-009 immediately enter the Formal Acceptance Protocol pilot stage. (5) Post-activation audit within 90 days \u2014 using P-013's own now-operative standards; adversarial member required; if compromised \u2192 P-013 suspended and re-submitted through the now-operative Formal Acceptance Protocol.\n- **Non-precedent statement (Tier 2 protected):** 'P-014 was invoked once, for P-013 only, because no other process was available. It may not be cited as authority for any future activation, exception, or urgency bypass. Any invocation of P-014 logic for any purpose requires H-2 amendment process.'\n- **Clauses to integrate:** AH1\u2013AH7. Annex N/U2 as constitutional anchor.\n- **New risks introduced:** Founding panel subject to capture during pre-activation window (mitigated by 60-day minimum disclosure, lot-drawing, external conflict verification, adversarial member, and the Founding Legitimacy Dossier). Post-activation audit finding of compromise suspends P-013 \u2014 creates a window where the Formal Acceptance Protocol is operative but its governing patch is suspended (mitigated by the prior Formal Acceptance Protocol fallback during suspension; suspension published immediately). Pre-activation disclosure creates a hostile narrative window (mitigated by framing as transparency demonstration).\n- **Residual risk:** Desk review cases may be selected to confirm rather than challenge P-013 \u2014 adversarial member's case selection is the primary control; cases published for independent scrutiny. Second-order self-reference if post-activation audit finds compromise \u2014 accepted as less circular than the original bootstrap problem.\n- **Auto-close clause:** P-014 closes permanently upon P-013 ACTIVE status. No re-opening, no emergency extension, no analogical application. This clause is Tier 2 protected.\n- **Compound linkages:** T-017 \u00d7 T-016 (bootstrap paradox is the exploit surface T-016 bad actors use for indefinite delay of P-013). T-017 \u00d7 T-011 (bootstrap paradox is a narrative attack surface \u2014 P-014 pre-activation disclosure converts it into a transparency demonstration).\n\n---\n\n## P-013 through P-025 \u2014 Founding Mechanics and Attack Surface Closure\n\n*Red-team hardening cycle. Addresses T-018 through T-023 and closes residual risks identified in T-001, T-002, T-017, and the register's own operational security posture.*\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-015 | T-018 / T-019 | **ACTIVE** | High | structural + protocol + escalation path |\n\n### P-015 \u2014 PCRP Attack Surface Hardening\n\n**Constitutional text:** [ANNEX_AP.md](../annexes/ANNEX_AP.md)\n\n- **Change type:** structural + protocol + escalation path.\n- **Addresses:** T-018 (False-Trigger Exhaustion Attack), T-019 (Demand-Context Flag Suppression Attack).\n- **Introduced design:**\n  - *False-trigger escalation path (T-018):* False PCRP triggers accompanied by oracle manipulation evidence or coordination timing signatures do not count toward the 3-trigger audit cap \u2014 they escalate immediately to the enforcement track with formal investigation. Cap reset is available via independent audit finding of deliberate manipulation. A \"trigger exhaustion alert\" fires when 2 of 3 cap slots are consumed within a single quarter, prompting pre-emptive review before the third activation.\n  - *Demand-context manufactured flag assessment (T-019):* Ombuds co-certification during demand-context periods must include an explicit assessment of whether the triggering enforcement action was manufactured or strategically timed; this assessment is a required step with a defined 4-hour timeline, not an optional judgment. A cross-register timing monitor flags any enforcement action initiated within 48 hours of sentinel indicator movement \u2014 this does not block the enforcement action but elevates scrutiny on any resulting demand-context flag. If Ombuds finds deliberate flag manufacture, the demand-context designation is lifted and PCRP activation proceeds at standard scope.\n  - *Ombuds constitution pre-condition:* Annex AI (Federated Ombuds constitution) specifies explicit authority, decision criteria, and the 4-hour determination timeline for manufactured-flag assessments. **Annex AI is a pre-launch blocking gate \u2014 P-015 is not operative until at least four of five sub-Ombuds are appointed, challenged, and seated, and the Ombuds Oversight Assembly is seated.**\n- **Clauses to integrate:** AP1\u2013AP4. Amends AC2.3 (false-trigger cap rules). Amends AE2.4 (demand-context Ombuds certification procedure). See Annex AI for full Ombuds mandate and independence requirements.\n- **Dependencies:** Federated Ombuds formally constituted per Annex AI (at least four of five sub-Ombuds seated, Oversight Assembly seated, manufactured-flag criteria published). P-006 PCRP false-trigger tracking infrastructure operative. P-012 demand-context flag register operative. Cross-register timing monitor (Annex AI Section 3.3) technically implemented and tested.\n- **New risks introduced:** False-trigger escalation path can be weaponized in reverse \u2014 a genuine false trigger attributed to manipulation to avoid the audit cap. Mitigated by: escalation requires two independent evidence types (oracle manipulation evidence AND timing cluster), not a single officer judgment. Manufactured-flag assessment timeline (4 hours) creates pressure that could produce errors; mitigated by conservative default (maintain demand-context designation while assessment runs, but PCRP can activate at reduced scope with single-source authorization).\n- **Residual risk:** Real-time distinction between genuine oracle failure and engineered false trigger remains unreliable; escalation path applies retroactively. Low-level demand-context flag suppression using a genuinely valid enforcement action remains possible \u2014 accepted as operational leakage below detection threshold.\n- **Compound linkages:** T-018 \u00d7 T-019 (compound PCRP attack \u2014 both simultaneously executed is highest-risk scenario; P-015 must address the compound case explicitly). T-018 \u00d7 T-013 (audit load from false-trigger investigation consumes CRP capacity).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-016 | T-002 | **PROPOSED** | Critical | constitutional commitment + quantified doctrine |\n\n### P-016 \u2014 Identity Asymmetric Error Doctrine\n\n**Constitutional text:** [ANNEX_AK.md](../annexes/ANNEX_AK.md)\n\n- **Change type:** constitutional commitment + quantified doctrine.\n- **Status basis:** **PROPOSED / pre-ratification** for deploy-state; **designed, needs evidence** for maturity. Annex AK is incorporated as the live design candidate, but P-016 is not evidence-backed and not ratified into a founding until the founding coalition adopts the doctrine, confirms pilot-calibrated rates, and binds remaining FC values.\n- **Addresses:** T-002 \u2014 calibrating fraud tolerance without making the system unusable for vulnerable populations. Extends P-003.\n- **Introduced design:** The founding coalition must publish and formally adopt an **Asymmetric Error Doctrine** (AED) as a Tier 2 founding commitment before deployment. The AED must specify:\n  - (a) Maximum acceptable fraud rate per instrument tier (Essential Access, Voice, Service Record) \u2014 expressed as a percentage of enrolled population per quarter, with confidence interval.\n  - (b) Maximum acceptable exclusion rate for vulnerable populations (displaced, undocumented, digitally fragile persons) per tier \u2014 expressed as a percentage of estimated vulnerable population.\n  - (c) The review trigger when either rate is exceeded \u2014 automatic publication and independent audit within 30 days.\n  - (d) The decision rule when the two error types trade off: when reducing fraud exclusion would increase vulnerable-population exclusion by more than a specified ratio, the exclusion reduction takes priority unless the fraud rate exceeds a specified ceiling.\n  - (e) Annual recalibration review by an independent panel with at least one member from a vulnerable-population advocacy organization.\n- **Clauses to integrate:** AK1\u2013AK5. Annex B (identity architecture) extended. AED added to P-004 protected terms registry. Founding preconditions checklist extended (Annex N).\n- **Dependencies:** Identity system operational data required for calibration. AED is therefore a Tier 2 design commitment at founding: FC-140 through FC-145 have bound starting values, FC-146 through FC-150 remain pre-launch commitments, and all values must be tested before scale-up. The commitment to publish and honor the doctrine is the founding obligation; passing the evidence gates is the scale-up obligation.\n- **New risks introduced:** Quantified targets create goodhart's-law gaming \u2014 operators optimize to the metric rather than the underlying goal. Mitigated by: AED specifies both rates and requires independent measurement (not self-reported). Published targets also create narrative attack surface (\"the system allows X% fraud\"). Mitigated by: pre-committed publication converts this from a vulnerability into a transparency demonstration consistent with P-011.\n- **Residual risk:** Some exclusion is structurally unavoidable with any identity system. The AED does not solve this; it makes the trade-off explicit and governable rather than implicit and subject to political manipulation.\n- **Compound linkages:** T-002 \u00d7 T-011 (AED publication is a narrative attack surface \u2014 simultaneously the correct response). T-002 \u00d7 T-008 (vulnerable population exclusion rates must be tracked independently from the same bodies that operate the identity system \u2014 Ombuds Office or equivalent).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-017 | T-020 / T-021 | **ACTIVE** | Critical | measurement architecture + accreditation + supply-chain transparency |\n\n### P-017 \u2014 Oracle Epistemological and Algorithmic Independence\n\n**Status: ACTIVE (promoted 2026-04-18 via Proposal 3 close-out).** Numerical floors bound in `/founding/commitments.md` FC-030 (N\u22655), FC-031 (\u22653 methodology classes), FC-032 (pairwise correlation \u22640.30), FC-033 (\u22651 adversarial seat), FC-100 (14-day quorum-loss restoration window). Annex AL promoted to ACTIVE with its former founding-parameter slots fully bound.\n\n**Constitutional text:** [ANNEX_AL.md](../annexes/ANNEX_AL.md)\n\n- **Change type:** measurement architecture + accreditation standards + supply-chain transparency.\n- **Addresses:** T-020 (Epistemological Oracle Capture), T-021 (Algorithmic Oracle Capture).\n- **Introduced design:**\n  - *Methodology-class diversity mandate (T-020):* RCS accreditation must include at least one measurement node per high-volatility essential category using a fundamentally different methodology class (e.g., community-based participatory research vs. institutional statistical modeling vs. independent physical sampling). The specific methodology classes are defined as a P-004 protected term (Annex AL \u2014 \"methodology class\" definition with worked examples).\n  - *Methodological divergence signal (T-020):* Systematic divergence between methodology classes is a first-order sentinel indicator requiring investigation, not an anomaly requiring suppression. A divergence above a defined threshold triggers an independent methodological review before that category can be used for Shared Storehouse activation.\n  - *Standards-funding transparency (T-020):* Any RCS-accredited node must disclose funding sources for the methodological standards it relies on, with a three-year lookback. Funding from parties with material interest in oracle outputs triggers additional scrutiny.\n  - *Anti-monoculture review trigger (T-020):* If three or more oracle nodes rely on the same standards body for a given category, an independent methodological review is required before that category can be used for Shared Storehouse activation.\n  - *AI supply chain transparency (T-021):* Any oracle node using ML or AI components must disclose model provenance, training data sources, and any shared upstream dependencies with other oracle nodes. This disclosure is published and part of the independence certification.\n  - *Algorithmic independence certification (T-021):* Oracle independence audit must include explicit verification that no two corroborating oracle nodes share a common upstream AI model, training dataset, or fine-tuning pipeline, and that formally independent nodes are not producing same-direction material errors that evade FC-032 pairwise-correlation checks.\n  - *Physical ground-truth requirement (T-021):* At least one measurement node per high-volatility category must use direct physical sampling (not model-derived estimates) as its primary measurement method.\n- **Clauses to integrate:** AL1\u2013AL7. Annex M (oracle architecture) extended. \"Methodology class\" and \"algorithmic independence\" added to P-004 protected terms registry per Annex AL. RCS accreditation standards document updated.\n- **Dependencies:** Annex AL (methodology-class definitions) published and initial methodology-class registry populated before first oracle set is accredited. **Annex AL is a pre-launch blocking gate \u2014 P-017 is not operative until the methodology-class registry is published and the standards-body concentration tracking system is built.** P-004 protected terms registry must be operative. Oracle independence audit capacity must include algorithmic supply chain review \u2014 new capability requirement. Physical sampling for high-volatility categories requires resource commitment from founding coalition.\n- **New risks introduced:** Methodology-class diversity requirement increases oracle system cost and coordination complexity. Physical sampling is expensive; cost pressure may produce under-investment that weakens the ground-truth requirement over time \u2014 addressed by Article VII publication of sampling frequency and method per category. AI supply chain disclosure creates competitive sensitivity concerns for oracle node operators \u2014 mitigated by: disclosure is to auditors, not publicly; methodology-level information is published but not proprietary implementation details.\n- **Residual risk:** Defining \"fundamentally different methodology class\" is subject to T-007 definition drift. Pairwise correlation alone can miss directional bias, so Annex AL now requires direction-of-error review and adversarial-seat certification before activation votes. Small pilot populations can also overclaim independence; Cohort 1 requires a small-population oracle plan if below 500 persons. Annex AL Sections 1 and 2 are P-004 protected; Sections 3 and 4 are updated through annual audit (Annex AL Section 5). The annual review panel must include an adversarial methodologist whose role is to find exploitation paths in the current definitions.\n- **Compound linkages:** T-020 \u00d7 T-021 (both target oracle epistemological foundations; P-017 addresses both). T-020 \u00d7 T-012 (structural oracle independence is necessary but not sufficient; P-017 adds the epistemological layer). T-020 \u00d7 T-008 (epistemic monoculture in oracle methodology parallels elite formation in oversight \u2014 P-008 and P-017 share the diversity-mandate logic).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-018 | T-022 | **PROPOSED** | Critical | constitutional architecture + political durability |\n\n### P-018 \u2014 Electoral Cycle Resilience\n\n**Constitutional text:** [ANNEX_AM.md](../annexes/ANNEX_AM.md)\n\n- **Change type:** constitutional architecture + political durability + transition protocol.\n- **Addresses:** T-022 (Electoral Cycle Capture).\n- **Introduced design:**\n  - *Entrenchment ladder (direct repeal route):* Tier 1 invariants require not just a legislative supermajority but concurrent ratification by an independent constitutional body. The constitutional body's composition must be specified at founding such that it cannot be reconstituted entirely by the governing coalition within a single electoral term.\n  - *Essential Access floor minimum persistence (administrative hollowing route):* A minimum Essential Access floor \u2014 defined at founding as 70% of the founding basket \u2014 is constitutionally self-executing: it does not require legislative appropriation and cannot be suspended by executive action. This floor persists through any governing coalition transition unless repealed via the full Tier 1 amendment process.\n  - *Administrative hollowing triggers:* If a founding institution is unfilled for more than 90 days, or post-mortem publication lapses for more than 30 days, or oracle accreditation count drops below a specified minimum, an automatic constitutional review is triggered that does not require the governing coalition's initiation. The review is initiated by the constitutional body and is self-executing.\n  - *Transition continuity protocol:* When a new governing coalition takes office, a mandatory 180-day transition audit is required before any changes to Tier 2 or Tier 1 provisions. The audit is conducted by the constitutional body, not the incoming government. During the 180-day window, no Tier 2 or higher changes may be made except through emergency deadlock resolution (P-012 AE2.3).\n  - *Treaty override protection (jurisdictional fragmentation route):* International agreements that require modification to the non-convertibility architecture trigger a mandatory Tier 2 impact assessment before ratification. An agreement that would produce cumulative Tier 2 impact (by T-007/P-012 cumulative drift trigger standards) requires the full Tier 2 amendment process for each applicable provision.\n- **Clauses to integrate:** AM1\u2013AM6. Tier 1 amendment process modified (Annex A). Essential Access floor persistence clause added to Article IV. Administrative hollowing triggers added to the Article VII dashboard as auto-publication requirements. Transition continuity protocol added to the operational layer.\n- **Dependencies:** Independent constitutional body formally constituted at founding with staggered terms and confirmed independence from governing coalition appointment. Essential Access floor minimum definition requires RCS capacity confirmation.\n- **New risks introduced:** Self-executing Essential Access floor minimum requires RCS capacity to be maintained regardless of political will \u2014 if oracle system degrades, the self-executing floor has no measurement basis. Mitigated by: oracle degradation itself triggers an administrative hollowing review. Transition continuity audit creates 180-day governance window \u2014 addressed by: audit has a defined 30-day maximum scope for routine transitions; extensions require independent authorization.\n- **Residual risk:** A government with sufficient political will and supermajority can repeal constitutional entrenchment. The designed defense buys time and raises political cost; it cannot prevent determined repeal. Ultimate residual risk: protocol durability depends on political culture. No design can substitute for a political culture that values the commitments.\n- **Compound linkages:** T-022 \u00d7 T-011 (hostile electoral success often follows narrative attack \u2014 P-011 and P-018 are jointly necessary). T-022 \u00d7 T-008 (elite formation inside institutions may assist administrative hollowing by a hostile government). T-022 \u00d7 T-017 (T-022 success produces a new bootstrap problem \u2014 recursive T-017). T-022 \u00d7 T-016 (hostile government can capture FAP sign-off authorities).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-019 | T-023 | **ACTIVE** | Med-High | evidence architecture + scale-up gating |\n\n### P-019 \u2014 Pilot External Validity Gate\n\n**Constitutional text:** [ANNEX_AN.md](../annexes/ANNEX_AN.md)\n\n- **Change type:** evidence architecture + scale-up gating + simulation mandate.\n- **Addresses:** T-023 (Pilot External Validity Collapse).\n- **Introduced design:**\n  - *Stress-condition pilot gate:* Scale-up approval requires the pilot evidence record to include at least one each of: an economic stress event (recession, significant unemployment spike, or supply price shock affecting the pilot region); a compound supply disruption (two or more essential categories simultaneously below adequate levels); and documented operation during a formal political opposition campaign against the system. Where a condition could not be tested in the pilot, the evidence record must include: (a) explicit documentation of why it could not be tested; (b) a designated substitute evidence source (e.g., analogous case from another jurisdiction, red-team analysis); (c) a residual-risk statement acknowledging the gap; and (d) a post-scale monitoring commitment specific to the untested condition.\n  - *Red-team challenge window (T-016 companion):* Before any scale-up vote, a mandatory 30-day adversarial challenge window allows independent reviewers to contest the external validity of the evidence base. Challengers must have access to the full evidence record, not just the summary. Responses to challenges are published before the vote.\n  - *Crisis simulation mandate:* The Annual Compound Simulation must include at least one compound-crisis scenario not previously simulated before each scale-up gate. The talent drain scenario and civic legibility scenario fulfill this requirement for the first scale-up gate only.\n- **Clauses to integrate:** AN1\u2013AN5. FAP (Formal Acceptance Protocol) extended \u2014 scale-up gate conditions added to evidence requirements. Annex T (simulation mandate) extended. P-013 representativeness standard cross-referenced (stress-condition pilot is a representativeness requirement).\n- **Dependencies:** Annual Compound Simulation must be updated to include new scenarios before each scale-up gate. Red-team challenge window requires independent reviewer access infrastructure.\n- **New risks introduced:** Stress-condition requirement may delay scale-up indefinitely if adverse conditions do not occur in the pilot region within a reasonable window. Mitigated by: substitute evidence pathway is explicitly available; the requirement is for good-faith engagement with external validity, not for a manufactured crisis. Red-team challenge window creates a blocking mechanism \u2014 mitigated by: challengers must propose specific residual-risk mitigations, not merely object.\n- **Residual risk:** Some external validity gaps cannot be filled by any pilot. A deliberately engineered crisis to satisfy the stress-condition requirement would satisfy the letter but not the spirit of P-019. Ultimate residual risk: the evidence base for a system of this scale will always be incomplete.\n- **Compound linkages:** T-023 \u00d7 T-016 (honest insufficient pilot is the complement to dishonest evidence farming \u2014 both require evidence quality controls). T-023 \u00d7 T-011 (scale-up failure after smooth pilot is a maximum-impact narrative attack). T-023 \u00d7 T-022 (hostile electoral challenge is one of the hardest conditions to include in a controlled pilot; substitute evidence pathway must address this explicitly).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-020 | T-017 | **ACTIVE** | Critical | founding governance + window extension |\n\n### P-020 \u2014 Founding Window Extension\n\n**Constitutional text:** [ANNEX_AH.md \u00a7 AH2.1\u2013AH2.4](../annexes/ANNEX_AH.md)\n\n- **Change type:** founding governance amendment \u2014 extends P-014 Annex AH.\n- **Addresses:** T-017 residual risk \u2014 14-day pre-activation disclosure window is insufficient for independent critique to organize against a coordinated founding capture attempt.\n- **Introduced design (Annex AH2, amending AH1):**\n  - *60-day pre-activation disclosure (replacing 14-day):* The P-014 pre-activation challenge window is extended from 14 days to 60 days minimum. The 60-day clock begins when the circular dependency analysis, founding exception statement, and panel composition are simultaneously published. No stage of P-014 may proceed until the 60-day window closes with no unresolved structural objections requiring response.\n  - *Oppose-coalition adversarial member nomination:* The adversarial panel member required by P-014 may not be appointed by the same nominating process as the other four panel members. The adversarial member must be nominated by a body that is structurally opposed to or independent from the founding coalition's interests \u2014 specifically: (a) a civil liberties or human rights organization not affiliated with the founding coalition; (b) a registered opposition political party or civic organization; or (c) an independent academic institution with no material funding relationship with founding coalition members. The nominating body's selection rationale must be published as part of the founding record.\n  - *Objection response requirement:* Any structural objection submitted during the 60-day window that identifies a specific P-013 standard not met by the P-014 process must receive a written response from the founding panel before the window closes. Unresponded objections extend the window by 14 days, non-cumulatively.\n- **Non-precedent statement (extends AH1 Tier 2 protection):** 'P-020 amends P-014. The 60-day window and oppose-coalition nomination are P-014 requirements only. They do not set a precedent for other patch activations, emergency processes, or governance decisions. Any invocation of P-020 logic for any other purpose requires H-2 amendment process.'\n- **Clauses to integrate:** AH2.1\u2013AH2.4. P-014 founding checklist extended. Annex N founding preconditions updated.\n- **Dependencies:** Oppose-coalition nominating body must be identified before P-014 stage 1 begins. 60-day window requires that the founding timeline allow for this \u2014 founding planning should budget 90 days for the P-014 process from first public disclosure to panel sign-off.\n- **New risks introduced:** 60-day window provides more time for coordinated opposition to manufacture procedural objections that are technically valid but strategically motivated. Mitigated by: objection response requirement specifies that only structural objections (identifying a specific P-013 standard not met) require response; procedural objections without structural grounding do not extend the window. Oppose-coalition nomination process requires identifying a legitimate opposition body \u2014 in contexts without organized opposition, this may be difficult. Mitigated by: the three pathways (civil liberties org, opposition party, academic institution) provide alternatives.\n- **Residual risk:** A 60-day window with published panel composition still allows founding panel capture if the oppose-coalition nomination process is itself captured. Ultimate residual: founding legitimacy depends on the quality of the political culture and civil society present at the founding moment. No procedural design fully compensates for absent civil society.\n- **Compound linkages:** T-017 \u00d7 T-022 (T-022 attack recurs as T-017 after a successful dismantling \u2014 P-020 hardened founding reduces risk of both initial capture and post-T-022 refounding capture). T-017 \u00d7 T-011 (60-day public window converts founding moment into sustained transparency demonstration).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-021 | \u2014 | **ACTIVE** | High | register architecture + disclosure policy |\n\n### P-021 \u2014 Register Disclosure Protocol\n\n**Constitutional text:** [ANNEX_AO.md](../annexes/ANNEX_AO.md)\n\n- **Change type:** register architecture + operational security + transparency calibration.\n- **Addresses:** Open threat register as attack surface \u2014 the current register publishes specific detection thresholds, timing windows, and exploit paths that constitute an operational manual for sophisticated attackers. This is not a new threat ID (the vulnerability is architectural, not a distinct attack class); it is a structural change to how the register is maintained.\n- **Introduced design:** The register is bifurcated into:\n  - *Public Register:* Threat categories, mechanisms (described at class level, not with specific thresholds), mitigation approaches, residual risks, risk scores, and compound linkages. The public register is published in the open GitHub repository and is the primary accountability and transparency artifact. The current `Threat_Register.md` is the public register.\n  - *Restricted Register Annex:* Specific detection thresholds (e.g., exact trigger counts and time windows), precise timing windows for exploitation, operational detection patterns and signatures, and calibration data used to set automated alerts. The Restricted Annex is available to: credentialed auditors under NDA; adversarial panel members in the P-013/P-014 acceptance process; the constitutional review body; and Ombuds Office staff. It is not published publicly. It is version-controlled privately with access logs.\n  - *Consistency requirement:* Both versions must be updated simultaneously. Any discrepancy between the public and restricted versions triggers a T-007 definition-drift review. The restricted version is the authoritative operational document; the public version is the transparency artifact.\n  - *Reclassification review:* Annually, the Threat Register Owner reviews whether any restricted-version content can be declassified to the public version (because the window of operational sensitivity has passed) or whether any public-version content should be reclassified to restricted (because specific operational details have been added).\n- **Clauses to integrate:** AO1\u2013AO5. Annex AO (Register Disclosure Protocol) \u2014 see `docs/annexes/ANNEX_AO.md`. P-004 protected terms registry: 'restricted annex' and 'public register' defined.\n- **Dependencies:** Restricted Annex infrastructure (private version-controlled repository with access controls) must be established before P-021 is operative. Threat Register Owner role must be formally constituted with authority to manage both versions.\n- **New risks introduced:** Bifurcation creates an accountability gap \u2014 the public cannot verify that the restricted version is consistent with stated mitigations. Mitigated by: credentialed auditors can access restricted version and publish a consistency attestation (not the content) annually. Restricted version existence itself creates an information asymmetry that could be used to claim mitigations are more robust than they are. Mitigated by: consistency attestation is published; any disclosed gap between public claims and restricted reality is a T-007 event.\n- **Residual risk:** The bifurcation design assumes that restricted content stays restricted. Leaks are possible. The design accepts this and treats the restricted version as reducing adversarial advantage, not eliminating it \u2014 full security through obscurity is not the goal.\n- **Compound linkages:** P-021 \u00d7 T-011 (restricted register removes some transparency \u2014 P-021 must be communicated publicly as a deliberate operational security choice, not a transparency failure, or it becomes a narrative attack surface).\n\n---\n\n## P-022 through P-023 \u2014 Operational Gap Closure\n\n*Operational gap closure (P-022) and design-discussion registration (P-023).*\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-022 | T-024 | **ACTIVE** | Critical | protocol + authority definition + FC-100 restoration verification + reconciliation |\n\n### P-022 \u2014 Shared Storehouse Oracle-Failure Fallback Protocol\n\n**Status: ACTIVE (promoted 2026-04-18 via Proposal 6 close-out).** FC-100 `ORACLE_QUORUM_LOSS_RESTORATION_WINDOW` = 14 days bound in `/founding/commitments.md`. Annex AQ promoted to ACTIVE with full protocol detail, survival floor unconditionality confirmed, Reconciliation Review specified.\n\n**Constitutional text:** [ANNEX_AQ.md](../annexes/ANNEX_AQ.md)\n\n- **Change type:** protocol + authority definition + oracle reconciliation procedure.\n- **Addresses:** T-024 (Shared Storehouse Oracle-Failure During Active Rationing) \u2014 the operational void where Shared Storehouse is active and the oracle system fails, loses quorum, or enters an unresolvable dispute with no defined decision path.\n- **Introduced design:**\n  - *Conservative hold default:* When the oracle system loses quorum or enters an unresolvable dispute while Shared Storehouse is active, Shared Storehouse holds at its current activation level. No escalation. No expansion to new categories. No automatic lapse. The conservative hold is the designed default \u2014 not doing nothing, but doing the least-harm thing until authority is restored.\n  - *48-hour REB first-responder window:* The Regional Executive Body (REB), using its existing P-006 first-responder authority, may issue a provisional continuation or provisional lapse within 48 hours of oracle failure based on non-oracle physical indicators: distribution fill rates, vendor inventory reports, and logistics data. The REB decision is published immediately with the full evidence base. The REB may not expand Shared Storehouse scope under this authority \u2014 only hold or begin a managed lapse. Expansion requires oracle quorum.\n  - *72-hour governance handoff:* If the oracle system is not restored within 72 hours of failure, the matter transfers to the emergency deadlock resolution protocol (P-012 AE2.3) for a binding decision. The 3-member arbitration panel has authority to issue a time-bound Shared Storehouse continuation or staged lapse. The survival floor bridge (P-012 AE2.3) is unconditional throughout oracle failure \u2014 Essential Access baseline access is never contingent on oracle availability.\n  - *Oracle restoration reconciliation:* When the oracle system begins restoration, a mandatory 24-hour preliminary reconciliation notice names restored-node status, unresolved discrepancies, and any provisional REB decision that appears inconsistent with restored readings. After the 14-day FC-100 verification window, a final Reconciliation Review is published within 7 days with root-cause analysis. Persistent REB-oracle divergence triggers an independent review of the non-oracle physical indicator methodology.\n  - *Deliberate-failure escalation:* If oracle failure during active Shared Storehouse is found to be deliberately engineered (oracle manipulation evidence per T-012/T-018), the matter escalates immediately to enforcement \u2014 the conservative hold and first-responder window both continue, but the investigation runs in parallel without waiting for oracle restoration.\n- **Clauses to integrate:** AQ1\u2013AQ5. Amends Annex U (Shared Storehouse termination and continuation procedures). Amends AC2 (P-006 PCRP/REB authority \u2014 Shared Storehouse oracle failure is a distinct REB authority from PCRP). Article VII dashboard extended: oracle status must include a live Shared Storehouse-active indicator so oracle failure during active Shared Storehouse is publicly visible in real time.\n- **Dependencies:** REB formally constituted with defined authority for non-oracle physical indicator assessments. Non-oracle physical indicator methodology must be published and reviewed annually. P-012 AE2.3 emergency deadlock protocol must be operative before P-022 is operative.\n- **New risks introduced:** REB use of non-oracle physical indicators creates a soft-oracle channel not subject to the independence requirements of the main oracle system. Mitigated by: (1) REB authority under P-022 is explicitly scoped to hold-or-lapse decisions only \u2014 no scope expansion; (2) REB decisions are published immediately with evidence base; (3) reconciliation review after oracle restoration creates accountability for REB accuracy; (4) the non-oracle indicator methodology is published and periodically reviewed. Risk: consistent REB-oracle agreement could be engineered by an adversary who also controls the physical indicator sources. Mitigated by: physical indicators (fill rates, inventory reports) are collected from distributed vendor networks \u2014 harder to simultaneously compromise than a concentrated oracle system.\n- **Residual risk:** A deliberate oracle failure timed to active Shared Storehouse, combined with physical indicator manipulation, could force a harmful REB decision during the 48-hour window. This is the highest-consequence compound attack on the Shared Storehouse system. The 72-hour governance handoff provides a backstop, but 72 hours of incorrect Shared Storehouse operation during a genuine shortage is a real harm. Accepted as the best available outcome given the operational constraint that a governance decision cannot be made faster than the arbitration panel can convene.\n- **Compound linkages:** T-024 \u00d7 T-006 (P-022 extends P-006 to cover oracle failure during Shared Storehouse \u2014 P-006 covers measurement lag; P-022 covers measurement absence). T-024 \u00d7 T-014 (triple deadlock during Shared Storehouse oracle failure is the worst-case scenario \u2014 survival floor bridge must be explicitly unconditional regardless of deadlock status). T-024 \u00d7 T-018 (deliberate false-trigger exhaustion designed to overlap with active Shared Storehouse is the highest-risk T-018 compound).\n\n---\n\n| Patch ID | Related Threat | Status | Priority | Change Type |\n| :--- | :--- | :--- | :--- | :--- |\n| P-023 | T-025 | **ACTIVE** | High | Contract-commitment architecture / protected-capital shelter control |\n\n### P-023 \u2014 Contract-Commitment Architecture (Protected-Capital Shelter Control)\n\n- **Status:** ACTIVE\n\n**Constitutional text:** [ANNEX_AR.md](../annexes/ANNEX_AR.md)\n\n- **Evidence package:** [Commons Return and Universal Stake Evidence Test Package](./Commons_Return_Universal_Stake_Evidence_Test_Package.md), plus Annex AR project-finance simulation and procurement red team.\n- **Threat addressed:** T-025 (Investment and Capital-Deployment Shelter Capture).\n- **Direction adopted:** Direction B \u2014 deployment-speed architecture. Investment-channel exemptions are removed entirely. Genuine long-horizon capital needs are served by contract-commitment architecture; protected-capital status requires real deployment, public accounting, and source-base review where Commons Return is implicated.\n- **Red-team pre-analysis:** Ten attack vectors identified and resolved before this patch was written. Vectors: (1) escrow control ambiguity, (2) milestone definition gaming, (3) \"working capital\" as new exemption label, (4) advance procurement rebranded as hoarding, (5) subcontractor chain gaming, (6) essential-sector carve-out pressure, (7) multi-jurisdiction pooling ambiguity, (8) force majeure as wedge for permanent exemptions, (9) sector definitional creep, (10) milestone oracle capture. All resolved in patch rules below.\n\n**P-023.1 \u2014 Zero Shelter Principle**\nNo entity, sector, or project type receives protected-capital shelter by label. The investment-channel exemption architecture from the original P-002 design is deprecated. The concept of \"investment-channel status\" is removed. No project account, escrow window, term pool, infrastructure label, or public-benefit designation may shield idle control from deployment review or Annex D source-base review.\n\n**P-023.2 \u2014 Contract-Commitment Architecture**\nLong-horizon projects are financed through milestone escrow:\n- The commissioning authority deposits Flow into an independent escrow account at project initiation.\n- Deployment-window review, public reporting, and Annex D source-base review apply to escrowed Flow. The commissioning authority bears accountability for delay, creating institutional incentive for timely contracting and completion.\n- Flow is released to the contractor only upon independently verified milestone completion.\n- The contractor holds only current working capital. Protected-capital shelter is unavailable without verified physical deployment.\n\n**P-023.3 \u2014 Independent Escrow Agent**\nEscrow accounts are administered by an independent escrow agent designated by the CRP. The contractor, any entity in the contractor's supply chain, and any entity with a financial interest in the project's outcome may not administer, co-administer, or materially influence the escrow account.\n\n**P-023.4 \u2014 Output Milestone Standard**\nMilestones eligible to trigger escrow releases must satisfy all of the following:\n- Physical deliverables only \u2014 no process milestones, no self-certified planning stages, no administrative completions.\n- Independently inspected and certified by a rotating inspector pool; the contractor does not select inspectors. Pool is administered by the escrow agent under P-017 oracle-independence standards.\n- Defined at contract signing and P-004-locked. No renegotiation of milestone definitions after contract execution.\n- High-value releases (above the threshold defined in Annex AR) require multiple independent verifiers and physical inspection with full audit trail.\n\n**P-023.5 \u2014 Procurement Clarification**\nAdvance procurement of materials means actual purchase: Flow exits the contractor's hands at the transaction. Holding Flow \"in reserve for future procurement\" without a bound deliverable is protected-capital sheltering and receives no protective treatment. Supply chain uncertainty is addressed through competitive procurement, staged purchasing, and futures commitments \u2014 not indefinite balance reserves.\n\n**P-023.6 \u2014 Universal Scope**\nP-023 applies at every tier of the supply chain: prime contractors, subcontractors, sub-subcontractors, and all entities receiving Flow for project work are subject to the same architecture. There is no sector-specific carve-out. Eligibility for contract-commitment structure is determined by deliverable characteristics (verifiable physical milestones + commissioning authority), not sector identity.\n\n**P-023.7 \u2014 Mandatory Deployment Timeline (Commissioning Authorities)**\nCommissioning authorities must contract idle escrowed funds within the deployment window defined in Annex AR. Funds held beyond this window without active contracting trigger mandatory CRP review. Review and publication continue regardless of whether any dormant backstop has been activated. This is an accountability mechanism, not an exemption.\n\n**P-023.8 \u2014 Multi-Jurisdiction Lead Authority**\nFor projects with multiple commissioning authorities pooling Flow, a lead authority must be designated at contract signing. The lead authority bears accountability for pooled escrow delay, publication, and review. Internal cost-sharing between participating authorities is a private arrangement; external accountability runs through the lead authority only.\n\n**P-023.9 \u2014 Force Majeure Escrow Freeze**\nVerified external delays may trigger a temporary freeze of deployment-delay consequences:\n- Qualifying events: permitting delays attributable to regulatory bodies outside the project's control; certified supply chain disruptions (independent third-party certification required); declared natural disasters.\n- Process: contractor applies with documented evidence; an independent assessment panel certifies the external cause and its temporal scope. Panel composition and selection use P-017 oracle-independence standards.\n- Effect: deployment-delay consequences on the affected escrow account are paused for the certified duration only.\n- Limits: freeze is time-limited to the verified external condition; total cumulative freeze time per project is capped at the period defined in Annex AR; freeze does not stack across overlapping events.\n- Gaming deterrent: misrepresentation in a freeze application is an audit trigger and grounds for contractor disqualification from future escrow eligibility.\n\n**P-023.10 \u2014 P-004 Protected Terms**\nThe following terms are added to the P-004 protected vocabulary: *milestone*, *physical deliverable*, *commissioning authority*, *independent escrow agent*, *force majeure* (for protocol purposes), *lead authority*, *verified external delay*, *deployment window*. Definitions may not be modified without a Tier 2 (H-2) amendment.\n\n- **Risk introduced:** (1) Force majeure certification panel is a new oracle \u2014 capture target per T-020/T-021; mitigated by P-017 independence requirements. (2) Mandatory deployment timelines may pressure commissioning authorities to rush contracting rather than hold idle; mitigated by requiring contracts to pass standard procurement integrity checks before they satisfy the timeline. (3) Inspector pool is a new oracle; mitigated by rotating pool under P-017 standards and escrow-agent administration. (4) P-023.4 output-only milestone standard may be challenged as too rigid for novel infrastructure categories; mitigated by P-004 protection \u2014 any redefinition requires H-2 amendment, raising the cost of definitional drift.\n- **Annex:** AR (contract-commitment architecture specification \u2014 high-value release thresholds, deployment window periods, force majeure cumulative freeze cap, inspector pool governance, escrow agent designation process).\n- **Compound linkages:** T-025 \u00d7 T-001 resolved (no investment-channel exemptions means no above-ledger boundary manipulation through exemption classification). T-025 \u00d7 T-007 mitigated (P-004 protection on all P-023.10 terms). T-025 \u00d7 T-008 mitigated (no classification to capture \u2014 sector identity is irrelevant to escrow eligibility).\n\n---\n\n## Operating Rules for the Patch Log\n\n- Every future patch must reference a threat ID and specify the new risk it creates.\n- If a patch only exists in the log and not in the Humane Constitution, it is not yet operative.\n- If a patch changes public explanation, the white paper and technical reference must be synced in the same cycle.\n- When a patch materially changes user experience or institutional authority, the diagram set must be updated too.\n- **PROPOSED** patches become ACTIVE only after formal Humane Constitution integration and oversight sign-off.\n- If two patches conflict, the conflict belongs in the patch log and must be resolved explicitly in the Humane Constitution.\n\n---\n\n## Current Threat/Patch Linkage\n\nThis table is the single source of truth for threat\u2192patch traceability. It covers every patch in the current inventory through P-074. Reserved IDs (P-007, P-010, P-028, P-071) and the draft-only P-063 review packet are listed in the Reserved / Never-Assigned Patch IDs table above. \"Multiple\" has been replaced with enumerated threat (or PRD-/IC-/INV-/ACL-) references throughout; patches with no standalone threat row are marked \"structural \u2014 no threat row.\"\n\n| Threat ID | Patch ID | Status | Master Reference |\n| :--- | :--- | :--- | :--- |\n| T-001 | P-001 | **ACTIVE** | Annex AB |\n| T-004 | P-002 | **ACTIVE** | Annex AB |\n| T-002 | P-003 | **ACTIVE** | Annex AB |\n| T-007 | P-004 | **ACTIVE** | Annex AB |\n| T-005 | P-005 | **ACTIVE** | Annex AC1 |\n| T-006 | P-006 | **ACTIVE** | Annex AC2 |\n| T-008 | P-008 | ACTIVE | Annex AC3 (operative authority superseded by P-025 ACTIVE) |\n| T-009 | P-009 | **ACTIVE** | Annex AF |\n| T-011 | P-011 | **ACTIVE** | Annex AD |\n| T-012\u2013T-015 | P-012 | **ACTIVE** | Annex AE |\n| T-016 | P-013 | **ACTIVE** | Annex AG |\n| T-017 | P-014 | **ACTIVE** | Annex AH |\n| T-018 / T-019 | P-015 | **ACTIVE** | Annex AP \u00b7 Annex AI |\n| T-002 | P-016 | ACTIVE | Annex AK (P-016 is pre-ratification design) |\n| T-020 / T-021 | P-017 | **ACTIVE** | Annex AL \u00b7 FC-030/031/032/033/100 |\n| P-018 | T-022 supplement | **PROPOSED** | Annex AM |\n| T-023 | P-019 | **ACTIVE** | Annex AN |\n| T-017 | P-020 | **ACTIVE** | Annex AH2 |\n| structural \u2014 no threat row (register disclosure protocol) | P-021 | **ACTIVE** | Annex AO |\n| T-024 | P-022 | **ACTIVE** | Annex AQ \u00b7 FC-100 |\n| T-025 | P-023 | **ACTIVE** | Annex AR |\n| T-009 / TR-07 / T-018 | P-024 | **ACTIVE** | Annex AS \u00b7 FC-080/081/082 |\n| T-008 | P-025 | **ACTIVE** | Annex AI \u00b7 FC-090/091/092 |\n| T-026 / T-027 | P-026 | **ACTIVE** | `founding/order/` \u00b7 FC-120/121/122 |\n| T-005 / T-008 | P-027 | **ACTIVE** | `Humane_Constitution.md` \u00b7 `docs/public/04_white_paper.md` |\n| T-016 (public-funding architecture) | P-029 | **ACTIVE** | Annex X \u00a7X8 |\n| PRD-004 | P-030 | **ACTIVE** | Annex X |\n| PRD-009 | P-031 | **ACTIVE** | Annex J \u00a7R1\u2013R2 |\n| PRD-009 | P-032 | **ACTIVE** | Annex J |\n| PRD-008 | P-033 | **ACTIVE** | Annex J |\n| T-016 / INV-007 | P-034 | **ACTIVE** | Annex AV |\n| structural \u2014 no threat row (corrigibility/humility clause) | P-035 | **ACTIVE** | Preamble \u00b7 \u00a70A |\n| structural \u2014 no threat row (keyholder servanthood duty) | P-036 | **ACTIVE** | Article I |\n| structural \u2014 no threat row (identity-serves-person clause) | P-037 | **ACTIVE** | Article II |\n| T-006 | P-038 | **ACTIVE** | Article III |\n| structural \u2014 no threat row (mutual-aid/family/religious protection) | P-039 | **ACTIVE** | Article IV |\n| structural \u2014 no threat row (housing-cap pastoral revision) | P-040 | **ACTIVE** | Article V |\n| T-008 | P-041 | **ACTIVE** | Article VI |\n| structural \u2014 no threat row (community alert pathway) | P-042 | **ACTIVE** | Article VII |\n| T-001 / T-002 / T-004 / T-007 | P-043 | **ACTIVE** | ANNEX_AH \u00b7 ANNEX_Y \u00b7 INVARIANTS \u00b7 SPECIFICATIONS |\n| T-001 / T-002 / T-004 / T-005 / T-007 / T-018 / T-019 | P-044 | **ACTIVE** | ANNEX_AI \u00b7 ANNEX_AP \u00b7 ANNEX_AB \u00b7 ANNEX_AK \u00b7 ANNEX_Y |\n| T-001 / T-002 / T-004 / T-007 / IC-004 | P-045 | **ACTIVE** | ANNEX_AB \u00b7 ANNEX_AK \u00b7 ANNEX_AH \u00a7AH5.1 |\n| T-001 / T-002 / T-007 / T-008 / T-016 (evidence + capture hardening) | P-046 | **ACTIVE** | evidence artifacts \u00b7 capture dashboard |\n| T-025 / T-026 / T-027 (external dependency capture) | P-047 | **ACTIVE** | Annex AT |\n| T-025 / T-026 / T-027 (external dependency capture) | P-048 | **ACTIVE** | Annex AT \u00b7 FC-194\u2013FC-201 |\n| T-025 / T-026 / T-027 (cross-register evidence-gap bridge) | P-049 | **ACTIVE** | Hardening Queue \u00b7 Open Problems \u00b7 Pilot Roadmap \u00b7 README |\n| T-028 | P-050 | **ACTIVE** | ANNEX_AT \u00a7AT6.6 |\n| T-022 | P-051 | **ACTIVE** | ANNEX_AM \u00a7AM8 |\n| T-019 | P-052 | **ACTIVE** | ANNEX_AI \u00a74.12 |\n| Insider retaliation / reporter protection | P-053 | **ACTIVE** | ANNEX_AW \u00b7 Article VII |\n| Identity disclosure as safety vector | P-054 | **ACTIVE** | ANNEX_AX \u00b7 Article II |\n| Delivery gap between guarantee and operation | P-055 | **ACTIVE** | ANNEX_AY \u00b7 Article IV |\n| INV-001 support (identity-related; active identity controls remain P-003/P-016) | P-056 | PROPOSED | ANNEX_AK \u00a7AK8 \u00b7 ANNEX_AZ \u00a7AZ2 |\n| ACL-011 / ACL-010 | P-057 | **PROPOSED** | Pilot site selection criteria |\n| constitutional void support \u2014 no standalone threat row | P-058 | PROPOSED | Jurisdiction Interface Clause |\n| ACL-010 / dignity-floor leverage | P-059 | **PROPOSED** | Vulnerable_Population_Consent_Protocol.md |\n| ACL-005 / founding keyholder capture | P-060 | **PROPOSED** | Founding Team Composition Standard |\n| ACL-007 / Power-Wealth Convergence | P-061 | **PROPOSED** | Founding Capital Framework |\n| ACL-011 / ACL-010 | P-062 | **PROPOSED** | Pilot Timeline Framework |\n| T-028 | P-064 | **ACTIVE** | Essential-Sector Refusal Test Package \u00b7 Capture Dashboard Specification \u00b7 Threat Resolution Matrix \u00b7 Pilot Evidence Roadmap |\n| T-022 | P-065 | **ACTIVE** | ANNEX_AM \u00a7AM3/\u00a7AM8.5\u2013AM8.7 \u00b7 amendment_protocol.md \u00a73 \u00b7 Capture Dashboard Specification \u00b7 Pilot Evidence Roadmap |\n| T-029 | P-066 | **ACTIVE** | ANNEX_D \u00b7 Commons Return and Universal Stake Evidence Test Package \u00b7 Threat Register \u00b7 Claims and Evidence Register |\n| T-030 | P-067 | **ACTIVE** | Cyber Resilience and Availability Evidence Test Package \u00b7 Threat Register \u00b7 Pilot Evidence Roadmap |\n| T-031 | P-068 | **ACTIVE** | Last-Resort Unenrolled Access Evidence Test Package \u00b7 ANNEX_AZ \u00b7 ANNEX_AY |\n| T-032 | P-069 | **ACTIVE** | Monitoring Repurposing Evidence Test Package \u00b7 Annex C \u00b7 Capture Dashboard Specification |\n| T-033 | P-070 | **ACTIVE** | Founding Consent and Civil-Society Review Evidence Test Package \u00b7 Founding Legitimacy Dossier |\n| P-072 | T-025 supplement | **PROPOSED** | Productive Status Register (operative T-025 control remains P-023 ACTIVE) |\n| structural \u2014 no threat row (anti-accretion intake gate) | P-073 | **ACTIVE** | Acceptance_Protocol.md Framework-First Intake |\n| structural \u2014 no threat row (appeal spine) | P-074 | **ACTIVE** | ANNEX_L \u00a7L7 |\n\n---\n\n## P-024 \u2014 Attestation-at-Risk Stake Mechanism\n\n### P-024 \u2014 Attestation-at-Risk Stake Mechanism\n\n- **Status:** ACTIVE (promoted 2026-04-25 via Annex AS ratification). FC-080 stake ratio, FC-081 audit window, FC-082 graph density threshold bound in `/founding/commitments.md`.\n\n**Constitutional text:** [ANNEX_AS.md](../annexes/ANNEX_AS.md)\n\n- **Evidence package:** [Service Record Misuse Evidence Test Package](./Service_Record_Misuse_Evidence_Test_Package.md)\n- **Threat addressed:** T-009 (Coordinated False-Positive Suppression), TR-07 (Attestor Collusion), T-018 (Deliberate False-Trigger Exhaustion).\n- **Direction adopted:** Attestors who certify a claim bear skin-in-the-game exposure proportional to the claim's downstream consequence. A slashing schedule fires automatically when a certified claim is later disconfirmed by oracle quorum; redistribution routes slashed stake to the claimant harmed (where identifiable) and to a system integrity reserve.\n- **Introduced design:**\n  - *FC-080 stake ratio:* Every attestation above the materiality threshold requires the attesting node to place a stake equal to at least the ratio defined in FC-080. Stake is denominated in the attestor's civic balance \u2014 Service Record for contribution, hardship, and identity attestations; Voice where the attestation directly supports a Voice allocation \u2014 and is locked, not spent, during the audit window.\n  - *FC-081 audit window:* Attestations remain auditable for the window defined in FC-081. Within this window any subsequent oracle measurement that contradicts the attested claim by more than the permitted variance triggers an automated slash-and-redistribute event. The audit window is the same for all attestation classes; no class-specific extension may be granted without a Tier 2 (H-2) amendment.\n  - *FC-082 graph density threshold:* A graph-density safe harbor protects attestations made by tightly connected communities (cooperatives, mutual-aid networks, family units) from slash penalties that would arise purely from the structural density of their social graph, not from factual error. Attestations above the FC-082 density threshold are flagged for manual review rather than automatic slashing; the Ombuds Duty Sub-Ombuds has 48 hours to certify the density basis before slashing is released. This prevents T-018 attacks that exploit normal community solidarity as evidence of collusion.\n  - *Slashed-stake redistribution:* Slashed civic stake is routed according to Annex AS \u00a73: whistleblower share, restitution to a harmed subject where identifiable, Article VII enforcement maintenance fund, and a small retired share. No slashed stake returns to the attesting node or its affiliated entities.\n  - *False-claim escalation:* Where slashing evidence reaches the threshold defined in Annex AS \u00a75, the Ombuds Plenum receives a formal referral. A finding of deliberate false attestation (not merely mistaken attestation) triggers disqualification from attestation roles for the period specified in Annex AS \u00a76. Deliberate false-trigger exhaustion (T-018 use of P-024 to drain legitimate attestors) is an aggravated finding with an extended disqualification period.\n- **Clauses integrated:** AS1\u2013AS6. Amends Annex U (adds attestation-stake exposure to bypass-closure layer). Article VII dashboard extended: real-time attestation-stake exposure by class and pending audit-window count are public indicators.\n- **Dependencies:** Independent escrow agent (P-023.3) operative. Oracle quorum system (P-017) operative with at least three independent oracle seats. Ombuds federation (P-025) seated at \u22654 sub-Ombuds before density-threshold manual review is operative. FC-080/081/082 values bound before any attestation-bearing transaction is accepted.\n- **New risks introduced:** (1) Stake requirement may chill legitimate attestation by resource-constrained community members \u2014 mitigated by FC-080 materiality threshold (low-value attestations are stake-exempt) and by graph-density safe harbor. (2) Automated slashing on oracle contradiction may fire incorrectly if oracle error precedes attestation error \u2014 mitigated by 48-hour Ombuds review gate at FC-082 density flag and by audit-window appeals process in Annex AS \u00a74. (3) Slashed-stake redistribution route to integrity reserve creates an incentive for the CRP to manufacture slash events \u2014 mitigated by Ombuds oversight of all slash events above the Annex AS \u00a75 threshold.\n- **Residual risk:** A coordinated oracle-and-attestor compromise that defeats both systems simultaneously remains the highest-risk failure mode. The graph-density safe harbor narrows the T-018 attack surface but cannot eliminate it if the adversary controls both oracle quorum and attestation review.\n- **Compound linkages:** T-009 \u00d7 T-018 (coordinated false-positive suppression paired with deliberate exhaustion is the canonical dual-threat; P-024 raises the cost of both by making attestation financially painful to corrupt). TR-07 \u00d7 P-017 (attestor collusion is detectable via oracle contradiction; P-017 oracle independence is a prerequisite for P-024 slash events to be trustworthy). T-018 \u00d7 FC-082 (density safe harbor is the primary T-018 surface \u2014 its threshold value is the key calibration parameter; see Annex AS \u00a73).\n- **Annex:** AS (attestation-at-risk stake mechanism \u2014 stake ratio schedule, audit window protocol, graph-density threshold methodology, slash-and-redistribute event specification, escalation thresholds, disqualification periods).\n\n---\n\n## P-025 through P-027 \u2014 Ombuds, Founding Order, and Consolidation\n\n### P-025 \u2014 Federated Ombuds Constitution\n\n**Constitutional text:** [ANNEX_AI.md](../annexes/ANNEX_AI.md)\n\n- **Introduced design:** Single-commissioner Ombuds replaced with a five-node federation. Each sub-Ombuds is structurally dispersed along at least four of five dimensions (jurisdictional, institutional-origin, funding, infrastructure, personnel-recruitment). Operational decisions are handled by a rotating Duty Sub-Ombuds; protocol-level decisions require a 4-of-5 Plenum supermajority (FC-091). Staggered 730-day terms (FC-092) with two-consecutive-term limit. Oversight Assembly of 7 members (5-of-7 threshold) certifies structural dispersal annually and activates Concentration Response on loss of dispersal.\n- **Clauses to integrate:** Full rewrite of Annex AI (previously PROPOSED single-commissioner draft) to Annex AI ACTIVE federated constitution. References from the Humane Constitution, Threat Register, and other annexes read through to the federation acting per \u00a73 (operational vs protocol-level classes).\n- **Load-bearing integrations:**\n  - **Proposal 1** \u2014 Tier 1 Amendment Integrity Report (Plenum 4-of-5 within 60 days of signature registration under `/architecture/amendment_protocol.md`).\n  - **Proposal 3** \u2014 Adversarial oracle seat certification (Annex AL \u00a73.3).\n  - **Proposal 6** \u2014 Arbitration panel seat on Annex AQ \u00a73 Shared Storehouse oracle-failure arbitration.\n  - **Proposal 7** \u2014 Enforcement Panel appeals on Annex AJ \u00a74 penalty determinations.\n  - **Proposal 9** \u2014 Final adjudication of Annex AS attestation false-claim findings and stake-slashing classification.\n- **Dependencies:** At least four sub-Ombuds seated before any Ombuds-dependent function is operative (\u00a72.1 pre-launch gate). Oversight Assembly seated with \u22655 of 7 before first Plenum vote. Duty rotation schedule published for first 90 days before operational activation. Federation secretariat built before operational activation.\n- **New risks introduced:** Duty rotation scheduling is itself a power locus (mitigated by published-in-advance rotation, non-party-choice rule). Five-node federation increases coordination cost on time-sensitive operational decisions (mitigated by operational/protocol-level bifurcation in \u00a73.1). Plenum deadlock (2 of 5 or 3 of 5) may stall matters (mitigated by conservative-default rule in \u00a73.3 \u2014 deadlock favours protection).\n- **Residual risk:** Structural-dispersal criteria can be met formally while capture is achieved through informal coordination (mitigated by Oversight Assembly \u00a75.1 institutional-health reporting; voting-pattern concentration is a published metric). Oversight Assembly itself can be captured at small scale (mitigated by \u00a75.4 meta-capture controls).\n- **Compound linkages:** P-025 \u00d7 P-008 (federation closes the T-008 open question \u2014 \"who audits the auditors of elite formation?\" \u2014 by making the auditor a federation subject to its own dispersal rule); P-025 \u00d7 P-015 (Ombuds-dependent PCRP flag determinations now robust to single-node capture); P-025 \u00d7 P-017 (methodology-class adversarial seat certification now clears 4-of-5 threshold rather than single-commissioner signature); P-025 \u00d7 P-022 (Annex AQ arbitration panel seat rotation is Plenum-certified).\n- **Auto-close clause:** P-025 is standing. It does not auto-close. Changes to the federation structure (FC-090, FC-091, FC-092) require Tier 1 amendment (7-of-9, 180-day timelock).\n\n---\n\n## P-026 \u2014 Founding Order Detail\n\n### P-026 \u2014 Founding Order: Subsidiarity, Consent & Exit\n\n**Constitutional text:** [Founding Order](../../founding/order/README.md)\n\n- **Introduced design:** The protocol acquires a foundational scale-and-consent layer beneath the operational articles. The Founding Order defines *who* consents to be governed, *at what scale*, and *how they withdraw*. Six files under `/founding/order/` cover: (1) README orientation, (2) five-tier scale hierarchy (FC-122: household / neighborhood \u2264500 / locality \u22645,000 / region \u2264500,000 / federation), (3) three-prong subsidiarity competence test (informational, adjudicative, externality-containment) with default-against-escalation rule, (4) affirmative consent protocol (2/3 supermajority, 90-day notice, 60-day deliberation, roll-call, 2/3 minimum participation), (5) exit protocol (FC-120 2/3 supermajority, FC-121 730-day graceful unwind with Essential Access continuity, no exit tax, no forfeiture, T-026 Exit Denial enforcement), (6) re-entry protocol (procedurally symmetric, no penalty, 365-day floor between cycles).\n- **Clauses to integrate:** Humane Constitution \u00a70 Founding Order paragraph; every operational article reads through the Founding Order (smallest-competent-scale default).\n- **Load-bearing integrations:**\n  - Federated Ombuds (Annex AI \u00a73.2 challenge process; \u00a73.4 automatic Plenum convocation on exit denial).\n  - Annex AJ \u00a74 severity 3 (Institutional) penalties for Exit Denial violations.\n  - CSM (Annex Y) as the single Tier 1 exception that binds regardless of consent.\n  - Architectural enforcement layer (Proposal 1) locks FC-120/121/122 under Tier 1 process.\n- **Dependencies:** Federated Ombuds seated (four of five sub-Ombuds) before any Founding Order challenge procedure is operative. Drift chain must support federation-scope expansion and contraction events. Scale registry (household through federation) must be initialized at founding.\n- **New risks introduced:** Re-entry 365-day floor could be gamed through individual-personhood cycling (mitigated by individual consent being distinct from unit consent, with the floor applying only to unit cycles). Exit-cost asymmetry \u2014 the 730-day unwind is generous for the unit but introduces a period of dual-authority \u2014 could produce enforcement ambiguity (mitigated by published unwind schedule and Ombuds oversight).\n- **Residual risk:** Subsidiarity is an aggregate property; any single decision's escalation may look reasonable while the cumulative drift toward federation-scale venue is substantial. Aggregate monitoring via the Ombuds \u00a74.3 federation-decision-concentration report is the mitigation \u2014 a threshold breach is itself a T-027 trigger.\n- **Compound linkages:** P-026 \u00d7 P-025 (Ombuds is the Founding Order enforcement organ \u2014 subsidiarity and exit both depend on Ombuds independence); P-026 \u00d7 P-018 (Essential Access-floor-persistence clause is reinforced by Essential Access continuity preservation during the 730-day unwind); P-026 \u00d7 P-008 (exit right structurally constrains elite formation \u2014 elites cannot form a federation they cannot lose).\n- **Auto-close clause:** P-026 is standing. Changes to FC-120/121/122 and the no-exit-tax rule require Tier 1 amendment (7-of-9, 180-day timelock). Strengthening (shorter unwind, lower supermajority) is Tier 2.\n\n---\n\n## P-027 \u2014 Constitutional Consolidation Detail\n\n### P-027 \u2014 Founding Order and Seven-Article Structural Consolidation\n\n**Constitutional text:** [Humane_Constitution.md \u00a7 III](../constitution/Humane_Constitution.md)\n\n- **Introduced design:** the constitutional architecture is consolidated into one Founding Order and seven Articles of Constitutional Order. Rights and rule-bound execution live together in Article I. Essential Access and delivery live together in Article IV. Flow, housing and commons use-rights, enterprise, and PFCR live together in Article V. Voice, Service Record, contribution recognition, and deliberation live together in Article VI. Transparency and environmental scanning live together in Article VII.\n- **Clauses integrated:** Humane Constitution \u00a7III rewritten around the final constitutional structure; White Paper \u00a74 aligned to the same article model.\n- **Load-bearing integrations:**\n  - **P-026** \u2014 the Founding Order establishes the scale, consent, and exit foundation across the full architecture.\n  - **Proposal 1** \u2014 the architectural enforcement layer remains bound to Article I rights protections.\n  - **P-017** \u2014 oracle requirements (N\u22655, three methodology classes, adversarial seat) remain anchored in Article III Physics & Reserves.\n  - **P-024** \u2014 attestation stake integrates with Article VI contribution recognition.\n  - **P-029 through P-033** \u2014 PFCR, anti-dynasty, stewardship ownership, and enterprise-governance architecture remain integrated inside Article V.\n- **Dependencies:** downstream annexes, simulations, and support docs must stay aligned to the final article structure and instrument names.\n- **New risks introduced:** Article V now concentrates more of the economic surface under one constitutional home. Mitigation: explicit internal boundaries between Flow, housing and commons use-rights, enterprise, and PFCR, plus public interface definitions and audit visibility.\n- **Residual risk:** future edits that blur article boundaries can recreate the fragmentation or overlap this consolidation removed. Mitigation: the constitutional article interfaces in Humane Constitution \u00a7III remain authoritative.\n- **Compound linkages:** P-027 \u00d7 P-026 (the Founding Order supplies the constitutional foundation); P-027 \u00d7 P-017 (Article III inherits the oracle hardening); P-027 \u00d7 P-029 (PFCR remains inside Article V instead of becoming a detached fiscal system); P-027 \u00d7 P-008 (fewer institutional homes reduce elite-formation surface area).\n- **Auto-close clause:** P-027 is standing. Any change to the number of constitutional articles or to the existence of the Founding Order requires Tier 1 amendment (7-of-9, 180-day timelock). Content within the articles may be amended by ordinary process subject to the existing Tier classifications of each clause.\n\n---\n\n### P-035 \u2014 Founding Group Corrigibility and Epistemic Humility\n\n**Threat addressed:** founding group capture / Babel-risk (structural overconfidence)\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Philosophical Preamble (closing paragraph) and \u00a70A (Moral Scope, Spiritual Limits, and Stewardship Orientation)\n\n**Problem diagnosed:**\nThe Preamble's statement \"If it is wrong, people should be able to show where\" is passive \u2014 it does not explicitly subject the founding group to the same corrigibility requirements it names for administrators. The rhetorical confidence of the document can imply that the design team has solved a problem that only ongoing moral community and dependence on God can sustain. This creates Babel-risk: a system that trusts its own architecture more than it trusts the communities and the God it claims to serve.\n\n**Introduced design:**\n- Preamble: explicit statement that founders are not exempt from the failures named in the document; the founding group must be the first to submit to correction.\n- \u00a70A: explicit statement that the system does not claim to reflect the mind of God; it reflects fallible human judgment that remains open to correction.\n\n**New risks introduced:**\n- Overly humble framing could be exploited to argue that all constitutional protections are provisional. Mitigated: the epistemic humility clauses apply to the founders' judgment about design, not to the dignity floor itself (separately protected by Tier 1 amendment requirements).\n\n**Residual risk:** Founding group may still exercise disproportionate influence during the founding window. The corrigibility clause is a normative commitment, not a structural enforcement mechanism. Structural enforcement is addressed by P-036.\n\n---\n\n### P-036 \u2014 Keyholder Servanthood Duty\n\n**Threat addressed:** amendment lock capture by founding group\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article I \u2014 Rights & Rules (Hard locks section)\n\n**Problem diagnosed:**\nThe 7-of-9 amendment lock protects the dignity floor from bad changes. But the same lock also protects the founders' judgment about what the dignity floor contains. If keyholders act in self-interest \u2014 delaying replacement of founding-era text, blocking challenges to their own authority \u2014 the lock becomes a tool of entrenchment rather than protection.\n\n**Introduced design:**\nExplicit constitutional statement that keyholder authority is custodial, not proprietary; keyholders may not use the lock to entrench founding group power; a qualified independent review body may petition for keyholder replacement when self-interest is demonstrated.\n\n**Dependencies:** The independent review body referenced here is the Federated Ombuds structure defined under P-025.\n\n**New risks introduced:**\n- \"Demonstrable self-interest\" requires interpretation. Mitigated: determination is made by the Federated Ombuds (P-025), not by the keyholders themselves.\n\n**Residual risk:** External pressure on keyholders (coercion, blackmail) is not addressed by internal accountability mechanisms. See P-034 residual risk for the same limitation.\n\n---\n\n### P-037 \u2014 Identity Serves the Person\n\n**Threat addressed:** identity system creep / surveillance expansion\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article II \u2014 Personhood, Identity & Continuity\n\n**Problem diagnosed:**\nAny identity system faces institutional pressure to expand verification requirements, cross-reference databases, and build behavioral profiles over time. Without a mandatory review cycle, \"minimum data for minimum access\" tends to expand into a comprehensive scoring regime.\n\n**Introduced design:**\nMandatory triennial review of identity data use; secondary use requires Article VI deliberative authorization with a published sunset date that cannot be made permanent by administrative action alone.\n\n**New risks introduced:**\n- Review cycles could be gamed or delayed. Mitigated: triennial requirement is constitutional; delay beyond the cycle is a reportable failure under Article VII.\n\n**Residual risk:** Administrative pressure to expand identity data use will recur in each review cycle. The review requirement creates a forcing function but does not eliminate the pressure.\n\n---\n\n### P-038 \u2014 Community Voice in Measurement\n\n**Threat addressed:** T-006 (oracle institutional blindness / measurement capture)\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article III \u2014 Real Capacity & Reserves\n\n**Problem diagnosed:**\nThe oracle quorum defends against manipulation but not against shared institutional blindness \u2014 the systematic tendency of measurement systems to reflect the assumptions of the institutions that design them rather than the lived reality of affected communities.\n\n**Introduced design:**\nConstitutional community challenge path: written submission to oracle quorum, mandatory 14-day published response, challenge submissions published alongside official figures.\n\n**Dependencies:** Oracle quorum publication infrastructure must support community submission intake and co-publication.\n\n**New risks introduced:**\n- Challenge system could be flooded with bad-faith submissions. Mitigated: prima facie threshold for mandatory response.\n\n**Residual risk:** Communities with less documentation capacity will use the challenge path less. Outreach and accessibility design are required \u2014 not addressed by this patch alone.\n\n---\n\n### P-039 \u2014 Protection of Pre-Existing Care Networks\n\n**Threat addressed:** institutional crowding-out of voluntary community\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article IV \u2014 Survival\n\n**Problem diagnosed:**\nA comprehensive constitutional delivery floor for survival essentials can inadvertently displace the mutual aid groups, religious food pantries, family networks, and neighborhood care structures that communities depend on \u2014 especially when the delivery system fails.\n\n**Introduced design:**\nConstitutional statement that Article IV is a floor not a monopoly; explicit duty to support pre-existing care networks; affirmation that the constitutional floor protects the conditions for voluntary generosity rather than replacing it.\n\n**New risks introduced:**\n- \"Must not displace\" is a normative commitment difficult to enforce mechanically. Mitigated: Article VII warning system can measure whether voluntary care networks are growing or shrinking post-implementation.\n\n**Residual risk:** Economic logic of consolidated delivery systems tends to crowd out smaller providers regardless of constitutional intent. Periodic measurement and active funding of voluntary-sector infrastructure are required.\n\n---\n\n### P-040 \u2014 Article V Housing Cap Pastoral Revision and Structural Humility\n\n**Threat addressed:** household penalization; Babel-risk structural overconfidence\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article V \u2014 Markets, Commons & Public Finance (housing allocation section; closing paragraph)\n\n**Problem diagnosed:**\n(1) The phrase \"regardless of household composition decisions\" treated a resource constraint as though it were a judgment about family structure. Large families, multigenerational households, and care-intensive arrangements may find the cap hostile if applied without a pastoral presumption of accommodation.\n(2) Article V's closing paragraph presented the five-instrument architecture with confidence that the design prevents exploitation. This exceeds what human institutions can reliably deliver.\n\n**Introduced design:**\n(1) Housing cap language revised: \"fiscal guarantee\" framing retained; pastoral review with strong presumption of accommodation added; \"mercy before procedure\" standard stated.\n(2) Structural humility closing paragraph added: names the limits of structural engineering and requires ongoing community paths to name and correct exploitation.\n\n**New risks introduced:**\n- \"Strong presumption of accommodation\" may be interpreted to override the cap entirely. Mitigated: \"fiscal guarantee\" framing preserved \u2014 the commons does not owe unlimited expansion; the review process applies mercy within real resource constraints.\n\n**Residual risk:** Review panels may apply \"mercy before procedure\" inconsistently across communities. Published review criteria and appeals paths are the mitigation; this patch adds the normative standard.\n\n---\n\n### P-041 \u2014 Recognized-Contribution Audit Requirement\n\n**Threat addressed:** T-008 (elite / professional-contributor capture of civic layer)\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article VI \u2014 Voice, Service Record & Public Decisions (Contribution and capability section)\n\n**Problem diagnosed:**\n\"Verified contribution\" as the basis for civic standing creates systematic pressure to perform contribution in legible, verifiable ways. Contributions that resist easy documentation \u2014 informal care, spiritual leadership, mutual aid, neighborhood presence, parenting \u2014 will be consistently underrepresented in the Service Record eligible pool.\n\n**Introduced design:**\nMandatory biennial audit of the recognized-contribution definition; explicit constitutional statement that informal, spiritual, and pastoral contributions must not be excluded by documentary difficulty alone; 180-day correction requirement when gaps are found.\n\n**Dependencies:** Audit body must be independent of the civic administration it is reviewing \u2014 consistent with Article VII independence requirements.\n\n**New risks introduced:**\n- \"Effect on human flourishing\" as a measurement criterion is harder to verify than documented hours. Mitigated: the audit requirement is about the framework definition, not individual claims.\n\n**Residual risk:** The gap between the ideal (invisible work recognized) and the operational (verification required) will persist. The audit creates a forcing function for closing it over time.\n\n---\n\n### P-042 \u2014 Community Alert Pathway\n\n**Threat addressed:** institutional capture of warning function; prophetic voices blocked\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** Article VII \u2014 Public Records & Warning Systems\n\n**Problem diagnosed:**\nArticle VII's warning function is defined, funded, and structured by the same apparatus it is meant to watch. Communities affected by systemic failures often see them earlier and more accurately than institutional reviewers \u2014 but currently have no constitutionally protected path to name them.\n\n**Introduced design:**\nConstitutionally protected community alert pathway: low-barrier, optionally anonymous, accessible without legal representation; 30-day acknowledgment requirement; 90-day formal review trigger for prima facie systemic failures; refusal to acknowledge or review is itself a reportable failure.\n\n**Dependencies:** Article VII independence requirement applies \u2014 the body managing community alerts must not be the same body whose performance is being reported.\n\n**New risks introduced:**\n- Alert pathway could be used for political harassment or coordinated false-flag campaigns. Mitigated: prima facie threshold for mandatory review; anonymous alerts published but not automatically elevated without threshold evidence.\n\n**Residual risk:** Power asymmetry between institutional reviewers and community reporters will persist. The pathway lowers the barrier; it does not equalize resources for evidence-gathering.\n\n---\n\n### P-043 \u2014 Logical-Analysis Corpus Corrections\n\n**Threat addressed:** T-001, T-002, T-004, T-007, T-generic (amendment capture, definitional ambiguity, status misrepresentation)\n**Status:** ACTIVE | **Priority:** High\n\n**Constitutional text:** ANNEX_AH.md, ANNEX_Y.md, INVARIANTS.md, SPECIFICATIONS.md, Humane_Constitution.md, Patch_Log.md, Threat_Register.md\n\n**Problem diagnosed:**\nSystematic logical analysis identified 18 issues across the corpus: 4 critical (including a Tier 1 amendment architecture paradox and a literal unfilled placeholder), 11 major (internal contradictions, definitional gaps, inconsistent status reporting), and 3 minor (structural tensions and epistemological inconsistencies).\n\n**Introduced design:**\n\n- **ANNEX_AH.md \u00a7AH2 header** \u2014 Updated heading from \"14 Days\" to \"60 Days minimum, per P-020 amendment.\" Heading was not updated when P-020 extended the window.\n- **Patch_Log.md P-014 entry** \u2014 Added parenthetical noting P-020 extended the 14-day challenge window to 60 days minimum.\n- **Threat_Register.md Complete Register Summary** \u2014 Corrected T-001, T-002, T-004, T-007 status from ACTIVE to Active \u2014 unproven to match the dashboard and individual entries.\n- **INVARIANTS.md INV-007** \u2014 Resolved the Tier 1 amendment paradox. \"Unamendable by any in-system process\" is replaced with precise language: Tier 1 is changeable only via the Tier 1 process (7-of-9 keyholder signatures + 180-day timelock, FC-110/FC-111). FC-110 and FC-111 are themselves Tier 1 protected. Changes to the amendment mechanism require H-3 refounding authority. P-014 is permanently closed.\n- **SPECIFICATIONS.md \u00a73.4** \u2014 Replaced \"full constitutional refounding under P-014 procedure\" with Tier 1 amendment process language and H-3 refounding authority reference.\n- **ANNEX_Y.md \u00a7Y5** \u2014 Added: H-3 refounding authority is a full constitutional convention, superseding the closed P-014.\n- **ANNEX_Y.md \u00a7Y4** \u2014 Filled the literal `[ACCEPTABLE_CSM_FAILURE_THRESHOLD]` bracket placeholder with provisional value: 3 verified delivery failures (FC-YT1, pre-launch blocking gate, must be confirmed before operational activation).\n- **SPECIFICATIONS.md \u00a73.3** \u2014 Added caregiver/dependent carve-out to the non-transferability rule, making it consistent with the Constitution's household pooling and delegated spend authority provisions.\n- **SPECIFICATIONS.md \u00a74.2** \u2014 Replaced \"two separate rules\" bridging note with an integration formula: the 300-unit issuance ceiling sets the quarterly stock; the 100-unit weight table caps each individual deployment draw. Sequential constraints, not competing ones.\n- **SPECIFICATIONS.md \u00a74.3** \u2014 Fixed sector ceiling arithmetic justification: reframed from Voice supermajority to Service Record governance panel concentration. Added note that P-008 is PROPOSED and P-025 is the operative ACTIVE authority for the 20% ceiling.\n- **SPECIFICATIONS.md \u00a78** \u2014 Added pre-launch blocking gates note to the Parameter Summary, clarifying that reserved parameters are not design gaps.\n- **Humane_Constitution.md Article V** \u2014 Added operational definitions of \"compounding interest\" (capitalisation-based, includes fee-equivalent traps) and \"household ordinary-life debt\" (personal/family purposes; excludes enterprise debt and voluntary investment instruments).\n- **Humane_Constitution.md Philosophical Preamble** \u2014 Added produced/shared value working test: three concrete examples (land labour, software, enterprise) and an appeal path reference.\n- **Humane_Constitution.md Founding Order** \u2014 Added dignity floor delivery obligation: 2% PFCR cross-boundary allocation minimum, published accounting of unmet commitments in adjacent non-consenting communities.\n\n**New risks introduced:**\n- The provisional CSM failure threshold (3 failures) requires founding commitment confirmation. If not confirmed before activation, the threshold remains provisional \u2014 which is by design (pre-launch blocking gate).\n\n**Residual risk:** Issues 4 (bootstrap circularity), 8 (silence tension), 12 (single-source philosophy), and 18 (structural vs. moral sufficiency tension) are acknowledged as honest philosophical tensions named in the corpus. They are not resolved by this patch; they are monitored as open interpretive questions.\n\n---\n\n### P-044 \u2014 Threat-Strengthening Batch\n\n**Status:** ACTIVE  \n**Date:** 2026-05-02  \n**Related threats:** T-001, T-002, T-004, T-005, T-007, T-018, T-019  \n**Core change:** Close mitigation gaps identified by systematic threat survey. Tighten Active \u2014 unproven threats with open gaps, add missing evidentiary standards, and fill operational voids in audit timelines and authority chains.\n\n**Changes included in this patch:**\n\n- **ANNEX_AI.md \u00a74.1** \u2014 Reproduced the T-019 three-criterion evidentiary standards inline (replacing a dangling \"incorporated by reference\" to a deleted prior section). Standards now specify: timing proximity (72-hour window, heightened scrutiny only), proportionality anomaly (disproportionate scope relative to documented need), no documented operational basis (contemporaneous record within 4-hour window). Three-tier outcome logic: all three \u2192 deliberate manufacture; two \u2192 provisional with 48-hour extension; one \u2192 logged only. Conservative default: flag stays active during pendency.\n- **ANNEX_AP.md \u00a7AP1** \u2014 Added cap-reset audit procedure: Federated Ombuds as responsible authority; 7-day open window; 30-day findings deadline; evidentiary standard (clear and convincing evidence); cap-counter freeze during audit; two outcome paths (reset to zero or count unchanged). Closes T-018 cap-reset void.\n- **ANNEX_AB.md \u00a7AB2** \u2014 Added FC-010 calibration methodology requirement: Article VII annual audit must publish the empirical/modelling basis for leakage thresholds, revision triggers, and methodology changes. Thresholds not documented in a published audit are not valid enforcement baselines. (T-001)\n- **ANNEX_AB.md \u00a7AB3** \u2014 Added invisible-work backstop: P-041 biennial recognized-contribution audit named as enforcement backstop for \u00a7AB3; findings requiring correction must be incorporated within 180 days; deficient contribution scores suspended from Voice/Service Record inputs until corrected. (T-004)\n- **ANNEX_AB.md \u00a7AB5** \u2014 Added registry administration clause: Federated Ombuds as custodian; no unilateral definition authority; Tier 2 amendment pathway; annual public review window; prima facie disputes forwarded to CRP. (T-007)\n- **ANNEX_AK.md** \u2014 Promoted the AED commitment architecture and later superseded FC-140 anchors. Current FC-140 values are target \u22642%, upper bound \u22645%, trigger \u22653% per quarter; see `/founding/commitments.md` and the Parameter Calibration Register. (T-002 / P-016)\n- **README.md** \u2014 Updated stale patch counts: 31\u219240 total, 16\u219225 active (two locations).\n- **ANNEX_Y.md \u00a7Y7** \u2014 Filled `[RESERVE_WINDOW_DAYS]` placeholder with provisional value: 90 days (FC-YT2, pre-launch blocking gate).\n- **CLAUDE.md** \u2014 Corrected \"Provenance_Map.md is planned\" \u2192 \"serves as\" (file already exists).\n- **Patch_Log.md P-005** \u2014 Advanced from PROPOSED \u2192 ACTIVE: ANNEX_AC1 design is complete; residual risks (sub-panel capture, throughput theater) are acknowledged and monitored.\n\n**New risks introduced:** This batch promoted statuses and bound provisional fraud-rate anchors, and that introduces residual risk. (1) Premature reliance \u2014 readers may treat the promoted statuses (e.g. P-005 advanced to ACTIVE) as field-tested rather than designed-and-monitored. (2) Parameter confusion \u2014 later FC-140 values supersede this batch's older anchor language and may still be mistaken for proven or evidence-backed thresholds. (3) Calibration drift \u2014 anchors set before pilot confirmation can drift or be quietly normalized as \"the number\" before any pilot evidence validates them. Mitigated by: the parameter register, pre-launch blocking gates, and the residual-risk note below.\n\n**Residual risk:** FC-140 through FC-145 have bound starting values, while FC-146 through FC-150 remain pre-launch commitments pending pilot data and founding adoption. P-016 remains PROPOSED / pre-ratification until the founding coalition confirms rate targets after first-year pilot evidence.\n\n---\n\n### P-045 \u2014 Threat-Mitigation Batch\n\n**Threats addressed:** T-001, T-002, T-004, T-007, IC-004  \n**Status:** ACTIVE | **Priority:** Critical  \n**Date:** 2026-05-02\n\n**Constitutional text:** ANNEX_AB.md (\u00a7AB2, \u00a7AB3, \u00a7AB5), ANNEX_AK.md (\u00a77, \u00a78), ANNEX_AH.md (\u00a7AH5.1)\n\n**Problem diagnosed:**\nFive critical threats remained at Active \u2014 unproven status with specific unresolved gaps: T-001 lacked threshold derivation logic (arbitrary numbers); T-002 had no procedural protection for excluded persons before rate targets are formally bound; T-004 had no enumerated floor for invisible/care work; T-007's registry started empty (first-mover capture window); IC-004 had no recovery path after P-013 suspension.\n\n**Introduced design:**\n\n- **ANNEX_AB.md \u00a7AB2** \u2014 Added enforcement-capacity derivation formula: FC-010 thresholds are derived from minimum detectable enforcement rate (N \u00f7 P). FC-010 3% = 2\u00d7 min-detectable rate; 7% = 5% supply-harm threshold. Audit participation designated as a qualified civic duty; resourcing limitations cannot justify raising thresholds. (T-001)\n- **ANNEX_AB.md \u00a7AB3** \u2014 Added enumerated contribution floor: six founding categories (primary caregiving, elder care, mutual aid, spiritual community leadership, unpaid household management, informal health work) with burden reversal. Self-attestation accepted; disproof burden on system. Extension via Tier 2; removal requires Tier 1 + impact assessment. (T-004)\n- **ANNEX_AB.md \u00a7AB5** \u2014 Added founding seed list: 14 Tier 2 protected terms (survival, survival floor, personhood, Essential Access, Flow, Voice, Service Record, non-convertibility, coercion, scarcity, contribution, identity, dignity, capacity) locked at founding. Adversarial review requirement before ratification. (T-007)\n- **ANNEX_AK.md \u00a77** \u2014 Added Asymmetric Default Rule: system bears burden of proof for all exclusion decisions; independent time-bounded review (14-day deadline) required before any Essential Access exclusion is final; exclusions without timely determination automatically reversed. (T-002)\n- **ANNEX_AK.md \u00a78** \u2014 Added Independent Identity Auditor mandate: quarterly public reports on fraud/exclusion rates per tier and vulnerable category; absence-of-data is a reportable failure; two consecutive quarters without data triggers Federated Ombuds referral; IIA appointment/removal requires Tier 2 amendment. (T-002)\n- **ANNEX_AH.md \u00a7AH5.1** \u2014 Replaced IC-004 governance-gap note with Dignity-Only Continuity Mode specification: CSM continues; governance suspended; 180-day trigger opens re-founding petition window (500 joint signatories to submit; 1,000 attestations to advance); P-014 non-precedent status unaffected; CSM floor cannot be suspended. (IC-004)\n\n**New risks introduced:**\n- The founding seed list authors own the semantic baseline permanently \u2014 mitigated by the mandatory adversarial review requirement before ratification.\n- The 14-day independent review deadline for identity exclusions requires review infrastructure to be operational at launch \u2014 this is a pre-launch blocking gate.\n- The 180-day dignity-only continuity period may be too long for urgent governance needs \u2014 mitigated by the automatic petition window at 180 days and the Federated Ombuds continuing to operate throughout.\n\n**Residual risk:** T-001, T-002, T-004, and T-007 remain Active \u2014 unproven pending pilot data confirmation. IC-004 is Active \u2014 unproven \u2014 the governance gap is now specified with a fallback mechanism but has not been field-tested.\n\n---\n\n### P-046 \u2014 Evidence and Capture Hardening Suite\n\n**Threats addressed:** Multiple control-plane and evidence-status risks, including T-005, T-008, T-016, T-017, T-022, T-023, T-025, T-026, T-027, and implementation-drift risk.\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-04\n\n**Constitutional text:** [Humane_Constitution.md \u00a70 and Article VII](../constitution/Humane_Constitution.md); [INVARIANTS.md \u00a7 Invariant Violation Detection](../constitution/INVARIANTS.md); [Acceptance_Protocol.md \u00a7 Pre-Launch Blocking Gates](../constitution/Acceptance_Protocol.md); [ANNEX_AH.md \u00a7 AH2](../annexes/ANNEX_AH.md); [ANNEX_C.md \u00a7 C-3/C-5](../annexes/ANNEX_C.md); [ANNEX_AO.md Part 1/2](../annexes/ANNEX_AO.md)\n\n**Problem diagnosed:**\nThe project had strong mechanisms and evidence packages, but seven proof surfaces remained too implicit: implementation drift, collapse-state traceability, parameter calibration, capture metrics, reusable abuse patterns, claim-evidence levels, and founding legitimacy. Without explicit artifacts, public language could outrun proof and technical compliance could be mistaken for legitimate activation.\n\n**Introduced design:**\n\n- **Implementation Drift Audit Package** \u2014 adds tests for reproducible hashes, append-only log behavior, publication-channel divergence, startup refusal, key custody, timelock response, and supply-chain bypass.\n- **Collapse-State Crosswalk** \u2014 maps every threat to Survival-Trade Bind, Power-Wealth Convergence, Static-Advantage Loop, and control-plane failure.\n- **Parameter Calibration Register** \u2014 tracks high-risk FC values, current status, rationale, capture route, evidence needed, revision trigger, and governing documents.\n- **Capture Dashboard Specification** \u2014 defines privacy-preserving public indicators for civic role concentration, Ombuds independence, definition capture, procurement/legal-wrapper capture, identity gatekeeping, and implementation drift.\n- **Abuse Case Library** \u2014 introduces reusable bad-actor patterns so patch intake and closure must test against plausible corruption routes and false reassurances.\n- **Evidence Ladder** \u2014 defines claim-strength levels, upgrade rules, downgrade rules, and forbidden status jumps.\n- **Founding Legitimacy Dossier** \u2014 defines the evidence burden for founding authority: scope, conflicts, notice, deliberation, consent, objections, exit rehearsal, dignity-floor non-coercion, founder sunset, and independent review.\n- **Architecture files** \u2014 implementation binding and drift chain now distinguish Tier 1 state hashing from implementation attestation records.\n- **Constitution and invariants** \u2014 added narrow cross-references making founding legitimacy and implementation drift public evidence duties.\n\n**New risks introduced:**\n- The new registries can become bureaucratic compliance artifacts if not tied to real tests. Mitigated by Evidence Ladder downgrade rules and Abuse Case Library false-reassurance fields.\n- Capture dashboards can become ranking tools. Mitigated by Article VII privacy language and dashboard rule that ordinary persons may not be ranked.\n- Implementation attestations can create false technical confidence. Mitigated by explicit claim boundaries in the Implementation Drift Audit Package.\n\n**Residual risk:** These upgrades make proof obligations clearer; they do not prove the system works. The highest residual risks remain founding consent theater, keyholder social capture, dashboard gaming, parameter arbitrariness, and technically valid but hostile amendment.\n\n---\n\n### P-047 \u2014 Essential-Sector Conglomerate Transition\n\n**Threats addressed:** T-025, T-026, T-027, T-028, external dependency capture, procurement capture, medicine-access capture, and essential-sector refusal risk.\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-04\n\n**Constitutional text:** [ANNEX_AT.md \u00a7 AT6.5 and AT8](../annexes/ANNEX_AT.md); [Capture_Dashboard_Specification.md \u00a7 Money, Procurement, And Legal Wrapper Capture](./Capture_Dashboard_Specification.md); [Conglomerate_Transition_Dossier.md](./Conglomerate_Transition_Dossier.md)\n\n**Problem diagnosed:**\nThe external-trade and anti-rent architecture named supply-chain dependency, public-return/source-base capture, and legal-wrapper risk, but it did not yet explain how incumbent oil, energy, medicine, logistics, and PBM-style medicine-access conglomerates would operate under the system. Without a sector-specific transition doctrine, the project risked relying on moral persuasion while firms with essential chokepoints could rationally leave, litigate, lobby, retaliate, or route control through foreign affiliates.\n\n**Introduced design:**\n\n- **Conglomerate Transition Dossier** \u2014 defines the operating rule: firms may earn Flow for verified production, reliability, transition work, innovation, and public-interest delivery; they may not convert survival chokepoints into rule authority or survival leverage.\n- **Numeric evidence anchors** \u2014 records real-world scale indicators: energy investment, fossil dependence, petroleum import/export flows, PBM prescription concentration, health spending, public procurement scale, lobbying spend, and beneficial-ownership risk.\n- **Sector models** \u2014 distinguishes oil/fossil firms, energy utilities/grid operators, and medicine manufacturers/PBMs, with allowed activity, prohibited leverage, compliant incentives, and refusal fallback.\n- **Refusal survivability tests** \u2014 requires largest-supplier exit modeling, reserve drawdown duration, medicine stockpile audit, compliant-bidder count, beneficial-owner trace, lobbying/capture exposure, and public fallback capacity before stronger claims.\n- **Annex AT interface** \u2014 adds AT6.5 so essential-sector conglomerates are treated as survival-leverage actors when their refusal, litigation, patent hold, supply-chain delay, or standards-body campaign can materially impair the CSM floor.\n- **Capture dashboard additions** \u2014 adds essential-sector refusal exposure and lobbying/capture exposure by contract value.\n\n**New risks introduced:**\n- Public procurement could overpay incumbents to keep them inside the system, creating disguised bailouts. Mitigated by compliant-margin tests, public fallback modeling, and beneficial-owner trace requirements.\n- Refusal drills could reveal sensitive supply-chain weaknesses. Mitigated by public class-level reporting with restricted operational detail where disclosure would improve attack execution.\n- Regulated utility treatment could entrench incumbents. Mitigated by performance metrics, public receiver authority, distributed/community fallback, and capture dashboard review.\n\n**Residual risk:** This patch makes the hard bargain explicit; it does not prove that fallback capacity can be built fast enough. The largest unresolved question is numeric: how many days can people keep eating, heating, traveling, communicating, and receiving medicine if the largest incumbent in a category says no?\n\n---\n\n### P-048 \u2014 Essential-Sector Refusal Operationalization\n\n**Threats addressed:** T-025, T-026, T-027, T-028, external dependency capture, medicine-access capture, grid/logistics chokepoint risk, and essential-sector refusal leverage.\n**Patch relation:** Operationalizes P-047.\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-04\n\n**Constitutional text:** [ANNEX_AT.md \u00a7 AT2.4 and AT6.5](../annexes/ANNEX_AT.md); [Parameter_Calibration_Register.md \u00a7 Seed Register](./Parameter_Calibration_Register.md); [Essential_Sector_Refusal_Test_Package.md](./Essential_Sector_Refusal_Test_Package.md); [05_life_and_rights.md](../public/05_life_and_rights.md)\n\n**Problem diagnosed:**\nP-047 defined the essential-sector conglomerate transition doctrine, but the project still needed operational drills, parameter rows, tighter Annex AT triggers, public-facing explanation, and a broader evidence pass for medicine patents, shortages, grid bottlenecks, fossil transition risk, and utility regulation.\n\n**Introduced design:**\n\n- **Essential-Sector Refusal Test Package** \u2014 adds largest oil/fuel supplier exit, largest medicine supplier/PBM refusal, and largest grid/logistics delay drills, with reserve drawdown, fallback capacity, compliant-bidder count, capture exposure, evidence packet, pass/fail, and residual-risk requirements.\n- **FC-194 through FC-201** \u2014 adds reserved/draft calibration rows for essential fuel reserves, medicine stockpiles, supplier concentration, public fallback deadlines, procurement concentration, PBM/intermediary separation, logistics redundancy, and essential data/claims portability.\n- **Annex AT tightening** \u2014 defines foreign-affiliate routing, survival-leverage actors, public receiver authority, and compulsory licensing/public manufacturing triggers for CSM-designated medicines.\n- **Public explainer** \u2014 adds \"How Big Companies Work Here\" for non-technical readers: profit remains allowed; hostage power does not.\n- **External evidence expansion** \u2014 adds sources for pharma patent-listing/evergreening risk, drug shortages, transformer/grid supply-chain bottlenecks, fossil transition/stranded-asset exposure, and utility regulation.\n\n**New risks introduced:**\n- Receiver authority and compulsory licensing can be abused if triggered on weak evidence. Mitigated by functional trigger definitions, Article VII publication, compensation/public-use standards, and refusal-drill evidence packets.\n- Public refusal drills can reveal operational weaknesses. Mitigated by class-level public reporting and justified redaction of exploit-enabling details.\n- Parameter draft anchors may be mistaken for proven values. Mitigated by reserved status and the Parameter Calibration Register's revision-trigger discipline.\n\n**Residual risk:** The package makes essential-sector refusal testable; it does not supply the physical reserves, manufacturing capacity, alternate operators, legal judgments, or treaty capacity needed to pass. The decisive future evidence remains sector-by-sector: how long the CSM floor holds when the largest incumbent refuses.\n\n---\n\n### P-049 \u2014 Evidence-Gap Bridge Alignment\n\n**Threats addressed:** Multiple evidence-gap and status-drift risks across founding legitimacy, essential-sector refusal, implementation drift, public readiness, and evidence-register consistency.\n**Status:** ACTIVE | **Priority:** High\n**Date:** 2026-05-04\n\n**Constitutional text:** No new constitutional text. Governance and public-readiness integration only.\n\n**Problem diagnosed:**\nRecent hardening work created stronger test artifacts, but the live dashboards still left some gaps implicit. The Founding Legitimacy Dossier now has an artifact-status register, and the Essential-Sector Refusal Test Package now defines sector drills, but several reader-facing and governance trackers still described the gaps in older, broader language.\n\n**Introduced design:**\n\n- **Hardening Queue alignment** \u2014 connects essential-sector refusal to the dedicated test package and reframes founding legitimacy around artifact production, not only design existence.\n- **Open Problems bridge** \u2014 updates essential-sector and founding rows so required proof points include the newest refusal drills, artifact-status register, medicine/PBM refusal path, grid/logistics delay path, and parameter/capture links.\n- **Pilot Roadmap bridge rules** \u2014 adds explicit Phase 9 and Phase 11 pass boundaries: paper capacity and clean technical integrity cannot substitute for refusal evidence or legitimate founding artifacts.\n- **Public readiness bridge** \u2014 adds plain-language warnings for essential-company refusal and founding-vote theater.\n- **Evidence-gap language** \u2014 narrows source gaps so the project asks for drill outputs and founding artifacts, not only general outside analogies.\n\n**New risks introduced:**\n- Cross-register alignment can create the appearance of progress without real evidence. Mitigated by repeating that these are bridge rules and evidence packets, not passed pilots.\n- More references can increase reader burden. Mitigated by putting the strongest public framing in the Public Readiness Guide and keeping detailed proof duties in governance registers.\n\n**Residual risk:** P-049 improves traceability; it does not close the underlying gaps. The unresolved work remains physical refusal capacity, real founding artifacts, independent review, and pilot evidence.\n\n---\n\n### P-053 \u2014 Whistleblower Protection and Anti-Retaliation Protocol\n\n**Threats addressed:** Insider retaliation risk against community alert reporters and Service Record audit requesters; Priya-type attack path (retaliatory record modification by named respondent before investigation completes).\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-07\n\n**Constitutional text:** [ANNEX_AW.md](../annexes/ANNEX_AW.md); Article VII (reporter protection clause)\n\n**Problem diagnosed:**\nThe community alert pathway (Article VII) and Service Record audit mechanism (Article VI) require ordinary people to name wrongdoing by administrators. Without explicit protection, a corrupt administrator can use their remaining administrative access to modify the reporter's Service Record, flag contributions \"under review,\" and revoke civic eligibility before any investigation completes. The Priya vignette in the Fairness Vignette Library documented this exact attack path. A system that cannot protect its own reporters will quickly teach everyone not to report.\n\n**Introduced design:**\n\n- **Administrative freeze on filing:** named respondents' write access to the reporter's records is automatically suspended from the moment a report is filed.\n- **Automatic escalation of retaliatory actions:** any attempted modification during the protected period is rejected, logged, and escalated to the Federated Ombuds within 24 hours.\n- **\"Under review\" flag governance:** flags require independent reviewer appointment (not self-authorization), evidence-based grounds, 45-day maximum duration, and automatic removal on expiry without finding.\n- **Restoration on exoneration:** retaliatory modifications are reversed; lost civic roles are restored or queued.\n- **Constitutional amendment:** reporter protection clause added to Article VII.\n\n**New risks introduced:**\n- The administrative freeze could be triggered by bad-faith reports. Mitigated by: the freeze affects only write access (not the respondent's own records), bad-faith reports are subject to the same accountability process as any false claim, and the Federated Ombuds reviews the freeze on filing.\n- Coordinated retaliation by multiple actors not individually named. Named as a residual risk in Annex AW \u00a7AW5; monitored through the community alert pathway.\n\n**Residual risk:** Informal retaliation (social pressure, community reputation) cannot be prevented by administrative controls. Culture and enforcement of the broader anti-capture provisions are the only long-term check.\n\n---\n\n### P-054 \u2014 Confidential Enrollment and Safety-Identity Protocol\n\n**Threats addressed:** Identity disclosure as a safety vector for domestic violence survivors, trafficking victims, and persons in safety-compromised situations; Elena-type attack path (wallet identity creates tracking vector for abuser via compromised administrator).\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-07\n\n**Constitutional text:** [ANNEX_AX.md](../annexes/ANNEX_AX.md); Article II (safety-shielded enrollment clause)\n\n**Problem diagnosed:**\nThe one-person-one-wallet requirement links identity to an administrator-visible record. For persons in documented safety situations, this creates a tracking vector for abusers, traffickers, or persecutors who have access to administrative channels. The Elena vignette documented this gap. The existing Asymmetric Error Doctrine (Annex AK) treats this as a calibration problem; P-054 treats it as a safety override \u2014 for persons in documented danger, the safety interest overrides the normal fraud/exclusion calibration.\n\n**Introduced design:**\n\n- **Safety-shielded enrollment pathway:** legal identity linked to wallet through a cryptographically sealed record; all location and identity fields suppressed from administrator-visible database.\n- **Address-blind delivery:** Essential Access delivered through anonymous pickup points, trusted community organizations, or encrypted digital channels without geolocation.\n- **Emergency enrollment:** 30-day temporary access on credible assertion without documentation, with support pathway to full safety-shielded enrollment.\n- **Documentation-free emergency path:** single-use 72-hour tokens for persons with no documentation, with connection to enrollment support organizations.\n- **Sealed record access governance:** sealed records accessible only by court order or Federated Ombuds finding; access requests logged and reported to the enrolled person within 72 hours.\n- **Constitutional amendment:** safety-shielded enrollment clause added to Article II.\n\n**New risks introduced:**\n- Emergency enrollment without documentation could be used for fraud. Mitigated by: 30-day window with transition requirement, the AK fraud-rate monitoring catches aggregate fraud signals, and false safety assertions are subject to accountability.\n- Sealed records could be accessed under pretextual court orders. Mitigated by: access limited to credible fraud investigation (not immigration enforcement or administrative convenience), Ombuds review authority, and notification to the enrolled person on any access request.\n\n**Residual risk:** Persons whose abuser controls their access to enrollment points cannot use this pathway. Long-term immigration or citizenship questions for undocumented persons are not resolved by AX \u2014 Essential Access continuity is provided, not immigration status.\n\n---\n\n### P-055 \u2014 Delivery Sufficiency Standard\n\n**Threats addressed:** Gap between constitutional guarantee of Essential Access and operational delivery for incarcerated persons, non-enrolled communities, persons unable to use digital interfaces, and persons in non-consenting jurisdictions.\n**Status:** ACTIVE | **Priority:** Critical\n**Date:** 2026-05-07\n\n**Constitutional text:** [ANNEX_AY.md](../annexes/ANNEX_AY.md); Article IV (delivery sufficiency obligation clause)\n\n**Problem diagnosed:**\nMultiple vignettes in the Fairness Vignette Library showed that the constitutional guarantee of Essential Access does not translate to operational delivery for several populations (Miriam, Ray, Amara, Yoder Community). The gap between the guarantee and the delivery mechanism was unnamed, untracked, and unaccountable. A constitutional guarantee that does not reach the people it covers is not a guarantee \u2014 it is a statement.\n\n**Introduced design:**\n\n- **Delivery Sufficiency Standard (AY1):** four conditions that must all be met for a population to be considered operationally covered: delivery path exists, is accessible, is monitored, and has an accountable responsible party.\n- **Delivery Sufficiency Register:** quarterly-published accounting of populations not yet meeting the standard, with gap type, current status, commitment, timeline, responsible party, and evidence link.\n- **Founding Register entries:** seven populations entered at founding with open commitments.\n- **Cross-boundary delivery operationalization:** quarterly accounting of the 2% PFCR cross-boundary allocation, flow to intermediary organizations, populations reached, no-enrollment-coercion rule.\n- **Register removal standard:** removal requires responsible party certification, Federated Ombuds independent verification, and published verification \u2014 not just administrative assertion.\n- **Constitutional amendment:** delivery sufficiency obligation clause added to Article IV.\n\n**New risks introduced:**\n- The Register could become a bureaucratic accounting exercise that satisfies the letter while missing the spirit. Mitigated by: the AY1 standard requires accessibility without extraordinary effort (not just existence of a path), and Federated Ombuds escalation authority for missed timelines.\n- Cross-boundary delivery through intermediary organizations could be used to build dependency relationships. Mitigated by: the no-enrollment-coercion rule (\u00a7AY3.3) prohibits conditioning delivery on future enrollment.\n\n**Residual risk:** The Register creates accountability; it does not create capacity. Physical infrastructure, institution enrollment, and intermediary organization funding must follow independently. P-055 makes the gap visible and governed; it does not close the gap operationally.\n\n---\n\n## P-050 through P-052 \u2014 CASP, Constitutional Integrity Panel, and Ombuds Manufacture Standard\n\n### P-050 \u2014 Compliant Alternative Supplier Pre-Registration (CASP)\n\n**Threat addressed:** T-028\n**Status:** ACTIVE | **Priority:** Critical | **Annex:** ANNEX_AT \u00a7AT6.6\n\n- **Introduced design:** Mandatory pre-registration of backup suppliers with automatic-activation contracts before any essential-sector procurement renewal. Procurement authorities must calculate and publish the gap-window \u2014 the period between a primary supplier exit and backup supplier operational readiness \u2014 before each renewal cycle. Any drill classified as drill-secure requires adversarial observation by at least one party outside the procurement authority's organizational chain.\n- **Dependencies:** Essential-sector supplier registry, automatic-activation contract templates approved by the CRP, gap-window calculation methodology published and P-004-protected.\n- **New risks introduced:** Pre-registered backup suppliers could become nominal alternatives with no real capacity. Mitigated by: adversarial observation requirement for drill-secure drills, and gap-window publication creates accountability for calibration accuracy.\n- **Residual risk:** Supplier pre-registration does not guarantee backup capacity is operationally ready in all stress conditions. Gap-window calculation relies on supplier self-reporting, which is subject to optimism bias.\n\n---\n\n### P-051 \u2014 Constitutional Integrity Panel (CIP)\n\n**Threat addressed:** T-022  \n**Status:** ACTIVE | **Priority:** Critical | **Annex:** ANNEX_AM \u00a7AM8\n\n- **Introduced design:** 7-member independent body with staggered terms. Funding is constitutionally fixed at 0.01% of annual Flow issuance \u2014 not subject to legislative appropriation and not reducible by the governing coalition. Appointment requires multi-body sign-off drawn from sources that cannot be simultaneously controlled by a single governing coalition. 5-of-7 quorum required for Tier 1 ratification. Automatic review triggers fire when institutional vacancies exceed 90 days or when mandatory publication lapses exceed 30 days, without requiring the governing coalition to initiate.\n- **Dependencies:** Founding appointment of the initial 7-member panel before constitutional activation. Staggered term schedule published at founding. Flow issuance tracking system for the 0.01% funding calculation.\n- **New risks introduced:** Multi-body appointment requires identifying genuinely independent appointing bodies at founding, which may be difficult in contexts with thin civil society. Mitigated by: P-020 oppose-coalition nomination pathways provide analogous alternatives.\n- **Residual risk:** Constitutional entrenchment of CIP funding can still be dismantled by a sufficiently determined supermajority willing to use the Tier 1 amendment process. The CIP raises the political cost; it does not make repeal impossible.\n\n---\n\n### P-052 \u2014 Federated Ombuds Deliberate-Manufacture Standard\n\n**Threat addressed:** T-019  \n**Status:** ACTIVE | **Priority:** High | **Annex:** ANNEX_AI \u00a74.12\n\n- **Introduced design:** Pre-committed 4-criterion assessment that the Ombuds Plenum must apply when evaluating whether a demand-context flag was deliberately manufactured: (1) timing \u2014 whether the triggering enforcement action was initiated within a sentinel indicator movement window; (2) proportionality \u2014 whether the enforcement action's scope is proportionate to the stated enforcement basis; (3) prior basis \u2014 whether enforcement basis documentation existed before the sentinel indicator moved; (4) knowledge \u2014 whether the enforcing authority had actual or constructive knowledge of sentinel indicator status at initiation. The Plenum must reach a decision within 24 hours. When evidence is inconclusive across all four criteria, the asymmetric default favors PCRP activation rather than flag maintenance. A manufactured-flag finding is automatically referred to the Enforcement Panel, not held within the Ombuds system.\n- **Dependencies:** Federated Ombuds fully constituted per P-025 (\u22654 sub-Ombuds seated). Cross-register timing monitor operative (Annex AI \u00a73.3). Enforcement Panel charter must include manufactured-flag referrals as a defined intake category.\n- **New risks introduced:** 24-hour decision window creates pressure that may produce errors in ambiguous cases. Mitigated by: asymmetric default toward PCRP activation when inconclusive, which is the conservative failure mode.\n- **Residual risk:** The 4-criterion assessment cannot definitively establish intent. A sophisticated actor who sequences enforcement actions to avoid triggering all four criteria simultaneously can manufacture a flag while technically passing the assessment. Accepted as bounded leakage \u2014 the standard raises the operational complexity and coordination cost of deliberate manufacture without eliminating it.\n\n---\n\n### P-056 \u2014 Open-Access Survival Floor (Two-Tier Identity Model)\n\n**Status:** PROPOSED  \n**Tier:** Tier 2  \n**Threat addressed:** T-002 (identity exclusion of vulnerable persons); INV-001 operationalization  \n**Annex:** ANNEX_AK \u00a7AK8  \n**Summary:** Separates non-duplication (required for CSM) from identity verification (required only for above-floor services and civic instruments). Defines Tier 0 (open-access/pseudonymous survival floor) and Tier 1 (identity-gated services). Establishes civic accountability norm: the system trusts citizens because there is enough for everyone. Aggregate anomaly detection replaces individual surveillance at the survival tier. Token mechanism specification delegated to ANNEX_AZ \u00a7AZ2 as a pre-operational prerequisite.\n\n---\n\n### P-057 \u2014 Pilot Site Selection Criteria\n\n**Threat addressed:** Pilot farming (ACL-011), founding consent theater (ACL-010)\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Pilot_Site_Selection_Criteria.md](./Pilot_Site_Selection_Criteria.md)\n\n**Summary:** Defines required, disqualifying, and preferred characteristics for pilot site selection, including Phase 1 capital reference ranges. Prevents friendly-site selection from producing misleading pilot evidence and blocks sites where consent conditions or jurisdictional conflicts cannot be met.\n\n---\n\n### P-058 \u2014 Jurisdiction Interface Clause\n\n**Threat addressed:** Implementation drift (T-016), constitutional void under external law\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Jurisdiction_Interface_Clause.md](./Jurisdiction_Interface_Clause.md)\n\n**Summary:** Establishes three-layer jurisdiction interface; defines RAC as Layer 1; specifies matters governed by external law; pre-enrollment grace window; retaliation prohibition. Ensures the Humane Constitution operates coherently within, alongside, and\u2014where necessary\u2014in tension with external legal systems.\n\n---\n\n### P-059 \u2014 Vulnerable Population Consent Protocol\n\n**Threat addressed:** Founding consent theater (ACL-010), T-027 (dignity floor leverage)\n**Status:** PROPOSED | **Priority:** Critical\n**Creates:** [docs/governance/Vulnerable_Population_Consent_Protocol.md](./Vulnerable_Population_Consent_Protocol.md)\n\n**Summary:** Defines ICA structure, 30-day cooling-off, teach-back verification, non-waivable exit rights, and pre-recruitment prerequisites for VPCP-scope populations (homeless, justice-exiting, unemployed, disability, elder, refugee). Requires ICA staffed and exit support fund pre-capitalized before any VPCP-scope recruitment begins.\n\n---\n\n### P-060 \u2014 Founding Team Composition Standard\n\n**Threat addressed:** Keyholder social capture (ACL-005), bureaucratic elite formation (T-008)\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Founding_Team_Composition_Standard.md](./Founding_Team_Composition_Standard.md)\n\n**Summary:** Defines founding team composition floor, disqualifying conflicts, 9-seat keyholder allocation, founder sunset rules (FS-1 through FS-7), and Perpetual Humility Review. Seats 3\u20138 nominated by civil-society organizations approved by the adversarial panel member, not selected by the founding team.\n\n---\n\n### P-061 \u2014 Founding Capital Framework\n\n**Threat addressed:** Procurement shell capture (ACL-007), power-wealth convergence\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Founding_Capital_Framework.md](./Founding_Capital_Framework.md)\n\n**Summary:** Defines phase capital targets, 20%/30% concentration limits, Capital Steward structure, constitutional primacy clause, government walk-away rule, CLT land structure, and wind-down reserve. Capital Steward must be independent of the founding team; selection precedes first capital commitment.\n\n---\n\n### P-062 \u2014 Pilot Timeline Framework\n\n**Threat addressed:** Pilot farming (ACL-011), founding consent theater (ACL-010)\n**Status:** PROPOSED | **Priority:** High\n**Creates:** [docs/governance/Pilot_Timeline_Framework.md](./Pilot_Timeline_Framework.md)\n\n**Summary:** Five-track parallel timeline with critical-path gates; three recruitment windows; phased occupancy sequence; failure contingency requiring Resident Transition Protocol before Cohort 1. Track A (governance/legal), Track B (infrastructure), Track C (capital), Track D (community/consent), Track E (technology) must all clear defined gates before enrollment opens.\n\n---\n\n### P-064 \u2014 Compliance-Masked Refusal Hardening\n\n**Threat addressed:** T-028\n**Status:** ACTIVE | **Priority:** Critical\n\nThe essential-sector refusal package already tested open exit, medicine/PBM refusal, and grid/logistics delay. The remaining P0 gap was subtler: an incumbent can stay formally compliant while degrading actual delivery through slow paperwork, data withholding, PBM access friction, standards-body delay, affiliate fallback capture, workforce poaching, selective regional degradation, litigation, or concession pressure.\n\n- **Introduced design:** Adds compliance-masked refusal as a named refusal lane in the Essential-Sector Refusal Test Package. Formal compliance is no defense when CSM delivery, CASP activation, fallback control transfer, patient continuity, vulnerable-cohort continuity, or reserve activation fails in practice.\n- **Medicine hardening:** Requires complete access paths, not merely alternate suppliers: manufacturer/API, distributor, pharmacy/specialty pharmacy, claims/formulary data, cold chain, prescribing interface, appeal route, and patient-support path. Adds patient-continuity floor and medicine metrics for time-to-fill, missed doses, PA clock breaches, formulary overrides, affiliated routing, substitution harm, and vulnerable-cohort continuity.\n- **Grid/logistics hardening:** Adds hidden compliance variants for partial restoration, standards objections, data migration delay, workforce poaching, affiliate substitution, and regional degradation. Adds transfer-control metrics for dispatch, routing, warehouse, outage, grid, fleet, inventory, credentialing, emergency data access, full operating package access, and workforce independence.\n- **Dashboard integration:** Adds compliance-masked refusal exposure to the Capture Dashboard and threshold anchors. Watch and active-capture-signal thresholds now cover data/control-system export delay, standards obstruction, PBM access friction, affiliate fallback correlation, workforce poaching, legal delay beyond 14 days, concession requests, vulnerable-cohort failure, CASP blockage, and fallback control-transfer failure.\n- **Evidence integration:** Updates T-028 in the Threat Register and Threat Resolution Matrix, Phase 9 of the Pilot Evidence Roadmap, the Claims and Evidence Register, Hardening Queue, Conglomerate Transition Dossier, and Annex AT CASP independence language.\n- **New risks introduced:** The metric can over-classify genuine operational difficulty as strategic refusal. Mitigated by independent clearance for legitimate delay, two-source confirmation for degradation periods under Annex AT, and affected-population evidence rather than inference from paperwork alone.\n- **Residual risk:** Sophisticated incumbents can distribute obstruction below individual thresholds, especially through informal standards influence, contractor labor markets, insurer/lender pressure, and patient-level administrative friction. The control improves detectability; it does not create physical capacity, independent staff, data escrow, or medicine supply by itself.\n\n---\n\n### P-065 \u2014 CIP Vacancy-Starvation Hardening\n\n**Threat addressed:** T-022\n**Status:** ACTIVE | **Priority:** Critical\n\nThe active CIP design made hostile successor hollowing visible but still had a load-bearing failure mode: a successor government could let CIP seats expire, keep the panel below quorum, delay dashboard publication, and then argue that absent ratification could not block later action. This patch makes vacancy itself self-repairing and makes silence a defect, not consent.\n\n- **Introduced design:** CIP vacancies must be published within 7 days. Ordinary appointing sources must transmit a qualified nominee within 30 days; fallback nomination activates at 45 days through the Federated Ombuds Plenum from a public, multi-source shortlist. The fallback path is a repair duty, not a policy-alignment power.\n- **Staggering enforcement:** Appointments that violate the no-more-than-2-seats-per-year rule are void unless tied to death, incapacity, or removal for cause. Void appointments do not count toward quorum, ratification, or review authority.\n- **Below-quorum rule:** Vacancy does not waive concurrent ratification. A below-quorum CIP may publish records, request fallback nomination, preserve evidence, accept objections, and issue interim risk notices, but may not ratify amendments, close AM3 reviews, waive deadlines, approve funding changes, or appoint itself.\n- **Publication and report fallback:** Dashboard failure routes trigger publication through the public amendment log and independent Ombuds channels. A missing Ombuds Tier 1 integrity report procedurally suspends the amendment until the report or fallback review is complete.\n- **Servant-authority limits:** CIP authority is custodial, corrigible, conduct-based, and subject to ordinary challenge. CIP funding is subordinate to immediate Essential Access relief; no review, vacancy, dispute, or funding issue may delay survival-floor activation.\n- **New risks introduced:** Fallback nomination could become a guardian-class formation path if repeated repairs are dominated by the same civil-society or expert networks. Mitigated by public shortlists, multi-source nomination, Article VII publication, non-renewable terms, ordinary challenge rights, and Capture Dashboard monitoring.\n- **Residual risk:** This patch blocks one hollowing route; it cannot prevent lawful democratic repeal or broad institutional culture collapse. The design can make hollowing visible, slow, and contestable; it cannot make human guardians incorruptible.\n\n---\n\n### P-066 \u2014 Commons Return and Universal Stake Fiscal Sustainability Gate\n\n**Threat addressed:** T-029\n**Status:** ACTIVE | **Priority:** Critical\n\nThe previous active economic spine still treated progressive net-worth demurrage as the primary anti-hoarding and commons-funding mechanism. That left two skipped problems: the active annex did not match the accepted Commons Return and Universal Stake direction, and the corpus had no registered threat for the fiscal question beneath every scale claim \u2014 what funds the floor, at what inflation cost, and who actually bears the burden?\n\n- **Introduced design:** Annex D is rebuilt around Commons Return and Universal Stake. Routine progressive net-worth demurrage, idle-money decay, and continuous personal-balance carrying cost are superseded as active policy. Commons Return applies only to named source bases: land/location value, natural resources, scarce licenses, public-infrastructure uplift, network/platform rents, large succession transfers, and external-capital use of protected commons.\n- **Universal Stake:** A protected civic inheritance may distribute a share of Commons Return after Essential Access, resilience reserves, restoration duties, payment rails, and governance operations are funded. It may not buy Voice, Service Record, office, identity priority, Essential Access priority, or review-body eligibility.\n- **Fiscal gate:** T-029 blocks scale claims unless a costed fiscal adequacy model exists. The model must cover Essential Access cost, delivery cost, source-base receipts, Universal Stake formula, administrative cost, inflation/debasement tolerance, transition cost, downside scenarios, burden incidence, and any remaining taxes, fees, or charges.\n- **Honest tax posture:** The patch does not claim taxes are unnecessary. It says Commons Return should narrow the preferred public burden toward public-created and scarcity-created value, while any residual taxes must be named, costed, dignity-screened, and barred from survival access, ordinary labor, basic household exchange, and modest household reserves unless explicitly justified through the fiscal gate.\n- **Evidence integration:** Creates the Commons Return and Universal Stake Evidence Test Package; updates Threat Register, Threat Resolution Matrix, Hardening Queue, Claims and Evidence Register, Open Problems Resolution Docket, Pilot Evidence Roadmap, Capture Dashboard Specification, Annex Directory, Annex Taxonomy, reader prompts, and corpus registration.\n- **New risks introduced:** Commons Return can become valuation bureaucracy, surveillance, political dividend timing, hidden wealth tax, asset-holder avoidance, or downward burden shift. Mitigated only by source-specific bases, protected ordinary use, appeal rights, privacy limits, lockbox accounting, incidence testing, and public \"who pays\" disclosure.\n- **Residual risk:** Commons Return may still be insufficient or volatile. Some taxes or fees may remain necessary during transition or at scale. The control is not proof of fiscal adequacy; it is a scale-blocking discipline until proof exists.\n\n---\n\n### P-067 \u2014 Cyber Resilience and Availability Gate\n\n**Threat addressed:** T-030\n**Status:** ACTIVE | **Priority:** Critical\n\nThe corpus already had controls for implementation drift, tamper evidence, oracle failure, and delivery sufficiency. Those controls did not answer a different question: what happens when ransomware, breached keys, regional network outage, cloud/provider failure, supply-chain compromise, or payment-rail failure makes the survival floor unreachable?\n\n- **Introduced design:** T-030 registers external cyber availability as a distinct threat. The Cyber Resilience and Availability Evidence Test Package requires a critical-service inventory, ransomware continuity drill, key-compromise and emergency-rotation drill, offline/analog continuity drill, regional failover drill, and supply-chain/dashboard integrity drill.\n- **Continuity standard:** Essential Access must remain deliverable through last-known-valid state, manual/offline provider paths, emergency settlement, and public status channels inside the published tolerance. Aggregate restoration is not enough if vulnerable cohorts, rural users, digitally fragile persons, or critical providers remain cut off.\n- **Claim discipline:** Implementation Drift Audit Package remains the evidence home for unauthorized drift and tamper evidence. The cyber package is the evidence home for whether people can still receive food, water, shelter, medicine, transit, and urgent care when digital systems, keys, providers, or networks fail.\n- **New risks introduced:** Offline fallback can become fraud-prone or privacy-invasive; emergency key rotation can concentrate authority; manual provider settlement can become a hidden bailout or coercive choke point. These are residual risks and must be measured in the evidence packet.\n- **Residual risk:** This patch registers the risk and defines the test path. It does not prove cyber resilience, key custody, recovery time, offline continuity, or supply-chain safety.\n\n---\n\n### P-068 \u2014 Last-Resort Unenrolled Access Gate\n\n**Threat addressed:** T-031\n**Status:** ACTIVE | **Priority:** Critical\n\nThe corpus already names the principle: identity is never a condition of survival access. It also contains the pieces: P-054 safety-shielded emergency access, P-055 delivery sufficiency, P-056 Tier 0 design, Annex AK \u00a7AK8, and Annex AZ's pseudonymous token constraints. The missed question is narrower and more concrete: can a person who never enrolls, never holds a credential, never keeps a wallet, and cannot safely become legible still receive the floor?\n\n- **Introduced design:** T-031 registers last-resort unenrolled access as a distinct critical threat rather than hiding it inside ordinary identity recovery. The Last-Resort Unenrolled Access Evidence Test Package requires access-point mapping, no-credential intake drills, trusted-intermediary drills, analog reconciliation privacy tests, abuse/diversion drills, and dignity interviews.\n- **Claim discipline:** P-056 remains the designed Tier 0 architecture. P-068 is the active evidence gate. No document should claim practical universality of Essential Access until this gate has evidence that the last-resort path works for people outside identity and digital infrastructure.\n- **Continuity standard:** The path must work without a phone, app, QR code, card, stable address, biometric, persistent account, future enrollment promise, or identity-disclosing intermediary. Abandonment counts as exclusion.\n- **New risks introduced:** An analog last-resort route can be exploited by organized brokers, captured by intermediaries, gamed by providers, or converted into a shadow registry through reconciliation records. The evidence package requires aggregate controls and privacy review precisely because individual surveillance would defeat the point.\n- **Residual risk:** This patch does not prove the floor is reachable. It makes the proof requirement explicit and blocks universality claims until no-credential and trusted-intermediary routes pass under dignity review.\n\n---\n\n### P-069 \u2014 Monitoring Repurposing Gate\n\n**Threat addressed:** T-032\n**Status:** ACTIVE | **Priority:** Critical\n\nThe corpus already limits several monitoring surfaces: Annex C gives monitored persons notice and appeal, Annex H requires privacy/surveillance notes for amendments, Annex AK restricts Tier 0 monitoring to aggregate anomaly, Annex AY requires privacy-preserving delivery monitoring, and the Capture Dashboard bans ranking ordinary persons. The gap was cross-cutting: the same data required to enforce protection can be repurposed into the coercive surveillance layer the project opposes.\n\n- **Introduced design:** T-032 registers monitoring repurposing as a distinct critical threat. The Monitoring Repurposing Evidence Test Package requires a Monitoring Purpose Register, purpose-creep red team, linkability/re-identification test, office-separation drill, individual-flag appeal drill, data-minimization and retention audit, and coercive-use scenario.\n- **Claim discipline:** No document should claim enforcement monitoring is bounded, non-surveillant, or safe from repurposing until every monitoring stream has a named purpose, minimum-data rule, access role, retention rule, independent reviewer, appeal path, and explicit secondary-use prohibition.\n- **Continuity standard:** Enforcement may monitor power, institutions, route performance, provider continuity, aggregate anomalies, and control-plane health. It may not silently create a general-purpose behavioral graph, location map, risk list, identity dossier, or ranking system for ordinary persons.\n- **New risks introduced:** Tight monitoring limits can reduce fraud detection or delay enforcement; strong auditability can conflict with deletion; aggregation can hide individual harm; raw records can still be pressured by lawful authorities or captured insiders. These are residual risks and must be measured honestly.\n- **Residual risk:** This patch does not prove monitoring is safe. It makes monitoring itself a test subject and blocks anti-surveillance claims until purpose limitation, linkability resistance, office separation, appealability, retention, and coercive-use tests pass.\n\n---\n\n### P-070 \u2014 Founding Legitimacy Prerequisite Definition Gate\n\n**Threat addressed:** T-033\n**Status:** ACTIVE | **Priority:** Critical\n\nThe corpus already names the founding legitimacy problem through T-017, T-022, T-026, T-027, the Founding Order, Annex AH, the Founding Legitimacy Dossier, the Vulnerable Population Consent Protocol, the Founding Team Composition Standard, and the Pilot Timeline Framework. The gap was not absence of concern. The gap was definition: the two Founding Legitimacy Dossier prerequisites, \"consent evidence\" and \"independent civil-society review,\" could not be produced without a public standard for what counted.\n\n- **Introduced design:** Creates the Founding Consent and Civil-Society Review Evidence Test Package. The package reconciles the Dossier's lower consultation threshold with the Founding Order's binding consent act: for activation authority, 2/3 eligible resident-personhood participation and 2/3 eligible resident-personhood affirmative consent govern, with 90-day notice, 60-day deliberation, roll-call-equivalent record, and drift-chain logging.\n- **Consent evidence standard:** Requires consent model, notice record, deliberation record, participation record, threshold certification, opt-out proof, aid-nonconditioning proof, pressure survey, coercion complaint log, and exit-cost report before the Dossier consent-evidence row can reach PRODUCED.\n- **Civil-society review standard:** Requires at least three qualified reviewer categories from an adversarial-panel shortlist after public challenge. Reviewers must pass financial, governance, affected-community accountability, dissent-capacity, conflict-disclosure, and plain-language-publication tests.\n- **Claim discipline:** Gate A does not clear if founders substitute low-turnout consultation, silence, humanitarian-aid acceptance, friendly expert review, funder-adjacent review, or unpublished reviewer findings for consent and independence evidence.\n- **New risks introduced:** A stricter review gate can be used to delay legitimate founding indefinitely or empower a civil-society gatekeeper class. Mitigations are public shortlists, public challenge records, separate reviewer findings, dissent preservation, affected-community accountability, and explicit Gate A failure reasons.\n- **Residual risk:** No evidence packet can prove perfect founding legitimacy. P-070 makes consent and reviewer independence falsifiable before activation; it does not eliminate the bootstrap problem, informal pressure, class capture, or the need for post-activation audit.\n\n---\n\n### P-072 \u2014 Productive Status Register\n\n**Threat addressed:** T-025\n**Status:** PROPOSED | **Priority:** High\n\nThe word \"productive\" unlocks two benefits on two separate tests: Flow issuance against verified productive commitments (ANNEX_X) and the Commons Return exemption for productive working assets (ANNEX_D \u00a7D3, on ANNEX_J's published Article V stewardship standard). P-023 closed the protected-capital shelter inside the contract-commitment architecture; the residual T-025 variant is *cross-instrument and temporal* \u2014 the same activity classified \"productive\" by the looser test claims both benefits, and because Flow mints at commitment start while the exemption is assessed at settlement, an honest determination at T0 can be exited before any reversal clears.\n\n- **Introduced design:** The [Productive Status Register](Productive_Status_Register.md) \u2014 one canonical productive-status determination per commitment/asset against the single published standard, with three structurally separate roles (standard-author, register-adjudicator, benefit issuer; INV-006 incl. the economic-parameter-setting extension); a **settle-forward escrow** under which the \u00a7D3 exemption vests only after the Flow-side commitment is verified to have stayed in productive use through a full settlement period (non-vesting replaces reversal, wages stay protected by no-clawback); a payroll/escrow fast-path so issuance is never blocked on adjudication; an appeal-bound, independently audited determiner; and the rule that status classifies the activity, never the person (INV-003; \u00a7D6 minimum-necessary data).\n- **Claim discipline:** No document may claim the productive double-dip is closed until the register's evidence test passes (double-dip closure in adversarial simulation; no issuance starvation; determiner non-capture; no person-scoring drift). The instrument is `Designed` and pilot-gated; it binds nothing until then.\n- **New risks introduced:** A single register is a new capture target (bounded by the three-way role split, appeal, audit, and the INV-006 recusal extension); escrowed exemptions add settlement-period accounting complexity; the fast-path's provisional status could be farmed below the de-minimis threshold (the escrow still withholds the exemption, so the farm nets nothing).\n- **Residual risk:** Settle-forward closes the modeled timing attack; it does not prove the published stewardship standard itself cannot be captured (that remains ANNEX_J / Article V territory under T-025), and no pilot evidence exists for adjudication throughput at scale.\n\n**Panel-revised before incorporation** (adversarial, Christ-centered, corpus-fit; source: `docs/superpowers/specs/2026-06-09-productive-register-recusal-redline.md`). The companion Fix 2 of that redline \u2014 the INV-006 economic-parameter-setting recusal extension \u2014 is already constitutional (applied with Session 23).\n\n---\n\n### P-073 \u2014 Framework-First Intake (Anti-Accretion Rule)\n\n**Threat addressed:** structural \u2014 no threat row (rule-count inflation as a systemic failure mode)\n**Status:** ACTIVE | **Priority:** High\n\nA full-corpus simplification audit (2026-06-12, three independent single-role reviews) found that the corpus's protective machinery grew by accretion: each threat received its own patch, and patches repeatedly reimplemented mechanisms the corpus had already designed elsewhere \u2014 at audit time, at least eight collusion-detection instances, eight appeal-path machineries, ten near-identical evidence test packages, seven restatements of the data-minimization rule, six overlapping status registries, and forty-seven standing institutions. Every duplicate mechanism is a new capture surface, a new audit obligation, and a new layer of illegibility between an ordinary person and the rules that govern them.\n\n- **Introduced design:** The Framework-First Intake gate in `Acceptance_Protocol.md`: a proposal introducing a mechanism whose protective function an existing mechanism already performs must extend the most general existing instrument or attach a published justification for why extension cannot serve. Returns are judgment calls, so they carry a published return record (void without it), a point-by-point resubmission ratchet, and escalation of contested duplication questions to the standing adversarial panel member. Extensions that add authority, personnel, data collection, or gatekeeping power receive full new-mechanism scrutiny at the higher applicable tier (no laundering). A simplicity presumption favors consolidation and deletion \u2014 bounded so it never blesses independence-reducing mergers (mechanism count, never independence count) and never costs a protected person their path to protection.\n- **Claim discipline:** This gate is process hygiene, not proof of simplicity. No document may claim the corpus is consolidated or minimal until the consolidation program (status spine, appeal spine, evidence framework, data stewardship standard, institutional mergers) actually lands and the rule shows fruit at real intakes.\n- **New risks introduced:** A captured intake could try to use \"duplicate\" as a veto on new protections (bounded by the return record, ratchet, and adversarial escalation); justification-writing could become ritual boilerplate (watched via the technical-review record requirement); the gate itself is one more rule (accepted: it is the rule that makes the next hundred unnecessary, and it creates no office, register, or new process step).\n- **Residual risk:** The gate stops *new* duplication; it does not remove the existing redundancy (that is the consolidation program's job). Its effectiveness is unproven until tested by real proposals; per its own corrigibility clause, evidence that it suppresses needed protections or relocates complexity into justification documents counts against it.\n\n**Panel process:** four independent single-role reviewers (adversarial systems designer, Christ-centered, corpus-fit, minimalist) reviewed the applied diff in parallel; all four returned APPROVE WITH FIXES and every required fix was incorporated (return-record discipline, anti-laundering tier rule, independence-count bound, protected-person clause, corrigibility clause, functional test replacing a closed family list, P-073 provenance). Christ-centered review recorded as Session 25 in `Christ_Centered_Evaluation.md`.\n\n**Consolidation program landings (running record):** 2026-06-12 \u2014 the status spine landed (first program step under this gate): `Status_Model.md` deleted, its vocabulary and edge rules absorbed into the Claims and Evidence Register's Status methodology section (now the canonical status spine); the Hardening Queue stripped of duplicated status tracking (worklist only, references owners); Threat Register restated patch-statuses converted to pointers. Net ~\u221295 lines; vocabulary-definition sites reduced from five to one. Evidence Ladder deliberately retained standalone (it defines evidence *levels*, a different axis, and its level numbers are cited by app code and seven documents). Named follow-ups: Patch Log single-row mini-tables (same-file restatement, checker-covered) and a single convention for Threat Register per-entry Status lines. 2026-06-12 \u2014 the appeal spine landed (P-074, ANNEX_L \u00a7L7): seven appeal procedures \u2192 one spine + a domain intake table (the ANNEX_AW \u00a7AW3.3 orphan appeal window, RRE-011, is a named follow-up); FC-209's reserved appeal path closed by binding it to the spine.\n\n\n---\n\n### P-074 \u2014 Appeal Spine Consolidation (ANNEX_L \u00a7L7)\n\n**Threat addressed:** structural \u2014 no threat row (appeal-path fragmentation as a systemic failure mode)\n**Status:** ACTIVE | **Priority:** High\n\nThe same simplification audit that produced P-073 counted at least eight separate appeal machineries across the corpus \u2014 each with its own filing rule, window, ladder, and clock. Fragmented appeal procedure is itself an exclusion mechanism: the person most likely to need an appeal is the person least equipped to discover which of eight procedures applies to them. This patch is the first P-073-mandated consolidation of an entire mechanism family.\n\n- **Introduced design:** ANNEX_L \u00a7L7, the canonical appeal spine: one filing rule and 30-day window (L7.1); the survival floor and the status quo ante continue during appeal, with penalties and stakes paused or escrowed until finality (L7.2); a single three-instance ladder with the Ombuds Plenum deliberately kept as a separate final instance for enforcement and attestation questions (L7.3); one timing table (L7.4); a domain intake table replacing scattered procedure (L7.5); and a drift rule in the \u00a7L7 provenance note making the spine govern over any domain restatement. Pointer rewrites in ANNEX_J, ANNEX_I, ANNEX_X, ANNEX_D, ANNEX_U, ANNEX_AJ, ANNEX_AS, the Productive Status Register, the Identity Recovery Evidence Test Package, and the Parameter Calibration Register (FC-209 bound to the spine) replace local appeal machinery with first-instance intake plus a spine citation: seven scattered appeal procedures become spine pointers (with ANNEX_I \u00a7I8's duplicate clocks and ANNEX_AI \u00a74.8's duplicate filing window deleted in favor of the spine); the ANNEX_AW \u00a7AW3.3 orphan appeal window (RRE-011) is a named follow-up, not yet absorbed.\n- **Claim discipline:** No claim that appeals are accessible, timely, or capture-resistant in practice until the appeal-path drills (including the FC-209 both-directions drill) actually run. The spine is `Designed`; consolidation reduces procedure count, not uncertainty.\n- **New risks introduced:** A single procedural spine is a single point of procedural capture \u2014 whoever controls the spine's clocks and intake controls every appeal (bounded by the Plenum/CRP split in L7.3 and the spine-discipline drift rule in the \u00a7L7 provenance note, which makes deviation visible rather than silent). The status-quo-ante rule (L7.2) could be exploited to freeze adverse-but-correct decisions in place during appeal (bounded by the published, reviewable imminent-serious-harm carve-out generalized from ANNEX_U \u00a7U6). The generalized imminent-serious-harm standard is itself unpublished \u2014 until it is authored under the ANNEX_U \u00a7U5 threshold-setting discipline and published (a pre-launch gate), each domain's existing published interim measure governs during appeal, so there is no absolute status quo ante.\n- **Residual risk:** The body names in L7.5 are designed institutions with no pilot evidence behind any of them; the 72-hour, 14-day, and 30-day clocks are design estimates, not measured capabilities. Whether one door genuinely lowers the filing barrier for the least-resourced appellant is unproven until drilled.\n\n**Numbering note:** the held Voice/Service-Record redline provisionally cited P-074 for its civic-misuse proposal; per that redline's own renumbering caveat, it takes the next free number at intake.\n",
       "headings": [
         {
           "level": 1,
@@ -1909,10 +1909,15 @@
           "level": 3,
           "text": "P-073 \u2014 Framework-First Intake (Anti-Accretion Rule)",
           "slug": "p-073-framework-first-intake-anti-accretion-rule"
+        },
+        {
+          "level": 3,
+          "text": "P-074 \u2014 Appeal Spine Consolidation (ANNEXL \u00a7L7)",
+          "slug": "p-074-appeal-spine-consolidation-annexl-l7"
         }
       ],
-      "wordCount": 26985,
-      "headingCount": 83
+      "wordCount": 27657,
+      "headingCount": 84
     },
     {
       "id": "docs__governance__Provenance_Map_md",
@@ -2715,7 +2720,7 @@
       "status": "",
       "statusBucket": "reference",
       "summary": "This register tracks high-risk parameters whose numbers matter enough that they should not remain \"because the document says so.\"",
-      "content": "# Parameter Calibration Register\n\nThis register tracks high-risk parameters whose numbers matter enough that they should not remain \"because the document says so.\"\n\nIt complements `/founding/commitments.md` and `architecture/parameter_registry.md`. Those files bind values. This file records why values are plausible, how they should be tested, and what evidence would force revision.\n\n---\n\n## Row Standard\n\nEvery high-risk parameter should eventually have:\n\n| Field | Meaning |\n|---|---|\n| Parameter | FC identifier or named constitutional threshold. |\n| Current value | Bound, provisional, reserved, or proposed value. |\n| Tier | Tier 1, Tier 2, Tier 3, or pre-launch blocking gate. |\n| Why this value exists | Plain-language rationale, not just cross-reference. |\n| Capture route | How a bad actor benefits from this value being too high, too low, vague, or stale. |\n| Evidence needed | Simulation, pilot, audit, legal review, or outside source needed. |\n| Revision trigger | What result forces review. |\n| Governing docs | Where the value is bound and where consequences appear. |\n\n---\n\n## Seed Register\n\n| Parameter | Current value | Tier | Why this value exists | Capture route | Evidence needed | Revision trigger | Governing docs |\n|---|---:|---|---|---|---|---|---|\n| FC-010 leakage thresholds | 3% routine target; 7% systemic review | Tier 1 / active-unproven | Converts shadow-convertibility enforcement capacity into published thresholds. | Too high normalizes broker markets; too low justifies surveillance. | Proxy-market red team; enforcement-capacity audit. | Broker profitability remains positive or ordinary households face overbroad enforcement. | Annex AB; Threat Register T-001. |\n| FC-020 Protected Pause floor | 0.30 Voice | Tier 1 | Prevents hardship from erasing civic continuity. | Too high preserves incumbents; too low punishes illness and care. | Hardship-pause abuse test. | Pause rings preserve roles or genuine hardship users avoid protection. | Annex AF; Service Record Misuse Evidence Test Package. |\n| FC-030 oracle N_MIN | 5 nodes | Tier 1 | Prevents single-source measurement control. | Too low enables capture; too high causes paralysis. | Capacity measurement and oracle-failure drill. | Quorum failure blocks response or correlated error persists. | Annex AL; Capacity Measurement Evidence Test Package. |\n| FC-031 methodology classes | 3 classes | Tier 1 | Reduces shared epistemic failure. | Standards bodies define all classes in their own image. | Methodology-class audit. | Method classes share data, funding, model supply chain, or standards body. | Annex AL; T-020/T-021. |\n| FC-032 pairwise correlation max | 0.30 Pearson, supplemented by directional-bias review | Tier 1 | Makes formal independence testable while preventing same-direction bias from passing merely because co-movement is low. | Actors tune reporting to pass correlation while sharing assumptions or incentives that push all errors in the same direction. | Forecast-vs-actual, directional-bias table, and oracle independence audit. | Shared error exceeds threshold during stress, or same-direction material error recurs without corrective action. | Annex AL; T-020/T-021. |\n| FC-033 adversarial oracle seats | 1 per cohort | Tier 1 | Forces hostile-method review inside measurement. | Seat becomes symbolic or captured by same professional network. | Adversarial-seat independence review. | Dissent never changes outcomes or is not resourced. | Annex AL; T-020/T-021. |\n| FC-040 penalty base multiplier | 5.0x | Tier 1 / active-unproven | Makes detected conversion expected-value negative. | Too low invites arbitrage; too high punishes edge cases harshly. | Annual deterrence audit. | Violations remain profitable or appeals show disproportionate harm. | Annex AJ; T-001/T-007. |\n| FC-041 detection assumption | 0.85 | Tier 1 / active-unproven | Supplies expected-value calculation for penalties. | Overstated detection hides under-enforcement. | Detection-rate audit. | Actual detection probability materially lower than assumed. | Annex AJ; Enforcement Panel audit. |\n| FC-202 Commons Return source-base list | Reserved \u2014 bind before CRUS activation | Tier 1 / pre-launch gate | Defines the closed list of allowed Commons Return bases (land/location value, natural resources, spectrum, monopoly licenses, platform/network rents, high-value concessions, large successions). The list is closed under INV-008: downward extension onto ordinary life is a Tier-1 amendment. | Source-base definitions quietly broadened to reach ordinary labor, homes, tools, or savings. | Source-base mapping pilot and incidence model. | Any base reaches an INV-008-protected category. | ANNEX_D; INVARIANTS INV-008; Commons Return and Universal Stake Evidence Package. |\n| FC-203 Commons Return assessment rate schedule | Reserved \u2014 calibrated by source base before activation | Tier 2 / pre-launch gate | Sets the per-base assessment rate without making ordinary labor or survival access the funding base. | Rates tuned to spare connected asset classes; valuation hiding. | Incidence, valuation-hiding, and external-capital-arbitrage tests. | Burden lands on ordinary households or productive stewardship instead of scarcity privilege. | ANNEX_D; CRUS Simulation Protocol. |\n| FC-204 protected ordinary-use threshold (formerly registered here as FC-052) | Reserved \u2014 bind before CRUS activation; initial reference remains 18 months \u00d7 regional median monthly consumption until replaced by the CRUS fiscal dossier | Tier 2 / pre-launch gate | Defines the ordinary household reserve that may not become the public funding base under Annex D protected-use rules. | Too low reaches ordinary households; too high shelters concentrated control under household labels. | Commons Return incidence model and household/small-operator burden review. | Ordinary households, caregivers, small operators, elders, disabled persons, or rural households bear Commons Return burden meant for scarcity privilege or public-created value. | ANNEX_D; Commons Return and Universal Stake Evidence Package; founding/commitments.md FC-204. |\n| FC-205 Universal Stake distribution cadence | Reserved \u2014 bind before first distribution | Tier 2 / pre-launch gate | Makes Stake timing reliable for households and useless as a political reward instrument; a distribution may be authorized only after the floor and reserves are funded (INV-014). | Distribution timed to elections or withheld as punishment. | Distribution drill with INV-014 ordering check. | Any distribution authorized while floor or reserves underfunded. | ANNEX_D; INVARIANTS INV-014. |\n| FC-206 Universal Stake eligibility rule | Reserved \u2014 bind before first distribution | Tier 1 / pre-launch gate | Keeps the Stake universal and non-convertible (no sale, assignment, garnishment, pledge, inheritance, or purchase of membership/priority/standing/office/Voice). | Eligibility narrowed to exclude the inconvenient; conversion pathways laundered through legal wrappers. | Non-convertibility red team. | Any conversion pathway clears. | ANNEX_D; ANNEX_AK; INVARIANTS INV-002/INV-017. |\n| FC-207 CRUS anti-capture gates | Reserved \u2014 bind before CRUS activation | Tier 1 / pre-launch gate | Public accounting, no patronage discretion, data minimization, auditability, appeal rights. | Fund administrators become patronage allocators. | Capture Dashboard drill. | Discretionary or targeted allocation observed. | ANNEX_D; Capture Dashboard Specification. |\n| FC-208 PFCR / lockbox reserve and routing rule (formerly registered here as FC-054) | Reserved | Tier 2 / pre-launch gate | Splits Commons Return receipts between Essential Access support, public rails, restoration, resilience reserves, infrastructure, and Universal Stake. | Too much to one channel creates fiscal dependency; too little weakens commons funding or turns Universal Stake into political dividend timing. | Fiscal adequacy model, source-base revenue model, lockbox sufficiency test, and burden-incidence review. | PFCR becomes dependent on inflation, hidden debt, or prohibited tax bases; or cannot fund baseline commons. | ANNEX_D; Article V; SPECIFICATIONS; founding/commitments.md FC-208. |\n| FC-209 CRUS appeal path | Reserved \u2014 bind before assessment or distribution | Tier 1 / pre-launch gate | Human appeal for assessed holders and excluded claimants without letting high-value actors stall assessment. | Procedural delay as avoidance; appeal priced out of reach of the poor claimant. | Appeal-path drill (both directions). | Appeals stall assessment or exclude the unrepresented. | ANNEX_D; Federated Ombuds. |\n| FC-210 CRUS review cadence | Reserved \u2014 bind before CRUS activation | Tier 2 / pre-launch gate | Scheduled review of incidence, eligibility, valuation, bases, distribution, reserves, capture metrics; a missed cadence is itself a failure. | Review quietly skipped in good years. | Cadence compliance audit. | Missed cadence or missing data. | ANNEX_D; Capture Dashboard Specification; Pilot Evidence Roadmap. |\n| Dormant \u00a7D9 backstop schedule (no live FC ID; a revival patch would assign one) | Superseded as an active parameter; no routine balance or net-worth decay schedule is operative unless a new patch, fiscal/dignity evidence, public review, and applicable amendment process revive a narrow dormant backstop. | Dormant / not operative | Preserves historical traceability for the retired demurrage designs without letting old rates govern by accident. The retired idle-balance parameters are tombstoned in founding/commitments.md FC-050\u2013FC-052, FC-054. | If treated as active, it can burden ordinary households, illiquid owners, or working savers while bypassing the Commons Return source-base test. | Dormant-backstop incidence model, dignity review, household burden model, and explicit amendment activation record before any use. | Any document or implementation treats old rates or \u03bb brackets as active, funds Essential Access from them, or applies routine balance/net-worth decay by interpretation. | ANNEX_D \u00a7D1 and \u00a7D9; SPECIFICATIONS. |\n| FC-055 issuance ceiling function | Reserved | Tier 1 / pre-launch gate | Links Flow supply to verified productive commitments. | Too loose inflates claims; too tight starves production. | Flow issuance simulation and productive-commitment audit. | Circulation detaches from real production or needed projects cannot clear. | Article V; SPECIFICATIONS. |\n| FC-058 CSM basket/regional adjustment | Reserved | Tier 1 / regional launch gate | Prevents one abstract basket from ignoring local climate, food, medicine, and shelter needs. | Under-adjustment harms high-need regions; over-adjustment invites political inflation. | Regional CSM pilot and capacity review. | Regional needs are mismeasured or adjustment becomes patronage. | Article III; Annex Y; SPECIFICATIONS. |\n| FC-060 Voice sector ceiling | 0.20 | Tier 1 | Prevents one sector dominating civic weighting. | Sector labels are split or merged to hide concentration. | Capture Dashboard Specification. | Sector concentration remains high through reclassification. | Article VI; Annex AC. |\n| FC-061 per-person cap | See commitments | Tier 1 | Prevents extreme individual civic weight. | Cap can still permit coordinated class control. | Civic-pool concentration review. | Repeat-role networks dominate despite compliance. | Article VI; Annex Z. |\n| FC-062 Service Record decay | See commitments | Tier 1 | Keeps standing tied to recent service. | Slow decay preserves old class; fast decay erases real long-term service. | Service Record misuse and hardship-pause tests. | Role pools become stale or participation becomes burnout. | Annex Z; Annex AF. |\n| FC-070 reserve window | 45 days x CSM x population | Tier 1 | Gives survival floor time during supply shock. | Under-reserve creates rationing; over-reserve creates hoarding bureaucracy. | Capacity stress test by essential category. | Reserves fail before recovery window or drain ordinary supply. | Annex Y; Article III. |\n| FC-071 CSM cluster failure threshold | 3 per 10,000 residents per 30 days | Tier 1 | Detects survival-floor delivery failure. | Too high hides local harm; too low causes noisy emergency churn. | Delivery pilot and small-cell privacy review. | Cluster failures undercount vulnerable groups. | Annex Y; Article VII. |\n| FC-072 Shared Storehouse activation threshold rule | Reserved by category | Tier 1 / activation gate | Prevents emergency rationing from activating on vague scarcity claims. | Too loose normalizes rationing; too strict delays needed protection. | Scarcity activation and unwind drill by essential category. | Shared Storehouse activates without real scarcity or fails during shortage. | Article III; Annex AQ; SPECIFICATIONS. |\n| FC-080 attestation stake ratio | See commitments | Tier 1 | Makes false high-impact attestations costly. | Rich actors buy credibility; poor attestors withdraw. | Attestation market test. | False claims persist or isolated people lose recognition. | Annex AS; Service Record package. |\n| FC-081 audit window | See commitments | Tier 1 | Keeps attestations reviewable long enough to catch false claims. | Too short invites delayed fraud; too long chills honest help. | Attestation/collusion pilot. | Disconfirmations arrive after window or honest attestation drops. | Annex AS. |\n| FC-082 graph density threshold | See commitments | Tier 1 | Protects close-knit communities from automatic collusion penalties. | Rings hide as community density. | Dense-community safe-harbor test. | Mutual-aid networks or fraud rings are misclassified. | Annex AS. |\n| FC-090 Ombuds sub-count | 5 nodes | Tier 1 | Distributes audit authority. | Five offices can still coordinate informally. | Capture Dashboard Specification. | Voting-pattern and staffing overlap exceed threshold. | Annex AI. |\n| FC-091 Ombuds supermajority | 4 of 5 | Tier 1 | Prevents one sub-node from ruling alone. | Minority can block needed correction; majority can coordinate. | Ombuds deadlock and collusion drill. | Repeated 3-2 deadlocks or rubber-stamp 5-0 patterns. | Annex AI. |\n| FC-100 quorum-loss restoration | 14 days | Tier 1 | Limits emergency hold under oracle loss. | Too long normalizes emergency; too short forces unsafe unwind. | Shared Storehouse oracle blackout drill. | Restoration misses reality or holds persist after recovery. | Annex AQ. |\n| FC-110 Tier 1 signatures | 7 of 9 | Tier 1 recursive | Blocks small-coalition amendment of core rules. | Three holders can block; seven can be captured socially. | Keyholder custody and capture review. | Holder concentration or coercion makes threshold easier than assumed. | Amendment Protocol. |\n| FC-111 Tier 1 timelock | 180 days | Tier 1 recursive | Creates public response and exit window. | Delay can be waited out or used for paralysis. | Timelock response drill. | Affected communities cannot understand, challenge, or exit in time. | Amendment Protocol; Drift Chain. |\n| FC-120 exit threshold | 2/3 resident personhood | Tier 1 | Prevents small faction exit capture. | Too high traps dissenters; too low enables hostile breakaway. | Exit rehearsal and participation-barrier audit. | Exit is formal but practically unavailable. | Founding Order. |\n| FC-121 exit unwind | 730 days | Tier 1 | Preserves Essential Access during exit. | Too long becomes exit denial; too short harms dependents. | Exit transition simulation. | Essential services fail or exit becomes punitive. | Founding Order. |\n| FC-140 identity fraud band | target \u22642% / upper bound \u22645% / trigger \u22653% per quarter | Tier 2 / pre-launch gate | Sets starting Essential Access identity-fraud tolerance while keeping fraud visible before it drains physical survival supply. | Over-tightening excludes vulnerable people; over-loosening lets identity fraud consume food, medicine, shelter, or other CSM capacity. | Identity and Recovery Evidence Test Package; Annex AK; founding commitments. | Exclusion rises, fraud drains Essential Access, or pilot evidence shows the band is too loose or too tight for vulnerable populations. | Annex AK; founding/commitments.md. |\n| FC-160-184 contract parameters | Reserved / proposed | Pre-launch gate | Escrow, deployment-window, force-majeure, and inspector-pool controls need calibration. | Loose terms recreate hoarding; tight terms block infrastructure. | Commons Return and Universal Stake Evidence Test Package, project-finance simulation, and procurement red team. | Escrows become protected-capital shelter markets or project finance stalls. | Annex AR; ANNEX_D. |\n| FC-185-193 external trade and strategic floor parameters | Reserved / draft anchors | Tier 1 / Tier 2 mixed | Strategic reserves and external-capital gates decide whether outside dependency can threaten the survival floor. | Too loose creates foreign-capital or supplier capture; too strict blocks useful trade. | External trade stress test, supplier concentration audit, reserve adequacy review. | Strategic categories fall below floor or capital controls become arbitrary. | Annex AT. |\n| FC-194 essential fuel reserve minimum | Reserved; draft anchor 60-90 days by region and season | Tier 1 / pre-launch gate | Fuel continuity is a refusal chokepoint for food, heat, emergency transport, and grid recovery. | Too low lets a conglomerate or import shock force capitulation; too high creates stockpile capture and spoilage bureaucracy. | Fuel reserve adequacy model; seasonal logistics drill; refinery and transport dependency audit. | Any region falls below minimum during a 30-day refusal scenario or reserve turnover degrades usable supply. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-195 essential medicine stockpile minimum | Reserved; draft anchor 90-180 days for critical lists | Tier 1 / pre-launch gate | Medicines with fragile supply chains need a longer buffer than ordinary inventory because substitution can be clinically impossible. | Too low lets suppliers, PBMs, or distributors ration access; too high causes expiry waste and favors incumbents with warehousing. | Critical medicine list; expiry and rotation audit; shortage simulation by region and care setting. | Critical medicine availability drops below clinical continuity floor or stock rotation losses become material. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-196 maximum essential supplier concentration | Reserved; draft anchor no supplier above 25% of regional essential throughput | Tier 1 / launch gate | Prevents one firm from becoming the practical veto point for survival-floor delivery. | Too loose permits single-supplier refusal; too strict blocks emergency use of scarce specialist capacity. | Supplier concentration audit; regional substitution map; refusal tabletop exercise. | One supplier can interrupt more than a quarter of regional essential throughput without a public fallback already active. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-197 public fallback activation deadline | Reserved; draft anchor 72 hours for critical interruption, 14 days for managed transition | Tier 1 / activation gate | Refusal protection only works if public or cooperative fallback capacity starts before households hit survival-floor failure. | Too slow lets private operators bargain through delay; too fast may trigger wasteful takeover before facts are verified. | Public fallback readiness drill; emergency procurement rehearsal; legal activation review. | Verified interruption persists past deadline without fallback service or false activations recur. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-198 procurement concentration threshold | Reserved; draft anchor review above 30%, mandatory remediation above 40% of essential category spend | Tier 2 / pre-launch gate | Public purchasing can accidentally rebuild the same conglomerate dependency it is meant to neutralize. | Too loose funnels demand to incumbents; too strict fragments procurement below quality and reliability needs. | Procurement spend audit; vendor capacity review; anti-collusion screen. | Essential procurement share exceeds remediation threshold for two review periods or fragmentation causes delivery failure. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-199 PBM/intermediary separation threshold | Reserved; draft anchor separation review at 10% cross-owned claims or dispensing volume, mandatory firewall above 20% | Tier 1 / launch gate | Pharmacy benefit managers and similar intermediaries can deny access while appearing to manage price or claims. | Too loose lets intermediaries steer patients and suppliers; too strict may disrupt legitimate administrative clearing. | PBM ownership and routing audit; claims-denial review; patient access stress test. | Cross-owned routing exceeds threshold, denial patterns favor affiliated entities, or independent access deteriorates. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-200 critical logistics redundancy floor | Reserved; draft anchor two independent routes and operators per essential region | Tier 1 / launch gate | Stockpiles do not matter if a conglomerate controls the practical path from reserve to household or clinic. | Too low creates carrier or warehouse chokepoints; too high imposes costly duplication in sparse regions. | Logistics dependency map; cold-chain and last-mile drill; emergency carrier substitution test. | A single operator, warehouse, port, rail spur, or cold-chain provider can block regional essential delivery. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-201 essential data and claims portability deadline | Reserved; draft anchor 24 hours for emergency export, 30 days for full transition package | Tier 2 / transition gate | Conglomerate refusal can happen through records, claims, formularies, and routing data even when physical supply exists. | Too loose lets incumbents hold operations hostage; too strict risks unsafe or incomplete data transfer. | Data escrow rehearsal; claims and formulary export audit; receiving-operator validation. | Public fallback cannot adjudicate, dispense, route, or reconcile essential service within deadline. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| RHL protected-channel ceiling | Reserved \u2014 Tier 2 founding commitment; any TFP/RHL ceiling must be re-derived under Annex D protected ordinary use, Annex X stale-purpose rules, Commons Return source-base review, and the Anti-Rent Legal Wrapper Evidence Test Package. | Tier 2 / pre-launch gate | Prevents protected savings or project-finance channels from becoming unlimited shelters for concentrated control while preserving ordinary retirement and household continuity. | Too high shelters concentrated wealth under protected labels; too low blocks ordinary savings, retirement planning, or productive small-operator resilience. | Household savings simulation; concentration impact assessment; source-base avoidance review; legal-wrapper review; comparison with floor needs over 5, 10, and 20 years. | High-balance households use TFP/RHL faster than expected to avoid Commons Return/source-base review, or ordinary retirement savers cannot reach the participation floor. | ANNEX_D; ANNEX_X; Anti-Rent Legal Wrapper Evidence Test Package. |\n| CASP price corridor | \u00b115% of the registered pricing index for the relevant category, adjusted quarterly for verified regional inflation | Tier 2 / operational | Prevents essential-sector suppliers from exploiting captive-buyer position through price spikes, while allowing legitimate cost fluctuation. | Too narrow blocks legitimate price adjustment; too wide defeats the price protection purpose. | Price corridor red team; inflation adjustment audit; supplier profitability review at corridor boundary. | Suppliers systematically price at corridor ceiling or exit when corridor prevents premium pricing. | Annex AT \u00a7AT6.6. |\n| CASP service-level baseline dimensions | Minimum four measurable dimensions co-signed at pre-registration: delivery timeliness, fill rate, quality certification rate, and incident response time; plus any category-specific additions | Tier 2 / operational | Makes degradation trigger (clause d) measurable and enforceable; prevents slow-squeeze through informal service erosion. | Too few dimensions misses degradation; too many dimensions creates gaming through selectively meeting some. | Degradation detection drill; supplier behavior under watch conditions. | Suppliers meet formal dimensions while degrading overall service or dimension gaming becomes observable. | Annex AT \u00a7AT6.6. |\n| CIP absolute funding floor | Reserved \u2014 Tier 2 founding commitment established before CIP constitution; must cover staff for 7 members, independent legal and technical review for 4 Tier-1-touching proposals per year, and publication infrastructure | Tier 2 / pre-launch gate | Prevents under-reporting of Flow issuance as a mechanism for CIP budget suppression below operating capacity. | Too low renders CIP ineffective; too high creates fiscal dependency risk. | CIP operating cost estimate; comparable constitutional body audit. | CIP cannot staff an adversarial review of a Tier-1-touching proposal within its budget or funding-floor breach goes unpublished. | Annex AM \u00a7AM8.3. |\n| FC-T0-01 | Tier 0 aggregate anomaly threshold | 5% of CSM capacity per category | 2%\u201315% | Ombuds via standard FAP | Baseline consumption data from Phase 2 pilot; revisit if physical-fraud rate exceeds threshold in stress test | ANNEX_AK \u00a7AK8.3 |\n\n---\n\n## Maintenance Rule\n\nNo parameter should move from provisional to bound without a row here, an evidence path, and a revision trigger. No parameter should stay bound after evidence shows it is causing the collapse state it was meant to prevent.\n",
+      "content": "# Parameter Calibration Register\n\nThis register tracks high-risk parameters whose numbers matter enough that they should not remain \"because the document says so.\"\n\nIt complements `/founding/commitments.md` and `architecture/parameter_registry.md`. Those files bind values. This file records why values are plausible, how they should be tested, and what evidence would force revision.\n\n---\n\n## Row Standard\n\nEvery high-risk parameter should eventually have:\n\n| Field | Meaning |\n|---|---|\n| Parameter | FC identifier or named constitutional threshold. |\n| Current value | Bound, provisional, reserved, or proposed value. |\n| Tier | Tier 1, Tier 2, Tier 3, or pre-launch blocking gate. |\n| Why this value exists | Plain-language rationale, not just cross-reference. |\n| Capture route | How a bad actor benefits from this value being too high, too low, vague, or stale. |\n| Evidence needed | Simulation, pilot, audit, legal review, or outside source needed. |\n| Revision trigger | What result forces review. |\n| Governing docs | Where the value is bound and where consequences appear. |\n\n---\n\n## Seed Register\n\n| Parameter | Current value | Tier | Why this value exists | Capture route | Evidence needed | Revision trigger | Governing docs |\n|---|---:|---|---|---|---|---|---|\n| FC-010 leakage thresholds | 3% routine target; 7% systemic review | Tier 1 / active-unproven | Converts shadow-convertibility enforcement capacity into published thresholds. | Too high normalizes broker markets; too low justifies surveillance. | Proxy-market red team; enforcement-capacity audit. | Broker profitability remains positive or ordinary households face overbroad enforcement. | Annex AB; Threat Register T-001. |\n| FC-020 Protected Pause floor | 0.30 Voice | Tier 1 | Prevents hardship from erasing civic continuity. | Too high preserves incumbents; too low punishes illness and care. | Hardship-pause abuse test. | Pause rings preserve roles or genuine hardship users avoid protection. | Annex AF; Service Record Misuse Evidence Test Package. |\n| FC-030 oracle N_MIN | 5 nodes | Tier 1 | Prevents single-source measurement control. | Too low enables capture; too high causes paralysis. | Capacity measurement and oracle-failure drill. | Quorum failure blocks response or correlated error persists. | Annex AL; Capacity Measurement Evidence Test Package. |\n| FC-031 methodology classes | 3 classes | Tier 1 | Reduces shared epistemic failure. | Standards bodies define all classes in their own image. | Methodology-class audit. | Method classes share data, funding, model supply chain, or standards body. | Annex AL; T-020/T-021. |\n| FC-032 pairwise correlation max | 0.30 Pearson, supplemented by directional-bias review | Tier 1 | Makes formal independence testable while preventing same-direction bias from passing merely because co-movement is low. | Actors tune reporting to pass correlation while sharing assumptions or incentives that push all errors in the same direction. | Forecast-vs-actual, directional-bias table, and oracle independence audit. | Shared error exceeds threshold during stress, or same-direction material error recurs without corrective action. | Annex AL; T-020/T-021. |\n| FC-033 adversarial oracle seats | 1 per cohort | Tier 1 | Forces hostile-method review inside measurement. | Seat becomes symbolic or captured by same professional network. | Adversarial-seat independence review. | Dissent never changes outcomes or is not resourced. | Annex AL; T-020/T-021. |\n| FC-040 penalty base multiplier | 5.0x | Tier 1 / active-unproven | Makes detected conversion expected-value negative. | Too low invites arbitrage; too high punishes edge cases harshly. | Annual deterrence audit. | Violations remain profitable or appeals show disproportionate harm. | Annex AJ; T-001/T-007. |\n| FC-041 detection assumption | 0.85 | Tier 1 / active-unproven | Supplies expected-value calculation for penalties. | Overstated detection hides under-enforcement. | Detection-rate audit. | Actual detection probability materially lower than assumed. | Annex AJ; Enforcement Panel audit. |\n| FC-202 Commons Return source-base list | Reserved \u2014 bind before CRUS activation | Tier 1 / pre-launch gate | Defines the closed list of allowed Commons Return bases (land/location value, natural resources, spectrum, monopoly licenses, platform/network rents, high-value concessions, large successions). The list is closed under INV-008: downward extension onto ordinary life is a Tier-1 amendment. | Source-base definitions quietly broadened to reach ordinary labor, homes, tools, or savings. | Source-base mapping pilot and incidence model. | Any base reaches an INV-008-protected category. | ANNEX_D; INVARIANTS INV-008; Commons Return and Universal Stake Evidence Package. |\n| FC-203 Commons Return assessment rate schedule | Reserved \u2014 calibrated by source base before activation | Tier 2 / pre-launch gate | Sets the per-base assessment rate without making ordinary labor or survival access the funding base. | Rates tuned to spare connected asset classes; valuation hiding. | Incidence, valuation-hiding, and external-capital-arbitrage tests. | Burden lands on ordinary households or productive stewardship instead of scarcity privilege. | ANNEX_D; CRUS Simulation Protocol. |\n| FC-204 protected ordinary-use threshold (formerly registered here as FC-052) | Reserved \u2014 bind before CRUS activation; initial reference remains 18 months \u00d7 regional median monthly consumption until replaced by the CRUS fiscal dossier | Tier 2 / pre-launch gate | Defines the ordinary household reserve that may not become the public funding base under Annex D protected-use rules. | Too low reaches ordinary households; too high shelters concentrated control under household labels. | Commons Return incidence model and household/small-operator burden review. | Ordinary households, caregivers, small operators, elders, disabled persons, or rural households bear Commons Return burden meant for scarcity privilege or public-created value. | ANNEX_D; Commons Return and Universal Stake Evidence Package; founding/commitments.md FC-204. |\n| FC-205 Universal Stake distribution cadence | Reserved \u2014 bind before first distribution | Tier 2 / pre-launch gate | Makes Stake timing reliable for households and useless as a political reward instrument; a distribution may be authorized only after the floor and reserves are funded (INV-014). | Distribution timed to elections or withheld as punishment. | Distribution drill with INV-014 ordering check. | Any distribution authorized while floor or reserves underfunded. | ANNEX_D; INVARIANTS INV-014. |\n| FC-206 Universal Stake eligibility rule | Reserved \u2014 bind before first distribution | Tier 1 / pre-launch gate | Keeps the Stake universal and non-convertible (no sale, assignment, garnishment, pledge, inheritance, or purchase of membership/priority/standing/office/Voice). | Eligibility narrowed to exclude the inconvenient; conversion pathways laundered through legal wrappers. | Non-convertibility red team. | Any conversion pathway clears. | ANNEX_D; ANNEX_AK; INVARIANTS INV-002/INV-017. |\n| FC-207 CRUS anti-capture gates | Reserved \u2014 bind before CRUS activation | Tier 1 / pre-launch gate | Public accounting, no patronage discretion, data minimization, auditability, appeal rights. | Fund administrators become patronage allocators. | Capture Dashboard drill. | Discretionary or targeted allocation observed. | ANNEX_D; Capture Dashboard Specification. |\n| FC-208 PFCR / lockbox reserve and routing rule (formerly registered here as FC-054) | Reserved | Tier 2 / pre-launch gate | Splits Commons Return receipts between Essential Access support, public rails, restoration, resilience reserves, infrastructure, and Universal Stake. | Too much to one channel creates fiscal dependency; too little weakens commons funding or turns Universal Stake into political dividend timing. | Fiscal adequacy model, source-base revenue model, lockbox sufficiency test, and burden-incidence review. | PFCR becomes dependent on inflation, hidden debt, or prohibited tax bases; or cannot fund baseline commons. | ANNEX_D; Article V; SPECIFICATIONS; founding/commitments.md FC-208. |\n| FC-209 CRUS appeal path | Bound to the appeal spine (ANNEX_L \u00a7L7): first instance Commons Return assessment review per ANNEX_D \u00a7D6, escalation per the spine \u2014 appeal-path drill still required pre-launch | Tier 1 / pre-launch gate | Human appeal for assessed holders and excluded claimants without letting high-value actors stall assessment. | Procedural delay as avoidance; appeal priced out of reach of the poor claimant. | Appeal-path drill (both directions). | Appeals stall assessment or exclude the unrepresented. | ANNEX_L \u00a7L7; ANNEX_D \u00a7D6; Federated Ombuds. |\n| FC-210 CRUS review cadence | Reserved \u2014 bind before CRUS activation | Tier 2 / pre-launch gate | Scheduled review of incidence, eligibility, valuation, bases, distribution, reserves, capture metrics; a missed cadence is itself a failure. | Review quietly skipped in good years. | Cadence compliance audit. | Missed cadence or missing data. | ANNEX_D; Capture Dashboard Specification; Pilot Evidence Roadmap. |\n| Dormant \u00a7D9 backstop schedule (no live FC ID; a revival patch would assign one) | Superseded as an active parameter; no routine balance or net-worth decay schedule is operative unless a new patch, fiscal/dignity evidence, public review, and applicable amendment process revive a narrow dormant backstop. | Dormant / not operative | Preserves historical traceability for the retired demurrage designs without letting old rates govern by accident. The retired idle-balance parameters are tombstoned in founding/commitments.md FC-050\u2013FC-052, FC-054. | If treated as active, it can burden ordinary households, illiquid owners, or working savers while bypassing the Commons Return source-base test. | Dormant-backstop incidence model, dignity review, household burden model, and explicit amendment activation record before any use. | Any document or implementation treats old rates or \u03bb brackets as active, funds Essential Access from them, or applies routine balance/net-worth decay by interpretation. | ANNEX_D \u00a7D1 and \u00a7D9; SPECIFICATIONS. |\n| FC-055 issuance ceiling function | Reserved | Tier 1 / pre-launch gate | Links Flow supply to verified productive commitments. | Too loose inflates claims; too tight starves production. | Flow issuance simulation and productive-commitment audit. | Circulation detaches from real production or needed projects cannot clear. | Article V; SPECIFICATIONS. |\n| FC-058 CSM basket/regional adjustment | Reserved | Tier 1 / regional launch gate | Prevents one abstract basket from ignoring local climate, food, medicine, and shelter needs. | Under-adjustment harms high-need regions; over-adjustment invites political inflation. | Regional CSM pilot and capacity review. | Regional needs are mismeasured or adjustment becomes patronage. | Article III; Annex Y; SPECIFICATIONS. |\n| FC-060 Voice sector ceiling | 0.20 | Tier 1 | Prevents one sector dominating civic weighting. | Sector labels are split or merged to hide concentration. | Capture Dashboard Specification. | Sector concentration remains high through reclassification. | Article VI; Annex AC. |\n| FC-061 per-person cap | See commitments | Tier 1 | Prevents extreme individual civic weight. | Cap can still permit coordinated class control. | Civic-pool concentration review. | Repeat-role networks dominate despite compliance. | Article VI; Annex Z. |\n| FC-062 Service Record decay | See commitments | Tier 1 | Keeps standing tied to recent service. | Slow decay preserves old class; fast decay erases real long-term service. | Service Record misuse and hardship-pause tests. | Role pools become stale or participation becomes burnout. | Annex Z; Annex AF. |\n| FC-070 reserve window | 45 days x CSM x population | Tier 1 | Gives survival floor time during supply shock. | Under-reserve creates rationing; over-reserve creates hoarding bureaucracy. | Capacity stress test by essential category. | Reserves fail before recovery window or drain ordinary supply. | Annex Y; Article III. |\n| FC-071 CSM cluster failure threshold | 3 per 10,000 residents per 30 days | Tier 1 | Detects survival-floor delivery failure. | Too high hides local harm; too low causes noisy emergency churn. | Delivery pilot and small-cell privacy review. | Cluster failures undercount vulnerable groups. | Annex Y; Article VII. |\n| FC-072 Shared Storehouse activation threshold rule | Reserved by category | Tier 1 / activation gate | Prevents emergency rationing from activating on vague scarcity claims. | Too loose normalizes rationing; too strict delays needed protection. | Scarcity activation and unwind drill by essential category. | Shared Storehouse activates without real scarcity or fails during shortage. | Article III; Annex AQ; SPECIFICATIONS. |\n| FC-080 attestation stake ratio | See commitments | Tier 1 | Makes false high-impact attestations costly. | Rich actors buy credibility; poor attestors withdraw. | Attestation market test. | False claims persist or isolated people lose recognition. | Annex AS; Service Record package. |\n| FC-081 audit window | See commitments | Tier 1 | Keeps attestations reviewable long enough to catch false claims. | Too short invites delayed fraud; too long chills honest help. | Attestation/collusion pilot. | Disconfirmations arrive after window or honest attestation drops. | Annex AS. |\n| FC-082 graph density threshold | See commitments | Tier 1 | Protects close-knit communities from automatic collusion penalties. | Rings hide as community density. | Dense-community safe-harbor test. | Mutual-aid networks or fraud rings are misclassified. | Annex AS. |\n| FC-090 Ombuds sub-count | 5 nodes | Tier 1 | Distributes audit authority. | Five offices can still coordinate informally. | Capture Dashboard Specification. | Voting-pattern and staffing overlap exceed threshold. | Annex AI. |\n| FC-091 Ombuds supermajority | 4 of 5 | Tier 1 | Prevents one sub-node from ruling alone. | Minority can block needed correction; majority can coordinate. | Ombuds deadlock and collusion drill. | Repeated 3-2 deadlocks or rubber-stamp 5-0 patterns. | Annex AI. |\n| FC-100 quorum-loss restoration | 14 days | Tier 1 | Limits emergency hold under oracle loss. | Too long normalizes emergency; too short forces unsafe unwind. | Shared Storehouse oracle blackout drill. | Restoration misses reality or holds persist after recovery. | Annex AQ. |\n| FC-110 Tier 1 signatures | 7 of 9 | Tier 1 recursive | Blocks small-coalition amendment of core rules. | Three holders can block; seven can be captured socially. | Keyholder custody and capture review. | Holder concentration or coercion makes threshold easier than assumed. | Amendment Protocol. |\n| FC-111 Tier 1 timelock | 180 days | Tier 1 recursive | Creates public response and exit window. | Delay can be waited out or used for paralysis. | Timelock response drill. | Affected communities cannot understand, challenge, or exit in time. | Amendment Protocol; Drift Chain. |\n| FC-120 exit threshold | 2/3 resident personhood | Tier 1 | Prevents small faction exit capture. | Too high traps dissenters; too low enables hostile breakaway. | Exit rehearsal and participation-barrier audit. | Exit is formal but practically unavailable. | Founding Order. |\n| FC-121 exit unwind | 730 days | Tier 1 | Preserves Essential Access during exit. | Too long becomes exit denial; too short harms dependents. | Exit transition simulation. | Essential services fail or exit becomes punitive. | Founding Order. |\n| FC-140 identity fraud band | target \u22642% / upper bound \u22645% / trigger \u22653% per quarter | Tier 2 / pre-launch gate | Sets starting Essential Access identity-fraud tolerance while keeping fraud visible before it drains physical survival supply. | Over-tightening excludes vulnerable people; over-loosening lets identity fraud consume food, medicine, shelter, or other CSM capacity. | Identity and Recovery Evidence Test Package; Annex AK; founding commitments. | Exclusion rises, fraud drains Essential Access, or pilot evidence shows the band is too loose or too tight for vulnerable populations. | Annex AK; founding/commitments.md. |\n| FC-160-184 contract parameters | Reserved / proposed | Pre-launch gate | Escrow, deployment-window, force-majeure, and inspector-pool controls need calibration. | Loose terms recreate hoarding; tight terms block infrastructure. | Commons Return and Universal Stake Evidence Test Package, project-finance simulation, and procurement red team. | Escrows become protected-capital shelter markets or project finance stalls. | Annex AR; ANNEX_D. |\n| FC-185-193 external trade and strategic floor parameters | Reserved / draft anchors | Tier 1 / Tier 2 mixed | Strategic reserves and external-capital gates decide whether outside dependency can threaten the survival floor. | Too loose creates foreign-capital or supplier capture; too strict blocks useful trade. | External trade stress test, supplier concentration audit, reserve adequacy review. | Strategic categories fall below floor or capital controls become arbitrary. | Annex AT. |\n| FC-194 essential fuel reserve minimum | Reserved; draft anchor 60-90 days by region and season | Tier 1 / pre-launch gate | Fuel continuity is a refusal chokepoint for food, heat, emergency transport, and grid recovery. | Too low lets a conglomerate or import shock force capitulation; too high creates stockpile capture and spoilage bureaucracy. | Fuel reserve adequacy model; seasonal logistics drill; refinery and transport dependency audit. | Any region falls below minimum during a 30-day refusal scenario or reserve turnover degrades usable supply. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-195 essential medicine stockpile minimum | Reserved; draft anchor 90-180 days for critical lists | Tier 1 / pre-launch gate | Medicines with fragile supply chains need a longer buffer than ordinary inventory because substitution can be clinically impossible. | Too low lets suppliers, PBMs, or distributors ration access; too high causes expiry waste and favors incumbents with warehousing. | Critical medicine list; expiry and rotation audit; shortage simulation by region and care setting. | Critical medicine availability drops below clinical continuity floor or stock rotation losses become material. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-196 maximum essential supplier concentration | Reserved; draft anchor no supplier above 25% of regional essential throughput | Tier 1 / launch gate | Prevents one firm from becoming the practical veto point for survival-floor delivery. | Too loose permits single-supplier refusal; too strict blocks emergency use of scarce specialist capacity. | Supplier concentration audit; regional substitution map; refusal tabletop exercise. | One supplier can interrupt more than a quarter of regional essential throughput without a public fallback already active. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-197 public fallback activation deadline | Reserved; draft anchor 72 hours for critical interruption, 14 days for managed transition | Tier 1 / activation gate | Refusal protection only works if public or cooperative fallback capacity starts before households hit survival-floor failure. | Too slow lets private operators bargain through delay; too fast may trigger wasteful takeover before facts are verified. | Public fallback readiness drill; emergency procurement rehearsal; legal activation review. | Verified interruption persists past deadline without fallback service or false activations recur. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-198 procurement concentration threshold | Reserved; draft anchor review above 30%, mandatory remediation above 40% of essential category spend | Tier 2 / pre-launch gate | Public purchasing can accidentally rebuild the same conglomerate dependency it is meant to neutralize. | Too loose funnels demand to incumbents; too strict fragments procurement below quality and reliability needs. | Procurement spend audit; vendor capacity review; anti-collusion screen. | Essential procurement share exceeds remediation threshold for two review periods or fragmentation causes delivery failure. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-199 PBM/intermediary separation threshold | Reserved; draft anchor separation review at 10% cross-owned claims or dispensing volume, mandatory firewall above 20% | Tier 1 / launch gate | Pharmacy benefit managers and similar intermediaries can deny access while appearing to manage price or claims. | Too loose lets intermediaries steer patients and suppliers; too strict may disrupt legitimate administrative clearing. | PBM ownership and routing audit; claims-denial review; patient access stress test. | Cross-owned routing exceeds threshold, denial patterns favor affiliated entities, or independent access deteriorates. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-200 critical logistics redundancy floor | Reserved; draft anchor two independent routes and operators per essential region | Tier 1 / launch gate | Stockpiles do not matter if a conglomerate controls the practical path from reserve to household or clinic. | Too low creates carrier or warehouse chokepoints; too high imposes costly duplication in sparse regions. | Logistics dependency map; cold-chain and last-mile drill; emergency carrier substitution test. | A single operator, warehouse, port, rail spur, or cold-chain provider can block regional essential delivery. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| FC-201 essential data and claims portability deadline | Reserved; draft anchor 24 hours for emergency export, 30 days for full transition package | Tier 2 / transition gate | Conglomerate refusal can happen through records, claims, formularies, and routing data even when physical supply exists. | Too loose lets incumbents hold operations hostage; too strict risks unsafe or incomplete data transfer. | Data escrow rehearsal; claims and formulary export audit; receiving-operator validation. | Public fallback cannot adjudicate, dispense, route, or reconcile essential service within deadline. | Annex AT; Conglomerate Transition Dossier; Essential-Sector Refusal Test Package. |\n| RHL protected-channel ceiling | Reserved \u2014 Tier 2 founding commitment; any TFP/RHL ceiling must be re-derived under Annex D protected ordinary use, Annex X stale-purpose rules, Commons Return source-base review, and the Anti-Rent Legal Wrapper Evidence Test Package. | Tier 2 / pre-launch gate | Prevents protected savings or project-finance channels from becoming unlimited shelters for concentrated control while preserving ordinary retirement and household continuity. | Too high shelters concentrated wealth under protected labels; too low blocks ordinary savings, retirement planning, or productive small-operator resilience. | Household savings simulation; concentration impact assessment; source-base avoidance review; legal-wrapper review; comparison with floor needs over 5, 10, and 20 years. | High-balance households use TFP/RHL faster than expected to avoid Commons Return/source-base review, or ordinary retirement savers cannot reach the participation floor. | ANNEX_D; ANNEX_X; Anti-Rent Legal Wrapper Evidence Test Package. |\n| CASP price corridor | \u00b115% of the registered pricing index for the relevant category, adjusted quarterly for verified regional inflation | Tier 2 / operational | Prevents essential-sector suppliers from exploiting captive-buyer position through price spikes, while allowing legitimate cost fluctuation. | Too narrow blocks legitimate price adjustment; too wide defeats the price protection purpose. | Price corridor red team; inflation adjustment audit; supplier profitability review at corridor boundary. | Suppliers systematically price at corridor ceiling or exit when corridor prevents premium pricing. | Annex AT \u00a7AT6.6. |\n| CASP service-level baseline dimensions | Minimum four measurable dimensions co-signed at pre-registration: delivery timeliness, fill rate, quality certification rate, and incident response time; plus any category-specific additions | Tier 2 / operational | Makes degradation trigger (clause d) measurable and enforceable; prevents slow-squeeze through informal service erosion. | Too few dimensions misses degradation; too many dimensions creates gaming through selectively meeting some. | Degradation detection drill; supplier behavior under watch conditions. | Suppliers meet formal dimensions while degrading overall service or dimension gaming becomes observable. | Annex AT \u00a7AT6.6. |\n| CIP absolute funding floor | Reserved \u2014 Tier 2 founding commitment established before CIP constitution; must cover staff for 7 members, independent legal and technical review for 4 Tier-1-touching proposals per year, and publication infrastructure | Tier 2 / pre-launch gate | Prevents under-reporting of Flow issuance as a mechanism for CIP budget suppression below operating capacity. | Too low renders CIP ineffective; too high creates fiscal dependency risk. | CIP operating cost estimate; comparable constitutional body audit. | CIP cannot staff an adversarial review of a Tier-1-touching proposal within its budget or funding-floor breach goes unpublished. | Annex AM \u00a7AM8.3. |\n| FC-T0-01 | Tier 0 aggregate anomaly threshold | 5% of CSM capacity per category | 2%\u201315% | Ombuds via standard FAP | Baseline consumption data from Phase 2 pilot; revisit if physical-fraud rate exceeds threshold in stress test | ANNEX_AK \u00a7AK8.3 |\n\n---\n\n## Maintenance Rule\n\nNo parameter should move from provisional to bound without a row here, an evidence path, and a revision trigger. No parameter should stay bound after evidence shows it is causing the collapse state it was meant to prevent.\n",
       "headings": [
         {
           "level": 1,
@@ -2738,7 +2743,7 @@
           "slug": "maintenance-rule"
         }
       ],
-      "wordCount": 3563,
+      "wordCount": 3587,
       "headingCount": 4
     },
     {
@@ -3487,7 +3492,7 @@
       "status": "",
       "statusBucket": "reference",
       "summary": "This package defines what must be true before the project can make strong claims about identity, recovery, and access continuity.",
-      "content": "# Identity and Recovery Evidence Test Package\n\nThis package defines what must be true before the project can make strong claims about identity, recovery, and access continuity.\n\nIdentity is a load-bearing precondition. Essential Access, Voice, Service Record, exit rights, consent records, and anti-fraud enforcement all depend on knowing whether a person is a unique living person and whether they are continuous with an earlier record. But identity controls can also become surveillance, exclusion, family coercion, bureaucratic discretion, or quiet denial of survival access.\n\nCurrent status: **unresolved prerequisite, designed direction, needs evidence**.\n\n---\n\n## Honest Claim Boundary\n\nThe project may currently claim:\n\n> The identity architecture rejects a single master credential, preserves the survival floor during disputes, and requires quantified fraud/exclusion trade-offs before scale-up.\n\nThe project may not yet claim:\n\n- the identity stack is proven;\n- fraud controls will not exclude vulnerable people;\n- recovery works for displaced, undocumented, disabled, elderly, digitally fragile, coerced, trafficked, or abused people;\n- privacy-preserving credentials are sufficient by themselves;\n- biometric, device, community, or document evidence can safely dominate the stack;\n- staff discretion is controlled in practice;\n- the survival floor cannot be interrupted by administrative failure.\n\nEvidence-backed claims require the tests below plus a residual-risk update.\n\n---\n\n## Source Base\n\n| Source | What it supports | What it does not prove |\n|---|---|---|\n| [NIST SP 800-63-4 Digital Identity Guidelines](https://pages.nist.gov/800-63-4/) | Identity systems need risk management, assurance levels, fraud controls, privacy, customer experience, and continuous evaluation. | It does not prove a survival-floor identity system can be both fraud-resistant and non-exclusionary. |\n| [World Bank ID4D Practitioner's Guide](https://id4d.worldbank.org/guide) | Foundational ID systems need inclusion, accessibility, privacy, institutional accountability, and risk assessment. | It does not supply this project's fraud/exclusion thresholds or recovery doctrine. |\n| [Principles on Identification for Sustainable Development](https://id4d.worldbank.org/guide/1-principles) | ID systems should pursue universal coverage, accessibility, privacy, user rights, accountability, and grievance mechanisms. | Principles are not evidence that any implementation protects vulnerable users. |\n| [World Bank ID4D exclusion-risk guidance](https://id4d.worldbank.org/guide/assess-risks) | ID systems can exclude poor, rural, elderly, disabled, displaced, refugee, stateless, digitally fragile, and other vulnerable groups if barriers are not designed around. | It does not prove which local groups will fail or what threshold is acceptable. |\n| [World Bank ID4D privacy and security guidance](https://id4d.worldbank.org/guide/privacy-security) | Privacy-by-design, data minimization, separation, tokenization, federation, and compartmentalization are real design disciplines. | It does not prove this project can enforce them against hostile administrators. |\n| [UNHCR registration and identity management guidance](https://www.unhcr.org/registration-guidance/chapter3/access-to-registration/) | Registration for displaced people must be accessible, non-arbitrary, and attentive to barriers. | Refugee registration doctrine does not solve ordinary civic identity, fraud, or long-term recovery. |\n| [W3C Verifiable Credentials Data Model v2.0](https://www.w3.org/news/2025/the-verifiable-credentials-2-0-family-of-specifications-is-now-a-w3c-recommendation/) | Cryptographically verifiable, privacy-respecting credentials are a mature technical design space. | Verifiable credentials do not by themselves solve enrollment, coercion, device loss, issuer capture, or exclusion. |\n\n---\n\n## Abuse Model\n\nAssume every identity mechanism will be attacked from both sides: by people seeking extra access and by institutions seeking easier denial.\n\n| Actor | Likely attack or failure route | What the test must expose |\n|---|---|---|\n| Fraud ring | Synthetic identities, duplicate enrollments, rented identities, proxy redemption, stolen recovery credentials. | Whether fraud is caught without turning all users into surveillance subjects. |\n| Insider operator | Approves friends, sells recovery, suppresses appeals, or flags inconvenient users as suspicious. | Whether staff discretion is bounded, logged, rotated, and appealable. |\n| Abusive household member | Controls devices, documents, biometrics, appointments, transport, or recovery contact channels. | Whether recovery can happen without evidence controlled by the abuser. |\n| Employer, landlord, sponsor, or institution | Uses dependency to force identity sharing, credential custody, or false attestations. | Whether coercive third-party control is detectable and reversible. |\n| Hostile administrator | Tightens identity rules after fraud panic to reduce caseload, exclude disliked groups, or punish dissent. | Whether Annex AK thresholds bind under political pressure. |\n| Vendor or platform | Optimizes for low fraud metrics while hiding abandonment, inaccessible UX, or biased failure. | Whether exclusion is measured outside successful enrollment data. |\n| Data broker or attacker | Links identifiers, service traces, biometrics, and recovery events into a behavioral dossier. | Whether compartmentalization and minimization survive realistic data-access pressure. |\n| Well-meaning bureaucracy | Adds forms, proof categories, case reviews, and escalation steps until recovery becomes unusable. | Whether ordinary people can recover access fast enough without expert help. |\n\n---\n\n## Required Models\n\n### 1. Fraud and Duplicate-Identity Model\n\n**Question:** Can the system prevent scalable duplicate personhood without making every ordinary user continuously legible?\n\n**Minimum scenarios:**\n\n- duplicate enrollment by one person;\n- synthetic identity with partial real evidence;\n- takeover of a real person's record;\n- rented identity;\n- family proxy use;\n- staff-assisted fraud;\n- cross-region duplicate enrollment;\n- post-disaster mass re-enrollment.\n\n**Required outputs:**\n\n- false acceptance rate by assurance tier;\n- confirmed fraud rate by instrument tier;\n- suspected-but-unconfirmed fraud trend;\n- detection latency;\n- investigation burden;\n- false-positive burden;\n- data used per detection event;\n- whether detection requires generalized behavioral monitoring.\n\n**Failure criteria:**\n\n- fraud is only detectable through broad activity surveillance;\n- staff-assisted fraud is not separately measurable;\n- duplicate detection works only for well-documented users;\n- false positives interrupt the Constitutional Survival Minimum;\n- suspected fraud data is treated as confirmed fraud in public dashboards;\n- fraud prevention creates a permanent unified behavioral graph.\n\n### 2. False-Exclusion and Abandonment Model\n\n**Question:** Who fails to enroll or recover, and is failure hidden because only successful users are counted?\n\n**Minimum segmentation:**\n\n- displaced people;\n- undocumented people;\n- stateless people;\n- elderly people;\n- disabled people;\n- digitally fragile people;\n- people without smartphone or reliable internet;\n- people with low literacy;\n- rural or remote users;\n- guardianship and dependent cases;\n- coercive-control and trafficking contexts;\n- people with name, gender, family, or document inconsistencies.\n\n**Required outputs:**\n\n- enrollment success rate;\n- abandonment rate;\n- reason for abandonment;\n- time to first decision;\n- appeal completion rate;\n- staff-discretion points;\n- required travel/time/cost;\n- language and accessibility failures;\n- denial reason distribution;\n- survival-floor continuity during unresolved status.\n\n**Failure criteria:**\n\n- vulnerable groups fail at materially higher rates than ordinary users;\n- abandonment is not counted as exclusion;\n- users must pay, travel repeatedly, own a smartphone, or expose unnecessary data to obtain survival access;\n- identity uncertainty reduces the CSM floor rather than only higher-consequence privileges;\n- staff discretion becomes the real eligibility rule;\n- denial reasons are too vague to appeal.\n\n### 3. Recovery and Continuity Model\n\n**Question:** Can a real person recover after device loss, document loss, displacement, disaster, abuse, incapacity, or data error?\n\n**Minimum scenarios:**\n\n- lost phone and no backup device;\n- stolen credentials;\n- abusive partner controls documents;\n- elder loses memory or physical access;\n- disabled person cannot use default interface;\n- person flees domestic violence, trafficking, or institutional abuse;\n- disaster destroys documents and local records;\n- refugee or displaced person lacks recognized state documents;\n- conflicting records across regions;\n- legal name or gender marker change;\n- death, birth, guardianship, and dependent coverage transition.\n\n**Required outputs:**\n\n- time to provisional restoration;\n- time to full restoration;\n- CSM continuity during recovery;\n- number of required interactions;\n- independent corroboration options;\n- unsafe evidence avoided;\n- appeal path completion;\n- data exposure during recovery;\n- post-recovery correction of harmful flags.\n\n**Failure criteria:**\n\n- recovery requires contacting an abuser, employer, landlord, sponsor, or hostile institution;\n- survival access is interrupted while recovery is pending;\n- recovery depends on a single device, biometric, document, or authority;\n- unresolved flags remain visible to unrelated service providers;\n- people cannot understand what evidence is required;\n- recovery is technically possible but too slow for food, shelter, medicine, or safety.\n\n### 4. Privacy and Data-Minimization Model\n\n**Question:** Does the identity stack prove what is needed without building a lifelong surveillance dossier?\n\n**Required tests:**\n\n- data inventory by evidence type;\n- purpose-limitation map;\n- retention schedule;\n- identifier-compartment test;\n- sector-tokenization test;\n- breach-impact simulation;\n- insider-query audit;\n- selective-disclosure test;\n- zero-knowledge or attribute-proof feasibility where useful;\n- behavioral-linkage red team.\n\n**Failure criteria:**\n\n- service use is routinely linkable across survival, market, civic, health, housing, and recovery contexts;\n- identity verification and activity monitoring fuse into a single graph;\n- recovery events expose sensitive histories to ordinary providers;\n- data minimization is described but not measurable;\n- breach impact would reveal enough to coerce, profile, or politically target users;\n- privacy controls depend mainly on trust in administrators.\n\n### 5. Coercion and Delegation Model\n\n**Question:** Can identity be protected when a powerful person or institution controls the user's practical life?\n\n**Minimum scenarios:**\n\n- family member controls phone, documents, or appointments;\n- employer or sponsor holds documents;\n- landlord conditions housing on credential access;\n- institution manages identity for residents;\n- caregiver acts for dependent adult;\n- parent or guardian acts for child;\n- trafficker or abusive partner monitors communications;\n- community witness system is captured by local power holders.\n\n**Required outputs:**\n\n- coercion detection channels;\n- safe alternate contact path;\n- protected interview availability;\n- emergency manual access;\n- independent advocate access;\n- custody-of-credential incidents;\n- delegation audit trail;\n- reversal speed when coercion is found.\n\n**Failure criteria:**\n\n- delegation becomes ownership;\n- credential custody by third parties becomes normal;\n- a user cannot safely report coercion;\n- identity recovery forces disclosure to the coercive actor;\n- community attestation systems reproduce local domination;\n- guardianship rules erase the person's own standing when supported decision-making would suffice.\n\n### 6. Governance Calibration Model\n\n**Question:** Does Annex AK's Asymmetric Error Doctrine bind real decisions, or does politics override it?\n\n**Required tests:**\n\n- test FC-140 through FC-145, bind FC-146 through FC-150, and revise any value that pilot evidence shows is too loose or too tight;\n- publish fraud and exclusion rates with confidence intervals;\n- audit abandonment and denied access separately;\n- simulate a fraud panic;\n- simulate an exclusion scandal;\n- simulate simultaneous fraud and exclusion breaches;\n- test recalibration panel independence;\n- test Article VII dashboard comprehension.\n\n**Failure criteria:**\n\n- thresholds remain reserved at scale-up;\n- a fraud incident causes emergency tightening outside Annex AK;\n- exclusion data depends on self-reporting by excluded people who cannot access the system;\n- vulnerable-category estimates are manipulated to make exclusion look lower;\n- dashboards hide confidence intervals or denominator uncertainty;\n- recalibration is controlled by identity-system operators.\n\n---\n\n## Calibration Rules\n\nIdentity parameters should not be set by political mood, vendor preference, or fear of headlines.\n\n**Minimum parameter set:**\n\n| Parameter | What it controls | Evidence needed before binding |\n|---|---|---|\n| FC-140 Essential Access fraud band | Maximum tolerated Essential Access identity fraud | Fraud simulation, staff-assisted fraud test, physical-supply impact model. |\n| FC-141 Voice fraud band | Maximum tolerated civic agenda fraud | Duplicate civic activation and agenda-distortion simulation. |\n| FC-142 Service Record fraud band | Maximum tolerated public-service eligibility fraud | Role-selection and contribution-verification red team. |\n| FC-143 through FC-147 exclusion bands | Maximum tolerated exclusion by vulnerable group and overall population | Enrollment, abandonment, recovery, and appeals pilot by group. |\n| FC-148 exclusion priority multiplier | When exclusion reduction must outrank fraud tightening | Joint fraud/exclusion trade-off simulation. |\n| FC-149 fraud priority bound | When fraud reduction must outrank inclusion loosening | Supply-impact and civic-integrity model. |\n| FC-150 simultaneous breach default | Default when fraud and exclusion both breach upper bounds | Public legitimacy review and independent panel recommendation. |\n\n**Calibration must satisfy all five constraints:**\n\n1. CSM access continues during identity uncertainty;\n2. fraud controls are stronger for higher-consequence privileges;\n3. vulnerable groups have separately visible failure rates;\n4. recovery is possible without a single master credential;\n5. identity verification does not become generalized surveillance.\n\n---\n\n## Test Sequence\n\n### Stage 0 - Desk Evidence Review\n\nOutput: source memo separating technical identity standards, development/inclusion guidance, refugee registration lessons, privacy-preserving credential standards, and gaps.\n\nPass condition: the memo identifies what outside sources support and what they do not prove.\n\n### Stage 1 - Synthetic Identity Attack Simulation\n\nOutput: duplicate, synthetic, takeover, rented-identity, and staff-assisted fraud scenarios across instrument tiers.\n\nPass condition: fraud controls identify scalable attacks without requiring broad behavioral surveillance.\n\n### Stage 2 - Exclusion and Abandonment Pilot\n\nOutput: voluntary enrollment/recovery exercise with protected participants and independent advocates.\n\nPass condition: abandonment, denial, time cost, data exposure, and appeal outcomes are measured by vulnerable group.\n\n### Stage 3 - Recovery Stress Drill\n\nOutput: device-loss, document-loss, disaster, abuse, incapacity, and displacement recovery drills.\n\nPass condition: provisional access is restored fast enough to preserve survival needs, and full restoration has recorded reasons and appeal rights.\n\n### Stage 4 - Privacy and Coercion Red Team\n\nOutput: insider-query audit, data-linkage attack, coercive-control scenario, credential-custody scenario, and community-attestation capture test.\n\nPass condition: sensitive recovery and service-use data cannot be casually linked, and coerced users have safe alternate routes.\n\n### Stage 5 - Annex AK Calibration Hearing\n\nOutput: public calibration package confirming or revising FC-140 through FC-145, binding FC-146 through FC-150, and publishing confidence intervals, dissenting views, and plain-language explanation.\n\nPass condition: the public can see the trade-off, vulnerable groups can challenge it, and scale-up is blocked if the numbers remain reserved.\n\n---\n\n## Minimum Evidence Tables\n\nThe project should not move identity from **unresolved prerequisite** to **partly tested** until these tables exist.\n\n| Table | Required columns |\n|---|---|\n| Fraud by tier | Instrument tier, fraud type, confirmed cases, suspected cases, detection method, false positives, investigation time. |\n| Exclusion by group | Group, attempted enrollments, successful enrollments, abandonment, denials, denial reason, appeal outcome, confidence interval. |\n| Recovery events | Scenario, provisional restoration time, full restoration time, CSM continuity, data exposed, unsafe evidence avoided, unresolved flags. |\n| Staff discretion | Decision point, role, override authority, reason code, audit log, appeal availability, concentration by staff/team. |\n| Privacy inventory | Data type, purpose, retention, compartment, who can query, breach harm, minimization alternative. |\n| Coercion incidents | Coercion route, reporter, safe contact path, protective action, restoration time, repeat-risk control. |\n| AED calibration | FC parameter, proposed value, evidence basis, uncertainty, dissent, review trigger, residual risk. |\n\n---\n\n## Decision Rule\n\nIdentity may support scale-up only if the tests show that it is:\n\n- multi-evidence rather than single-credential;\n- stronger at higher-consequence tiers;\n- continuous for CSM during disputes;\n- measurable for fraud and exclusion;\n- recoverable after realistic life disruptions;\n- usable by vulnerable groups;\n- resistant to insider and family coercion;\n- privacy-preserving by architecture, not promise;\n- governed by bound Annex AK thresholds;\n- understandable enough that denial and recovery can be appealed.\n\nIf those conditions fail, the project must pause scale-up, keep survival access provisional where necessary, revise Annex AK parameters, change enrollment/recovery procedures, or explicitly downgrade the claim from \"identity architecture\" to \"unproven design candidate.\"\n\n---\n\n## Failure Thresholds\n\nThis section defines specific numeric thresholds that constitute failure. These are not aspirational targets. They are ceilings: breach means the system has failed in a constitutional sense and must trigger the escalation path described below. Thresholds without empirical analogues are marked **precautionary \u2014 no field analogue**.\n\nAuditors should treat any threshold left as \"TBD\" at scale-up as a governance failure in itself.\n\n### Relationship to Annex AK\n\nAnnex AK defines the founding Asymmetric Error Doctrine bands. FC-143 through FC-145 are bound vulnerable-category pilot gates; FC-146 through FC-150 remain pre-launch commitments that must be bound before scale-up. The thresholds below do not silently replace Annex AK. They define stricter operational failure conditions for the Identity and Recovery Evidence Test Package.\n\nWhere the values differ, read them this way:\n\n- Annex AK FC bands are the public constitutional calibration bands for founding adoption and pilot governance.\n- The T-1 false-exclusion ceiling below is a scale-up ambition and warning threshold for the full Essential Access population, including abandonment.\n- Any interruption of the Constitutional Survival Minimum during an identity dispute is a Category A constitutional failure even if Annex AK's quarterly percentage bands are otherwise satisfied.\n- If the pilot passes Annex AK but breaches a stricter evidence-package threshold, the claim may not advance beyond \"active-unproven\" without a residual-risk update explaining the divergence.\n\n---\n\n### T-1: False Exclusion Ceiling\n\n**Threshold:** Fewer than 0.5% of Essential Access attempts denied per quarter due to identity verification failure, across the full eligible population including abandonment. This is a scale-up ambition and evidence-package warning threshold, not a replacement for Annex AK's vulnerable-category founding bands.\n\n**Rationale:** Essential Access is the Constitutional Survival Minimum. A system that correctly identifies 99.5% of users still excludes thousands at population scale. The 0.5% ceiling is not lenient \u2014 it is chosen because lower thresholds are not achievable with current best-practice ID systems in low-documentation contexts (see: UNHCR registration data, World Bank ID4D exclusion audits). Anything above 0.5% at scale implies structural exclusion, not edge-case error. The ceiling applies to the full denominator including people who abandoned the enrollment or recovery process, not only people who completed it.\n\n**Measurement:** Requires enrollment-attempt tracking from the moment of first contact, not from the moment of enrollment completion. Abandonment must be coded by point of exit and reason where ascertainable. Stage 2 pilot must produce this data disaggregated by vulnerable group. Confidence intervals required; point estimates alone do not pass.\n\n**Evidence basis:** Precautionary \u2014 no field analogue in a survival-floor context. 0.5% is borrowed from NHS digital access failure rate targets and EU eIDAS high-assurance rejection benchmarks, neither of which concerns survival access. The value is conservatively tight because the consequence of false exclusion here is not inconvenience but denial of survival resources.\n\n**Breach escalation:** Any quarter where measured false exclusion exceeds 0.5% triggers:\n1. Immediate mandatory override to manual-human review pathway for all affected categories;\n2. Public notification within 72 hours via Article VII dashboard;\n3. Independent audit panel convened within 14 days;\n4. Scale-up halt until two consecutive quarters show compliance;\n5. Annex AK FC-143 through FC-147 recalibration hearing if the breach is in a vulnerable category.\n\n---\n\n### T-2: Recovery Delay Ceiling\n\n**Threshold (tiered):**\n\n| Recovery tier | Ceiling |\n|---|---|\n| Emergency provisional access (food, medicine, shelter) | 4 hours from dispute filing |\n| Standard provisional access (all Essential Access) | 24 hours from dispute filing |\n| Full identity restoration with clean record | 14 calendar days from dispute filing |\n| Complex cases (displacement, abuse, statelessness, guardianship) | 30 calendar days with mandatory human case manager |\n\nThe survival floor must be maintained at provisional access level throughout the recovery window regardless of outcome. A disputed identity does not reduce Essential Access below the Constitutional Survival Minimum while the dispute is open.\n\n**Rationale for 4-hour emergency tier:** Food and medicine access delays beyond one missed meal cycle constitute a health harm. Four hours is the minimum operationally credible emergency manual pathway; faster is better but must be tested. This is based on humanitarian registration precedent (UNHCR same-day food ration access targets) adapted to a non-disaster context.\n\n**Rationale for 14-day full restoration:** Longer recovery windows create persistent second-class status. Identity flags left unresolved past 14 days begin to compound: credit, housing, civic, and health records may degrade based on unresolved status. 14 days matches the outer bound of UK Universal Credit identity dispute resolution targets, which is itself considered too long by welfare advocates.\n\n**Rationale for 30-day complex cases:** Some cases require independent corroboration, document reconstruction, or specialist interviews. 30 days is the ceiling, not the target. Every complex case must have a named human case manager, a written status update every 5 days, and a documented reason if the 30-day ceiling is missed.\n\n**Evidence basis:** Emergency tier \u2014 precautionary adapted from UNHCR field data. Standard and full tiers \u2014 adapted from UK Universal Credit and EU eIDAS dispute resolution benchmarks. Complex case tier \u2014 precautionary, no direct analogue for survival-floor context.\n\n**Breach escalation:** Any case that breaches the applicable tier ceiling:\n1. Triggers an immediate case flag and supervisor review within 2 hours;\n2. Is logged in the Article VII dashboard as a recovery failure event;\n3. Counts toward the quarterly appeal failure rate (T-4 below);\n4. Is subject to independent audit if five or more breach events occur in the same quarter.\n\nIf the survival floor is interrupted during recovery (i.e., Essential Access falls below CSM while dispute is pending), this is a Category A constitutional failure regardless of whether subsequent restoration occurs.\n\n---\n\n### T-3: Data Exposure Failure Conditions\n\n**Threshold:** Zero tolerance for any of the following; each is a discrete failure event triggering immediate audit:\n\n| Failure event | Definition |\n|---|---|\n| Unauthorized access | Any access to identity or recovery data by a party not listed in the purpose-limitation map at the time of access |\n| Scope creep use | Identity data used for a purpose not stated at the time of collection, including internal analytics, law enforcement disclosure, or inter-agency sharing not authorized in the data inventory |\n| Unconsented sharing | Any identification data \u2014 including recovery metadata, dispute history, or biometric indicators \u2014 shared with a third party without the subject's explicit, specific, and revocable consent |\n| Linkage attack success | A successful test demonstrating that a realistic adversary can re-link sector-tokenized identifiers across two or more service domains |\n| Retention breach | Any data retained past its scheduled deletion date without a documented and subject-notified extension |\n\n**Rationale:** Identity and recovery data in a survival-floor system is among the most sensitive data a system can hold. It reveals displacement, abuse, disability, undocumented status, and dependency relationships. Zero-tolerance is appropriate here because the harm of exposure is not merely financial but can include deportation, domestic violence escalation, and denial of protection. A single unauthorized access event can enable an abuser, an employer, or a hostile state actor to locate and target a person.\n\n**Evidence basis:** Zero-tolerance for unauthorized access is standard in HIPAA, GDPR Article 5, and NIST SP 800-53 high-impact controls. Applying it here is consistent with those frameworks adapted to a higher harm context.\n\n**Breach escalation:** Each failure event triggers:\n1. Immediate system audit covering the full scope of the compromised data class;\n2. Subject notification within 24 hours if the person can be safely contacted;\n3. Public summary report within 7 days (redacted for safety);\n4. Independent privacy panel review within 30 days;\n5. Scale-up halt until the audit is complete and remediation is verified;\n6. If linkage attack succeeds: mandatory architecture review of the tokenization and compartmentalization design before resuming operations.\n\n---\n\n### T-4: Appeal Failure Rate Ceiling\n\n**Threshold:**\n\n| Metric | Ceiling |\n|---|---|\n| Appeals resolved without any human review | 0% \u2014 all appeals must have at least one human decision-maker |\n| Appeals denied past the applicable recovery delay ceiling (T-2) | Less than 2% per quarter |\n| Appeals with no written reason provided | 0% \u2014 denial without written reason is void |\n| Appeals reviewed exclusively by identity-system operators | 0% \u2014 at least one reviewer must be organizationally independent of the identity system |\n\n**Rationale for 0% no-human-review:** Automated denial of an appeal in a survival-floor system is constitutionally incompatible with Voice rights and the right to challenge denial. There is no exclusion-risk acceptable enough to justify machine-only appeal resolution. This is not aspirational; it is a design constraint.\n\n**Rationale for 2% breach-ceiling on delayed appeals:** Some cases will be genuinely hard. A 2% allowance acknowledges operational reality. Anything above 2% suggests systemic processing failure rather than case complexity. The 2% is per quarter of all appeals filed, not per quarter of contested appeals.\n\n**Who audits:** Appeal outcomes must be reviewed by an independent body that includes:\n- at least one person with no institutional affiliation with the identity system operators;\n- at least one person with lived experience of identity exclusion, displacement, or documentation barriers;\n- access to the full appeal record including staff notes and reason codes.\n\n**Evidence basis:** Human-review requirement \u2014 adapted from EU AI Act Article 14 (human oversight for high-risk AI decisions). Delay ceiling \u2014 precautionary, no direct analogue. Independent reviewer requirement \u2014 adapted from ombudsman and tribunal independence standards (UK Administrative Court practice direction).\n\n**Breach escalation:** Exceeding any appeal failure ceiling:\n1. Triggers an immediate internal audit of the appeal processing pipeline;\n2. Results in all pending appeals being reassigned to independent reviewers;\n3. Is reported in the Article VII dashboard by category and quarter;\n4. Counts as a governance failure for purposes of the Annex AK FC-150 simultaneous breach assessment.\n\n---\n\n### T-5: Discretion Floor\n\n**Threshold:** Every staff-discretion decision in identity verification or recovery must meet all of the following minimum documentation requirements:\n\n| Required element | Standard |\n|---|---|\n| Decision reason | At least one of a defined reason-code set; free-text supplemental required if reason is \"other\" |\n| Evidence considered | List of specific evidence types reviewed; \"insufficient evidence\" is not sufficient without specifying what was present and why it was inadequate |\n| Alternatives offered | Documentation that at least one alternative pathway was offered or explicitly determined inapplicable, with reason |\n| Supervisor flag | Flag required if the decision contradicts the default outcome for this evidence combination |\n| Audit log | Timestamped, tamper-evident, accessible to independent auditors |\n\n**Audit rate:** 10% of all staff-discretion decisions must be independently audited per quarter. Audits must specifically test for pattern discrimination: whether denial rates differ by demographic group controlling for documented evidence quality.\n\n**Threshold for pattern finding:** If any demographic subgroup shows a denial rate more than 1.5x the baseline denial rate after controlling for evidence quality, this constitutes a pattern finding and triggers escalation.\n\n**Rationale for 10% audit rate:** Below 10%, pattern discrimination can persist invisibly for years. Above 10%, audit burden may distort frontline behavior in ways that reduce documentation honesty. 10% is the threshold used in healthcare implicit-bias audits (Joint Commission standard) and adapted here. The 1.5x disparity threshold matches EEOC adverse impact analysis standards (the \"four-fifths rule\" adapted for ratio rather than proportion).\n\n**Evidence basis:** Audit rate \u2014 adapted from Joint Commission healthcare audit standards. Disparity threshold \u2014 adapted from EEOC adverse impact doctrine. Documentation requirements \u2014 adapted from UK administrative law procedural fairness standards.\n\n**Breach escalation:** Pattern finding triggers:\n1. Mandatory retraining for affected staff within 30 days;\n2. Increased audit rate (25%) for the affected decision category for two subsequent quarters;\n3. Review of training materials and reason-code design for structural bias;\n4. Public summary report (anonymized) in the Article VII dashboard within 60 days;\n5. If the pattern persists through two consecutive escalated-audit quarters, the discretion point must be redesigned or removed.\n\n---\n\n### Threshold Summary Table\n\n| ID | Metric | Ceiling | Breach trigger |\n|---|---|---|---|\n| T-1 | False exclusion rate (Essential Access) | <0.5% per quarter | Manual override, public notice, audit panel, scale-up halt |\n| T-2a | Emergency access restoration | 4 hours | Case flag, supervisor review, dashboard log |\n| T-2b | Full Essential Access restoration | 24 hours | Case flag, supervisor review, dashboard log |\n| T-2c | Full identity restoration | 14 calendar days | Case flag, supervisor review, dashboard log |\n| T-2d | Complex case restoration | 30 calendar days | As T-2c, plus mandatory case manager review |\n| T-2e | CSM interruption during recovery | 0 instances | Category A constitutional failure, immediate escalation |\n| T-3 | Unauthorized data access or scope creep | 0 instances | Immediate audit, subject notification, scale-up halt |\n| T-4a | Appeals without human review | 0% | Pipeline audit, reassignment, dashboard report |\n| T-4b | Appeals denied past delay ceiling | <2% per quarter | Internal audit, independent reviewer reassignment |\n| T-4c | Denials without written reason | 0% | Decision void, reprocess |\n| T-5a | Staff discretion audit rate | \u226510% per quarter | Governance failure flag |\n| T-5b | Demographic disparity in denial rate | <1.5x baseline | Retraining, increased audit, dashboard report |\n\n---\n\nEven if the tests pass, identity will remain a permanent danger surface. A humane identity system must fight fraud and protect access at the same time, and those goals will always conflict under stress. The correct goal is not perfect identity. The goal is a bounded, appealable, privacy-preserving system that makes fraud costly while making exclusion visible, reversible, and unable to interrupt the survival floor.\n",
+      "content": "# Identity and Recovery Evidence Test Package\n\nThis package defines what must be true before the project can make strong claims about identity, recovery, and access continuity.\n\nIdentity is a load-bearing precondition. Essential Access, Voice, Service Record, exit rights, consent records, and anti-fraud enforcement all depend on knowing whether a person is a unique living person and whether they are continuous with an earlier record. But identity controls can also become surveillance, exclusion, family coercion, bureaucratic discretion, or quiet denial of survival access.\n\nCurrent status: **unresolved prerequisite, designed direction, needs evidence**.\n\n---\n\n## Honest Claim Boundary\n\nThe project may currently claim:\n\n> The identity architecture rejects a single master credential, preserves the survival floor during disputes, and requires quantified fraud/exclusion trade-offs before scale-up.\n\nThe project may not yet claim:\n\n- the identity stack is proven;\n- fraud controls will not exclude vulnerable people;\n- recovery works for displaced, undocumented, disabled, elderly, digitally fragile, coerced, trafficked, or abused people;\n- privacy-preserving credentials are sufficient by themselves;\n- biometric, device, community, or document evidence can safely dominate the stack;\n- staff discretion is controlled in practice;\n- the survival floor cannot be interrupted by administrative failure.\n\nEvidence-backed claims require the tests below plus a residual-risk update.\n\n---\n\n## Source Base\n\n| Source | What it supports | What it does not prove |\n|---|---|---|\n| [NIST SP 800-63-4 Digital Identity Guidelines](https://pages.nist.gov/800-63-4/) | Identity systems need risk management, assurance levels, fraud controls, privacy, customer experience, and continuous evaluation. | It does not prove a survival-floor identity system can be both fraud-resistant and non-exclusionary. |\n| [World Bank ID4D Practitioner's Guide](https://id4d.worldbank.org/guide) | Foundational ID systems need inclusion, accessibility, privacy, institutional accountability, and risk assessment. | It does not supply this project's fraud/exclusion thresholds or recovery doctrine. |\n| [Principles on Identification for Sustainable Development](https://id4d.worldbank.org/guide/1-principles) | ID systems should pursue universal coverage, accessibility, privacy, user rights, accountability, and grievance mechanisms. | Principles are not evidence that any implementation protects vulnerable users. |\n| [World Bank ID4D exclusion-risk guidance](https://id4d.worldbank.org/guide/assess-risks) | ID systems can exclude poor, rural, elderly, disabled, displaced, refugee, stateless, digitally fragile, and other vulnerable groups if barriers are not designed around. | It does not prove which local groups will fail or what threshold is acceptable. |\n| [World Bank ID4D privacy and security guidance](https://id4d.worldbank.org/guide/privacy-security) | Privacy-by-design, data minimization, separation, tokenization, federation, and compartmentalization are real design disciplines. | It does not prove this project can enforce them against hostile administrators. |\n| [UNHCR registration and identity management guidance](https://www.unhcr.org/registration-guidance/chapter3/access-to-registration/) | Registration for displaced people must be accessible, non-arbitrary, and attentive to barriers. | Refugee registration doctrine does not solve ordinary civic identity, fraud, or long-term recovery. |\n| [W3C Verifiable Credentials Data Model v2.0](https://www.w3.org/news/2025/the-verifiable-credentials-2-0-family-of-specifications-is-now-a-w3c-recommendation/) | Cryptographically verifiable, privacy-respecting credentials are a mature technical design space. | Verifiable credentials do not by themselves solve enrollment, coercion, device loss, issuer capture, or exclusion. |\n\n---\n\n## Abuse Model\n\nAssume every identity mechanism will be attacked from both sides: by people seeking extra access and by institutions seeking easier denial.\n\n| Actor | Likely attack or failure route | What the test must expose |\n|---|---|---|\n| Fraud ring | Synthetic identities, duplicate enrollments, rented identities, proxy redemption, stolen recovery credentials. | Whether fraud is caught without turning all users into surveillance subjects. |\n| Insider operator | Approves friends, sells recovery, suppresses appeals, or flags inconvenient users as suspicious. | Whether staff discretion is bounded, logged, rotated, and appealable. |\n| Abusive household member | Controls devices, documents, biometrics, appointments, transport, or recovery contact channels. | Whether recovery can happen without evidence controlled by the abuser. |\n| Employer, landlord, sponsor, or institution | Uses dependency to force identity sharing, credential custody, or false attestations. | Whether coercive third-party control is detectable and reversible. |\n| Hostile administrator | Tightens identity rules after fraud panic to reduce caseload, exclude disliked groups, or punish dissent. | Whether Annex AK thresholds bind under political pressure. |\n| Vendor or platform | Optimizes for low fraud metrics while hiding abandonment, inaccessible UX, or biased failure. | Whether exclusion is measured outside successful enrollment data. |\n| Data broker or attacker | Links identifiers, service traces, biometrics, and recovery events into a behavioral dossier. | Whether compartmentalization and minimization survive realistic data-access pressure. |\n| Well-meaning bureaucracy | Adds forms, proof categories, case reviews, and escalation steps until recovery becomes unusable. | Whether ordinary people can recover access fast enough without expert help. |\n\n---\n\n## Required Models\n\n### 1. Fraud and Duplicate-Identity Model\n\n**Question:** Can the system prevent scalable duplicate personhood without making every ordinary user continuously legible?\n\n**Minimum scenarios:**\n\n- duplicate enrollment by one person;\n- synthetic identity with partial real evidence;\n- takeover of a real person's record;\n- rented identity;\n- family proxy use;\n- staff-assisted fraud;\n- cross-region duplicate enrollment;\n- post-disaster mass re-enrollment.\n\n**Required outputs:**\n\n- false acceptance rate by assurance tier;\n- confirmed fraud rate by instrument tier;\n- suspected-but-unconfirmed fraud trend;\n- detection latency;\n- investigation burden;\n- false-positive burden;\n- data used per detection event;\n- whether detection requires generalized behavioral monitoring.\n\n**Failure criteria:**\n\n- fraud is only detectable through broad activity surveillance;\n- staff-assisted fraud is not separately measurable;\n- duplicate detection works only for well-documented users;\n- false positives interrupt the Constitutional Survival Minimum;\n- suspected fraud data is treated as confirmed fraud in public dashboards;\n- fraud prevention creates a permanent unified behavioral graph.\n\n### 2. False-Exclusion and Abandonment Model\n\n**Question:** Who fails to enroll or recover, and is failure hidden because only successful users are counted?\n\n**Minimum segmentation:**\n\n- displaced people;\n- undocumented people;\n- stateless people;\n- elderly people;\n- disabled people;\n- digitally fragile people;\n- people without smartphone or reliable internet;\n- people with low literacy;\n- rural or remote users;\n- guardianship and dependent cases;\n- coercive-control and trafficking contexts;\n- people with name, gender, family, or document inconsistencies.\n\n**Required outputs:**\n\n- enrollment success rate;\n- abandonment rate;\n- reason for abandonment;\n- time to first decision;\n- appeal completion rate;\n- staff-discretion points;\n- required travel/time/cost;\n- language and accessibility failures;\n- denial reason distribution;\n- survival-floor continuity during unresolved status.\n\n**Failure criteria:**\n\n- vulnerable groups fail at materially higher rates than ordinary users;\n- abandonment is not counted as exclusion;\n- users must pay, travel repeatedly, own a smartphone, or expose unnecessary data to obtain survival access;\n- identity uncertainty reduces the CSM floor rather than only higher-consequence privileges;\n- staff discretion becomes the real eligibility rule;\n- denial reasons are too vague to appeal.\n\n### 3. Recovery and Continuity Model\n\n**Question:** Can a real person recover after device loss, document loss, displacement, disaster, abuse, incapacity, or data error?\n\n**Minimum scenarios:**\n\n- lost phone and no backup device;\n- stolen credentials;\n- abusive partner controls documents;\n- elder loses memory or physical access;\n- disabled person cannot use default interface;\n- person flees domestic violence, trafficking, or institutional abuse;\n- disaster destroys documents and local records;\n- refugee or displaced person lacks recognized state documents;\n- conflicting records across regions;\n- legal name or gender marker change;\n- death, birth, guardianship, and dependent coverage transition.\n\n**Required outputs:**\n\n- time to provisional restoration;\n- time to full restoration;\n- CSM continuity during recovery;\n- number of required interactions;\n- independent corroboration options;\n- unsafe evidence avoided;\n- appeal path completion;\n- data exposure during recovery;\n- post-recovery correction of harmful flags.\n\n**Failure criteria:**\n\n- recovery requires contacting an abuser, employer, landlord, sponsor, or hostile institution;\n- survival access is interrupted while recovery is pending;\n- recovery depends on a single device, biometric, document, or authority;\n- unresolved flags remain visible to unrelated service providers;\n- people cannot understand what evidence is required;\n- recovery is technically possible but too slow for food, shelter, medicine, or safety.\n\n### 4. Privacy and Data-Minimization Model\n\n**Question:** Does the identity stack prove what is needed without building a lifelong surveillance dossier?\n\n**Required tests:**\n\n- data inventory by evidence type;\n- purpose-limitation map;\n- retention schedule;\n- identifier-compartment test;\n- sector-tokenization test;\n- breach-impact simulation;\n- insider-query audit;\n- selective-disclosure test;\n- zero-knowledge or attribute-proof feasibility where useful;\n- behavioral-linkage red team.\n\n**Failure criteria:**\n\n- service use is routinely linkable across survival, market, civic, health, housing, and recovery contexts;\n- identity verification and activity monitoring fuse into a single graph;\n- recovery events expose sensitive histories to ordinary providers;\n- data minimization is described but not measurable;\n- breach impact would reveal enough to coerce, profile, or politically target users;\n- privacy controls depend mainly on trust in administrators.\n\n### 5. Coercion and Delegation Model\n\n**Question:** Can identity be protected when a powerful person or institution controls the user's practical life?\n\n**Minimum scenarios:**\n\n- family member controls phone, documents, or appointments;\n- employer or sponsor holds documents;\n- landlord conditions housing on credential access;\n- institution manages identity for residents;\n- caregiver acts for dependent adult;\n- parent or guardian acts for child;\n- trafficker or abusive partner monitors communications;\n- community witness system is captured by local power holders.\n\n**Required outputs:**\n\n- coercion detection channels;\n- safe alternate contact path;\n- protected interview availability;\n- emergency manual access;\n- independent advocate access;\n- custody-of-credential incidents;\n- delegation audit trail;\n- reversal speed when coercion is found.\n\n**Failure criteria:**\n\n- delegation becomes ownership;\n- credential custody by third parties becomes normal;\n- a user cannot safely report coercion;\n- identity recovery forces disclosure to the coercive actor;\n- community attestation systems reproduce local domination;\n- guardianship rules erase the person's own standing when supported decision-making would suffice.\n\n### 6. Governance Calibration Model\n\n**Question:** Does Annex AK's Asymmetric Error Doctrine bind real decisions, or does politics override it?\n\n**Required tests:**\n\n- test FC-140 through FC-145, bind FC-146 through FC-150, and revise any value that pilot evidence shows is too loose or too tight;\n- publish fraud and exclusion rates with confidence intervals;\n- audit abandonment and denied access separately;\n- simulate a fraud panic;\n- simulate an exclusion scandal;\n- simulate simultaneous fraud and exclusion breaches;\n- test recalibration panel independence;\n- test Article VII dashboard comprehension.\n\n**Failure criteria:**\n\n- thresholds remain reserved at scale-up;\n- a fraud incident causes emergency tightening outside Annex AK;\n- exclusion data depends on self-reporting by excluded people who cannot access the system;\n- vulnerable-category estimates are manipulated to make exclusion look lower;\n- dashboards hide confidence intervals or denominator uncertainty;\n- recalibration is controlled by identity-system operators.\n\n---\n\n## Calibration Rules\n\nIdentity parameters should not be set by political mood, vendor preference, or fear of headlines.\n\n**Minimum parameter set:**\n\n| Parameter | What it controls | Evidence needed before binding |\n|---|---|---|\n| FC-140 Essential Access fraud band | Maximum tolerated Essential Access identity fraud | Fraud simulation, staff-assisted fraud test, physical-supply impact model. |\n| FC-141 Voice fraud band | Maximum tolerated civic agenda fraud | Duplicate civic activation and agenda-distortion simulation. |\n| FC-142 Service Record fraud band | Maximum tolerated public-service eligibility fraud | Role-selection and contribution-verification red team. |\n| FC-143 through FC-147 exclusion bands | Maximum tolerated exclusion by vulnerable group and overall population | Enrollment, abandonment, recovery, and appeals pilot by group. |\n| FC-148 exclusion priority multiplier | When exclusion reduction must outrank fraud tightening | Joint fraud/exclusion trade-off simulation. |\n| FC-149 fraud priority bound | When fraud reduction must outrank inclusion loosening | Supply-impact and civic-integrity model. |\n| FC-150 simultaneous breach default | Default when fraud and exclusion both breach upper bounds | Public legitimacy review and independent panel recommendation. |\n\n**Calibration must satisfy all five constraints:**\n\n1. CSM access continues during identity uncertainty;\n2. fraud controls are stronger for higher-consequence privileges;\n3. vulnerable groups have separately visible failure rates;\n4. recovery is possible without a single master credential;\n5. identity verification does not become generalized surveillance.\n\n---\n\n## Test Sequence\n\n### Stage 0 - Desk Evidence Review\n\nOutput: source memo separating technical identity standards, development/inclusion guidance, refugee registration lessons, privacy-preserving credential standards, and gaps.\n\nPass condition: the memo identifies what outside sources support and what they do not prove.\n\n### Stage 1 - Synthetic Identity Attack Simulation\n\nOutput: duplicate, synthetic, takeover, rented-identity, and staff-assisted fraud scenarios across instrument tiers.\n\nPass condition: fraud controls identify scalable attacks without requiring broad behavioral surveillance.\n\n### Stage 2 - Exclusion and Abandonment Pilot\n\nOutput: voluntary enrollment/recovery exercise with protected participants and independent advocates.\n\nPass condition: abandonment, denial, time cost, data exposure, and appeal outcomes are measured by vulnerable group.\n\n### Stage 3 - Recovery Stress Drill\n\nOutput: device-loss, document-loss, disaster, abuse, incapacity, and displacement recovery drills.\n\nPass condition: provisional access is restored fast enough to preserve survival needs, and full restoration has recorded reasons and appeal rights.\n\n### Stage 4 - Privacy and Coercion Red Team\n\nOutput: insider-query audit, data-linkage attack, coercive-control scenario, credential-custody scenario, and community-attestation capture test.\n\nPass condition: sensitive recovery and service-use data cannot be casually linked, and coerced users have safe alternate routes.\n\n### Stage 5 - Annex AK Calibration Hearing\n\nOutput: public calibration package confirming or revising FC-140 through FC-145, binding FC-146 through FC-150, and publishing confidence intervals, dissenting views, and plain-language explanation.\n\nPass condition: the public can see the trade-off, vulnerable groups can challenge it, and scale-up is blocked if the numbers remain reserved.\n\n---\n\n## Minimum Evidence Tables\n\nThe project should not move identity from **unresolved prerequisite** to **partly tested** until these tables exist.\n\n| Table | Required columns |\n|---|---|\n| Fraud by tier | Instrument tier, fraud type, confirmed cases, suspected cases, detection method, false positives, investigation time. |\n| Exclusion by group | Group, attempted enrollments, successful enrollments, abandonment, denials, denial reason, appeal outcome, confidence interval. |\n| Recovery events | Scenario, provisional restoration time, full restoration time, CSM continuity, data exposed, unsafe evidence avoided, unresolved flags. |\n| Staff discretion | Decision point, role, override authority, reason code, audit log, appeal availability, concentration by staff/team. |\n| Privacy inventory | Data type, purpose, retention, compartment, who can query, breach harm, minimization alternative. |\n| Coercion incidents | Coercion route, reporter, safe contact path, protective action, restoration time, repeat-risk control. |\n| AED calibration | FC parameter, proposed value, evidence basis, uncertainty, dissent, review trigger, residual risk. |\n\n---\n\n## Decision Rule\n\nIdentity may support scale-up only if the tests show that it is:\n\n- multi-evidence rather than single-credential;\n- stronger at higher-consequence tiers;\n- continuous for CSM during disputes;\n- measurable for fraud and exclusion;\n- recoverable after realistic life disruptions;\n- usable by vulnerable groups;\n- resistant to insider and family coercion;\n- privacy-preserving by architecture, not promise;\n- governed by bound Annex AK thresholds;\n- understandable enough that denial and recovery can be appealed.\n\nIf those conditions fail, the project must pause scale-up, keep survival access provisional where necessary, revise Annex AK parameters, change enrollment/recovery procedures, or explicitly downgrade the claim from \"identity architecture\" to \"unproven design candidate.\"\n\n---\n\n## Failure Thresholds\n\nThis section defines specific numeric thresholds that constitute failure. These are not aspirational targets. They are ceilings: breach means the system has failed in a constitutional sense and must trigger the escalation path described below. Thresholds without empirical analogues are marked **precautionary \u2014 no field analogue**.\n\nAuditors should treat any threshold left as \"TBD\" at scale-up as a governance failure in itself.\n\n### Relationship to Annex AK\n\nAnnex AK defines the founding Asymmetric Error Doctrine bands. FC-143 through FC-145 are bound vulnerable-category pilot gates; FC-146 through FC-150 remain pre-launch commitments that must be bound before scale-up. The thresholds below do not silently replace Annex AK. They define stricter operational failure conditions for the Identity and Recovery Evidence Test Package.\n\nWhere the values differ, read them this way:\n\n- Annex AK FC bands are the public constitutional calibration bands for founding adoption and pilot governance.\n- The T-1 false-exclusion ceiling below is a scale-up ambition and warning threshold for the full Essential Access population, including abandonment.\n- Any interruption of the Constitutional Survival Minimum during an identity dispute is a Category A constitutional failure even if Annex AK's quarterly percentage bands are otherwise satisfied.\n- If the pilot passes Annex AK but breaches a stricter evidence-package threshold, the claim may not advance beyond \"active-unproven\" without a residual-risk update explaining the divergence.\n\n---\n\n### T-1: False Exclusion Ceiling\n\n**Threshold:** Fewer than 0.5% of Essential Access attempts denied per quarter due to identity verification failure, across the full eligible population including abandonment. This is a scale-up ambition and evidence-package warning threshold, not a replacement for Annex AK's vulnerable-category founding bands.\n\n**Rationale:** Essential Access is the Constitutional Survival Minimum. A system that correctly identifies 99.5% of users still excludes thousands at population scale. The 0.5% ceiling is not lenient \u2014 it is chosen because lower thresholds are not achievable with current best-practice ID systems in low-documentation contexts (see: UNHCR registration data, World Bank ID4D exclusion audits). Anything above 0.5% at scale implies structural exclusion, not edge-case error. The ceiling applies to the full denominator including people who abandoned the enrollment or recovery process, not only people who completed it.\n\n**Measurement:** Requires enrollment-attempt tracking from the moment of first contact, not from the moment of enrollment completion. Abandonment must be coded by point of exit and reason where ascertainable. Stage 2 pilot must produce this data disaggregated by vulnerable group. Confidence intervals required; point estimates alone do not pass.\n\n**Evidence basis:** Precautionary \u2014 no field analogue in a survival-floor context. 0.5% is borrowed from NHS digital access failure rate targets and EU eIDAS high-assurance rejection benchmarks, neither of which concerns survival access. The value is conservatively tight because the consequence of false exclusion here is not inconvenience but denial of survival resources.\n\n**Breach escalation:** Any quarter where measured false exclusion exceeds 0.5% triggers:\n1. Immediate mandatory override to manual-human review pathway for all affected categories;\n2. Public notification within 72 hours via Article VII dashboard;\n3. Independent audit panel convened within 14 days;\n4. Scale-up halt until two consecutive quarters show compliance;\n5. Annex AK FC-143 through FC-147 recalibration hearing if the breach is in a vulnerable category.\n\n---\n\n### T-2: Recovery Delay Ceiling\n\n**Threshold (tiered):**\n\n| Recovery tier | Ceiling |\n|---|---|\n| Emergency provisional access (food, medicine, shelter) | 4 hours from dispute filing |\n| Standard provisional access (all Essential Access) | 24 hours from dispute filing |\n| Full identity restoration with clean record | 14 calendar days from dispute filing |\n| Complex cases (displacement, abuse, statelessness, guardianship) | 30 calendar days with mandatory human case manager |\n\nThe survival floor must be maintained at provisional access level throughout the recovery window regardless of outcome. A disputed identity does not reduce Essential Access below the Constitutional Survival Minimum while the dispute is open.\n\n**Rationale for 4-hour emergency tier:** Food and medicine access delays beyond one missed meal cycle constitute a health harm. Four hours is the minimum operationally credible emergency manual pathway; faster is better but must be tested. This is based on humanitarian registration precedent (UNHCR same-day food ration access targets) adapted to a non-disaster context.\n\n**Rationale for 14-day full restoration:** Longer recovery windows create persistent second-class status. Identity flags left unresolved past 14 days begin to compound: credit, housing, civic, and health records may degrade based on unresolved status. 14 days matches the outer bound of UK Universal Credit identity dispute resolution targets, which is itself considered too long by welfare advocates.\n\n**Rationale for 30-day complex cases:** Some cases require independent corroboration, document reconstruction, or specialist interviews. 30 days is the ceiling, not the target. Every complex case must have a named human case manager, a written status update every 5 days, and a documented reason if the 30-day ceiling is missed.\n\n**Evidence basis:** Emergency tier \u2014 precautionary adapted from UNHCR field data. Standard and full tiers \u2014 adapted from UK Universal Credit and EU eIDAS dispute resolution benchmarks. Complex case tier \u2014 precautionary, no direct analogue for survival-floor context.\n\n**Breach escalation:** Any case that breaches the applicable tier ceiling:\n1. Triggers an immediate case flag and supervisor review within 2 hours;\n2. Is logged in the Article VII dashboard as a recovery failure event;\n3. Counts toward the quarterly appeal failure rate (T-4 below);\n4. Is subject to independent audit if five or more breach events occur in the same quarter.\n\nIf the survival floor is interrupted during recovery (i.e., Essential Access falls below CSM while dispute is pending), this is a Category A constitutional failure regardless of whether subsequent restoration occurs.\n\n---\n\n### T-3: Data Exposure Failure Conditions\n\n**Threshold:** Zero tolerance for any of the following; each is a discrete failure event triggering immediate audit:\n\n| Failure event | Definition |\n|---|---|\n| Unauthorized access | Any access to identity or recovery data by a party not listed in the purpose-limitation map at the time of access |\n| Scope creep use | Identity data used for a purpose not stated at the time of collection, including internal analytics, law enforcement disclosure, or inter-agency sharing not authorized in the data inventory |\n| Unconsented sharing | Any identification data \u2014 including recovery metadata, dispute history, or biometric indicators \u2014 shared with a third party without the subject's explicit, specific, and revocable consent |\n| Linkage attack success | A successful test demonstrating that a realistic adversary can re-link sector-tokenized identifiers across two or more service domains |\n| Retention breach | Any data retained past its scheduled deletion date without a documented and subject-notified extension |\n\n**Rationale:** Identity and recovery data in a survival-floor system is among the most sensitive data a system can hold. It reveals displacement, abuse, disability, undocumented status, and dependency relationships. Zero-tolerance is appropriate here because the harm of exposure is not merely financial but can include deportation, domestic violence escalation, and denial of protection. A single unauthorized access event can enable an abuser, an employer, or a hostile state actor to locate and target a person.\n\n**Evidence basis:** Zero-tolerance for unauthorized access is standard in HIPAA, GDPR Article 5, and NIST SP 800-53 high-impact controls. Applying it here is consistent with those frameworks adapted to a higher harm context.\n\n**Breach escalation:** Each failure event triggers:\n1. Immediate system audit covering the full scope of the compromised data class;\n2. Subject notification within 24 hours if the person can be safely contacted;\n3. Public summary report within 7 days (redacted for safety);\n4. Independent privacy panel review within 30 days;\n5. Scale-up halt until the audit is complete and remediation is verified;\n6. If linkage attack succeeds: mandatory architecture review of the tokenization and compartmentalization design before resuming operations.\n\n---\n\n### T-4: Appeal Failure Rate Ceiling\n\n**Threshold:**\n\n| Metric | Ceiling |\n|---|---|\n| Appeals resolved without any human review | 0% \u2014 all appeals must have at least one human decision-maker |\n| Appeals denied past the applicable recovery delay ceiling (T-2) | Less than 2% per quarter |\n| Appeals with no written reason provided | 0% \u2014 denial without written reason is void |\n| Appeals reviewed exclusively by identity-system operators | 0% \u2014 at least one reviewer must be organizationally independent of the identity system |\n\n**Rationale for 0% no-human-review:** Automated denial of an appeal in a survival-floor system is constitutionally incompatible with Voice rights and the right to challenge denial. There is no exclusion-risk acceptable enough to justify machine-only appeal resolution. This is not aspirational; it is a design constraint.\n\n**Rationale for 2% breach-ceiling on delayed appeals:** Some cases will be genuinely hard. A 2% allowance acknowledges operational reality. Anything above 2% suggests systemic processing failure rather than case complexity. The 2% is per quarter of all appeals filed, not per quarter of contested appeals.\n\n**Who audits:** Appeal outcomes must be reviewed by an independent body that includes:\n- at least one person with no institutional affiliation with the identity system operators;\n- at least one person with lived experience of identity exclusion, displacement, or documentation barriers;\n- access to the full appeal record including staff notes and reason codes.\n\nAppeal structure: identity-recovery appeals run on the appeal spine (ANNEX_L \u00a7L7) \u2014 first instance the administrative identity tribunal, escalation to the Regional Constitutional Chamber, constitutional review by the CRP. The T-4 ceilings above are the pass/fail evidence gates on that spine, not a separate procedure.\n\n**Evidence basis:** Human-review requirement \u2014 adapted from EU AI Act Article 14 (human oversight for high-risk AI decisions). Delay ceiling \u2014 precautionary, no direct analogue. Independent reviewer requirement \u2014 adapted from ombudsman and tribunal independence standards (UK Administrative Court practice direction).\n\n**Breach escalation:** Exceeding any appeal failure ceiling:\n1. Triggers an immediate internal audit of the appeal processing pipeline;\n2. Results in all pending appeals being reassigned to independent reviewers;\n3. Is reported in the Article VII dashboard by category and quarter;\n4. Counts as a governance failure for purposes of the Annex AK FC-150 simultaneous breach assessment.\n\n---\n\n### T-5: Discretion Floor\n\n**Threshold:** Every staff-discretion decision in identity verification or recovery must meet all of the following minimum documentation requirements:\n\n| Required element | Standard |\n|---|---|\n| Decision reason | At least one of a defined reason-code set; free-text supplemental required if reason is \"other\" |\n| Evidence considered | List of specific evidence types reviewed; \"insufficient evidence\" is not sufficient without specifying what was present and why it was inadequate |\n| Alternatives offered | Documentation that at least one alternative pathway was offered or explicitly determined inapplicable, with reason |\n| Supervisor flag | Flag required if the decision contradicts the default outcome for this evidence combination |\n| Audit log | Timestamped, tamper-evident, accessible to independent auditors |\n\n**Audit rate:** 10% of all staff-discretion decisions must be independently audited per quarter. Audits must specifically test for pattern discrimination: whether denial rates differ by demographic group controlling for documented evidence quality.\n\n**Threshold for pattern finding:** If any demographic subgroup shows a denial rate more than 1.5x the baseline denial rate after controlling for evidence quality, this constitutes a pattern finding and triggers escalation.\n\n**Rationale for 10% audit rate:** Below 10%, pattern discrimination can persist invisibly for years. Above 10%, audit burden may distort frontline behavior in ways that reduce documentation honesty. 10% is the threshold used in healthcare implicit-bias audits (Joint Commission standard) and adapted here. The 1.5x disparity threshold matches EEOC adverse impact analysis standards (the \"four-fifths rule\" adapted for ratio rather than proportion).\n\n**Evidence basis:** Audit rate \u2014 adapted from Joint Commission healthcare audit standards. Disparity threshold \u2014 adapted from EEOC adverse impact doctrine. Documentation requirements \u2014 adapted from UK administrative law procedural fairness standards.\n\n**Breach escalation:** Pattern finding triggers:\n1. Mandatory retraining for affected staff within 30 days;\n2. Increased audit rate (25%) for the affected decision category for two subsequent quarters;\n3. Review of training materials and reason-code design for structural bias;\n4. Public summary report (anonymized) in the Article VII dashboard within 60 days;\n5. If the pattern persists through two consecutive escalated-audit quarters, the discretion point must be redesigned or removed.\n\n---\n\n### Threshold Summary Table\n\n| ID | Metric | Ceiling | Breach trigger |\n|---|---|---|---|\n| T-1 | False exclusion rate (Essential Access) | <0.5% per quarter | Manual override, public notice, audit panel, scale-up halt |\n| T-2a | Emergency access restoration | 4 hours | Case flag, supervisor review, dashboard log |\n| T-2b | Full Essential Access restoration | 24 hours | Case flag, supervisor review, dashboard log |\n| T-2c | Full identity restoration | 14 calendar days | Case flag, supervisor review, dashboard log |\n| T-2d | Complex case restoration | 30 calendar days | As T-2c, plus mandatory case manager review |\n| T-2e | CSM interruption during recovery | 0 instances | Category A constitutional failure, immediate escalation |\n| T-3 | Unauthorized data access or scope creep | 0 instances | Immediate audit, subject notification, scale-up halt |\n| T-4a | Appeals without human review | 0% | Pipeline audit, reassignment, dashboard report |\n| T-4b | Appeals denied past delay ceiling | <2% per quarter | Internal audit, independent reviewer reassignment |\n| T-4c | Denials without written reason | 0% | Decision void, reprocess |\n| T-5a | Staff discretion audit rate | \u226510% per quarter | Governance failure flag |\n| T-5b | Demographic disparity in denial rate | <1.5x baseline | Retraining, increased audit, dashboard report |\n\n---\n\nEven if the tests pass, identity will remain a permanent danger surface. A humane identity system must fight fraud and protect access at the same time, and those goals will always conflict under stress. The correct goal is not perfect identity. The goal is a bounded, appealable, privacy-preserving system that makes fraud costly while making exclusion visible, reversible, and unable to interrupt the survival floor.\n",
       "headings": [
         {
           "level": 1,
@@ -3635,7 +3640,7 @@
           "slug": "threshold-summary-table"
         }
       ],
-      "wordCount": 4549,
+      "wordCount": 4596,
       "headingCount": 29
     },
     {
@@ -4125,7 +4130,7 @@
       "status": "Status: Designed \u2014 specified in corpus, not yet in force (PROPOSED per Patch Log). Tier-2 founding commitment, pilot-gated: it binds nothing until its evidence test passes. Introduced by patch P-072 against threat T-025 (Investment and Capital-Deployment Shelter Capture). Panel-revised before incorporation (adversarial, Christ-centered, corpus-fit; source redline: docs/superpowers/specs/2026-06-09-productive-register-recusal-redline.md).",
       "statusBucket": "proposed",
       "summary": "The word \"productive\" unlocks two separate benefits on two separate tests: Flow issuance is made only against verified productive commitments (ANNEXX), and the Commons Return exempts productive working assets from the public-return base (ANNEXD \u00a7D3, with the stewardship/extraction line published under Article V via ANNEXJ). Because the tests are separate, the same activity can be classified \"productive\" by whichever test is looser and claim both benefits.",
-      "content": "# Productive Status Register\n\n**Status:** `Designed` \u2014 specified in corpus, not yet in force (PROPOSED per Patch Log). Tier-2 founding commitment, pilot-gated: it binds nothing until its evidence test passes. Introduced by patch **P-072** against threat **T-025** (Investment and Capital-Deployment Shelter Capture). Panel-revised before incorporation (adversarial, Christ-centered, corpus-fit; source redline: `docs/superpowers/specs/2026-06-09-productive-register-recusal-redline.md`).\n\n## The problem this instrument closes\n\nThe word \"productive\" unlocks two separate benefits on two separate tests: Flow issuance is made only against *verified productive commitments* ([ANNEX_X](../annexes/ANNEX_X.md)), and the Commons Return exempts *productive working assets* from the public-return base ([ANNEX_D \u00a7D3](../annexes/ANNEX_D.md), with the stewardship/extraction line published under Article V via [ANNEX_J](../annexes/ANNEX_J.md)). Because the tests are separate, the same activity can be classified \"productive\" by whichever test is looser and claim both benefits.\n\nThe deeper flaw is **temporal**: Flow mints at commitment *start*; the Commons Return exemption is assessed at *settlement*. A holder can take an honest \"productive\" determination at T0, mint Flow, then exit productive use before any reversal clears \u2014 the Flow is already created and moved. Separate criteria do not stop a timing attack.\n\n## The design\n\n**One determination, recorded once, three roles separated.** Each commitment or asset is assessed for productive status once, against the single published Article V stewardship standard. The **standard-author** (Article V / ANNEX_J), the **register-adjudicator**, and either benefit's **issuer** are three structurally separate roles (INV-006, including its economic-parameter-setting extension) \u2014 written in, not left to inference.\n\n**Settle-forward escrow (closes the temporal double-dip).** On commitment-linked assets, the Commons Return \u00a7D3 exemption is **not pre-granted**; it is escrowed and vests only after the Flow-side commitment is verified to have *stayed* in productive use through one full settlement period. If the commitment fails or exits productive use first (the ANNEX_X \"enhanced audit when issuance exits productive use too quickly\" trigger), the escrowed exemption never vests and the deferred public return is collected \u2014 while wages already paid stay protected by the no-clawback rule. Reversal is replaced by non-vesting, so the gaming cannot pay off before it clears.\n\n**Each benefit checks its own criterion** against the shared record; the looser test for one benefit may never be borrowed for the other. A Commons Return finding of passive extraction (ANNEX_J) refers any reliant Flow issuance to the ANNEX_X membrane/asset-equivalence review.\n\n**Payroll/escrow fast-path (no bottleneck).** Time-critical issuance below the ANNEX_X de-minimis threshold proceeds on a *provisional* productive status; the register catches up and settle-forward governs the exemption. Issuance is never blocked waiting on an adjudication; the double-dip stays closed because the exemption is escrowed regardless.\n\n**The determiner is humble and correctable.** A productive-status determination is appealable through the ANNEX_J independent-review path; the determiner publishes its basis and the criterion applied, bears the bounded burden of proof (a holder is not presumed an extractor; an honest steward is not put to impossible proof), and is itself audited by a structurally independent party (INV-006, \"no apex may sit unaudited\"). It applies the published standard; it does not author the boundary while deciding a case.\n\n**Status classifies the activity, never the person.** Productive status is a classification of an asset or commitment, never a standing judgment of a person's worth (INV-003), and stays within the ANNEX_D \u00a7D6 minimum-necessary-data rule (no new surveillance surface).\n\n## Evidence test (blocking gate before this instrument binds)\n\nThis instrument remains `Designed` until a pilot or simulation shows, with published failure criteria and residual-risk updates:\n\n1. **Double-dip closure:** the settle-forward escrow closes the temporal double-dip in adversarial simulation \u2014 a T0-honest/T1-exit strategy cannot net the exemption.\n2. **No starvation:** legitimate payroll and project issuance is not materially delayed by register adjudication (the fast-path holds under load).\n3. **Determiner non-capture:** the three-way role split + appeal + independent audit + the INV-006 recusal extension keep the register-adjudicator non-capturable in a red-team exercise.\n4. **No person-scoring drift:** an audit confirms the register holds asset/commitment classifications only \u2014 no person-level standing score has accreted (INV-003; \u00a7D6 data check).\n\n## Provenance and relationships\n\n- **Threat:** T-025 \u2014 the protected-capital classification capture family ([Threat_Register](Threat_Register.md)); this register closes the cross-instrument and temporal variants that P-023's contract-commitment architecture (ANNEX_AR) does not reach on its own.\n- **Companion (already constitutional):** the INV-006 economic-parameter-setting recusal extension ([INVARIANTS.md](../constitution/INVARIANTS.md)), applied with Session 23 \u2014 the general rule whose specific instance protects this register's adjudicator from self-dealing.\n- **Consumed by:** ANNEX_X (Flow issuance) and ANNEX_D \u00a7D3/\u00a7D3.3 (Commons Return exemption), against ANNEX_J's published Article V stewardship standard.\n- **Christ-centered note (from the panel review):** honest weights and measures \u2014 one true standard for \"productive,\" not a loose ruler for the powerful (Prov 11:1; Deut 25:13\u201316) \u2014 with the determiner made humble and correctable (Prov 11:14), and the double-dip closed without clawing back honest wages.\n",
+      "content": "# Productive Status Register\n\n**Status:** `Designed` \u2014 specified in corpus, not yet in force (PROPOSED per Patch Log). Tier-2 founding commitment, pilot-gated: it binds nothing until its evidence test passes. Introduced by patch **P-072** against threat **T-025** (Investment and Capital-Deployment Shelter Capture). Panel-revised before incorporation (adversarial, Christ-centered, corpus-fit; source redline: `docs/superpowers/specs/2026-06-09-productive-register-recusal-redline.md`).\n\n## The problem this instrument closes\n\nThe word \"productive\" unlocks two separate benefits on two separate tests: Flow issuance is made only against *verified productive commitments* ([ANNEX_X](../annexes/ANNEX_X.md)), and the Commons Return exempts *productive working assets* from the public-return base ([ANNEX_D \u00a7D3](../annexes/ANNEX_D.md), with the stewardship/extraction line published under Article V via [ANNEX_J](../annexes/ANNEX_J.md)). Because the tests are separate, the same activity can be classified \"productive\" by whichever test is looser and claim both benefits.\n\nThe deeper flaw is **temporal**: Flow mints at commitment *start*; the Commons Return exemption is assessed at *settlement*. A holder can take an honest \"productive\" determination at T0, mint Flow, then exit productive use before any reversal clears \u2014 the Flow is already created and moved. Separate criteria do not stop a timing attack.\n\n## The design\n\n**One determination, recorded once, three roles separated.** Each commitment or asset is assessed for productive status once, against the single published Article V stewardship standard. The **standard-author** (Article V / ANNEX_J), the **register-adjudicator**, and either benefit's **issuer** are three structurally separate roles (INV-006, including its economic-parameter-setting extension) \u2014 written in, not left to inference.\n\n**Settle-forward escrow (closes the temporal double-dip).** On commitment-linked assets, the Commons Return \u00a7D3 exemption is **not pre-granted**; it is escrowed and vests only after the Flow-side commitment is verified to have *stayed* in productive use through one full settlement period. If the commitment fails or exits productive use first (the ANNEX_X \"enhanced audit when issuance exits productive use too quickly\" trigger), the escrowed exemption never vests and the deferred public return is collected \u2014 while wages already paid stay protected by the no-clawback rule. Reversal is replaced by non-vesting, so the gaming cannot pay off before it clears.\n\n**Each benefit checks its own criterion** against the shared record; the looser test for one benefit may never be borrowed for the other. A Commons Return finding of passive extraction (ANNEX_J) refers any reliant Flow issuance to the ANNEX_X membrane/asset-equivalence review.\n\n**Payroll/escrow fast-path (no bottleneck).** Time-critical issuance below the ANNEX_X de-minimis threshold proceeds on a *provisional* productive status; the register catches up and settle-forward governs the exemption. Issuance is never blocked waiting on an adjudication; the double-dip stays closed because the exemption is escrowed regardless.\n\n**The determiner is humble and correctable.** A productive-status determination is appealable per the appeal spine ([ANNEX_L \u00a7L7](../annexes/ANNEX_L.md)), first instance the [ANNEX_J](../annexes/ANNEX_J.md) independent stewardship reviewer; the determiner publishes its basis and the criterion applied, bears the bounded burden of proof (a holder is not presumed an extractor; an honest steward is not put to impossible proof), and is itself audited by a structurally independent party (INV-006, \"no apex may sit unaudited\"). It applies the published standard; it does not author the boundary while deciding a case.\n\n**Status classifies the activity, never the person.** Productive status is a classification of an asset or commitment, never a standing judgment of a person's worth (INV-003), and stays within the ANNEX_D \u00a7D6 minimum-necessary-data rule (no new surveillance surface).\n\n## Evidence test (blocking gate before this instrument binds)\n\nThis instrument remains `Designed` until a pilot or simulation shows, with published failure criteria and residual-risk updates:\n\n1. **Double-dip closure:** the settle-forward escrow closes the temporal double-dip in adversarial simulation \u2014 a T0-honest/T1-exit strategy cannot net the exemption.\n2. **No starvation:** legitimate payroll and project issuance is not materially delayed by register adjudication (the fast-path holds under load).\n3. **Determiner non-capture:** the three-way role split + appeal + independent audit + the INV-006 recusal extension keep the register-adjudicator non-capturable in a red-team exercise.\n4. **No person-scoring drift:** an audit confirms the register holds asset/commitment classifications only \u2014 no person-level standing score has accreted (INV-003; \u00a7D6 data check).\n\n## Provenance and relationships\n\n- **Threat:** T-025 \u2014 the protected-capital classification capture family ([Threat_Register](Threat_Register.md)); this register closes the cross-instrument and temporal variants that P-023's contract-commitment architecture (ANNEX_AR) does not reach on its own.\n- **Companion (already constitutional):** the INV-006 economic-parameter-setting recusal extension ([INVARIANTS.md](../constitution/INVARIANTS.md)), applied with Session 23 \u2014 the general rule whose specific instance protects this register's adjudicator from self-dealing.\n- **Consumed by:** ANNEX_X (Flow issuance) and ANNEX_D \u00a7D3/\u00a7D3.3 (Commons Return exemption), against ANNEX_J's published Article V stewardship standard.\n- **Christ-centered note (from the panel review):** honest weights and measures \u2014 one true standard for \"productive,\" not a loose ruler for the powerful (Prov 11:1; Deut 25:13\u201316) \u2014 with the determiner made humble and correctable (Prov 11:14), and the double-dip closed without clawing back honest wages.\n",
       "headings": [
         {
           "level": 1,
@@ -4153,7 +4158,7 @@
           "slug": "provenance-and-relationships"
         }
       ],
-      "wordCount": 852,
+      "wordCount": 865,
       "headingCount": 5
     },
     {
@@ -9070,7 +9075,7 @@
       "status": "Status: ACTIVE \u2014 Proposal 8 close-out, 2026-04-18",
       "statusBucket": "active",
       "summary": "The prior single-Ombuds design made the Ombuds itself the highest-value capture target in the protocol: one office, one commissioner, one point of failure across six patches. P-008's own open question \u2014 \"who audits the auditors of elite formation?\" \u2014 had only a panel-level answer (Section 5 of the prior version), while the operative authority (manufactured-flag determinations, PCRP co-certifications, register access, AED monitoring) remained consolidated in a single institution.",
-      "content": "# ANNEX AI \u2014 Federated Ombuds Constitution\n\n> **Provenance:** Implements [P-025 \u2014 Federated Ombuds Constitution] \u00b7 Addresses T-008 auditor-capture residual and supports T-019, T-026, and T-027 enforcement \u00b7 Status: **ACTIVE**\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Constitutes the Federated Ombuds as five structurally independent sub-nodes, replacing a single-commissioner design that was the protocol's highest-value capture target. Governs manufactured-flag authority, PCRP co-certification, oracle seat certification, enforcement appeals, and attestation adjudication. |\n> | **Who it protects** | Everyone who depends on independent oversight of the enforcement, identity, and supply systems; populations harmed by manufactured enforcement actions; the protocol's constitutional architecture from being controlled through a single captured institution. |\n> | **Failure risk** | A single pressure campaign, legal compulsion, or coercion event captures the Ombuds and produces systematically wrong determinations; one sub-node being captured is insufficient to compromise a 4-of-5 supermajority threshold. |\n> | **Evidence status** | Active \u2014 unproven |\n> | **Linked risks** | T-008 / P-008 (elite formation and auditor capture); T-019 / P-052 (manufactured demand-context flags); T-026 / P-026; T-027 / P-026; FC-090, FC-091, FC-092 |\n\n**Status:** ACTIVE \u2014 Proposal 8 close-out, 2026-04-18\n**Authority:** Tier 1 structural (FC-090, FC-091 lock the federation and its threshold; FC-092 governs terms).\n**Supersedes:** The prior single-commissioner draft of Annex AI. Every load-bearing function previously carried by the \"Ombuds Office\" is now carried by the **Federated Ombuds** \u2014 five structurally independent sub-nodes, each a full Ombuds office, with explicit protocol-level decision rules.\n\n---\n\n## 0. Why Federated\n\nThe prior single-Ombuds design made the Ombuds itself the highest-value capture target in the protocol: one office, one commissioner, one point of failure across six patches. P-008's own open question \u2014 \"who audits the auditors of elite formation?\" \u2014 had only a panel-level answer (Section 5 of the prior version), while the operative authority (manufactured-flag determinations, PCRP co-certifications, register access, AED monitoring) remained consolidated in a single institution.\n\nFederation resolves this at the structural layer:\n\n- **Byzantine-fault margin at the institutional scale.** Five sub-Ombuds with a 4-of-5 supermajority for protocol-level decisions tolerate f = 1 captured or coerced sub-node without producing a wrong determination, and f = 2 without producing an unauthorised determination (a 3-of-5 coalition cannot meet threshold). This matches the oracle-cohort design (FC-030 N_MIN = 5 at BFT floor) \u2014 the same reasoning applied one level up.\n- **Geographic and institutional dispersal.** Five sub-nodes sited in structurally distinct jurisdictions cannot be simultaneously captured by any single legal, political, or coercive actor without producing observable, coordinated pressure.\n- **Redundancy without blocking.** Operational functions (see \u00a74) that require rapid decisions under pressure do not need the full federation \u2014 they are handled by a single rotating duty sub-Ombuds with a post-hoc federation review. The federation threshold applies only where the decision is protocol-structural (see \u00a73).\n\nThis annex constitutes the Federated Ombuds. Prior references to \"the Ombuds\" or \"the Ombuds Office\" in the Humane Constitution, Patch Log, Threat Register, and other annexes are read as references to the Federated Ombuds acting through the rule appropriate to the matter (\u00a73 for protocol-level, \u00a74 for operational).\n\n---\n\n## Plain-Language Guide\n\nThe Ombuds is the system's independent watchdog.\n\nThis annex uses five Ombuds offices instead of one. That matters because one office can be captured, pressured, or fooled. Five independent offices are harder to capture at the same time.\n\nIn plain terms:\n\n- Routine urgent cases can be handled by the duty Ombuds office.\n- System-level decisions need 4 of 5 Ombuds offices to agree.\n- The five offices must be separated by place, funding, infrastructure, and appointing networks.\n- If one office is captured or conflicted, the others can still protect the system.\n\n---\n\n## 1. Structure\n\n### 1.1 Five Sub-Ombuds (FC-090)\n\nThe Federated Ombuds is constituted as **five sub-Ombuds offices**, each with:\n\n- A full standing staff (Commissioner, deputies, investigators) with local protected-status rules mirroring the prior Section 2 of this annex.\n- An independent budget floor line-item that cannot be reduced below floor without Tier 1 amendment.\n- A local access-authority mandate over enforcement records, identity-system telemetry, and supply-signal data within its assigned jurisdictional scope.\n- A signed inter-office protocol committing each sub-Ombuds to the federation's decision rules and publication commitments.\n\nThe five sub-Ombuds are sited so that no two share primary jurisdiction, primary regulatory relationship, primary funding channel, or primary infrastructure dependency. Separation criteria are defined in Section 1.2.\n\nFC-090 sets `OMBUDS_SUBCOUNT_MIN = 5` as a Tier 1 floor. The federation may be extended above five (for example, to seven or nine sub-nodes as the protocol scales) by Tier 2 amendment with adjusted supermajority threshold. **Below five is prohibited; contraction to below five requires Tier 1 amendment (H-3) and is treated as re-centralizing the office.**\n\n### 1.2 Separation Criteria\n\nEach sub-Ombuds must be dispersed from every other sub-Ombuds along **at least four** of the following five dimensions:\n\n| Dimension | Dispersal test |\n| :--- | :--- |\n| **Jurisdictional** | Sited in a distinct legal jurisdiction with independent judicial review authority; cannot be compelled to produce records by any one jurisdiction's subpoena power alone. |\n| **Institutional-origin** | The appointing body for each sub-Ombuds is drawn from a distinct class (civil liberties, academic, federated trade/labour, independent practitioner registry, faith or community-charter institutions) \u2014 no two sub-Ombuds share an appointing-body class. |\n| **Funding** | The budget floor for each sub-Ombuds flows from a distinct fiscal channel (e.g., distinct resource-class levies, distinct federation-layer allocations) so that no single funder can simultaneously squeeze multiple sub-nodes. |\n| **Infrastructure** | Distinct primary publication channel, distinct primary communication infrastructure, distinct primary record-storage custodian. |\n| **Personnel-recruitment** | No more than one sub-Ombuds may recruit primarily from any single academic, professional, or alumni network (per FC-032-style concentration limit applied institutionally). |\n\n**Worldview and intellectual diversity.** Structural dispersal along the five dimensions above is necessary but not sufficient. Five sub-Ombuds may satisfy every structural-separation test while sharing a single worldview, professional formation, or interpretive school \u2014 a pluralist architecture housing a monoculture, which preserves the form of multiple counsellors while voiding the substance of safety in their multiplicity. The appointing classes of \u00a71.2 must therefore be operated to produce genuinely diverse reasoning, not merely structurally separated offices. Concretely:\n\n- The appointing bodies, taken together, must draw from distinct intellectual and ethical traditions, not a single dominant school filtered through five separate institutions.\n- The Oversight Assembly's annual certification (Section 5.1) assesses substantive worldview diversity across the federation alongside the five structural dimensions, and reports where the seated sub-Ombuds have converged toward a common interpretive frame despite formal separation.\n- Diversity here is a means to sound judgment under uncertainty, not a quota: the test is whether the federation can surface genuine dissent on contested questions, not whether any demographic or institutional box is checked.\n\nThe Ombuds Oversight Assembly (Section 5) certifies compliance annually and publishes the certification. Non-compliance on any structural dimension, or a certified failure of substantive worldview diversity, triggers a repair window of 180 days. Persistent non-compliance is treated as structural capture and activates the Section 5.3 Concentration Response.\n\n### 1.3 Duty Rotation and Federation Plenum\n\nDay-to-day operational functions (manufactured-flag determinations, PCRP co-certifications, exclusion-report triage) are handled by a **Duty Sub-Ombuds** \u2014 a single sub-Ombuds rotating on a published schedule (default weekly, exception scheduling for contiguous investigations). Duty rotation is published at least 14 days in advance; no party may choose their own reviewing Duty Sub-Ombuds.\n\n**Federation Plenum** \u2014 the five sub-Ombuds together, voting under \u00a73 \u2014 convenes:\n- Scheduled quarterly for standing protocol-level matters (integrity audits, dispersal certification, annual reports).\n- Emergency convocation on request of any sub-Ombuds or under automatic trigger (\u00a73.4).\n- For all \u00a73.2 protocol-level decisions, Plenum vote is required; Duty Sub-Ombuds may not substitute.\n\n---\n\n## 2. Independence Requirements\n\n### 2.1 Appointment\n\n| Role | Appointment mechanism | Term |\n| :--- | :--- | :--- |\n| **Sub-Ombuds Commissioner** (head of each sub-node) | Nominated by the sub-node's assigned appointing body (per \u00a71.2 institutional-origin class); confirmed by a 2/3 vote of the CRP; subject to a 60-day public challenge period | **730 days (FC-092)**, staggered across the five seats so that no more than two seats turn over in any single year |\n| **Deputy Commissioners** | Appointed by sub-node Commissioner with Plenum notification; subject to challenge within 30 days | 5 years, renewable once |\n| **Staff investigators** | Civil-service protection; appointed by sub-node Commissioner; removable only for cause with published rationale | Indefinite |\n\n**Staggering plan.** Sub-Ombuds seats 1, 3, 5 are appointed in odd years of the 730-day cycle; seats 2, 4 in even years. This guarantees that at any moment, at least three sub-Ombuds have served more than one year and fewer than two years, providing institutional continuity without entrenchment.\n\n**Term limit.** A Sub-Ombuds Commissioner may serve a maximum of **two consecutive 730-day terms**, then must wait at least one full term (730 days) before standing again. Lifetime service cap: four non-consecutive terms. This prevents any single individual from accumulating federation-scale authority.\n\n**Pre-launch appointment gate.** The protocol is not operative with respect to any Ombuds-dependent function until at least **four of five sub-Ombuds** have been appointed, challenged, and seated. The four-of-five pre-launch requirement ensures that the FC-091 supermajority is achievable from day one; the final fifth seat must be filled within 180 days of protocol genesis.\n\n### 2.2 Funding Independence\n\nEach sub-Ombuds holds a **Tier 1-protected budget floor** expressed as a percentage of total protocol administration budget, split among the five sub-nodes so that no sub-node falls below a per-node floor sufficient to staff the mandate functions of \u00a74. Floor percentages are set at founding and locked at Tier 1.\n\nBudget reductions below floor require Tier 1 amendment. Budget reductions at any level that would impair a \u00a74 function trigger automatic escalation to the Plenum within 14 days, and to the Oversight Assembly (\u00a75) within 30 days.\n\nNo sub-Ombuds may accept external funding, contract revenue, or in-kind support from any entity subject to its own oversight \u2014 the prior Section 2.2 single-source rule is preserved and extended across the federation.\n\n### 2.3 Recusal Rules\n\nThe prior recusal standards (professional relationship in prior 5 years; participation in design, implementation, or review; direct or indirect financial interest) apply to every sub-Ombuds and every staff investigator.\n\n**Federation-level recusal cascade:**\n- If the Duty Sub-Ombuds is recused on a particular matter, the Duty role for that matter transfers to the next sub-Ombuds in published rotation order.\n- If two or more sub-Ombuds are recused on the same matter, the Plenum convenes with the remaining three sub-Ombuds and may either (a) proceed under a \"reduced Plenum\" rule requiring **3 of 3 unanimous** for that matter only, or (b) appoint a substitute determining officer from the Oversight Assembly's register for that matter only. Choice between (a) and (b) is made by the three non-recused sub-Ombuds unanimously.\n\nRecusal is self-declared and recorded publicly. Failure to recuse when a recusal condition is met is treated as serious misconduct (\u00a72.4).\n\n### 2.4 Protected Status\n\nRemoval of a Sub-Ombuds Commissioner requires **all four** of:\n- Proven incapacity or serious misconduct, with specific findings of fact.\n- A 3/4 supermajority of the CRP with published rationale.\n- An affirmative vote of the Oversight Assembly (\u00a75).\n- A public challenge period of 60 days with right of response.\n\nRemoval of a Sub-Ombuds Commissioner by any procedure short of the above is treated as structural capture and activates the \u00a75.3 Concentration Response. Staff investigators are removable only for cause with written rationale and a right of appeal to the Oversight Assembly.\n\nRemoval procedures are Tier 1 protected; modification requires H-3 refounding authority.\n\n---\n\n## 3. Decision Rules\n\n### 3.1 Two Classes of Decision\n\n| Class | Definition | Decision rule |\n| :--- | :--- | :--- |\n| **Operational** | Time-sensitive individual-case determinations (manufactured-flag findings, PCRP co-certifications, exclusion-report triage, register-access authorisations within a single sub-node's scope) | Duty Sub-Ombuds acts; post-hoc Plenum review within 30 days; Plenum may overturn or confirm |\n| **Protocol-level** | Determinations that bind the federation as an institution (integrity audits, dispersal certification, appeals from \u00a74 operational decisions, appointment challenges, concentration-response activation, \u00a73.4 matters below) | **Plenum vote under FC-091 \u2014 4 of 5 affirmative required** |\n\nThis two-class design preserves operational speed while keeping system-level decisions hard to capture. A supply-shock flag cannot wait for all five offices, but structural decisions still need the 4-of-5 threshold.\n\n### 3.2 Protocol-Level Matters Requiring 4-of-5 Plenum Vote (FC-091)\n\nThe following matters are reserved to the Plenum under FC-091:\n\n1. **Tier 1 Amendment Integrity Report** (Proposal 1). Within 60 days of a Tier 1 amendment signature registration per `/architecture/amendment_protocol.md \u00a73`, the Plenum publishes an integrity report assessing: signature authenticity, holder independence, procedural compliance, and the absence of coercion signals. 4 of 5 affirmative required for the report to carry federation authority; dissenting positions are published with rationale.\n2. **Adversarial Oracle Seat Certification** (Proposal 3, Annex AL \u00a73.3). Each oracle cohort's FC-033 adversarial seat is certified by Plenum vote prior to cohort activation and recertified at each methodology-class rotation. 4 of 5 required.\n3. **Annex AQ \u00a73 Arbitration Panel Seat** (Proposal 6). One sub-Ombuds rotates into the 3-member arbitration panel convened during oracle-quorum-loss events. Seat assignment is by Plenum vote \u2014 4 of 5 required to confirm \u2014 with conflicts-of-interest published before seating.\n4. **Annex AJ \u00a74 Enforcement Panel Appeals** (Proposal 7). Appeals from Enforcement Panel penalty determinations are heard by Plenum. 4 of 5 required to overturn an Enforcement Panel finding; 3 of 5 may remand for further investigation.\n5. **Annex AS Attestation False-Claim Adjudication** (Proposal 9). Final adjudication of attestation false-claim findings \u2014 and the consequent stake-slashing classification (25% / 50% / 100% per Annex AS \u00a72.4) \u2014 requires 4 of 5 Plenum affirmative. Below threshold, the matter is remanded to the originating investigator; stake is held escrowed until final determination.\n6. **Dispersal and Concentration Certifications** (\u00a71.2, \u00a75.3). Annual dispersal compliance certification and any \u00a75.3 Concentration Response activation.\n7. **Appointment Challenges.** Any challenge to a sub-Ombuds appointment filed within the 60-day public challenge period.\n8. **Supersession of Duty Sub-Ombuds Operational Determinations.** Post-hoc review of an operational determination (\u00a73.1) may overturn the determination; overturn requires 4 of 5.\n\n### 3.3 Tie-Breaking and Deadlock\n\nFC-091 = 4/5 means:\n- 4 or 5 affirmative \u2192 decision carries.\n- 3 affirmative, 2 dissenting \u2192 no decision; matter is remanded for investigation or tabled for next Plenum session; **during pendency, the conservative default applies** (flag maintained, penalty not overturned, panel seat not confirmed, report not issued).\n- \u2264 2 affirmative \u2192 proposal fails; may be re-introduced with new evidence.\n\nThe conservative default is designed so that inaction favours the status quo of protection: ambiguous or divided Plenums do not lift a demand-context flag, do not overturn a penalty, and do not certify a new oracle seat. This directly serves the deterrence logic of the protocol \u2014 capture of 2 sub-Ombuds can produce deadlock but cannot produce a permissive outcome.\n\n### 3.4 Automatic Plenum Convocation Triggers\n\nThe Plenum is automatically convened (72-hour emergency session) when any of the following occur:\n- A Tier 1 amendment signature registration under `/architecture/amendment_protocol.md`.\n- A drift-chain divergence alert under `/architecture/drift_chain.md` that is not resolved within 72 hours.\n- A CSM cluster-failure report exceeding FC-071 (3 per 10,000 per 30 days).\n- An FC-010 systemic-leakage threshold breach (7% / annum).\n- A P-022 Shared Storehouse-oracle-failure event exceeding 72 hours without restoration.\n- A formal concentration-complaint filed by any advocacy organisation or by any sub-Ombuds regarding another sub-Ombuds.\n\nEmergency sessions operate under the same FC-091 threshold. If fewer than four sub-Ombuds can attend within the 72-hour window, the Plenum operates under the reduced-Plenum unanimous rule (\u00a72.3) for the matter.\n\n---\n\n## 4. Mandate\n\nThe Federated Ombuds holds the full mandate of the prior Annex AI, extended to each of the six Proposal-1-through-10 integrations.\n\n### 4.1 Manufactured-Flag Authority (P-015)\n\n*Operational class \u2014 handled by Duty Sub-Ombuds.*\n\nThe Duty Sub-Ombuds handles manufactured-flag determinations as an operational-class function. The evidentiary standard, decision rule, burden of proof, timeline, and default for these determinations are governed exclusively by **\u00a74.12** (Demand-Context Flag Assessment \u2014 Deliberate Manufacture Standard). \u00a74.12 supersedes any earlier criteria language in this section. The Duty Sub-Ombuds issues the operational determination; the Plenum reviews under \u00a73.1 post-hoc review within 30 days. When \u00a74.12 requires a mandatory Plenum determination (rather than a Duty Sub-Ombuds determination), the Plenum pathway governs and the Duty Sub-Ombuds defers.\n\nRepeated determinations favorable to the same enforcement body without documented evidence trigger Plenum review of the Duty Sub-Ombuds' independence \u2014 this is a \u00a73.2 matter requiring 4 of 5.\n\n### 4.2 PCRP Demand-Context Co-Certification (P-012)\n\n*Operational class \u2014 handled by Duty Sub-Ombuds.*\n\nThe Duty Sub-Ombuds co-certifies PCRP activation within a 2-hour window, with reduced-scope default if co-certification is not issued in time. Standards and conservative defaults are preserved from the prior Section 4.2.\n\n### 4.3 Cohort Concentration Tracking (P-008)\n\n*Protocol-level class \u2014 handled by Plenum annually; monitoring staff distributed across sub-nodes.*\n\nEach sub-Ombuds tracks cohort concentrations within its jurisdictional scope. The Plenum consolidates data quarterly and publishes a federation-wide concentration report. AC3.3 diversity standard violations identified in the report trigger automatic \u00a73.2 matters for remediation.\n\nThe federation itself is subject to AC3.3 \u2014 \u00a71.2 structural-dispersal criteria operationalise this. Failure to meet dispersal is a structural-capture signal (\u00a75.3).\n\n### 4.4 AED Monitoring (P-016 / Annex AK)\n\n*Mixed \u2014 operational triage at sub-node level; Plenum-level quarterly reporting.*\n\nEach sub-Ombuds receives exclusion-rate reports from its regional advocacy organisations. The Plenum consolidates and publishes quarterly AED compliance dashboards and triggers independent audits when Annex AK thresholds are exceeded.\n\n### 4.5 Register Access and Annual Attestation (Annex AO / P-021)\n\n*Operational class per access event \u2014 protocol-level for annual attestation.*\n\nEach sub-Ombuds holds restricted Threat Register access within its jurisdictional scope. The Plenum conducts the annual consistency attestation and publishes findings; 4 of 5 affirmative required to certify consistency.\n\n### 4.6 Adversarial Oracle Certification (Proposal 3 / Annex AL \u00a73.3)\n\n*Protocol-level \u2014 Plenum vote required per \u00a73.2 item 2.*\n\nThe Plenum certifies each cohort's adversarial oracle seat (FC-033 = 1 per cohort) and recertifies at every methodology-class rotation.\n\n### 4.7 Shared Storehouse Oracle-Failure Arbitration (Proposal 6 / Annex AQ \u00a73)\n\n*Protocol-level seating; operational decisions within the arbitration panel.*\n\nOne sub-Ombuds rotates into the 3-member arbitration panel convened within 72 hours of an Shared Storehouse oracle-quorum-loss event (Annex AQ \u00a73.1). Seat assignment is by Plenum vote (\u00a73.2 item 3). The seated sub-Ombuds acts on the panel under the panel's own rules; dissents are published.\n\n### 4.8 Enforcement Panel Appeals (Proposal 7 / Annex AJ \u00a74.4)\n\n*Protocol-level \u2014 Plenum vote required per \u00a73.2 item 4.*\n\nAny party subject to a \u00a74.2 Graduated Penalty may appeal to the Federation within 30 days of determination. The Plenum hears the appeal and decides under FC-091 (4 of 5 to overturn). If the Plenum overturns, the penalty is vacated; if remanded (3 of 5), the Enforcement Panel re-investigates; if affirmed (<3 affirmative for overturn), the penalty stands.\n\nAppeals are heard de novo on the evidentiary record. The Plenum may also issue binding interpretive guidance to the Enforcement Panel with each appeal decision.\n\n### 4.9 Attestation False-Claim Adjudication (Proposal 9 / Annex AS)\n\n*Protocol-level \u2014 Plenum vote required per \u00a73.2 item 5.*\n\nFinal attestation false-claim findings and stake-slashing classifications require Plenum affirmative. Pending final determination, stake is held in escrow; investigatory staff are drawn from the sub-Ombuds whose jurisdiction the attestor operates in.\n\n### 4.10 Founding Panel Participation (P-013 / P-014)\n\n*Preserved from prior Section 4.3.*\n\nOne staff member drawn from the Federation (lot-drawn across all five sub-Ombuds staff registers) participates in the P-014 heightened panel as one of five votes. The participating staff member is selected at the sub-node level by lot, not by Plenum vote \u2014 this maintains independence-from-self.\n\n### 4.11 General Notice and Escalation Authority\n\nAny sub-Ombuds may issue a **Public Ombuds Notice** on any matter within \u00a71 mandate (prior). Notices carry the signature of the issuing sub-Ombuds; Plenum-affirmed notices (4 of 5) carry federation authority. Enforcement bodies are required to respond to a federation-authority notice within 14 days.\n\n### 4.12 Demand-Context Flag Assessment \u2014 Deliberate Manufacture Standard\n\n*Protocol-level \u2014 Plenum assessment required. Closes the open problem identified in T-019.*\n\nWhen a demand-context flag is active and PCRP co-certification is requested, the Federated Ombuds Plenum must assess whether the triggering enforcement action was deliberately manufactured. This assessment is a mandatory Plenum function, not delegable to a single Duty Sub-Ombuds. FC-091 (4-of-5 supermajority) applies to the determination.\n\n**Criteria for finding \"deliberate manufacture.\"** The Plenum must evaluate all four of the following criteria:\n\n1. **Timing criterion.** The enforcement action was initiated within 48 hours of a sentinel indicator movement in the relevant supply category.\n2. **Proportionality criterion.** The enforcement action is disproportionate to the conduct alleged \u2014 the penalty or disruption caused exceeds what routine enforcement of comparable violations produces.\n3. **Prior-basis criterion.** No documented basis existed for the enforcement action before the sentinel indicator movement.\n4. **Knowledge criterion.** The actor initiating the enforcement action had observable knowledge of the sentinel indicator movement at the time of initiation.\n\n**Decision rule.** A finding of deliberate manufacture requires satisfaction of the timing criterion PLUS at least one of the other three criteria (proportionality, prior-basis, or knowledge). No single criterion alone is sufficient.\n\n**Decision timeline.** The Plenum must issue a written determination within 24 hours of receiving a deliberate-manufacture assessment request. The determination must be published immediately on the public dashboard.\n\n**Effect of a positive finding.** If the Plenum finds deliberate manufacture, the demand-context flag is lifted immediately and PCRP proceeds to its standard activation process without co-certification requirement. The enforcement action initiator is referred to the Enforcement Panel for investigation under the manufactured-flag provisions.\n\n**Burden of proof.** The burden is on the party seeking to maintain the demand-context flag to demonstrate the enforcement action was not manufactured. The Plenum's default, when evidence is inconclusive within the 24-hour window, is to lift the flag and allow PCRP to proceed \u2014 an asymmetric default favoring supply protection.\n\n**Repeat-beneficiary tracking.** The asymmetric inconclusive-default rightly protects supply when the evidence will not resolve within the window, but a genuinely manufactured action benefits from the same default. The mercy-extended-to-the-uncertain must not become a laundering channel for a repeat offender. The Plenum therefore publishes, on the public dashboard, a standing metric of every actor and enforcement body that has benefited from the inconclusive-default \u2014 each instance in which a flag was maintained, or PCRP proceeded, solely because evidence was inconclusive within the 24-hour window rather than on the merits. Repeated benefit by the same actor or body \u2014 applying the same standard as \u00a74.1's repeated favorable determinations \u2014 triggers a \u00a73.2 Plenum review (4 of 5) and heightened scrutiny of that party's subsequent assessments, including a rebuttable presumption that the inconclusive-default will not be extended again to the same party absent affirmative evidence of legitimate basis. The metric is published whether the repeat beneficiary is the enforcement initiator or the party maintaining the flag, so the default's protective asymmetry is preserved without becoming a shelter for the persistently guilty.\n\n**Authority basis.** This assessment is a mandatory Plenum function under \u00a73.2 (protocol-level decisions). The 24-hour timeline and asymmetric default are pre-committed criteria that apply regardless of which sub-Ombuds holds Duty rotation at the time of the request.\n\n---\n\n## 5. Oversight of the Federation\n\nThe prior Section 5 of this annex constituted a small Oversight Panel as a meta-capture defence. Federation structurally reduces the need for a single external body, but does not eliminate it \u2014 the Plenum cannot be its own auditor on matters touching the federation as an institution (e.g., dispersal compliance, systemic mis-calibration).\n\n### 5.1 Ombuds Oversight Assembly\n\nThe **Ombuds Oversight Assembly** is constituted with the following authority:\n- Annual certification of \u00a71.2 structural-dispersal compliance.\n- Review and public report on Plenum institutional health (voting patterns, dissents, recusal frequency, staffing diversity).\n- Power to initiate removal proceedings against any sub-Ombuds Commissioner if \u00a72.4 removal conditions are met \u2014 removal still requires CRP and Plenum concurrence, but the Oversight Assembly is the triggering body.\n- Appointment of substitute determining officers under \u00a72.3 reduced-Plenum option (b).\n- Activation of \u00a75.3 Concentration Response.\n\n**Composition.** The Oversight Assembly has **seven members**, drawn from structurally distinct sources:\n- 2 nominated by civil liberties organisations with no CRP funding relationship.\n- 2 nominated by independent academic institutions with published constitutional law, public administration, or civic-systems expertise.\n- 1 nominated by a federated trade or labour body with independent standing.\n- 1 nominated by an independent practitioner register (judges, retired officials, published public-interest litigators) with no prior protocol-administration employment.\n- 1 lot-drawn from citizens (personhood-holders at protocol scale) who have passed a published qualification review.\n\nTerms are **3 years, staggered, non-renewable**. No more than 2 members may turn over in any single year. No member may hold simultaneous roles in the CRP, any sub-Ombuds, any Enforcement Panel, or any founding coalition.\n\n### 5.2 Assembly Decision Rule\n\nThe Oversight Assembly operates under a **5-of-7 supermajority** for all binding decisions. This mirrors the Plenum's FC-091 ratio (4/5 = 80%; 5/7 \u2248 71%, slightly relaxed to account for the Assembly's larger size and broader nomination base) while preserving a strong supermajority requirement.\n\n### 5.3 Concentration Response\n\nIf the Assembly certifies that the federation has lost structural dispersal along two or more \u00a71.2 dimensions, or that two or more sub-Ombuds are operating under common capture signals (e.g., concordant anomalous voting, shared-counsel engagements, coordinated personnel transfers), the Assembly activates the **Concentration Response**:\n\nIdeological or epistemic monoculture is itself a concentration signal. Concordant reasoning across the sub-Ombuds that cannot be explained by the merits of the matters decided \u2014 for example, near-unanimous determinations on genuinely contested questions, the systematic absence of dissent where reasonable judgment would diverge, or shared blind spots evident across unrelated cases \u2014 is treated on the same footing as a structural-dispersal loss, whether or not any \u00a71.2 dimension has formally failed. Where the Assembly certifies such monoculture, the \u00a71.2 worldview-diversity repair window and, on persistence, this Concentration Response apply.\n\n1. Immediate public notice on Article VII dashboards.\n2. Suspension of Plenum authority on \u00a73.2 matters pending remediation.\n3. Automatic activation of a reduced-Plenum unanimous rule (\u00a72.3 option (a)) for all pending operational determinations.\n4. A 180-day remediation window in which the affected sub-Ombuds must either (a) restore dispersal (via personnel, funding, or infrastructure change) or (b) face removal under \u00a72.4.\n5. If remediation is not achieved, the affected seats are declared vacant and filled under \u00a72.1 on an accelerated timeline (90-day challenge period instead of 60).\n\nConcentration Response activation is itself a Tier 1\u2013logged event \u2014 recorded in `/architecture/drift_chain.md` as a federation-integrity event.\n\n### 5.4 Assembly's Own Meta-Capture\n\nThe Oversight Assembly is small enough to face its own capture risk. Defences:\n- **Diversity lock.** No two members may share primary institutional origin.\n- **Rotation.** 3-year staggered non-renewable terms prevent entrenchment.\n- **Publication of all votes with rationale.** Voting pattern concentration is itself an Article VII monitoring metric.\n- **Right of complaint.** Any sub-Ombuds, any CRP member, or any advocacy organisation may file a complaint against an Assembly member; complaints are heard by a lot-drawn 5-member panel from the Assembly's alternates registry.\n\nThe Oversight Assembly does not hold authority over the sub-Ombuds' \u00a74 operational functions \u2014 it audits the federation's structural health, not its casework.\n\n---\n\n## 6. Publication Commitment\n\nThe Federated Ombuds publishes the following as a continuous public record, in coordination with Article VII:\n\n| Item | Publication format | Frequency | Responsible body |\n| :--- | :--- | :--- | :--- |\n| All operational determinations (manufactured-flag findings, PCRP co-certifications, exclusion triage) | Full written determination with evidence basis, timeline, Duty Sub-Ombuds signature | Immediately upon issuance | Duty Sub-Ombuds |\n| All Plenum votes on \u00a73.2 matters | Vote count, per-sub-Ombuds positions, dissenting rationales, decision | Within 7 days of vote | Plenum |\n| Annual Tier 1 Integrity Report | Full report on all Tier 1 amendments registered in prior year | Annually (plus per-amendment within 60 days) | Plenum |\n| Adversarial oracle certifications | Per-cohort certification record | At each certification / rotation | Plenum |\n| Enforcement appeal decisions | Full decision with vote and rationale | Within 14 days of decision | Plenum |\n| Attestation adjudications | Finding, stake-slashing classification, vote | Within 14 days of decision | Plenum |\n| Cohort concentration quarterly report | Federation-wide diversity-compliance tables | Quarterly | Plenum |\n| AED compliance dashboard | Metrics per Annex AK \u00a76 | Quarterly | Plenum |\n| Structural-dispersal annual certification | \u00a71.2 compliance findings | Annually | Oversight Assembly |\n| Plenum institutional health report | Voting patterns, recusal frequency, staffing diversity | Annually | Oversight Assembly |\n| Concentration Response events | Full activation record with timeline and remediation status | At activation; monthly update through remediation | Oversight Assembly |\n| Duty rotation schedule | Forward-looking rotation for next 90 days | Rolling, updated weekly | Federation secretariat |\n| Inconclusive-default repeat-beneficiary metric (\u00a74.12) | Per-actor and per-enforcement-body tally of inconclusive-default benefits, with heightened-scrutiny flags | Updated per determination; standing public record | Plenum |\n| Recusal events | Officer, matter class, acting officer | Within 24 hours | Affected sub-Ombuds |\n\nPublication of every vote, every dissent, and every dispersal-compliance finding is the mechanism that makes the federation institutionally legible. A Plenum that consistently produces lopsided votes with predictable dissents is visible; a federation that has drifted toward common capture is visible; an Assembly that is rubber-stamping dispersal compliance is visible.\n\n---\n\n## 7. Founding Coalition Instructions\n\nTo constitute the Federated Ombuds before deployment, the founding coalition must:\n\n1. **Designate five structural-dispersal slots** satisfying \u00a71.2 along at least four of five dimensions. Slot definitions are published at founding.\n2. **Complete at least four sub-Ombuds appointments** before any Ombuds-dependent function is operative, with the fifth completed within 180 days of genesis (\u00a72.1 pre-launch gate).\n3. **Constitute the Oversight Assembly** with at least five of seven seats filled before the first Plenum vote; all seven filled within 180 days.\n4. **Publish the manufactured-flag criteria** (preserved from prior Section 3.2) at least 30 days before the first Duty Sub-Ombuds determination is made.\n5. **Build the federation secretariat** \u2014 cross-node operational support (duty rotation scheduling, Plenum convocation, publication infrastructure) \u2014 prior to operational activation. The secretariat has no independent authority; it serves the federation.\n6. **Set the budget floor percentages** per sub-Ombuds at founding, lock at Tier 1.\n7. **Publish the duty rotation schedule** for the first 90 days prior to operational activation.\n\n---\n\n## 8. Relationship to Other Annexes\n\n| Annex | Relationship |\n| :--- | :--- |\n| `/architecture/parameter_registry.md` | FC-090, FC-091, FC-092 are Tier 1 parameters locked in the registry |\n| `/architecture/amendment_protocol.md` | Federation issues the 60-day Tier 1 Amendment Integrity Report (\u00a73.2 item 1) |\n| `/architecture/drift_chain.md` | Federation plenum votes and Oversight Assembly certifications are drift-chain-logged events |\n| Annex AJ (Above-Ledger Bypass) | Federation hears enforcement appeals (\u00a73.2 item 4; \u00a74.8) |\n| Annex AK (Identity AED) | Federation monitors AED and receives exclusion reports (\u00a74.4) |\n| Annex AL (Methodology-Class) | Federation certifies adversarial oracle seats (\u00a73.2 item 2; \u00a74.6) |\n| Annex AO (Register Disclosure) | Sub-Ombuds hold restricted register access; Plenum conducts annual attestation (\u00a74.5) |\n| Annex AQ (Shared Storehouse Oracle-Failure Fallback) | Federation seats one sub-Ombuds on the arbitration panel (\u00a73.2 item 3; \u00a74.7) |\n| Annex AS (Attestation-at-Risk Stake) | Federation adjudicates false-claim findings (\u00a73.2 item 5; \u00a74.9) |\n| Annex AH/AH2 (Founding Window) | Federation contributes one staff member to the P-014 panel by lot (\u00a74.10) |\n| Annex AR (Contract-Commitment Architecture) | Federation issues public notices when Annex AR deployment-window reviews are triggered (\u00a74.11) |\n\n---\n\n## 9. Governance of This Annex\n\nThis annex is Tier 1 protected per `/architecture/parameter_registry.md`. Changes to the federation structure (FC-090 = 5), the supermajority threshold (FC-091 = 4/5), or the term length (FC-092 = 730 days) require the full amendment protocol (7 of 9, 180-day timelock). Changes to \u00a74 mandate functions that would weaken protection of any Tier 1 invariant are prohibited without H-3 refounding authority.\n\nMandate functions may be **extended** by Tier 2 amendment \u2014 new integrations may add protocol-level matters to \u00a73.2 or new operational functions to \u00a74 \u2014 but cannot be **reduced** without Tier 1 amendment. The principle mirrors the implementation-binding rule: the lock can be strengthened but not weakened by ordinary amendment.\n\n---\n\n*This document is Annex AI of the Humane Constitution. The Federated Ombuds is operative as of Proposal 8 close-out (2026-04-18). No patch that depends on Ombuds functions is active until at least four sub-Ombuds are seated and the Oversight Assembly has completed its pre-launch dispersal certification.*\n",
+      "content": "# ANNEX AI \u2014 Federated Ombuds Constitution\n\n> **Provenance:** Implements [P-025 \u2014 Federated Ombuds Constitution] \u00b7 Addresses T-008 auditor-capture residual and supports T-019, T-026, and T-027 enforcement \u00b7 Status: **ACTIVE**\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Constitutes the Federated Ombuds as five structurally independent sub-nodes, replacing a single-commissioner design that was the protocol's highest-value capture target. Governs manufactured-flag authority, PCRP co-certification, oracle seat certification, enforcement appeals, and attestation adjudication. |\n> | **Who it protects** | Everyone who depends on independent oversight of the enforcement, identity, and supply systems; populations harmed by manufactured enforcement actions; the protocol's constitutional architecture from being controlled through a single captured institution. |\n> | **Failure risk** | A single pressure campaign, legal compulsion, or coercion event captures the Ombuds and produces systematically wrong determinations; one sub-node being captured is insufficient to compromise a 4-of-5 supermajority threshold. |\n> | **Evidence status** | Active \u2014 unproven |\n> | **Linked risks** | T-008 / P-008 (elite formation and auditor capture); T-019 / P-052 (manufactured demand-context flags); T-026 / P-026; T-027 / P-026; FC-090, FC-091, FC-092 |\n\n**Status:** ACTIVE \u2014 Proposal 8 close-out, 2026-04-18\n**Authority:** Tier 1 structural (FC-090, FC-091 lock the federation and its threshold; FC-092 governs terms).\n**Supersedes:** The prior single-commissioner draft of Annex AI. Every load-bearing function previously carried by the \"Ombuds Office\" is now carried by the **Federated Ombuds** \u2014 five structurally independent sub-nodes, each a full Ombuds office, with explicit protocol-level decision rules.\n\n---\n\n## 0. Why Federated\n\nThe prior single-Ombuds design made the Ombuds itself the highest-value capture target in the protocol: one office, one commissioner, one point of failure across six patches. P-008's own open question \u2014 \"who audits the auditors of elite formation?\" \u2014 had only a panel-level answer (Section 5 of the prior version), while the operative authority (manufactured-flag determinations, PCRP co-certifications, register access, AED monitoring) remained consolidated in a single institution.\n\nFederation resolves this at the structural layer:\n\n- **Byzantine-fault margin at the institutional scale.** Five sub-Ombuds with a 4-of-5 supermajority for protocol-level decisions tolerate f = 1 captured or coerced sub-node without producing a wrong determination, and f = 2 without producing an unauthorised determination (a 3-of-5 coalition cannot meet threshold). This matches the oracle-cohort design (FC-030 N_MIN = 5 at BFT floor) \u2014 the same reasoning applied one level up.\n- **Geographic and institutional dispersal.** Five sub-nodes sited in structurally distinct jurisdictions cannot be simultaneously captured by any single legal, political, or coercive actor without producing observable, coordinated pressure.\n- **Redundancy without blocking.** Operational functions (see \u00a74) that require rapid decisions under pressure do not need the full federation \u2014 they are handled by a single rotating duty sub-Ombuds with a post-hoc federation review. The federation threshold applies only where the decision is protocol-structural (see \u00a73).\n\nThis annex constitutes the Federated Ombuds. Prior references to \"the Ombuds\" or \"the Ombuds Office\" in the Humane Constitution, Patch Log, Threat Register, and other annexes are read as references to the Federated Ombuds acting through the rule appropriate to the matter (\u00a73 for protocol-level, \u00a74 for operational).\n\n---\n\n## Plain-Language Guide\n\nThe Ombuds is the system's independent watchdog.\n\nThis annex uses five Ombuds offices instead of one. That matters because one office can be captured, pressured, or fooled. Five independent offices are harder to capture at the same time.\n\nIn plain terms:\n\n- Routine urgent cases can be handled by the duty Ombuds office.\n- System-level decisions need 4 of 5 Ombuds offices to agree.\n- The five offices must be separated by place, funding, infrastructure, and appointing networks.\n- If one office is captured or conflicted, the others can still protect the system.\n\n---\n\n## 1. Structure\n\n### 1.1 Five Sub-Ombuds (FC-090)\n\nThe Federated Ombuds is constituted as **five sub-Ombuds offices**, each with:\n\n- A full standing staff (Commissioner, deputies, investigators) with local protected-status rules mirroring the prior Section 2 of this annex.\n- An independent budget floor line-item that cannot be reduced below floor without Tier 1 amendment.\n- A local access-authority mandate over enforcement records, identity-system telemetry, and supply-signal data within its assigned jurisdictional scope.\n- A signed inter-office protocol committing each sub-Ombuds to the federation's decision rules and publication commitments.\n\nThe five sub-Ombuds are sited so that no two share primary jurisdiction, primary regulatory relationship, primary funding channel, or primary infrastructure dependency. Separation criteria are defined in Section 1.2.\n\nFC-090 sets `OMBUDS_SUBCOUNT_MIN = 5` as a Tier 1 floor. The federation may be extended above five (for example, to seven or nine sub-nodes as the protocol scales) by Tier 2 amendment with adjusted supermajority threshold. **Below five is prohibited; contraction to below five requires Tier 1 amendment (H-3) and is treated as re-centralizing the office.**\n\n### 1.2 Separation Criteria\n\nEach sub-Ombuds must be dispersed from every other sub-Ombuds along **at least four** of the following five dimensions:\n\n| Dimension | Dispersal test |\n| :--- | :--- |\n| **Jurisdictional** | Sited in a distinct legal jurisdiction with independent judicial review authority; cannot be compelled to produce records by any one jurisdiction's subpoena power alone. |\n| **Institutional-origin** | The appointing body for each sub-Ombuds is drawn from a distinct class (civil liberties, academic, federated trade/labour, independent practitioner registry, faith or community-charter institutions) \u2014 no two sub-Ombuds share an appointing-body class. |\n| **Funding** | The budget floor for each sub-Ombuds flows from a distinct fiscal channel (e.g., distinct resource-class levies, distinct federation-layer allocations) so that no single funder can simultaneously squeeze multiple sub-nodes. |\n| **Infrastructure** | Distinct primary publication channel, distinct primary communication infrastructure, distinct primary record-storage custodian. |\n| **Personnel-recruitment** | No more than one sub-Ombuds may recruit primarily from any single academic, professional, or alumni network (per FC-032-style concentration limit applied institutionally). |\n\n**Worldview and intellectual diversity.** Structural dispersal along the five dimensions above is necessary but not sufficient. Five sub-Ombuds may satisfy every structural-separation test while sharing a single worldview, professional formation, or interpretive school \u2014 a pluralist architecture housing a monoculture, which preserves the form of multiple counsellors while voiding the substance of safety in their multiplicity. The appointing classes of \u00a71.2 must therefore be operated to produce genuinely diverse reasoning, not merely structurally separated offices. Concretely:\n\n- The appointing bodies, taken together, must draw from distinct intellectual and ethical traditions, not a single dominant school filtered through five separate institutions.\n- The Oversight Assembly's annual certification (Section 5.1) assesses substantive worldview diversity across the federation alongside the five structural dimensions, and reports where the seated sub-Ombuds have converged toward a common interpretive frame despite formal separation.\n- Diversity here is a means to sound judgment under uncertainty, not a quota: the test is whether the federation can surface genuine dissent on contested questions, not whether any demographic or institutional box is checked.\n\nThe Ombuds Oversight Assembly (Section 5) certifies compliance annually and publishes the certification. Non-compliance on any structural dimension, or a certified failure of substantive worldview diversity, triggers a repair window of 180 days. Persistent non-compliance is treated as structural capture and activates the Section 5.3 Concentration Response.\n\n### 1.3 Duty Rotation and Federation Plenum\n\nDay-to-day operational functions (manufactured-flag determinations, PCRP co-certifications, exclusion-report triage) are handled by a **Duty Sub-Ombuds** \u2014 a single sub-Ombuds rotating on a published schedule (default weekly, exception scheduling for contiguous investigations). Duty rotation is published at least 14 days in advance; no party may choose their own reviewing Duty Sub-Ombuds.\n\n**Federation Plenum** \u2014 the five sub-Ombuds together, voting under \u00a73 \u2014 convenes:\n- Scheduled quarterly for standing protocol-level matters (integrity audits, dispersal certification, annual reports).\n- Emergency convocation on request of any sub-Ombuds or under automatic trigger (\u00a73.4).\n- For all \u00a73.2 protocol-level decisions, Plenum vote is required; Duty Sub-Ombuds may not substitute.\n\n---\n\n## 2. Independence Requirements\n\n### 2.1 Appointment\n\n| Role | Appointment mechanism | Term |\n| :--- | :--- | :--- |\n| **Sub-Ombuds Commissioner** (head of each sub-node) | Nominated by the sub-node's assigned appointing body (per \u00a71.2 institutional-origin class); confirmed by a 2/3 vote of the CRP; subject to a 60-day public challenge period | **730 days (FC-092)**, staggered across the five seats so that no more than two seats turn over in any single year |\n| **Deputy Commissioners** | Appointed by sub-node Commissioner with Plenum notification; subject to challenge within 30 days | 5 years, renewable once |\n| **Staff investigators** | Civil-service protection; appointed by sub-node Commissioner; removable only for cause with published rationale | Indefinite |\n\n**Staggering plan.** Sub-Ombuds seats 1, 3, 5 are appointed in odd years of the 730-day cycle; seats 2, 4 in even years. This guarantees that at any moment, at least three sub-Ombuds have served more than one year and fewer than two years, providing institutional continuity without entrenchment.\n\n**Term limit.** A Sub-Ombuds Commissioner may serve a maximum of **two consecutive 730-day terms**, then must wait at least one full term (730 days) before standing again. Lifetime service cap: four non-consecutive terms. This prevents any single individual from accumulating federation-scale authority.\n\n**Pre-launch appointment gate.** The protocol is not operative with respect to any Ombuds-dependent function until at least **four of five sub-Ombuds** have been appointed, challenged, and seated. The four-of-five pre-launch requirement ensures that the FC-091 supermajority is achievable from day one; the final fifth seat must be filled within 180 days of protocol genesis.\n\n### 2.2 Funding Independence\n\nEach sub-Ombuds holds a **Tier 1-protected budget floor** expressed as a percentage of total protocol administration budget, split among the five sub-nodes so that no sub-node falls below a per-node floor sufficient to staff the mandate functions of \u00a74. Floor percentages are set at founding and locked at Tier 1.\n\nBudget reductions below floor require Tier 1 amendment. Budget reductions at any level that would impair a \u00a74 function trigger automatic escalation to the Plenum within 14 days, and to the Oversight Assembly (\u00a75) within 30 days.\n\nNo sub-Ombuds may accept external funding, contract revenue, or in-kind support from any entity subject to its own oversight \u2014 the prior Section 2.2 single-source rule is preserved and extended across the federation.\n\n### 2.3 Recusal Rules\n\nThe prior recusal standards (professional relationship in prior 5 years; participation in design, implementation, or review; direct or indirect financial interest) apply to every sub-Ombuds and every staff investigator.\n\n**Federation-level recusal cascade:**\n- If the Duty Sub-Ombuds is recused on a particular matter, the Duty role for that matter transfers to the next sub-Ombuds in published rotation order.\n- If two or more sub-Ombuds are recused on the same matter, the Plenum convenes with the remaining three sub-Ombuds and may either (a) proceed under a \"reduced Plenum\" rule requiring **3 of 3 unanimous** for that matter only, or (b) appoint a substitute determining officer from the Oversight Assembly's register for that matter only. Choice between (a) and (b) is made by the three non-recused sub-Ombuds unanimously.\n\nRecusal is self-declared and recorded publicly. Failure to recuse when a recusal condition is met is treated as serious misconduct (\u00a72.4).\n\n### 2.4 Protected Status\n\nRemoval of a Sub-Ombuds Commissioner requires **all four** of:\n- Proven incapacity or serious misconduct, with specific findings of fact.\n- A 3/4 supermajority of the CRP with published rationale.\n- An affirmative vote of the Oversight Assembly (\u00a75).\n- A public challenge period of 60 days with right of response.\n\nRemoval of a Sub-Ombuds Commissioner by any procedure short of the above is treated as structural capture and activates the \u00a75.3 Concentration Response. Staff investigators are removable only for cause with written rationale and a right of appeal to the Oversight Assembly.\n\nRemoval procedures are Tier 1 protected; modification requires H-3 refounding authority.\n\n---\n\n## 3. Decision Rules\n\n### 3.1 Two Classes of Decision\n\n| Class | Definition | Decision rule |\n| :--- | :--- | :--- |\n| **Operational** | Time-sensitive individual-case determinations (manufactured-flag findings, PCRP co-certifications, exclusion-report triage, register-access authorisations within a single sub-node's scope) | Duty Sub-Ombuds acts; post-hoc Plenum review within 30 days; Plenum may overturn or confirm |\n| **Protocol-level** | Determinations that bind the federation as an institution (integrity audits, dispersal certification, appeals from \u00a74 operational decisions, appointment challenges, concentration-response activation, \u00a73.4 matters below) | **Plenum vote under FC-091 \u2014 4 of 5 affirmative required** |\n\nThis two-class design preserves operational speed while keeping system-level decisions hard to capture. A supply-shock flag cannot wait for all five offices, but structural decisions still need the 4-of-5 threshold.\n\n### 3.2 Protocol-Level Matters Requiring 4-of-5 Plenum Vote (FC-091)\n\nThe following matters are reserved to the Plenum under FC-091:\n\n1. **Tier 1 Amendment Integrity Report** (Proposal 1). Within 60 days of a Tier 1 amendment signature registration per `/architecture/amendment_protocol.md \u00a73`, the Plenum publishes an integrity report assessing: signature authenticity, holder independence, procedural compliance, and the absence of coercion signals. 4 of 5 affirmative required for the report to carry federation authority; dissenting positions are published with rationale.\n2. **Adversarial Oracle Seat Certification** (Proposal 3, Annex AL \u00a73.3). Each oracle cohort's FC-033 adversarial seat is certified by Plenum vote prior to cohort activation and recertified at each methodology-class rotation. 4 of 5 required.\n3. **Annex AQ \u00a73 Arbitration Panel Seat** (Proposal 6). One sub-Ombuds rotates into the 3-member arbitration panel convened during oracle-quorum-loss events. Seat assignment is by Plenum vote \u2014 4 of 5 required to confirm \u2014 with conflicts-of-interest published before seating.\n4. **Annex AJ \u00a74 Enforcement Panel Appeals** (Proposal 7). Appeals from Enforcement Panel penalty determinations are heard by Plenum. 4 of 5 required to overturn an Enforcement Panel finding; 3 of 5 may remand for further investigation.\n5. **Annex AS Attestation False-Claim Adjudication** (Proposal 9). Final adjudication of attestation false-claim findings \u2014 and the consequent stake-slashing classification (25% / 50% / 100% per Annex AS \u00a72.4) \u2014 requires 4 of 5 Plenum affirmative. Below threshold, the matter is remanded to the originating investigator; stake is held escrowed until final determination.\n6. **Dispersal and Concentration Certifications** (\u00a71.2, \u00a75.3). Annual dispersal compliance certification and any \u00a75.3 Concentration Response activation.\n7. **Appointment Challenges.** Any challenge to a sub-Ombuds appointment filed within the 60-day public challenge period.\n8. **Supersession of Duty Sub-Ombuds Operational Determinations.** Post-hoc review of an operational determination (\u00a73.1) may overturn the determination; overturn requires 4 of 5.\n\n### 3.3 Tie-Breaking and Deadlock\n\nFC-091 = 4/5 means:\n- 4 or 5 affirmative \u2192 decision carries.\n- 3 affirmative, 2 dissenting \u2192 no decision; matter is remanded for investigation or tabled for next Plenum session; **during pendency, the conservative default applies** (flag maintained, penalty not overturned, panel seat not confirmed, report not issued).\n- \u2264 2 affirmative \u2192 proposal fails; may be re-introduced with new evidence.\n\nThe conservative default is designed so that inaction favours the status quo of protection: ambiguous or divided Plenums do not lift a demand-context flag, do not overturn a penalty, and do not certify a new oracle seat. This directly serves the deterrence logic of the protocol \u2014 capture of 2 sub-Ombuds can produce deadlock but cannot produce a permissive outcome.\n\n### 3.4 Automatic Plenum Convocation Triggers\n\nThe Plenum is automatically convened (72-hour emergency session) when any of the following occur:\n- A Tier 1 amendment signature registration under `/architecture/amendment_protocol.md`.\n- A drift-chain divergence alert under `/architecture/drift_chain.md` that is not resolved within 72 hours.\n- A CSM cluster-failure report exceeding FC-071 (3 per 10,000 per 30 days).\n- An FC-010 systemic-leakage threshold breach (7% / annum).\n- A P-022 Shared Storehouse-oracle-failure event exceeding 72 hours without restoration.\n- A formal concentration-complaint filed by any advocacy organisation or by any sub-Ombuds regarding another sub-Ombuds.\n\nEmergency sessions operate under the same FC-091 threshold. If fewer than four sub-Ombuds can attend within the 72-hour window, the Plenum operates under the reduced-Plenum unanimous rule (\u00a72.3) for the matter.\n\n---\n\n## 4. Mandate\n\nThe Federated Ombuds holds the full mandate of the prior Annex AI, extended to each of the six Proposal-1-through-10 integrations.\n\n### 4.1 Manufactured-Flag Authority (P-015)\n\n*Operational class \u2014 handled by Duty Sub-Ombuds.*\n\nThe Duty Sub-Ombuds handles manufactured-flag determinations as an operational-class function. The evidentiary standard, decision rule, burden of proof, timeline, and default for these determinations are governed exclusively by **\u00a74.12** (Demand-Context Flag Assessment \u2014 Deliberate Manufacture Standard). \u00a74.12 supersedes any earlier criteria language in this section. The Duty Sub-Ombuds issues the operational determination; the Plenum reviews under \u00a73.1 post-hoc review within 30 days. When \u00a74.12 requires a mandatory Plenum determination (rather than a Duty Sub-Ombuds determination), the Plenum pathway governs and the Duty Sub-Ombuds defers.\n\nRepeated determinations favorable to the same enforcement body without documented evidence trigger Plenum review of the Duty Sub-Ombuds' independence \u2014 this is a \u00a73.2 matter requiring 4 of 5.\n\n### 4.2 PCRP Demand-Context Co-Certification (P-012)\n\n*Operational class \u2014 handled by Duty Sub-Ombuds.*\n\nThe Duty Sub-Ombuds co-certifies PCRP activation within a 2-hour window, with reduced-scope default if co-certification is not issued in time. Standards and conservative defaults are preserved from the prior Section 4.2.\n\n### 4.3 Cohort Concentration Tracking (P-008)\n\n*Protocol-level class \u2014 handled by Plenum annually; monitoring staff distributed across sub-nodes.*\n\nEach sub-Ombuds tracks cohort concentrations within its jurisdictional scope. The Plenum consolidates data quarterly and publishes a federation-wide concentration report. AC3.3 diversity standard violations identified in the report trigger automatic \u00a73.2 matters for remediation.\n\nThe federation itself is subject to AC3.3 \u2014 \u00a71.2 structural-dispersal criteria operationalise this. Failure to meet dispersal is a structural-capture signal (\u00a75.3).\n\n### 4.4 AED Monitoring (P-016 / Annex AK)\n\n*Mixed \u2014 operational triage at sub-node level; Plenum-level quarterly reporting.*\n\nEach sub-Ombuds receives exclusion-rate reports from its regional advocacy organisations. The Plenum consolidates and publishes quarterly AED compliance dashboards and triggers independent audits when Annex AK thresholds are exceeded.\n\n### 4.5 Register Access and Annual Attestation (Annex AO / P-021)\n\n*Operational class per access event \u2014 protocol-level for annual attestation.*\n\nEach sub-Ombuds holds restricted Threat Register access within its jurisdictional scope. The Plenum conducts the annual consistency attestation and publishes findings; 4 of 5 affirmative required to certify consistency.\n\n### 4.6 Adversarial Oracle Certification (Proposal 3 / Annex AL \u00a73.3)\n\n*Protocol-level \u2014 Plenum vote required per \u00a73.2 item 2.*\n\nThe Plenum certifies each cohort's adversarial oracle seat (FC-033 = 1 per cohort) and recertifies at every methodology-class rotation.\n\n### 4.7 Shared Storehouse Oracle-Failure Arbitration (Proposal 6 / Annex AQ \u00a73)\n\n*Protocol-level seating; operational decisions within the arbitration panel.*\n\nOne sub-Ombuds rotates into the 3-member arbitration panel convened within 72 hours of an Shared Storehouse oracle-quorum-loss event (Annex AQ \u00a73.1). Seat assignment is by Plenum vote (\u00a73.2 item 3). The seated sub-Ombuds acts on the panel under the panel's own rules; dissents are published.\n\n### 4.8 Enforcement Panel Appeals (Proposal 7 / Annex AJ \u00a74.4)\n\n*Protocol-level \u2014 Plenum vote required per \u00a73.2 item 4.*\n\nAny party subject to a \u00a74.2 Graduated Penalty may appeal to the Federation on the appeal spine ([ANNEX_L \u00a7L7](./ANNEX_L.md) \u2014 one filing rule, L7.1). The Plenum hears the appeal and decides under FC-091 (4 of 5 to overturn). If the Plenum overturns, the penalty is vacated; if remanded (3 of 5), the Enforcement Panel re-investigates; if affirmed (<3 affirmative for overturn), the penalty stands.\n\nAppeals are heard de novo on the evidentiary record. The Plenum may also issue binding interpretive guidance to the Enforcement Panel with each appeal decision.\n\n### 4.9 Attestation False-Claim Adjudication (Proposal 9 / Annex AS)\n\n*Protocol-level \u2014 Plenum vote required per \u00a73.2 item 5.*\n\nFinal attestation false-claim findings and stake-slashing classifications require Plenum affirmative. Pending final determination, stake is held in escrow; investigatory staff are drawn from the sub-Ombuds whose jurisdiction the attestor operates in.\n\n### 4.10 Founding Panel Participation (P-013 / P-014)\n\n*Preserved from prior Section 4.3.*\n\nOne staff member drawn from the Federation (lot-drawn across all five sub-Ombuds staff registers) participates in the P-014 heightened panel as one of five votes. The participating staff member is selected at the sub-node level by lot, not by Plenum vote \u2014 this maintains independence-from-self.\n\n### 4.11 General Notice and Escalation Authority\n\nAny sub-Ombuds may issue a **Public Ombuds Notice** on any matter within \u00a71 mandate (prior). Notices carry the signature of the issuing sub-Ombuds; Plenum-affirmed notices (4 of 5) carry federation authority. Enforcement bodies are required to respond to a federation-authority notice within 14 days.\n\n### 4.12 Demand-Context Flag Assessment \u2014 Deliberate Manufacture Standard\n\n*Protocol-level \u2014 Plenum assessment required. Closes the open problem identified in T-019.*\n\nWhen a demand-context flag is active and PCRP co-certification is requested, the Federated Ombuds Plenum must assess whether the triggering enforcement action was deliberately manufactured. This assessment is a mandatory Plenum function, not delegable to a single Duty Sub-Ombuds. FC-091 (4-of-5 supermajority) applies to the determination.\n\n**Criteria for finding \"deliberate manufacture.\"** The Plenum must evaluate all four of the following criteria:\n\n1. **Timing criterion.** The enforcement action was initiated within 48 hours of a sentinel indicator movement in the relevant supply category.\n2. **Proportionality criterion.** The enforcement action is disproportionate to the conduct alleged \u2014 the penalty or disruption caused exceeds what routine enforcement of comparable violations produces.\n3. **Prior-basis criterion.** No documented basis existed for the enforcement action before the sentinel indicator movement.\n4. **Knowledge criterion.** The actor initiating the enforcement action had observable knowledge of the sentinel indicator movement at the time of initiation.\n\n**Decision rule.** A finding of deliberate manufacture requires satisfaction of the timing criterion PLUS at least one of the other three criteria (proportionality, prior-basis, or knowledge). No single criterion alone is sufficient.\n\n**Decision timeline.** The Plenum must issue a written determination within 24 hours of receiving a deliberate-manufacture assessment request. The determination must be published immediately on the public dashboard.\n\n**Effect of a positive finding.** If the Plenum finds deliberate manufacture, the demand-context flag is lifted immediately and PCRP proceeds to its standard activation process without co-certification requirement. The enforcement action initiator is referred to the Enforcement Panel for investigation under the manufactured-flag provisions.\n\n**Burden of proof.** The burden is on the party seeking to maintain the demand-context flag to demonstrate the enforcement action was not manufactured. The Plenum's default, when evidence is inconclusive within the 24-hour window, is to lift the flag and allow PCRP to proceed \u2014 an asymmetric default favoring supply protection.\n\n**Repeat-beneficiary tracking.** The asymmetric inconclusive-default rightly protects supply when the evidence will not resolve within the window, but a genuinely manufactured action benefits from the same default. The mercy-extended-to-the-uncertain must not become a laundering channel for a repeat offender. The Plenum therefore publishes, on the public dashboard, a standing metric of every actor and enforcement body that has benefited from the inconclusive-default \u2014 each instance in which a flag was maintained, or PCRP proceeded, solely because evidence was inconclusive within the 24-hour window rather than on the merits. Repeated benefit by the same actor or body \u2014 applying the same standard as \u00a74.1's repeated favorable determinations \u2014 triggers a \u00a73.2 Plenum review (4 of 5) and heightened scrutiny of that party's subsequent assessments, including a rebuttable presumption that the inconclusive-default will not be extended again to the same party absent affirmative evidence of legitimate basis. The metric is published whether the repeat beneficiary is the enforcement initiator or the party maintaining the flag, so the default's protective asymmetry is preserved without becoming a shelter for the persistently guilty.\n\n**Authority basis.** This assessment is a mandatory Plenum function under \u00a73.2 (protocol-level decisions). The 24-hour timeline and asymmetric default are pre-committed criteria that apply regardless of which sub-Ombuds holds Duty rotation at the time of the request.\n\n---\n\n## 5. Oversight of the Federation\n\nThe prior Section 5 of this annex constituted a small Oversight Panel as a meta-capture defence. Federation structurally reduces the need for a single external body, but does not eliminate it \u2014 the Plenum cannot be its own auditor on matters touching the federation as an institution (e.g., dispersal compliance, systemic mis-calibration).\n\n### 5.1 Ombuds Oversight Assembly\n\nThe **Ombuds Oversight Assembly** is constituted with the following authority:\n- Annual certification of \u00a71.2 structural-dispersal compliance.\n- Review and public report on Plenum institutional health (voting patterns, dissents, recusal frequency, staffing diversity).\n- Power to initiate removal proceedings against any sub-Ombuds Commissioner if \u00a72.4 removal conditions are met \u2014 removal still requires CRP and Plenum concurrence, but the Oversight Assembly is the triggering body.\n- Appointment of substitute determining officers under \u00a72.3 reduced-Plenum option (b).\n- Activation of \u00a75.3 Concentration Response.\n\n**Composition.** The Oversight Assembly has **seven members**, drawn from structurally distinct sources:\n- 2 nominated by civil liberties organisations with no CRP funding relationship.\n- 2 nominated by independent academic institutions with published constitutional law, public administration, or civic-systems expertise.\n- 1 nominated by a federated trade or labour body with independent standing.\n- 1 nominated by an independent practitioner register (judges, retired officials, published public-interest litigators) with no prior protocol-administration employment.\n- 1 lot-drawn from citizens (personhood-holders at protocol scale) who have passed a published qualification review.\n\nTerms are **3 years, staggered, non-renewable**. No more than 2 members may turn over in any single year. No member may hold simultaneous roles in the CRP, any sub-Ombuds, any Enforcement Panel, or any founding coalition.\n\n### 5.2 Assembly Decision Rule\n\nThe Oversight Assembly operates under a **5-of-7 supermajority** for all binding decisions. This mirrors the Plenum's FC-091 ratio (4/5 = 80%; 5/7 \u2248 71%, slightly relaxed to account for the Assembly's larger size and broader nomination base) while preserving a strong supermajority requirement.\n\n### 5.3 Concentration Response\n\nIf the Assembly certifies that the federation has lost structural dispersal along two or more \u00a71.2 dimensions, or that two or more sub-Ombuds are operating under common capture signals (e.g., concordant anomalous voting, shared-counsel engagements, coordinated personnel transfers), the Assembly activates the **Concentration Response**:\n\nIdeological or epistemic monoculture is itself a concentration signal. Concordant reasoning across the sub-Ombuds that cannot be explained by the merits of the matters decided \u2014 for example, near-unanimous determinations on genuinely contested questions, the systematic absence of dissent where reasonable judgment would diverge, or shared blind spots evident across unrelated cases \u2014 is treated on the same footing as a structural-dispersal loss, whether or not any \u00a71.2 dimension has formally failed. Where the Assembly certifies such monoculture, the \u00a71.2 worldview-diversity repair window and, on persistence, this Concentration Response apply.\n\n1. Immediate public notice on Article VII dashboards.\n2. Suspension of Plenum authority on \u00a73.2 matters pending remediation.\n3. Automatic activation of a reduced-Plenum unanimous rule (\u00a72.3 option (a)) for all pending operational determinations.\n4. A 180-day remediation window in which the affected sub-Ombuds must either (a) restore dispersal (via personnel, funding, or infrastructure change) or (b) face removal under \u00a72.4.\n5. If remediation is not achieved, the affected seats are declared vacant and filled under \u00a72.1 on an accelerated timeline (90-day challenge period instead of 60).\n\nConcentration Response activation is itself a Tier 1\u2013logged event \u2014 recorded in `/architecture/drift_chain.md` as a federation-integrity event.\n\n### 5.4 Assembly's Own Meta-Capture\n\nThe Oversight Assembly is small enough to face its own capture risk. Defences:\n- **Diversity lock.** No two members may share primary institutional origin.\n- **Rotation.** 3-year staggered non-renewable terms prevent entrenchment.\n- **Publication of all votes with rationale.** Voting pattern concentration is itself an Article VII monitoring metric.\n- **Right of complaint.** Any sub-Ombuds, any CRP member, or any advocacy organisation may file a complaint against an Assembly member; complaints are heard by a lot-drawn 5-member panel from the Assembly's alternates registry.\n\nThe Oversight Assembly does not hold authority over the sub-Ombuds' \u00a74 operational functions \u2014 it audits the federation's structural health, not its casework.\n\n---\n\n## 6. Publication Commitment\n\nThe Federated Ombuds publishes the following as a continuous public record, in coordination with Article VII:\n\n| Item | Publication format | Frequency | Responsible body |\n| :--- | :--- | :--- | :--- |\n| All operational determinations (manufactured-flag findings, PCRP co-certifications, exclusion triage) | Full written determination with evidence basis, timeline, Duty Sub-Ombuds signature | Immediately upon issuance | Duty Sub-Ombuds |\n| All Plenum votes on \u00a73.2 matters | Vote count, per-sub-Ombuds positions, dissenting rationales, decision | Within 7 days of vote | Plenum |\n| Annual Tier 1 Integrity Report | Full report on all Tier 1 amendments registered in prior year | Annually (plus per-amendment within 60 days) | Plenum |\n| Adversarial oracle certifications | Per-cohort certification record | At each certification / rotation | Plenum |\n| Enforcement appeal decisions | Full decision with vote and rationale | Within 14 days of decision | Plenum |\n| Attestation adjudications | Finding, stake-slashing classification, vote | Within 14 days of decision | Plenum |\n| Cohort concentration quarterly report | Federation-wide diversity-compliance tables | Quarterly | Plenum |\n| AED compliance dashboard | Metrics per Annex AK \u00a76 | Quarterly | Plenum |\n| Structural-dispersal annual certification | \u00a71.2 compliance findings | Annually | Oversight Assembly |\n| Plenum institutional health report | Voting patterns, recusal frequency, staffing diversity | Annually | Oversight Assembly |\n| Concentration Response events | Full activation record with timeline and remediation status | At activation; monthly update through remediation | Oversight Assembly |\n| Duty rotation schedule | Forward-looking rotation for next 90 days | Rolling, updated weekly | Federation secretariat |\n| Inconclusive-default repeat-beneficiary metric (\u00a74.12) | Per-actor and per-enforcement-body tally of inconclusive-default benefits, with heightened-scrutiny flags | Updated per determination; standing public record | Plenum |\n| Recusal events | Officer, matter class, acting officer | Within 24 hours | Affected sub-Ombuds |\n\nPublication of every vote, every dissent, and every dispersal-compliance finding is the mechanism that makes the federation institutionally legible. A Plenum that consistently produces lopsided votes with predictable dissents is visible; a federation that has drifted toward common capture is visible; an Assembly that is rubber-stamping dispersal compliance is visible.\n\n---\n\n## 7. Founding Coalition Instructions\n\nTo constitute the Federated Ombuds before deployment, the founding coalition must:\n\n1. **Designate five structural-dispersal slots** satisfying \u00a71.2 along at least four of five dimensions. Slot definitions are published at founding.\n2. **Complete at least four sub-Ombuds appointments** before any Ombuds-dependent function is operative, with the fifth completed within 180 days of genesis (\u00a72.1 pre-launch gate).\n3. **Constitute the Oversight Assembly** with at least five of seven seats filled before the first Plenum vote; all seven filled within 180 days.\n4. **Publish the manufactured-flag criteria** (preserved from prior Section 3.2) at least 30 days before the first Duty Sub-Ombuds determination is made.\n5. **Build the federation secretariat** \u2014 cross-node operational support (duty rotation scheduling, Plenum convocation, publication infrastructure) \u2014 prior to operational activation. The secretariat has no independent authority; it serves the federation.\n6. **Set the budget floor percentages** per sub-Ombuds at founding, lock at Tier 1.\n7. **Publish the duty rotation schedule** for the first 90 days prior to operational activation.\n\n---\n\n## 8. Relationship to Other Annexes\n\n| Annex | Relationship |\n| :--- | :--- |\n| `/architecture/parameter_registry.md` | FC-090, FC-091, FC-092 are Tier 1 parameters locked in the registry |\n| `/architecture/amendment_protocol.md` | Federation issues the 60-day Tier 1 Amendment Integrity Report (\u00a73.2 item 1) |\n| `/architecture/drift_chain.md` | Federation plenum votes and Oversight Assembly certifications are drift-chain-logged events |\n| Annex AJ (Above-Ledger Bypass) | Federation hears enforcement appeals (\u00a73.2 item 4; \u00a74.8) |\n| Annex AK (Identity AED) | Federation monitors AED and receives exclusion reports (\u00a74.4) |\n| Annex AL (Methodology-Class) | Federation certifies adversarial oracle seats (\u00a73.2 item 2; \u00a74.6) |\n| Annex AO (Register Disclosure) | Sub-Ombuds hold restricted register access; Plenum conducts annual attestation (\u00a74.5) |\n| Annex AQ (Shared Storehouse Oracle-Failure Fallback) | Federation seats one sub-Ombuds on the arbitration panel (\u00a73.2 item 3; \u00a74.7) |\n| Annex AS (Attestation-at-Risk Stake) | Federation adjudicates false-claim findings (\u00a73.2 item 5; \u00a74.9) |\n| Annex AH/AH2 (Founding Window) | Federation contributes one staff member to the P-014 panel by lot (\u00a74.10) |\n| Annex AR (Contract-Commitment Architecture) | Federation issues public notices when Annex AR deployment-window reviews are triggered (\u00a74.11) |\n\n---\n\n## 9. Governance of This Annex\n\nThis annex is Tier 1 protected per `/architecture/parameter_registry.md`. Changes to the federation structure (FC-090 = 5), the supermajority threshold (FC-091 = 4/5), or the term length (FC-092 = 730 days) require the full amendment protocol (7 of 9, 180-day timelock). Changes to \u00a74 mandate functions that would weaken protection of any Tier 1 invariant are prohibited without H-3 refounding authority.\n\nMandate functions may be **extended** by Tier 2 amendment \u2014 new integrations may add protocol-level matters to \u00a73.2 or new operational functions to \u00a74 \u2014 but cannot be **reduced** without Tier 1 amendment. The principle mirrors the implementation-binding rule: the lock can be strengthened but not weakened by ordinary amendment.\n\n---\n\n*This document is Annex AI of the Humane Constitution. The Federated Ombuds is operative as of Proposal 8 close-out (2026-04-18). No patch that depends on Ombuds functions is active until at least four sub-Ombuds are seated and the Oversight Assembly has completed its pre-launch dispersal certification.*\n",
       "headings": [
         {
           "level": 1,
@@ -9268,7 +9273,7 @@
           "slug": "9-governance-of-this-annex"
         }
       ],
-      "wordCount": 5614,
+      "wordCount": 5622,
       "headingCount": 39
     },
     {
@@ -9279,7 +9284,7 @@
       "status": "Status: ACTIVE \u2014 penalty schedule bound to Founding Commitments FC-010, FC-040, FC-041 (Proposal 7 close-out, 2026-04-18)",
       "statusBucket": "active",
       "summary": "Pre-launch gate: required before system deployment \u00b7 Governed as P-004 protected specification Status: ACTIVE \u2014 penalty schedule bound to Founding Commitments FC-010, FC-040, FC-041 (Proposal 7 close-out, 2026-04-18)",
-      "content": "# ANNEX AJ \u2014 Above-Ledger Bypass Worked Examples\n\n> **Provenance:** Implements [P-001 \u2014 Shadow Convertibility Containment] above-ledger worked examples \u00b7 Addresses T-001 \u00b7 Status: **ACTIVE**\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Extends the convertibility prohibition above the ledger: enumerates specific prohibited patterns for each instrument boundary (Essential Access/Flow, Voice/Service Record, Shared Storehouse/Flow) so that social-layer workarounds are named, detectable, and subject to a graduated penalty schedule. |\n> | **Who it protects** | Genuine Essential Access recipients from preferential treatment schemes that invert the survival floor into a status currency; people rationed during Shared Storehouse periods from Flow-wealthy actors who exit or hoard; contributors without institutional backing from civic standing being purchased through Flow resources. |\n> | **Failure risk** | On-ledger detection leaves the social layer unguarded; sophisticated actors use employer-sponsored contribution accumulation, side queues, or anticipatory hoarding to reproduce the convertibility relationship without touching the ledger. |\n> | **Evidence status** | Active \u2014 unproven |\n> | **Linked risks** | T-001 / P-001 (shadow convertibility); FC-010 (leakage thresholds); FC-040 (deterrence multiplier); FC-041 (detection probability); Annex AI (Enforcement Panel appeals) |\n\n**Pre-launch gate: required before system deployment \u00b7 Governed as P-004 protected specification**\n**Status: ACTIVE \u2014 penalty schedule bound to Founding Commitments FC-010, FC-040, FC-041 (Proposal 7 close-out, 2026-04-18)**\n\n---\n\n## Purpose\n\nT-001 (Shadow Convertibility) and its mitigation P-001 address on-ledger arbitrage: direct trades of Essential Access for Flow, proxy redemption, and broker-mediated exchanges that touch the ledger. P-001's detection infrastructure monitors these channels.\n\nThis annex addresses the gap identified during adversarial review: **above-ledger bypass** \u2014 convertibility attacks that do not touch the ledger at all and therefore evade P-001 detection entirely. In above-ledger bypass, the boundary between Flow, Essential Access, Voice and Service Record, and Shared Storehouse is not breached on the ledger; it is circumvented through arrangements made entirely in the social and economic layer above it.\n\nThe purpose of this annex is to enumerate specific prohibited patterns per instrument boundary so that:\n1. The legal and enforcement definition of \"convertibility violation\" extends above the ledger.\n2. Operators, vendors, and participants have clear notice of what is prohibited.\n3. Detection can be designed for social-layer patterns, not just ledger-layer patterns.\n4. The protected-term definitions in P-004 include concrete examples that resist definitional drift.\n\n**Governing rule:** Any arrangement that produces the *functional effect* of instrument conversion \u2014 regardless of whether it involves a ledger transaction \u2014 is a convertibility violation. The test is effect, not mechanism.\n\n**Anti-enumeration clause (governing):** The worked examples in Sections 1\u20133 are illustrations of the effect test, not an exhaustive catalogue of what is forbidden. Absence of a pattern from this annex does **not** imply that the pattern is permitted. Any arrangement whose economic effect is to let wealth purchase preferential survival access, civic standing, or exemption from scarcity rationing is a convertibility violation regardless of its mechanism, its novelty, or whether it resembles any example listed here. New mechanisms that achieve a prohibited effect are prohibited the moment their effect is established, without waiting for a worked example to be added. No actor may rely on the absence of a named pattern as a defence; the only defence is that the arrangement's effect is not instrument conversion. This clause governs the interpretation of every section below and prevails over any narrower reading of an individual example.\n\n---\n\n## Plain-Language Guide\n\nThis annex explains banned workarounds.\n\nThe main rule is simple: people cannot turn one instrument into another by using side deals, informal networks, special queues, employers, vendors, or civic positions.\n\nExamples of banned behavior:\n\n- using Essential Access status to get special treatment above the survival floor\n- charging Flow for faster access to the same essential service\n- using money to buy easier Service Record or Voice accumulation\n- using a civic role to get contracts or private economic advantage\n- using money to escape Shared Storehouse rationing during a shortage\n\nThe system looks at the real effect, not the excuse. If a side deal acts like conversion, it is treated as conversion.\n\n---\n\n## Boundary 1 \u2014 Essential Access / Flow Boundary\n\n*The prohibited direction: Essential Access entitlements being used to confer Flow-equivalent benefit, or Flow being used to secure preferential Essential Access access.*\n\n### AJ-1.1 | Preferential Allocation Based on Essential Access Status\n\n**Pattern:** A housing provider, food distributor, or healthcare service allocates better-quality units, priority queue positions, or enhanced service tiers exclusively or preferentially to individuals who hold or actively use Essential Access entitlements \u2014 creating a status differential based on Essential Access utilisation.\n\n**Why it is prohibited:** Essential Access is a survival floor, not a status signal. If Essential Access-active individuals receive preferential access to goods or services above the floor, Essential Access entitlements have effectively been converted into a preference currency. This recreates the leverage relationship that the instrument separation was designed to prevent \u2014 now with the state-maintained floor as the leverage instrument.\n\n**Concrete examples:**\n- A private landlord who accepts Essential Access for baseline housing but allocates larger or better-located units to Essential Access-active tenants as a retention mechanism.\n- A grocery vendor who offers Essential Access-active customers early access to limited-stock items before Flow-paying customers.\n- A healthcare provider who reduces wait times for Essential Access-active patients beyond what is required for baseline delivery.\n\n**Permitted:** Providers may offer Flow-priced upgrades above the Essential Access basket floor to any customer regardless of Essential Access status. What is prohibited is using Essential Access status itself as the selection criterion for preferential treatment.\n\n**Detection signal:** Correlation between Essential Access utilisation and allocation outcomes above the baseline level across a vendor's customer population.\n\n---\n\n### AJ-1.2 | Flow Premium for Essential Access-Equivalent Access\n\n**Pattern:** A vendor or service provider charges an Flow premium \u2014 either explicitly or through differential pricing \u2014 that functions as a fee to avoid the Essential Access-mediated queue, obtain goods above the Essential Access-rationed allocation, or access the same goods through a \"non-Essential Access\" channel perceived as higher status.\n\n**Why it is prohibited:** If Flow can purchase faster or superior access to goods that are simultaneously available through Essential Access, the separation between the instruments is functional only for those who cannot pay the Flow premium. This recreates price-based exclusion within the formal basket \u2014 the survival floor becomes a low-status track.\n\n**Concrete examples:**\n- A clinic that offers the same consultation via Essential Access delivery with a 2-week wait or via Flow payment with a same-day appointment.\n- A transit operator that sells Flow-priced \"priority boarding\" that consistently results in a better journey than the Essential Access-covered standard service.\n- A food vendor that sells Essential Access-basket items at one counter and \"premium\" versions of the identical item at an Flow counter, where the practical difference is queue length.\n\n**Permitted:** Genuine product or service differentiation \u2014 Flow-priced items that are substantively different in quality, variety, or features from Essential Access-basket items \u2014 is allowed. Markets may serve above-basket preferences. What is prohibited is structuring delivery so that Flow payment provides faster or superior access to the *same* Essential Access-basket entitlement.\n\n**Detection signal:** Systematic wait-time or quality differentials between Essential Access and Flow delivery channels for the same essential basket item at the same vendor.\n\n---\n\n### AJ-1.3 | Social Brokerage Networks\n\n**Pattern:** An informal network of individuals pools Essential Access entitlements through non-ledger social arrangements \u2014 households agreeing to share, community groups concentrating entitlements, or individual brokers who coordinate Essential Access use across a network of participants \u2014 to achieve the functional effect of a pooled Flow fund.\n\n**Why it is prohibited:** At sufficient scale, coordinated Essential Access pooling allows the network to redeem Essential Access at a rate that exceeds any individual's basket allocation, creating liquidity and substitutability properties that Essential Access is specifically designed not to have. This converts the aggregate Essential Access flow into Flow-like purchasing power for the network's coordinators.\n\n**Permitted:** Household sharing of Essential Access basket goods after redemption is not prohibited \u2014 individuals living together may share their food, for example. What is prohibited is coordinated pre-redemption pooling that is designed to achieve above-individual-basket access or to create a tradeable pool. The test is coordination for arbitrage purpose, not ordinary household life.\n\n**Detection signal:** Synchronized redemption patterns across non-cohabiting individuals; redemption rates significantly above typical single-household use per Essential Access account; network topology suggesting coordination.\n\n---\n\n## Boundary 2 \u2014 Voice and Service Record / Resource Access Boundary\n\n*The prohibited direction: civic standing being used to gain preferential access to goods, services, or opportunities; or resource/Flow advantage being used to accumulate Voice and Service Record.*\n\n### AJ-2.1 | Civic Standing as Allocation Preference\n\n**Pattern:** An institution, vendor, service provider, or programme uses Voice balance, Service Record score, or civic participation history as an explicit or implicit criterion for preferential allocation of goods, services, employment, housing, or any resource that is not a formal civic function.\n\n**Why it is prohibited:** Voice and Service Record are scoped exclusively to civic agenda-setting and service eligibility within the civic instruments. If Voice and Service Record balance produces preferential outcomes in markets, housing, employment, or services, it has effectively become a general status currency \u2014 which is the social credit failure mode the instrument separation is designed to prevent.\n\n**Concrete examples:**\n- An employer who uses Service Record records as a positive factor in hiring decisions for non-civic roles.\n- A housing authority that gives Voice-active applicants priority in allocation of units above the Essential Access baseline.\n- A university that offers admissions preference to applicants with high Service Record records on the grounds that they are \"engaged citizens.\"\n- A vendor loyalty programme that grants discounts or perks based on civic participation history.\n\n**Permitted:** Civic functions \u2014 jury selection pools, audit panels, deliberation bodies, and oversight roles \u2014 may and should use Service Record eligibility criteria. These are the defined uses of the civic instruments. What is prohibited is any use of Voice and Service Record as a criterion in decisions that are not formal civic functions.\n\n**Detection signal:** Correlation between Voice and Service Record balance and outcomes in non-civic domains (employment rates, housing allocation rates, service quality) across a population.\n\n---\n\n### AJ-2.2 | Flow-Funded Civic Standing Accumulation\n\n**Pattern:** An individual or organisation uses Flow resources \u2014 paid time, staff, facilities, or services \u2014 to systematically enable a group of individuals to accumulate Voice and Service Record at rates not available to those without equivalent Flow resources. This converts Flow advantage into civic advantage through the mechanism of contribution verification.\n\n**Why it is prohibited:** Voice and Service Record is intended to represent genuine stewardship contribution. If Flow can buy the conditions that make contribution easy, verifiable, and legible \u2014 while those without Flow must contribute under harder conditions with less verification infrastructure \u2014 then Flow has purchased civic standing indirectly.\n\n**Concrete examples:**\n- A corporation that pays employees to perform verifiable \"stewardship\" activities during work hours, systematically accumulating Service Record for its workforce at rates unavailable to informal workers.\n- A civic consultancy that charges Flow fees to prepare contribution documentation that passes verification more reliably than self-submitted records.\n- An organisation that funds community activities specifically designed to generate contribution-verification events, channelling Service Record accumulation toward its affiliated networks.\n\n**Permitted:** Employers may encourage genuine community stewardship. Organisations may support community activities with genuine civic benefit. What is prohibited is structuring these activities specifically as Service Record accumulation mechanisms for affiliated populations, particularly where the Flow resource advantage produces a systematic Service Record gap between affiliated and non-affiliated participants.\n\n**Detection signal:** Service Record accumulation rates systematically higher for economically affiliated groups than for non-affiliated groups with similar activity levels.\n\n---\n\n### AJ-2.3 | Civic Position as Economic Leverage\n\n**Pattern:** An individual uses their formal position in a civic body \u2014 an audit panel, oversight committee, CRP seat, or deliberation body \u2014 to advance Flow-beneficial decisions, direct contracts, or signal preferences to market actors in ways that translate civic position into economic advantage.\n\n**Why it is prohibited:** Civic positions carry real decision-making authority. If that authority can be converted into Flow advantage \u2014 through directed contracts, information asymmetry, or signalled preferences \u2014 then the civic instruments have become an economic power instrument, inverting the separation the protocol is designed to maintain.\n\n**Concrete examples:**\n- A CRP member who votes on procurement priorities in ways that systematically benefit businesses they have personal Flow relationships with.\n- An audit panel member who signals audit focus areas to connected market participants before the audit begins, allowing them to prepare preferentially.\n- An oversight committee member who leverages their position to obtain speaking engagements, consulting arrangements, or advisory roles from organisations they oversee.\n\n**Permitted:** Civic participants may have ordinary economic lives. What is prohibited is using the information, authority, or influence of a civic position to secure Flow advantage \u2014 standard conflict-of-interest doctrine applied to Voice and Service Record.\n\n**Detection signal:** Correlation between civic position and Flow outcomes for the individual and their connected networks; post-position employment in sectors they previously oversaw.\n\n---\n\n## Boundary 3 \u2014 Shared Storehouse / Flow Boundary\n\n*The prohibited direction: scarcity rationing being used to confer Flow-equivalent advantage; or Flow being used to circumvent Shared Storehouse rationing.*\n\n### AJ-3.1 | Shared Storehouse Allocation as Premium Service\n\n**Pattern:** During an active Shared Storehouse period, an entity with allocation authority \u2014 a vendor, distributor, or regional operator \u2014 provides Shared Storehouse-rationed goods to some individuals faster, in better condition, or in greater variety than the Shared Storehouse allocation technically requires, in exchange for Flow payment or economic relationship.\n\n**Why it is prohibited:** Shared Storehouse rationing is designed to ensure equitable distribution during genuine shortage. If Shared Storehouse allocations can be enhanced by Flow payment, rationing reproduces price-based exclusion under a different name. The Shared Storehouse period is precisely when the separation between Flow and survival access must be most robust, because it is the period of highest vulnerability.\n\n**Concrete examples:**\n- A food distributor who, during an Shared Storehouse activation for a specific food category, offers \"priority delivery\" of that category's Shared Storehouse allocation for an Flow fee.\n- A regional operator who fulfils Shared Storehouse allocations faster for businesses that maintain ongoing Flow contracts with the operator.\n- A vendor who, during Shared Storehouse rationing, offers the Shared Storehouse-rationed item alongside a \"premium bundle\" where the Shared Storehouse item is included \u2014 effectively tying Shared Storehouse access to Flow purchase.\n\n**Permitted:** Markets for goods outside the Shared Storehouse-rationed category continue unaffected. Flow sales of non-rationed items continue normally. What is prohibited is conditioning the delivery, quality, timing, or access to Shared Storehouse-rationed allocations on Flow payment or relationship.\n\n**Detection signal:** Systematic differences in Shared Storehouse allocation delivery outcomes correlated with Flow-relationship status; complaints from non-Flow-affiliated Shared Storehouse recipients about delayed or inferior delivery.\n\n---\n\n### AJ-3.2 | Flow Exit from Shared Storehouse Scope\n\n**Pattern:** A market actor \u2014 an individual, household, or firm \u2014 uses Flow resources to obtain goods in the same category as the Shared Storehouse-rationed essential from sources outside the Shared Storehouse system, in quantities that effectively exempt them from the rationing regime while drawing down the shared supply pool that the Shared Storehouse system was designed to manage.\n\n**Why it is prohibited:** Shared Storehouse is activated because the overall supply of a category is constrained. If Flow-wealthy actors can simply purchase from outside the Shared Storehouse system, the shortage is not actually shared \u2014 it is concentrated among those without Flow resources to exit. The Shared Storehouse system manages a shared resource; actors who exit via Flow while drawing on the same physical supply undermine the entire rationing purpose.\n\n**Concrete examples:**\n- During a regional water-intensive food Shared Storehouse, an individual purchases large quantities of the rationed category from an import source not yet captured by the Shared Storehouse boundary.\n- A wealthy household stockpiles Shared Storehouse-rationed goods using Flow in advance of an anticipated Shared Storehouse activation, before the activation formally begins.\n- A firm with Flow resources contracts directly with producers outside the Shared Storehouse-designated supply chain, bypassing rationing while competing for the same underlying physical supply.\n\n**Permitted:** Genuine product substitution \u2014 purchasing a different product from outside the Shared Storehouse-rationed category \u2014 is permitted; the Shared Storehouse is category-specific. What is prohibited is using Flow to obtain the same category of good at scale while the rationing system is designed to manage overall supply of that category.\n\n**Detection signal:** Category consumption in Shared Storehouse-affected regions correlated with Flow wealth levels; import flows of Shared Storehouse-rationed categories increasing during Shared Storehouse periods.\n\n---\n\n### AJ-3.3 | Anticipatory Hoarding via Flow\n\n**Pattern:** A market actor uses Flow resources to accumulate large quantities of goods in a category where Shared Storehouse activation is anticipated, before the activation formally begins \u2014 creating a personal reserve that exempts them from the rationing period while contributing to the supply shortfall that triggers it.\n\n**Why it is prohibited:** Anticipatory hoarding is a self-fulfilling attack on the Shared Storehouse system: the hoarding behaviour accelerates the supply shortfall that triggers Shared Storehouse activation, while exempting the hoarder from its effects. It is both a cause of the shortage and a circumvention of the rationing response.\n\n**Concrete examples:**\n- A firm that monitors RCS sentinel indicators and purchases months of supply of a flagged category before PCRP activation, making the shortfall worse while ensuring their own supply.\n- An individual who, upon hearing about drought conditions, purchases large quantities of water-intensive foods before the Shared Storehouse is announced.\n\n**Permitted:** Normal inventory management and ordinary household provisioning. What is prohibited is large-scale anticipatory accumulation that is scaled to the anticipated Shared Storehouse period and timed to sentinel indicator movements.\n\n**Detection signal:** Spikes in category purchasing correlated with sentinel indicator movements, particularly by actors with the information access to monitor oracle signals.\n\n---\n\n## Section 4 \u2014 Penalty Schedule (Proposal 7 close-out)\n\nThe worked examples in Sections 1\u20133 state what is prohibited. Without a published penalty schedule, \"prohibited\" is a word without teeth \u2014 detection produces cases that have to be adjudicated ex post with no pre-committed sanction, which is itself a drift surface. This section binds each boundary-class pattern to a graduated penalty schedule calibrated on the Founding Commitments.\n\n### 4.1 \u2014 Deterrence Calibration (FC-040, FC-041)\n\n**Deterrence identity:** expected value to the violator of a detected-and-sanctioned attempt must be strictly negative. Given detection probability *p* and penalty-to-gain multiplier *k*:\n\n> EV(violation) = (1 \u2212 *p*) \u00b7 gain \u2212 *p* \u00b7 *k* \u00b7 gain = gain \u00b7 (1 \u2212 *p* \u2212 *p*\u00b7*k*)\n\nFor EV \u2264 0: *k* \u2265 (1 \u2212 *p*) / *p*. At the assumed detection probability **FC-041 `DETECTION_PROBABILITY_ASSUMED` = 0.85**, break-even is *k* \u2248 0.18. The protocol commits to **FC-040 `BRIBE_DETERRENCE_MULTIPLIER` = 5.0** \u2014 meaning the base penalty for any detected above-ledger violation is **5\u00d7 the detected functional gain**. This produces EV(violation) = gain \u00b7 (1 \u2212 0.85 \u2212 4.25) = gain \u00b7 (\u22124.10), a decisive deterrent. The 5\u00d7 multiplier also survives a detection-rate collapse to \u22480.17 before EV turns positive, so the schedule is not fragile to realistic detection shortfalls.\n\n**Gain definition.** The \"functional gain\" is the Flow-equivalent value the violator captured through the violation, measured as:\n- For individual/household violations: the Flow-market price of the preferential access, goods, or standing secured above the Essential Access/Shared Storehouse baseline or civic floor.\n- For operator/vendor violations: the incremental revenue or margin attributable to the violating pattern, measured against a non-violating baseline cohort.\n- For institutional violations (employer-sponsored Service Record accumulation, directed civic positions): the Flow-equivalent value of the civic-standing advantage conferred, valued at the cost of securing equivalent standing through non-violating means.\n\nGain is measured by the enforcement body at the time of adjudication and is documented on the public Enforcement Ledger under Article VII (without PII).\n\n### 4.2 \u2014 Graduated Penalty Matrix\n\nPenalties are calibrated per-actor-scale and per-boundary-severity. The scheduled penalty is the base multiplier (5\u00d7) times the severity factor in the matrix below, applied to the functional gain and capped or floored at the per-actor amounts shown.\n\n| Pattern | Severity | Actor: Individual | Actor: Operator / Firm | Actor: Institution / Sponsor |\n| :--- | :---: | :--- | :--- | :--- |\n| **AJ-1.1** Essential Access status as allocation preference | 1.0\u00d7 | 5\u00d7 gain; Service Record \u22120.1 for cycle | 5\u00d7 gain; 90-day vendor license probation; 2nd offense = vendor ban in essential category | 5\u00d7 gain; 180-day exclusion from Essential Access-redemption network; public Enforcement Ledger notice |\n| **AJ-1.2** Flow premium for Essential Access-equivalent access | 1.2\u00d7 | 6\u00d7 gain; Service Record \u22120.2 for cycle | 6\u00d7 gain; 180-day vendor license probation; operator-license review | 6\u00d7 gain; 365-day exclusion from essential-category redemption; mandatory divestment of Essential Access redemption operations |\n| **AJ-1.3** Social brokerage networks (coordinators) | 1.5\u00d7 | 7.5\u00d7 gain against coordinator; network participants liable only on knowing participation | 7.5\u00d7 gain; operator license revoked for essential-category brokerage | 7.5\u00d7 gain; criminal referral under convertibility-violation statute where coordination is organised |\n| **AJ-2.1** Civic standing as allocation preference | 1.2\u00d7 | 6\u00d7 gain (rare as individual pattern); Service Record \u22120.2 | 6\u00d7 gain; 180-day probation from civic-eligibility data access; vendor loyalty program disqualification | 6\u00d7 gain; 365-day exclusion from Service Record-conditioned hiring pools or allocation queues; mandatory audit of prior-period decisions |\n| **AJ-2.2** Flow-funded civic standing accumulation | 1.5\u00d7 | \u2014 | 7.5\u00d7 gain; Service Record accrued under the pattern is voided for affected accounts; employer barred 365 days from Service Record-attestation sponsorship | 7.5\u00d7 gain; all attributable Service Record accruals voided; 365-day exclusion; mandatory restitution of civic-sponsorship Flow flows |\n| **AJ-2.3** Civic position as economic leverage | 2.0\u00d7 | 10\u00d7 gain; **civic position vacated; 5-year Service Record-eligibility suspension; criminal referral** | 10\u00d7 gain against contracted entity; 365-day procurement exclusion; contract voidance | 10\u00d7 gain; 5-year exclusion from civic-procurement relationships |\n| **AJ-3.1** Shared Storehouse allocation as premium service | 1.5\u00d7 | 7.5\u00d7 gain; Service Record \u22120.3 | 7.5\u00d7 gain; operator license suspended for duration of Shared Storehouse period and 180 days post-restoration; 2nd offense = operator license revoked | 7.5\u00d7 gain; 365-day exclusion from Shared Storehouse-rationed supply chain; mandatory restitution to underserved recipients |\n| **AJ-3.2** Flow exit from Shared Storehouse scope (during active Shared Storehouse) | 1.8\u00d7 | 9\u00d7 gain; excess quantity returned to Shared Storehouse pool or forfeit | 9\u00d7 gain; import/supply license suspended for Shared Storehouse duration; operator subject to per-unit excise recouping the Shared Storehouse-pool draw | 9\u00d7 gain; mandatory contribution to Shared Storehouse buffer equal to 2\u00d7 goods acquired |\n| **AJ-3.3** Anticipatory hoarding via Flow | 1.5\u00d7 pre-activation; 2.0\u00d7 post-activation timing | 7.5\u00d7\u201310\u00d7 gain; excess inventory forfeit to Shared Storehouse pool at activation | 7.5\u00d7\u201310\u00d7 gain; license suspension; mandatory release of hoarded inventory at Shared Storehouse-activation basket prices | 7.5\u00d7\u201310\u00d7 gain; 365-day exclusion; mandatory audit of trading activity during the 90 days preceding activation |\n\n**Notes on the matrix:**\n- Severity factor is applied to the FC-040 base multiplier (5\u00d7), so AJ-1.1 = 5.0\u00d7 gain, AJ-1.2 = 6.0\u00d7 gain, AJ-2.3 = 10.0\u00d7 gain, etc.\n- \"Service Record \u22120.X for cycle\" is a deduction from the violator's civic record balance proportional to severity; Service Record deduction is independent of the gain-multiplier and is not netted against it.\n- Vendor/operator license actions are administered by the licensing authority named in the Article VII enforcement architecture; suspension and revocation are appealable only through the Ombuds process per Annex AI.\n- \"Criminal referral\" indicates a finding that meets the threshold for separate prosecution under the convertibility-violation statute (out of scope of this annex); the civil/administrative penalty in this matrix applies regardless of prosecution outcome.\n\n### 4.3 \u2014 Escalation Ladder for Repeat and Systemic Violations\n\n**Repeat offense:** a second adjudicated violation of any AJ pattern by the same actor within 24 months triggers automatic escalation to the next severity band, plus:\n- Individuals: Service Record deduction doubles; civic-position eligibility suspended for 2 cycles.\n- Operators: license revocation in essential category; 5-year prohibition from operating in Essential Access or Shared Storehouse supply chains.\n- Institutions: public Enforcement Ledger notice with named leadership; mandatory independent governance audit at institution's cost.\n\n**Systemic violation:** when enforcement data shows AJ-pattern incidence across a vendor class, sector, or region exceeds **FC-010 systemic-review trigger of 7% / annum of Essential Access allocations in the affected scope**, the Ombuds triggers a **sector-level systemic review** under Annex AI. Individual enforcement continues in parallel. The systemic review assesses whether the architecture itself requires hardening (new detection signal, new prohibited pattern) or whether the breach is an enforcement-capacity failure.\n\nThe **routine leakage ceiling of 3% / annum (FC-010)** is the operational target. Between 3% and 7%, the Ombuds prioritises detection investment and enforcement acceleration but does not trigger systemic review. Below 3%, the regime is considered in normal operating state.\n\n### 4.4 \u2014 Enforcement Body and Process\n\nPenalty adjudication is administered by the **Enforcement Panel** (a sub-body of the authority named in the Article VII enforcement architecture). Process:\n\n1. **Finding.** Detection signal triggers investigation; investigation produces a factual finding with documented evidence.\n2. **Gain quantification.** The enforcement body quantifies the functional gain per \u00a74.1. Quantification methodology is documented and subject to the P-017 oracle-independence standards (Annex AL) where gain estimation requires measurement of market prices or cohort comparisons.\n3. **Notice and response.** The accused actor receives notice with the factual finding, the gain quantification, and the scheduled penalty. Actor has 30 days to contest findings or accept.\n4. **Adjudication.** Contested cases proceed to the Enforcement Panel. Panel composition: 3 seats drawn from the Article VII enforcement staff, 2 seats drawn from the Ombuds roster per Annex AI, 1 seat drawn from the affected-party advocacy roster. No Enforcement Panel member may have a prior relationship with the accused actor within 3 years.\n5. **Appeal.** Adjudicated penalties are appealable once, through the federated Ombuds process per Annex AI \u00a74.8 (Enforcement Panel Appeals). Appeal pauses license actions but not gain-recoupment until resolved.\n6. **Publication.** Final findings are published on the Enforcement Ledger (Article VII) in aggregate form, with individual findings published only where necessary for statutory notice or where the actor has consented. PII is stripped per Annex AM.\n\n### 4.5 \u2014 Deterrence Audit\n\nThe Enforcement Panel publishes an **Annual Deterrence Audit** (parallel to the Ombuds annual audit, Annex AI \u00a7AI-8) with:\n- Estimated total functional gain attempted across each AJ pattern (from detection plus estimation of undetected).\n- Actual penalties assessed and collected.\n- Realised penalty-to-gain ratio by pattern.\n- Realised detection probability by pattern.\n- Whether the FC-040 (5.0\u00d7) and FC-041 (0.85) assumptions are holding; if detection probability slips below the level at which the 5.0\u00d7 multiplier yields negative EV, the Panel issues a formal recalibration recommendation to the Founding Coalition for consideration under the Tier 2 amendment ladder.\n\nThe Annual Deterrence Audit is the feedback loop that keeps the penalty schedule calibrated. If either the multiplier or the detection assumption drifts, the deterrence identity in \u00a74.1 tells the Coalition exactly how much headroom remains before the regime becomes EV-positive for violators.\n\n---\n\n## Governance of This Annex\n\nThis annex is a **P-004 protected specification**. The worked examples above cannot be removed, narrowed, or recharacterised through ordinary operational updates. Changes to these examples require the same process as changes to core protected terms: semantic effect test, upward classification default, and public definition registry update.\n\nThe numerical values of FC-040 (5.0\u00d7 multiplier) and FC-041 (0.85 detection probability assumption) are **Tier 2 commitments in `/founding/commitments.md`**. Changes require the Tier 2 amendment ladder with public redlines. FC-010 leakage thresholds (3% / 7%) are likewise Tier 2.\n\nNew worked examples may be added through the standard P-004 amendment process as new above-ledger bypass patterns are identified in operation. The annex should be reviewed annually and updated with patterns identified through enforcement activity. Penalty schedule matrix updates for new patterns must maintain deterrence identity (\u00a74.1) and are subject to Tier 2 amendment authority.\n\n**Detection infrastructure requirement:** Article VII monitoring must extend to the social-layer detection signals identified in each worked example above. These signals are not ledger-based; they require vendor-level data collection, population-level outcome analysis, and complaint-pattern monitoring. The specific detection thresholds are maintained in the Restricted Register Annex per P-021 (Annex AO).\n\n**Public scope of monitoring:** What is monitored is public even where specific numeric thresholds are restricted. The categories and scope of social-layer monitoring \u2014 which outcomes are observed, which correlations are tested, which vendor-level and population-level signals are collected, and for which boundary patterns \u2014 are published in plain language so that operators, vendors, and participants retain the clear notice of what is prohibited that this annex requires (Purpose, item 2). Only the calibrated numeric trigger values may be withheld in the Restricted Register per P-021 (Annex AO), and only to prevent gaming of the exact thresholds. Each restricted item carries a published, specific justification for why that value \u2014 and no broader category of information \u2014 is held restricted. The Restricted Register may narrow the precision of notice; it may not erode the notice itself. Any monitoring scope not published in this register is not authorised.\n\n**Data purpose-limitation:** The vendor-level and population-level data collected to detect above-ledger bypass is purpose-limited to bypass-detection and the enforcement process in Section 4, and to nothing else. This data is PII-stripped at the earliest point consistent with detection (per Annex AM), is retained only for the bounded period necessary to establish patterns and adjudicate findings and is then deleted, is access-limited to the Enforcement Panel and detection staff acting under that mandate, and is never repurposed for general population surveillance, civic scoring, eligibility determination, commercial use, or any objective outside bypass-detection. The remedy against wealth purchasing the survival floor must not itself become a general-purpose surveillance asset; a monitoring programme that exceeds these limits is itself a Babel-risk failure of this annex and is subject to Ombuds review under Annex AI. These constraints are P-004 protected and may not be relaxed through ordinary operational updates.\n\n---\n\n*This document is Annex AJ of the Humane Constitution. Operative as an ACTIVE specification as of Proposal 7 close-out. Penalty schedule (\u00a74) and Founding Commitments FC-010, FC-040, FC-041 are binding on the Enforcement Panel through the Article VII enforcement architecture.*\n",
+      "content": "# ANNEX AJ \u2014 Above-Ledger Bypass Worked Examples\n\n> **Provenance:** Implements [P-001 \u2014 Shadow Convertibility Containment] above-ledger worked examples \u00b7 Addresses T-001 \u00b7 Status: **ACTIVE**\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Extends the convertibility prohibition above the ledger: enumerates specific prohibited patterns for each instrument boundary (Essential Access/Flow, Voice/Service Record, Shared Storehouse/Flow) so that social-layer workarounds are named, detectable, and subject to a graduated penalty schedule. |\n> | **Who it protects** | Genuine Essential Access recipients from preferential treatment schemes that invert the survival floor into a status currency; people rationed during Shared Storehouse periods from Flow-wealthy actors who exit or hoard; contributors without institutional backing from civic standing being purchased through Flow resources. |\n> | **Failure risk** | On-ledger detection leaves the social layer unguarded; sophisticated actors use employer-sponsored contribution accumulation, side queues, or anticipatory hoarding to reproduce the convertibility relationship without touching the ledger. |\n> | **Evidence status** | Active \u2014 unproven |\n> | **Linked risks** | T-001 / P-001 (shadow convertibility); FC-010 (leakage thresholds); FC-040 (deterrence multiplier); FC-041 (detection probability); Annex AI (Enforcement Panel appeals) |\n\n**Pre-launch gate: required before system deployment \u00b7 Governed as P-004 protected specification**\n**Status: ACTIVE \u2014 penalty schedule bound to Founding Commitments FC-010, FC-040, FC-041 (Proposal 7 close-out, 2026-04-18)**\n\n---\n\n## Purpose\n\nT-001 (Shadow Convertibility) and its mitigation P-001 address on-ledger arbitrage: direct trades of Essential Access for Flow, proxy redemption, and broker-mediated exchanges that touch the ledger. P-001's detection infrastructure monitors these channels.\n\nThis annex addresses the gap identified during adversarial review: **above-ledger bypass** \u2014 convertibility attacks that do not touch the ledger at all and therefore evade P-001 detection entirely. In above-ledger bypass, the boundary between Flow, Essential Access, Voice and Service Record, and Shared Storehouse is not breached on the ledger; it is circumvented through arrangements made entirely in the social and economic layer above it.\n\nThe purpose of this annex is to enumerate specific prohibited patterns per instrument boundary so that:\n1. The legal and enforcement definition of \"convertibility violation\" extends above the ledger.\n2. Operators, vendors, and participants have clear notice of what is prohibited.\n3. Detection can be designed for social-layer patterns, not just ledger-layer patterns.\n4. The protected-term definitions in P-004 include concrete examples that resist definitional drift.\n\n**Governing rule:** Any arrangement that produces the *functional effect* of instrument conversion \u2014 regardless of whether it involves a ledger transaction \u2014 is a convertibility violation. The test is effect, not mechanism.\n\n**Anti-enumeration clause (governing):** The worked examples in Sections 1\u20133 are illustrations of the effect test, not an exhaustive catalogue of what is forbidden. Absence of a pattern from this annex does **not** imply that the pattern is permitted. Any arrangement whose economic effect is to let wealth purchase preferential survival access, civic standing, or exemption from scarcity rationing is a convertibility violation regardless of its mechanism, its novelty, or whether it resembles any example listed here. New mechanisms that achieve a prohibited effect are prohibited the moment their effect is established, without waiting for a worked example to be added. No actor may rely on the absence of a named pattern as a defence; the only defence is that the arrangement's effect is not instrument conversion. This clause governs the interpretation of every section below and prevails over any narrower reading of an individual example.\n\n---\n\n## Plain-Language Guide\n\nThis annex explains banned workarounds.\n\nThe main rule is simple: people cannot turn one instrument into another by using side deals, informal networks, special queues, employers, vendors, or civic positions.\n\nExamples of banned behavior:\n\n- using Essential Access status to get special treatment above the survival floor\n- charging Flow for faster access to the same essential service\n- using money to buy easier Service Record or Voice accumulation\n- using a civic role to get contracts or private economic advantage\n- using money to escape Shared Storehouse rationing during a shortage\n\nThe system looks at the real effect, not the excuse. If a side deal acts like conversion, it is treated as conversion.\n\n---\n\n## Boundary 1 \u2014 Essential Access / Flow Boundary\n\n*The prohibited direction: Essential Access entitlements being used to confer Flow-equivalent benefit, or Flow being used to secure preferential Essential Access access.*\n\n### AJ-1.1 | Preferential Allocation Based on Essential Access Status\n\n**Pattern:** A housing provider, food distributor, or healthcare service allocates better-quality units, priority queue positions, or enhanced service tiers exclusively or preferentially to individuals who hold or actively use Essential Access entitlements \u2014 creating a status differential based on Essential Access utilisation.\n\n**Why it is prohibited:** Essential Access is a survival floor, not a status signal. If Essential Access-active individuals receive preferential access to goods or services above the floor, Essential Access entitlements have effectively been converted into a preference currency. This recreates the leverage relationship that the instrument separation was designed to prevent \u2014 now with the state-maintained floor as the leverage instrument.\n\n**Concrete examples:**\n- A private landlord who accepts Essential Access for baseline housing but allocates larger or better-located units to Essential Access-active tenants as a retention mechanism.\n- A grocery vendor who offers Essential Access-active customers early access to limited-stock items before Flow-paying customers.\n- A healthcare provider who reduces wait times for Essential Access-active patients beyond what is required for baseline delivery.\n\n**Permitted:** Providers may offer Flow-priced upgrades above the Essential Access basket floor to any customer regardless of Essential Access status. What is prohibited is using Essential Access status itself as the selection criterion for preferential treatment.\n\n**Detection signal:** Correlation between Essential Access utilisation and allocation outcomes above the baseline level across a vendor's customer population.\n\n---\n\n### AJ-1.2 | Flow Premium for Essential Access-Equivalent Access\n\n**Pattern:** A vendor or service provider charges an Flow premium \u2014 either explicitly or through differential pricing \u2014 that functions as a fee to avoid the Essential Access-mediated queue, obtain goods above the Essential Access-rationed allocation, or access the same goods through a \"non-Essential Access\" channel perceived as higher status.\n\n**Why it is prohibited:** If Flow can purchase faster or superior access to goods that are simultaneously available through Essential Access, the separation between the instruments is functional only for those who cannot pay the Flow premium. This recreates price-based exclusion within the formal basket \u2014 the survival floor becomes a low-status track.\n\n**Concrete examples:**\n- A clinic that offers the same consultation via Essential Access delivery with a 2-week wait or via Flow payment with a same-day appointment.\n- A transit operator that sells Flow-priced \"priority boarding\" that consistently results in a better journey than the Essential Access-covered standard service.\n- A food vendor that sells Essential Access-basket items at one counter and \"premium\" versions of the identical item at an Flow counter, where the practical difference is queue length.\n\n**Permitted:** Genuine product or service differentiation \u2014 Flow-priced items that are substantively different in quality, variety, or features from Essential Access-basket items \u2014 is allowed. Markets may serve above-basket preferences. What is prohibited is structuring delivery so that Flow payment provides faster or superior access to the *same* Essential Access-basket entitlement.\n\n**Detection signal:** Systematic wait-time or quality differentials between Essential Access and Flow delivery channels for the same essential basket item at the same vendor.\n\n---\n\n### AJ-1.3 | Social Brokerage Networks\n\n**Pattern:** An informal network of individuals pools Essential Access entitlements through non-ledger social arrangements \u2014 households agreeing to share, community groups concentrating entitlements, or individual brokers who coordinate Essential Access use across a network of participants \u2014 to achieve the functional effect of a pooled Flow fund.\n\n**Why it is prohibited:** At sufficient scale, coordinated Essential Access pooling allows the network to redeem Essential Access at a rate that exceeds any individual's basket allocation, creating liquidity and substitutability properties that Essential Access is specifically designed not to have. This converts the aggregate Essential Access flow into Flow-like purchasing power for the network's coordinators.\n\n**Permitted:** Household sharing of Essential Access basket goods after redemption is not prohibited \u2014 individuals living together may share their food, for example. What is prohibited is coordinated pre-redemption pooling that is designed to achieve above-individual-basket access or to create a tradeable pool. The test is coordination for arbitrage purpose, not ordinary household life.\n\n**Detection signal:** Synchronized redemption patterns across non-cohabiting individuals; redemption rates significantly above typical single-household use per Essential Access account; network topology suggesting coordination.\n\n---\n\n## Boundary 2 \u2014 Voice and Service Record / Resource Access Boundary\n\n*The prohibited direction: civic standing being used to gain preferential access to goods, services, or opportunities; or resource/Flow advantage being used to accumulate Voice and Service Record.*\n\n### AJ-2.1 | Civic Standing as Allocation Preference\n\n**Pattern:** An institution, vendor, service provider, or programme uses Voice balance, Service Record score, or civic participation history as an explicit or implicit criterion for preferential allocation of goods, services, employment, housing, or any resource that is not a formal civic function.\n\n**Why it is prohibited:** Voice and Service Record are scoped exclusively to civic agenda-setting and service eligibility within the civic instruments. If Voice and Service Record balance produces preferential outcomes in markets, housing, employment, or services, it has effectively become a general status currency \u2014 which is the social credit failure mode the instrument separation is designed to prevent.\n\n**Concrete examples:**\n- An employer who uses Service Record records as a positive factor in hiring decisions for non-civic roles.\n- A housing authority that gives Voice-active applicants priority in allocation of units above the Essential Access baseline.\n- A university that offers admissions preference to applicants with high Service Record records on the grounds that they are \"engaged citizens.\"\n- A vendor loyalty programme that grants discounts or perks based on civic participation history.\n\n**Permitted:** Civic functions \u2014 jury selection pools, audit panels, deliberation bodies, and oversight roles \u2014 may and should use Service Record eligibility criteria. These are the defined uses of the civic instruments. What is prohibited is any use of Voice and Service Record as a criterion in decisions that are not formal civic functions.\n\n**Detection signal:** Correlation between Voice and Service Record balance and outcomes in non-civic domains (employment rates, housing allocation rates, service quality) across a population.\n\n---\n\n### AJ-2.2 | Flow-Funded Civic Standing Accumulation\n\n**Pattern:** An individual or organisation uses Flow resources \u2014 paid time, staff, facilities, or services \u2014 to systematically enable a group of individuals to accumulate Voice and Service Record at rates not available to those without equivalent Flow resources. This converts Flow advantage into civic advantage through the mechanism of contribution verification.\n\n**Why it is prohibited:** Voice and Service Record is intended to represent genuine stewardship contribution. If Flow can buy the conditions that make contribution easy, verifiable, and legible \u2014 while those without Flow must contribute under harder conditions with less verification infrastructure \u2014 then Flow has purchased civic standing indirectly.\n\n**Concrete examples:**\n- A corporation that pays employees to perform verifiable \"stewardship\" activities during work hours, systematically accumulating Service Record for its workforce at rates unavailable to informal workers.\n- A civic consultancy that charges Flow fees to prepare contribution documentation that passes verification more reliably than self-submitted records.\n- An organisation that funds community activities specifically designed to generate contribution-verification events, channelling Service Record accumulation toward its affiliated networks.\n\n**Permitted:** Employers may encourage genuine community stewardship. Organisations may support community activities with genuine civic benefit. What is prohibited is structuring these activities specifically as Service Record accumulation mechanisms for affiliated populations, particularly where the Flow resource advantage produces a systematic Service Record gap between affiliated and non-affiliated participants.\n\n**Detection signal:** Service Record accumulation rates systematically higher for economically affiliated groups than for non-affiliated groups with similar activity levels.\n\n---\n\n### AJ-2.3 | Civic Position as Economic Leverage\n\n**Pattern:** An individual uses their formal position in a civic body \u2014 an audit panel, oversight committee, CRP seat, or deliberation body \u2014 to advance Flow-beneficial decisions, direct contracts, or signal preferences to market actors in ways that translate civic position into economic advantage.\n\n**Why it is prohibited:** Civic positions carry real decision-making authority. If that authority can be converted into Flow advantage \u2014 through directed contracts, information asymmetry, or signalled preferences \u2014 then the civic instruments have become an economic power instrument, inverting the separation the protocol is designed to maintain.\n\n**Concrete examples:**\n- A CRP member who votes on procurement priorities in ways that systematically benefit businesses they have personal Flow relationships with.\n- An audit panel member who signals audit focus areas to connected market participants before the audit begins, allowing them to prepare preferentially.\n- An oversight committee member who leverages their position to obtain speaking engagements, consulting arrangements, or advisory roles from organisations they oversee.\n\n**Permitted:** Civic participants may have ordinary economic lives. What is prohibited is using the information, authority, or influence of a civic position to secure Flow advantage \u2014 standard conflict-of-interest doctrine applied to Voice and Service Record.\n\n**Detection signal:** Correlation between civic position and Flow outcomes for the individual and their connected networks; post-position employment in sectors they previously oversaw.\n\n---\n\n## Boundary 3 \u2014 Shared Storehouse / Flow Boundary\n\n*The prohibited direction: scarcity rationing being used to confer Flow-equivalent advantage; or Flow being used to circumvent Shared Storehouse rationing.*\n\n### AJ-3.1 | Shared Storehouse Allocation as Premium Service\n\n**Pattern:** During an active Shared Storehouse period, an entity with allocation authority \u2014 a vendor, distributor, or regional operator \u2014 provides Shared Storehouse-rationed goods to some individuals faster, in better condition, or in greater variety than the Shared Storehouse allocation technically requires, in exchange for Flow payment or economic relationship.\n\n**Why it is prohibited:** Shared Storehouse rationing is designed to ensure equitable distribution during genuine shortage. If Shared Storehouse allocations can be enhanced by Flow payment, rationing reproduces price-based exclusion under a different name. The Shared Storehouse period is precisely when the separation between Flow and survival access must be most robust, because it is the period of highest vulnerability.\n\n**Concrete examples:**\n- A food distributor who, during an Shared Storehouse activation for a specific food category, offers \"priority delivery\" of that category's Shared Storehouse allocation for an Flow fee.\n- A regional operator who fulfils Shared Storehouse allocations faster for businesses that maintain ongoing Flow contracts with the operator.\n- A vendor who, during Shared Storehouse rationing, offers the Shared Storehouse-rationed item alongside a \"premium bundle\" where the Shared Storehouse item is included \u2014 effectively tying Shared Storehouse access to Flow purchase.\n\n**Permitted:** Markets for goods outside the Shared Storehouse-rationed category continue unaffected. Flow sales of non-rationed items continue normally. What is prohibited is conditioning the delivery, quality, timing, or access to Shared Storehouse-rationed allocations on Flow payment or relationship.\n\n**Detection signal:** Systematic differences in Shared Storehouse allocation delivery outcomes correlated with Flow-relationship status; complaints from non-Flow-affiliated Shared Storehouse recipients about delayed or inferior delivery.\n\n---\n\n### AJ-3.2 | Flow Exit from Shared Storehouse Scope\n\n**Pattern:** A market actor \u2014 an individual, household, or firm \u2014 uses Flow resources to obtain goods in the same category as the Shared Storehouse-rationed essential from sources outside the Shared Storehouse system, in quantities that effectively exempt them from the rationing regime while drawing down the shared supply pool that the Shared Storehouse system was designed to manage.\n\n**Why it is prohibited:** Shared Storehouse is activated because the overall supply of a category is constrained. If Flow-wealthy actors can simply purchase from outside the Shared Storehouse system, the shortage is not actually shared \u2014 it is concentrated among those without Flow resources to exit. The Shared Storehouse system manages a shared resource; actors who exit via Flow while drawing on the same physical supply undermine the entire rationing purpose.\n\n**Concrete examples:**\n- During a regional water-intensive food Shared Storehouse, an individual purchases large quantities of the rationed category from an import source not yet captured by the Shared Storehouse boundary.\n- A wealthy household stockpiles Shared Storehouse-rationed goods using Flow in advance of an anticipated Shared Storehouse activation, before the activation formally begins.\n- A firm with Flow resources contracts directly with producers outside the Shared Storehouse-designated supply chain, bypassing rationing while competing for the same underlying physical supply.\n\n**Permitted:** Genuine product substitution \u2014 purchasing a different product from outside the Shared Storehouse-rationed category \u2014 is permitted; the Shared Storehouse is category-specific. What is prohibited is using Flow to obtain the same category of good at scale while the rationing system is designed to manage overall supply of that category.\n\n**Detection signal:** Category consumption in Shared Storehouse-affected regions correlated with Flow wealth levels; import flows of Shared Storehouse-rationed categories increasing during Shared Storehouse periods.\n\n---\n\n### AJ-3.3 | Anticipatory Hoarding via Flow\n\n**Pattern:** A market actor uses Flow resources to accumulate large quantities of goods in a category where Shared Storehouse activation is anticipated, before the activation formally begins \u2014 creating a personal reserve that exempts them from the rationing period while contributing to the supply shortfall that triggers it.\n\n**Why it is prohibited:** Anticipatory hoarding is a self-fulfilling attack on the Shared Storehouse system: the hoarding behaviour accelerates the supply shortfall that triggers Shared Storehouse activation, while exempting the hoarder from its effects. It is both a cause of the shortage and a circumvention of the rationing response.\n\n**Concrete examples:**\n- A firm that monitors RCS sentinel indicators and purchases months of supply of a flagged category before PCRP activation, making the shortfall worse while ensuring their own supply.\n- An individual who, upon hearing about drought conditions, purchases large quantities of water-intensive foods before the Shared Storehouse is announced.\n\n**Permitted:** Normal inventory management and ordinary household provisioning. What is prohibited is large-scale anticipatory accumulation that is scaled to the anticipated Shared Storehouse period and timed to sentinel indicator movements.\n\n**Detection signal:** Spikes in category purchasing correlated with sentinel indicator movements, particularly by actors with the information access to monitor oracle signals.\n\n---\n\n## Section 4 \u2014 Penalty Schedule (Proposal 7 close-out)\n\nThe worked examples in Sections 1\u20133 state what is prohibited. Without a published penalty schedule, \"prohibited\" is a word without teeth \u2014 detection produces cases that have to be adjudicated ex post with no pre-committed sanction, which is itself a drift surface. This section binds each boundary-class pattern to a graduated penalty schedule calibrated on the Founding Commitments.\n\n### 4.1 \u2014 Deterrence Calibration (FC-040, FC-041)\n\n**Deterrence identity:** expected value to the violator of a detected-and-sanctioned attempt must be strictly negative. Given detection probability *p* and penalty-to-gain multiplier *k*:\n\n> EV(violation) = (1 \u2212 *p*) \u00b7 gain \u2212 *p* \u00b7 *k* \u00b7 gain = gain \u00b7 (1 \u2212 *p* \u2212 *p*\u00b7*k*)\n\nFor EV \u2264 0: *k* \u2265 (1 \u2212 *p*) / *p*. At the assumed detection probability **FC-041 `DETECTION_PROBABILITY_ASSUMED` = 0.85**, break-even is *k* \u2248 0.18. The protocol commits to **FC-040 `BRIBE_DETERRENCE_MULTIPLIER` = 5.0** \u2014 meaning the base penalty for any detected above-ledger violation is **5\u00d7 the detected functional gain**. This produces EV(violation) = gain \u00b7 (1 \u2212 0.85 \u2212 4.25) = gain \u00b7 (\u22124.10), a decisive deterrent. The 5\u00d7 multiplier also survives a detection-rate collapse to \u22480.17 before EV turns positive, so the schedule is not fragile to realistic detection shortfalls.\n\n**Gain definition.** The \"functional gain\" is the Flow-equivalent value the violator captured through the violation, measured as:\n- For individual/household violations: the Flow-market price of the preferential access, goods, or standing secured above the Essential Access/Shared Storehouse baseline or civic floor.\n- For operator/vendor violations: the incremental revenue or margin attributable to the violating pattern, measured against a non-violating baseline cohort.\n- For institutional violations (employer-sponsored Service Record accumulation, directed civic positions): the Flow-equivalent value of the civic-standing advantage conferred, valued at the cost of securing equivalent standing through non-violating means.\n\nGain is measured by the enforcement body at the time of adjudication and is documented on the public Enforcement Ledger under Article VII (without PII).\n\n### 4.2 \u2014 Graduated Penalty Matrix\n\nPenalties are calibrated per-actor-scale and per-boundary-severity. The scheduled penalty is the base multiplier (5\u00d7) times the severity factor in the matrix below, applied to the functional gain and capped or floored at the per-actor amounts shown.\n\n| Pattern | Severity | Actor: Individual | Actor: Operator / Firm | Actor: Institution / Sponsor |\n| :--- | :---: | :--- | :--- | :--- |\n| **AJ-1.1** Essential Access status as allocation preference | 1.0\u00d7 | 5\u00d7 gain; Service Record \u22120.1 for cycle | 5\u00d7 gain; 90-day vendor license probation; 2nd offense = vendor ban in essential category | 5\u00d7 gain; 180-day exclusion from Essential Access-redemption network; public Enforcement Ledger notice |\n| **AJ-1.2** Flow premium for Essential Access-equivalent access | 1.2\u00d7 | 6\u00d7 gain; Service Record \u22120.2 for cycle | 6\u00d7 gain; 180-day vendor license probation; operator-license review | 6\u00d7 gain; 365-day exclusion from essential-category redemption; mandatory divestment of Essential Access redemption operations |\n| **AJ-1.3** Social brokerage networks (coordinators) | 1.5\u00d7 | 7.5\u00d7 gain against coordinator; network participants liable only on knowing participation | 7.5\u00d7 gain; operator license revoked for essential-category brokerage | 7.5\u00d7 gain; criminal referral under convertibility-violation statute where coordination is organised |\n| **AJ-2.1** Civic standing as allocation preference | 1.2\u00d7 | 6\u00d7 gain (rare as individual pattern); Service Record \u22120.2 | 6\u00d7 gain; 180-day probation from civic-eligibility data access; vendor loyalty program disqualification | 6\u00d7 gain; 365-day exclusion from Service Record-conditioned hiring pools or allocation queues; mandatory audit of prior-period decisions |\n| **AJ-2.2** Flow-funded civic standing accumulation | 1.5\u00d7 | \u2014 | 7.5\u00d7 gain; Service Record accrued under the pattern is voided for affected accounts; employer barred 365 days from Service Record-attestation sponsorship | 7.5\u00d7 gain; all attributable Service Record accruals voided; 365-day exclusion; mandatory restitution of civic-sponsorship Flow flows |\n| **AJ-2.3** Civic position as economic leverage | 2.0\u00d7 | 10\u00d7 gain; **civic position vacated; 5-year Service Record-eligibility suspension; criminal referral** | 10\u00d7 gain against contracted entity; 365-day procurement exclusion; contract voidance | 10\u00d7 gain; 5-year exclusion from civic-procurement relationships |\n| **AJ-3.1** Shared Storehouse allocation as premium service | 1.5\u00d7 | 7.5\u00d7 gain; Service Record \u22120.3 | 7.5\u00d7 gain; operator license suspended for duration of Shared Storehouse period and 180 days post-restoration; 2nd offense = operator license revoked | 7.5\u00d7 gain; 365-day exclusion from Shared Storehouse-rationed supply chain; mandatory restitution to underserved recipients |\n| **AJ-3.2** Flow exit from Shared Storehouse scope (during active Shared Storehouse) | 1.8\u00d7 | 9\u00d7 gain; excess quantity returned to Shared Storehouse pool or forfeit | 9\u00d7 gain; import/supply license suspended for Shared Storehouse duration; operator subject to per-unit excise recouping the Shared Storehouse-pool draw | 9\u00d7 gain; mandatory contribution to Shared Storehouse buffer equal to 2\u00d7 goods acquired |\n| **AJ-3.3** Anticipatory hoarding via Flow | 1.5\u00d7 pre-activation; 2.0\u00d7 post-activation timing | 7.5\u00d7\u201310\u00d7 gain; excess inventory forfeit to Shared Storehouse pool at activation | 7.5\u00d7\u201310\u00d7 gain; license suspension; mandatory release of hoarded inventory at Shared Storehouse-activation basket prices | 7.5\u00d7\u201310\u00d7 gain; 365-day exclusion; mandatory audit of trading activity during the 90 days preceding activation |\n\n**Notes on the matrix:**\n- Severity factor is applied to the FC-040 base multiplier (5\u00d7), so AJ-1.1 = 5.0\u00d7 gain, AJ-1.2 = 6.0\u00d7 gain, AJ-2.3 = 10.0\u00d7 gain, etc.\n- \"Service Record \u22120.X for cycle\" is a deduction from the violator's civic record balance proportional to severity; Service Record deduction is independent of the gain-multiplier and is not netted against it.\n- Vendor/operator license actions are administered by the licensing authority named in the Article VII enforcement architecture; suspension and revocation are appealable only through the Ombuds process per Annex AI.\n- \"Criminal referral\" indicates a finding that meets the threshold for separate prosecution under the convertibility-violation statute (out of scope of this annex); the civil/administrative penalty in this matrix applies regardless of prosecution outcome.\n\n### 4.3 \u2014 Escalation Ladder for Repeat and Systemic Violations\n\n**Repeat offense:** a second adjudicated violation of any AJ pattern by the same actor within 24 months triggers automatic escalation to the next severity band, plus:\n- Individuals: Service Record deduction doubles; civic-position eligibility suspended for 2 cycles.\n- Operators: license revocation in essential category; 5-year prohibition from operating in Essential Access or Shared Storehouse supply chains.\n- Institutions: public Enforcement Ledger notice with named leadership; mandatory independent governance audit at institution's cost.\n\n**Systemic violation:** when enforcement data shows AJ-pattern incidence across a vendor class, sector, or region exceeds **FC-010 systemic-review trigger of 7% / annum of Essential Access allocations in the affected scope**, the Ombuds triggers a **sector-level systemic review** under Annex AI. Individual enforcement continues in parallel. The systemic review assesses whether the architecture itself requires hardening (new detection signal, new prohibited pattern) or whether the breach is an enforcement-capacity failure.\n\nThe **routine leakage ceiling of 3% / annum (FC-010)** is the operational target. Between 3% and 7%, the Ombuds prioritises detection investment and enforcement acceleration but does not trigger systemic review. Below 3%, the regime is considered in normal operating state.\n\n### 4.4 \u2014 Enforcement Body and Process\n\nPenalty adjudication is administered by the **Enforcement Panel** (a sub-body of the authority named in the Article VII enforcement architecture). Process:\n\n1. **Finding.** Detection signal triggers investigation; investigation produces a factual finding with documented evidence.\n2. **Gain quantification.** The enforcement body quantifies the functional gain per \u00a74.1. Quantification methodology is documented and subject to the P-017 oracle-independence standards (Annex AL) where gain estimation requires measurement of market prices or cohort comparisons.\n3. **Notice and response.** The accused actor receives notice with the factual finding, the gain quantification, and the scheduled penalty. Actor has 30 days to contest findings or accept.\n4. **Adjudication.** Contested cases proceed to the Enforcement Panel. Panel composition: 3 seats drawn from the Article VII enforcement staff, 2 seats drawn from the Ombuds roster per Annex AI, 1 seat drawn from the affected-party advocacy roster. No Enforcement Panel member may have a prior relationship with the accused actor within 3 years.\n5. **Appeal.** Adjudicated penalties are appealable once, on the appeal spine ([ANNEX_L \u00a7L7](./ANNEX_L.md)) via the federated Ombuds process per Annex AI \u00a74.8 (Enforcement Panel Appeals) \u2014 the Plenum, not the CRP ladder, is the final instance (ANNEX_L \u00a7L7.3). Appeal pauses license actions but not gain-recoupment: recoupment proceeds during appeal **into escrow**, refunded with accrued return if the appeal succeeds (ANNEX_L \u00a7L7.2) \u2014 so appeal never becomes a window to dissipate gains, and a successful appellant is made whole.\n6. **Publication.** Final findings are published on the Enforcement Ledger (Article VII) in aggregate form, with individual findings published only where necessary for statutory notice or where the actor has consented. PII is stripped per Annex AM.\n\n### 4.5 \u2014 Deterrence Audit\n\nThe Enforcement Panel publishes an **Annual Deterrence Audit** (parallel to the Ombuds annual audit, Annex AI \u00a7AI-8) with:\n- Estimated total functional gain attempted across each AJ pattern (from detection plus estimation of undetected).\n- Actual penalties assessed and collected.\n- Realised penalty-to-gain ratio by pattern.\n- Realised detection probability by pattern.\n- Whether the FC-040 (5.0\u00d7) and FC-041 (0.85) assumptions are holding; if detection probability slips below the level at which the 5.0\u00d7 multiplier yields negative EV, the Panel issues a formal recalibration recommendation to the Founding Coalition for consideration under the Tier 2 amendment ladder.\n\nThe Annual Deterrence Audit is the feedback loop that keeps the penalty schedule calibrated. If either the multiplier or the detection assumption drifts, the deterrence identity in \u00a74.1 tells the Coalition exactly how much headroom remains before the regime becomes EV-positive for violators.\n\n---\n\n## Governance of This Annex\n\nThis annex is a **P-004 protected specification**. The worked examples above cannot be removed, narrowed, or recharacterised through ordinary operational updates. Changes to these examples require the same process as changes to core protected terms: semantic effect test, upward classification default, and public definition registry update.\n\nThe numerical values of FC-040 (5.0\u00d7 multiplier) and FC-041 (0.85 detection probability assumption) are **Tier 2 commitments in `/founding/commitments.md`**. Changes require the Tier 2 amendment ladder with public redlines. FC-010 leakage thresholds (3% / 7%) are likewise Tier 2.\n\nNew worked examples may be added through the standard P-004 amendment process as new above-ledger bypass patterns are identified in operation. The annex should be reviewed annually and updated with patterns identified through enforcement activity. Penalty schedule matrix updates for new patterns must maintain deterrence identity (\u00a74.1) and are subject to Tier 2 amendment authority.\n\n**Detection infrastructure requirement:** Article VII monitoring must extend to the social-layer detection signals identified in each worked example above. These signals are not ledger-based; they require vendor-level data collection, population-level outcome analysis, and complaint-pattern monitoring. The specific detection thresholds are maintained in the Restricted Register Annex per P-021 (Annex AO).\n\n**Public scope of monitoring:** What is monitored is public even where specific numeric thresholds are restricted. The categories and scope of social-layer monitoring \u2014 which outcomes are observed, which correlations are tested, which vendor-level and population-level signals are collected, and for which boundary patterns \u2014 are published in plain language so that operators, vendors, and participants retain the clear notice of what is prohibited that this annex requires (Purpose, item 2). Only the calibrated numeric trigger values may be withheld in the Restricted Register per P-021 (Annex AO), and only to prevent gaming of the exact thresholds. Each restricted item carries a published, specific justification for why that value \u2014 and no broader category of information \u2014 is held restricted. The Restricted Register may narrow the precision of notice; it may not erode the notice itself. Any monitoring scope not published in this register is not authorised.\n\n**Data purpose-limitation:** The vendor-level and population-level data collected to detect above-ledger bypass is purpose-limited to bypass-detection and the enforcement process in Section 4, and to nothing else. This data is PII-stripped at the earliest point consistent with detection (per Annex AM), is retained only for the bounded period necessary to establish patterns and adjudicate findings and is then deleted, is access-limited to the Enforcement Panel and detection staff acting under that mandate, and is never repurposed for general population surveillance, civic scoring, eligibility determination, commercial use, or any objective outside bypass-detection. The remedy against wealth purchasing the survival floor must not itself become a general-purpose surveillance asset; a monitoring programme that exceeds these limits is itself a Babel-risk failure of this annex and is subject to Ombuds review under Annex AI. These constraints are P-004 protected and may not be relaxed through ordinary operational updates.\n\n---\n\n*This document is Annex AJ of the Humane Constitution. Operative as an ACTIVE specification as of Proposal 7 close-out. Penalty schedule (\u00a74) and Founding Commitments FC-010, FC-040, FC-041 are binding on the Enforcement Panel through the Article VII enforcement architecture.*\n",
       "headings": [
         {
           "level": 1,
@@ -9392,7 +9397,7 @@
           "slug": "governance-of-this-annex"
         }
       ],
-      "wordCount": 5092,
+      "wordCount": 5144,
       "headingCount": 22
     },
     {
@@ -10285,7 +10290,7 @@
       "status": "Status: ACTIVE \u2014 founding commitments bound (FC-080, FC-081, FC-082) \u2014 Proposal 9 close-out, 2026-04-18",
       "statusBucket": "active",
       "summary": "Attestation is the infrastructure by which individuals without institutional standing can still produce legible evidence of contribution, hardship, identity, or need. Without attestation, the protocol excludes the undocumented, the informally-employed, and the isolated \u2014 the people the protocol most needs to reach. With attestation, the protocol exposes itself to a specific failure mode: costless false attestation.",
-      "content": "# ANNEX AS \u2014 Attestation-at-Risk Stake Mechanism\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Add skin-in-the-game to attestation: attestors place a portion of their own civic balance at risk when they vouch for others, so the cost of a false attestation is paid before detection rather than only after. |\n> | **Who it protects** | People whose access to Service Record credits, Protected Pauses, and civic roles depends on honest attestation from their networks; also the system's integrity against coordinated attestation rings. |\n> | **Failure risk** | Costless false attestation: without stake, attestors have no reason to refuse a favor or reciprocal arrangement before they are caught \u2014 and social reputation penalties are slow, socially mediated, and absorbable by dense networks. |\n> | **Evidence status** | Active \u2014 unproven |\n> | **Linked risks** | T-009; TR-07 (Contribution fraud / attestation rings); T-018 (PCRP False-Trigger Exhaustion); P-024; Annex AF (grace exploitation); Annex AI (Federated Ombuds); FC-080, FC-081, FC-082 |\n\n> **Provenance:** Implements [P-024 \u2014 Attestation-at-Risk Stake Mechanism] \u00b7 Addresses T-009, TR-07, and T-018 \u00b7 Status: **ACTIVE**\n\n**Status: ACTIVE \u2014 founding commitments bound (FC-080, FC-081, FC-082) \u2014 Proposal 9 close-out, 2026-04-18**\n**Governs:** contribution attestation, hardship attestation, civic identity attestation, and any Service Record or Voice allocation that depends on third-party verification.\n**Related:** Article VI civic-layer rules for Service Record; Annex AF (P-009 Grace Exploitation patches, hardship attestation); Humane Constitution Article VI multi-attestation and random-audit clauses; Threat Register T-018 (PCRP False-Trigger Exhaustion), TR-07 (Contribution fraud / attestation rings).\n\n---\n\n## Purpose\n\nAttestation is the infrastructure by which individuals without institutional standing can still produce legible evidence of contribution, hardship, identity, or need. Without attestation, the protocol excludes the undocumented, the informally-employed, and the isolated \u2014 the people the protocol most needs to reach. With attestation, the protocol exposes itself to a specific failure mode: **costless false attestation**.\n\nThe existing constitutional mitigations (multi-attestation, random audits, verifier reputation scoring, collusion-graph analytics) are necessary but not sufficient. They raise the probability of detection after a false attestation is made. They do not change the calculation *before* the attestation is made. An attestor with no stake in the outcome has no reason to refuse a favor, a reciprocal arrangement, or a sympathetic lie \u2014 until after they are caught, at which point reputational loss is a lagging, socially-mediated signal that can be absorbed by thick networks.\n\nThis annex adds **skin-in-the-game**. An attestor's Service Record (or Voice, for civic attestations) is placed at measurable risk when they attest, proportional to the claim size. False attestations \u2014 adjudicated through the Ombuds process or the Enforcement Panel \u2014 slash the stake. Slashed stake is redistributed to whistleblowers and to restitution for those harmed by the false claim. Honest attestations are returned with time; skilled attestors accrue reputation along with their returned stake.\n\nThe mechanism is calibrated via three Founding Commitments (FC-080, FC-081, FC-082) binding in `/founding/commitments.md`.\n\n---\n\n## Section 1 \u2014 Scope: What Counts as an Attestation\n\n**Attestation (protected term):** a statement by an identified civic participant (the *attestor*) about another participant (the *subject*) that is entered into the Service Record to support a claim the subject is making.\n\nCovered attestation classes:\n\n| Class | Subject claim | Typical attestor | Example |\n| :--- | :--- | :--- | :--- |\n| **Contribution attestation** | Stewardship or civic work that should accrue Service Record | Co-participant, recipient-of-service, or supervising civic body | \"I confirm Subject X staffed the distribution site on dates Y\u2013Z as the schedule records show.\" |\n| **Hardship attestation** | Qualification for Protected Pause or reduced-contribution accommodation | Household member, community worker, or healthcare provider | \"I confirm Subject X is caring full-time for a dependent who requires continuous supervision.\" |\n| **Identity attestation** | Identity assurance where institutional documentation is not available (P-003 / P-016) | Long-standing community member or trusted institution | \"I have known Subject X in community for \u22655 years and affirm their stated identity.\" |\n| **Civic-qualification attestation** | Eligibility for CRP seat, Ombuds role, audit panel, or other civic position requiring independent witness | Current or prior civic officeholders outside the nominee's direct network | \"I affirm Subject X has no disqualifying conflict for the [body] seat.\" |\n\n**Not covered** (out of scope of this annex): ordinary social statements not entered into the Service Record; character references for non-protocol purposes; statements by the subject about themselves (self-attestation is governed separately under Annex K multi-path verification rules).\n\n---\n\n## Section 2 \u2014 Stake Mechanism (FC-080 Attestation Stake Ratio)\n\n### 2.1 \u2014 Stake Placed at Attestation Time\n\nWhen an attestor submits an attestation covered by this annex, a stake is **placed** (locked, not spent) from the attestor's own civic balance:\n\n> **Stake placed = FC-080 \u00d7 Claim-size-scaled base**\n>\n> **FC-080 `ATTESTATION_STAKE_RATIO` = 0.20** (20% of attestor's own Voice or Service Record at the time of attestation, scaled to claim size)\n\nThe **claim-size-scaled base** is the fraction of the attestor's own Voice and Service Record proportional to the magnitude of the subject's claim:\n\n- **Small claim** (e.g., individual Service Record accrual \u2264 50 units, routine contribution verification): stake = 20% of attestor's Service Record \u00d7 0.1 = 2% of attestor's Service Record placed\n- **Mid claim** (e.g., Service Record accrual 50\u2013200 units, Protected Pause eligibility, identity assurance Tier 2): stake = 20% of attestor's Service Record \u00d7 0.3 = 6% of attestor's Service Record placed\n- **High claim** (e.g., Service Record accrual >200 units, civic-position qualification, high-impact Voice allocation, identity assurance Tier 3): stake = 20% of attestor's Service Record \u00d7 1.0 = 20% of attestor's Service Record placed\n\nRationale: the stake ratio FC-080 = 0.20 ensures meaningful skin-in-the-game (not trivial) without destroying attestor livelihoods on single errors (not ruinous). A 20% loss on a high claim is a genuine cost; a 2% loss on a small claim is a measurable signal without being disproportionate to the stakes of the routine verification.\n\nThe stake is placed against the attestor's existing balance at the time of attestation. Where an attestor's balance is sufficient, the stake is placed in the ordinary way, ensuring those with civic standing put real standing at risk. Where an attestor's balance is insufficient for the scheduled stake, the attestor is **not** thereby barred from attesting: they are routed instead to the guaranteed no-stake or reduced-stake path of \u00a72.6, so that lacking balance never silences a true witness.\n\n### 2.1a \u2014 Cost Relative to Means\n\nThe stake base and the slashing impact in \u00a72.4 must be calibrated **relative to the attestor's means**, not by absolute volume alone. The proportional figures in \u00a72.1 set the maximum; for low-balance attestors the realized stake and any slash are scaled down so that an honest attestation never costs the poor a larger fraction of their subsistence balance than it costs the rich. The cost of telling the truth is measured by what it takes from the giver, not by its absolute size: a stake or slash that would consume a low-balance attestor's subsistence floor is itself a respecter-of-persons failure and is prohibited. The Service Record ledger preserves each attestor's protected subsistence balance against placement or slashing, and \u00a77 reports slash impact as a fraction of remaining subsistence so that this calibration can be audited.\n\n### 2.2 \u2014 Stake Release (Honest Attestations)\n\nStake is **released** back to the attestor's available balance after the audit window expires (\u00a72.3) without a false-claim finding.\n\nReleased stake returns:\n- The original placed amount.\n- A **small reputation credit** recorded in the attestor's Service Record: +0.01 \u00d7 FC-080 \u00d7 claim-scaled-base per successful attestation, bounded at a lifetime cap so reputation accrual does not itself become a status-currency drift surface (see \u00a75.2).\n\nReputation credit is public (anonymised ledger) and visible to future subjects considering whom to ask for attestation \u2014 so consistently-accurate attestors become valued civic resources.\n\n### 2.3 \u2014 Audit Window (FC-081)\n\nSlashing is possible for **FC-081 `ATTESTATION_AUDIT_WINDOW` = 365 days** after the attestation is submitted (1-year civic cycle).\n\nThe 365-day window matches the civic-cycle duration. This is long enough for:\n- Contribution attestations to be verified against activity records, cross-attestation, and random audits.\n- Hardship attestations to be verified against subsequent behavior (e.g., does the subject's stated condition continue to manifest in ways consistent with the attestation?).\n- Identity attestations to surface through downstream usage (does the subject's activity consistent with their attested identity?).\n\nAnd short enough that:\n- Attestors get their stake back on a predictable schedule and can plan their participation.\n- The system does not accrue indefinite liabilities against attestor balances.\n\nAfter 365 days, the attestation is **final**. It cannot be retroactively slashed, though patterns of later-discovered falsehood may trigger investigation of newer attestations by the same attestor or of the subject's other claims.\n\n### 2.4 \u2014 Slashing (False-Claim Finding)\n\nA false-claim finding by the Ombuds (Annex AI) or the Enforcement Panel (Annex AJ \u00a74) during the audit window triggers **slashing** of the placed stake:\n\n| Finding | Slash amount |\n| :--- | :--- |\n| False attestation, inadvertent (attestor believed claim true; was deceived by subject) | 25% of placed stake slashed; remaining 75% released |\n| False attestation, negligent (attestor should have verified; did not) | 50% of placed stake slashed; remaining 50% released |\n| False attestation, knowing (attestor knew claim was false or recklessly indifferent) | 100% of placed stake slashed; attestor referred to Enforcement Panel under Annex AJ \u00a74.2 at AJ-2.2 severity (1.5\u00d7) for the functional gain created by the false attestation |\n| Attestation ring or coordinated false attestation | 100% of placed stake slashed for all ring members; Annex AJ \u00a74.2 AJ-2.2 + AJ-2.3 escalation; 2-year attestation disqualification; Service Record deduction per matrix |\n\n**Slashed stake distribution** (\u00a73).\n\n### 2.5 \u2014 Pre-commit Transparency\n\nAttestors see the scheduled stake amount before submitting an attestation. The interface presents:\n- The claim the subject is making, in the subject's own framing.\n- The claim-size scaling that determines the stake base.\n- The attestor's current balance and the stake amount that would be placed.\n- The 365-day audit window and the slashing schedule in \u00a72.4.\n- The option to decline \u2014 declining to attest is a legitimate and costless choice; no civic penalty attaches to non-participation.\n\nDeclining to attest is *never* slashable. Only submitted false attestations are slashable. The purpose of the mechanism is not to punish non-participation but to require that participation reflect the attestor's actual knowledge of the subject.\n\n### 2.6 \u2014 Anti-Exclusion Floor (Operative)\n\nNo subject may be rendered un-vouchable, and no person may be rendered unable to attest, solely because they or their network lack sufficient civic balance to place a stake. This floor is **operative within this annex**: it binds at the point of attestation and is not deferred to downstream implementation.\n\nTo guarantee the floor, a stake-independent attestation path is always available:\n\n- **No-stake / reduced-stake community-verified path.** A low-balance or zero-balance attestor may attest through a community-verified route that requires no stake (or a reduced stake calibrated under \u00a72.1a), with the integrity assurance carried by augmented cross-attestation and random audit rather than by balance at risk.\n- **Tier 0 safe-harbor route.** Subjects with few or no balance-holding attestors in their network (new arrivals, the isolated, the recently displaced) qualify for the Tier 0 safe-harbor path, in which standing is established through documented community verification and elevated audit instead of staked attestation.\n- **Public attestor of last resort.** Where no eligible attestor is otherwise available, a designated public attestor (an institutional or civic body staking institutional rather than personal balance) ensures that a real person is never stranded without a path to recognition.\n\nThese paths carry the same legibility as staked attestation; they are not a lesser class of recognition. Exclusion of a subject because no one with sufficient balance knows them, or silencing of a true witness because they are civically poor, is an unacceptable failure mode that this section forecloses. The Article VI and Annex K multi-path verification clauses elaborate the operational detail of these routes, but the guarantee itself is binding here.\n\n### 2.7 \u2014 Restoration and Re-entry After a Non-Knowing Finding\n\nA slashing finding is a correction, not a permanent brand. An attestor found to have made an **inadvertent** or **negligent** false attestation (the non-knowing categories of \u00a72.4) has a documented path back to full attestation standing. After such a finding, and after a defined period of honest conduct \u2014 set by analogy to the Annex AF grace mechanisms and no longer than one civic cycle of accurate, unslashed attestation \u2014 the attestor's standing is restored: reputation accrual resumes under \u00a72.2 and any temporary limitation on their attestation rights lapses.\n\nThe 2-year ring disqualification of \u00a72.4 applies only to knowing or coordinated-ring findings and is not affected by this restoration path. For non-knowing findings, restoration is the rule: the mechanism seeks the return of the honest witness, not their permanent exclusion. Restoration is recorded in the attestor's ledger so that correction, completion, and re-entry are visible rather than the fault alone.\n\n---\n\n## Section 3 \u2014 Slashed Stake Distribution\n\nSlashed stake does not simply disappear \u2014 that would be deflationary and would eliminate the opportunity to compensate those harmed by the false attestation. Distribution:\n\n| Recipient | Share | Conditions |\n| :--- | :--- | :--- |\n| **Whistleblower** (the party who raised the complaint leading to finding) | **40%** | Direct transfer to whistleblower's Service Record balance. If complaint was anonymous, share is held in a whistleblower-reserve account and released on claim with identity verification. If complaint was automated (e.g., collusion-graph detection), share routes to the Article VII enforcement maintenance fund. |\n| **Subject harmed by false attestation** (when a false attestation harmed someone other than the subject of the attestation \u2014 e.g., someone excluded from a position the false claim helped secure) | **30%** | Restitution; paid into harmed party's Service Record. If no third-party harm is identified, share reallocates to the Article VII enforcement maintenance fund. |\n| **Article VII enforcement maintenance fund** | **20%** | Funds detection infrastructure (AF3 collusion-graph analytics, cross-attestation audit sampling, whistleblower protection infrastructure per P-021). |\n| **Service Record overall** (deflationary \u2014 permanently retired) | **10%** | A small deflationary share ensures the system does not reward detection without any cost to the civic-record aggregate. |\n\nThe distribution is executed automatically on finality of the finding (post-appeal, or appeal deadline lapsed).\n\n---\n\n## Section 4 \u2014 Attestation Graph Density (FC-082)\n\nIndividual-level stake mechanisms handle individual false attestations. They do not, by themselves, defeat coordinated attestation rings where every member is \"honest\" about the others within the ring but the ring as a whole is closed to outside verification.\n\n**FC-082 `ATTESTATION_GRAPH_DENSITY_THRESHOLD` = 0.40** (mutual cross-attestation ratio)\n\nThe Service Record system computes, for each attestor cohort of \u226510 participants, the **mutual cross-attestation ratio**: the fraction of pairs (A, B) in the cohort for which A has attested for B *and* B has attested for A within any overlapping 2-year window, divided by the total possible such pairs.\n\n**Null-model baseline.** A random graph with the same number of attestations distributed uniformly across eligible attestors would produce a mutual cross-attestation ratio of approximately k/n (where k is per-person attestations and n is cohort size). For realistic cohort sizes and activity rates, this baseline is typically under 0.05. A threshold of **0.40** is a large multiple of the null-model expectation \u2014 meaning attestor networks exceeding 0.40 are structurally distinct from independent attestors making unrelated judgments, and the deviation is statistically hard to explain without coordination.\n\n**Trigger consequence.** Cohorts above 0.40 enter **automatic review**:\n- All attestations within the cohort are flagged for manual audit.\n- New attestations from cohort members are accepted but held in audit queue pending cohort-level review.\n- The Ombuds (Annex AI) initiates a cohort-level investigation: is this a legitimate close-knit community (e.g., a small indigenous community where everyone knows everyone \u2014 legitimately high density), or is it a coordinated ring?\n- Cohort-level finding proceeds through the standard Ombuds + Enforcement Panel process. Legitimate close-knit communities are certified (with documentation) and exempted from the threshold; coordinated rings are slashed at the AJ-1.3 or AJ-2.2 severity.\n\n**Community safe harbor** (parallels Annex AF \u00a7hardship community-disaster safe harbor): attestor cohorts that are geographically co-located in an area with declared emergency status, or that meet documented small-community demographic criteria, are exempt from the 0.40 trigger automatically \u2014 the ratio is still computed and reported, but the trigger is gated on the Ombuds cohort-certification finding, not on the ratio alone.\n\n---\n\n## Section 5 \u2014 Interaction with Existing Mechanisms\n\n### 5.1 \u2014 Relationship to Article VI Multi-Attestation\n\nArticle VI already requires **multi-attestation** (multiple independent attestors) for mid- and high-impact claims. This annex does not replace multi-attestation; it **stakes** each of the multiple attestors.\n\nEffect: on a high claim requiring 3 attestations at 20% stake base each, the aggregate stake at risk across attestors is 60% of one attestor's balance (distributed across three people), or 20% \u00d7 3 = 60% aggregate equivalent. For the subject to obtain a false attestation set, they must find three attestors each willing to stake their own civic standing on a claim none of them can verify. This is qualitatively different from finding three people willing to sign a piece of paper at no cost.\n\n### 5.2 \u2014 Relationship to P-009 Grace Exploitation Patches\n\nAnnex AF \u00a7AF3 establishes collusion-graph analytics for hardship attestation networks with mutual-pair, star-cluster, and temporal-clustering triggers. This annex's FC-082 density threshold (\u00a74) **generalizes** AF3 to all attestation classes, not just hardship. The AF3-specific triggers remain the primary detection instrument for the hardship attestation domain; FC-082 is the broader network-structure threshold that applies across all attestation classes including contribution, identity, and civic-qualification.\n\n### 5.3 \u2014 Relationship to TR-07 Contribution Fraud\n\nThreat Register TR-07 addresses contribution fraud via multi-attestation + random audits + anomaly detection + reputation decay + sanctions. This annex adds the **pre-commitment stake** layer: sanctions become mechanical (automatic slashing on finding) rather than contingent on separate disciplinary action, and the economic cost of ring participation is calibrated to FC-080 regardless of whether social reputation penalties materialize.\n\n### 5.4 \u2014 Reputation Cap\n\nReputation credit accrued via honest attestation (\u00a72.2) is capped at a lifetime ceiling equivalent to **FC-083 = 2 civic cycles** of successful attestation reputation credit. This prevents the accumulation of reputation from becoming itself a status-currency surface for AJ-2.1 patterns (civic standing as allocation preference).\n\n---\n\n## Section 6 \u2014 Implementation Notes for Founding Coalition\n\n1. **Technical infrastructure.** The stake mechanism requires Service Record ledger support for:\n   - Atomic place/release/slash operations on attestor balances.\n   - Audit-window tracking (365-day cursor) per attestation.\n   - Attestation-graph density computation (FC-082) with the null-model baseline as a verifiable benchmark, recomputed monthly.\n   - Automatic distribution of slashed stakes per \u00a73.\n\n2. **Attestation UI.** The attestation submission interface must present the stake amount, the audit window, and the slashing schedule to the attestor *before* they submit. Attestors submitting without seeing this information (e.g., via automated tooling) constitute a failure of informed consent and invalidate the attestation.\n\n3. **Whistleblower infrastructure.** \u00a73 requires whistleblower complaints to be attributable to a party (for direct share) or routable to a reserve (for anonymous). The whistleblower-reserve account requires the same protections as identity recovery \u2014 secure, surveillance-resistant, with recovery through the Ombuds process if the whistleblower subsequently identifies themselves.\n\n4. **Pilot phase calibration.** Before full scale, the founding coalition runs a pilot cohort (\u22651,000 attestors, \u22656 months) to verify:\n   - FC-080 stake ratio produces measurable behavioral change (attestation rates, decline rates, detected falsehood rates compared to no-stake baseline).\n   - FC-082 density threshold does not over-flag legitimate small communities (false positive rate on community safe harbor).\n   - FC-081 audit window length is sufficient for realistic detection latencies across attestation classes.\n   Pilot findings are documented; any recommended recalibration proceeds through the Tier 2 amendment ladder.\n\n5. **Exclusion safety.** The anti-exclusion floor of \u00a72.6 is operative and binding: no attestor is barred and no subject is rendered un-vouchable for lack of balance. Where an attestor's balance is sufficient, the staked path applies; where it is not, the no-stake / reduced-stake community-verified path, the Tier 0 safe-harbor route, and the public-attestor-of-last-resort guarantee a real path to recognition. Implementation of these routes \u2014 institutional attestors who stake professional rather than personal balance, rotating-jury lightweight attestations for small claims, community-verified or self-declaration paths with augmented random audit \u2014 is detailed in the Article VI and Annex K multi-path verification clauses, but the guarantee that lacking balance never silences a true witness or strands a real person is fixed in \u00a72.6 and does not await that detail.\n\n---\n\n## Section 7 \u2014 Governance\n\n**This annex is governed as P-004 protected specification.** Core mechanisms (the place/slash/release architecture; the 365-day audit window structure; the graduated-culpability slashing schedule in \u00a72.4) cannot be modified without Tier 2 amendment with public redlines.\n\n**Founding Commitments bound:**\n- FC-080 `ATTESTATION_STAKE_RATIO` = 0.20 (Tier 2)\n- FC-081 `ATTESTATION_AUDIT_WINDOW` = 365 days (Tier 2)\n- FC-082 `ATTESTATION_GRAPH_DENSITY_THRESHOLD` = 0.40 (Tier 2)\n- FC-083 `ATTESTATION_REPUTATION_CREDIT_CAP` = 2 civic cycles (Tier 2)\n\nNumerical changes to these commitments proceed through the Tier 2 amendment ladder in `/founding/commitments.md`.\n\n**Annual audit.** The Enforcement Panel and the Ombuds produce a joint Annual Attestation Audit (parallel to the Annex AJ \u00a74.5 Annual Deterrence Audit) reporting:\n- Total attestations placed; total stake volume; aggregate balance at risk at year-end.\n- Slashing events by finding category; realized slash rate.\n- **Slash impact as a fraction of each attestor's remaining subsistence balance**, not only as absolute volume \u2014 reported across the attestor-wealth distribution so that the proportional cost borne by low-balance attestors is visible.\n- **Equity early-warning.** Any poverty-correlated trend \u2014 exclusion, decline, or slash impact falling disproportionately on low-balance attestors or on subjects whose networks are poor \u2014 is flagged as an early-warning that the mechanism is becoming a respecter of persons, and triggers review of the \u00a72.1a calibration and the \u00a72.6 floor.\n- Cohort-level density findings (cohorts above 0.40, certified vs. slashed).\n- Attestor exclusion rate (subjects who could not obtain staked attestation through insufficient balance of their network, and the rate at which they were routed to and recognized through the \u00a72.6 alternative paths); trend line over time.\n- Restoration and re-entry events under \u00a72.7 (non-knowing findings restored to standing); trend line over time.\n- Recommendations for calibration of FC-080, FC-081, or FC-082 if empirical behavior deviates from design assumptions.\n\n---\n\n*This document is Annex AS of the Humane Constitution. Operative as an ACTIVE specification as of Proposal 9 close-out (2026-04-18). Integration with Article VI and Annex AF proceeds through the ordinary implementation sequence.*\n",
+      "content": "# ANNEX AS \u2014 Attestation-at-Risk Stake Mechanism\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Add skin-in-the-game to attestation: attestors place a portion of their own civic balance at risk when they vouch for others, so the cost of a false attestation is paid before detection rather than only after. |\n> | **Who it protects** | People whose access to Service Record credits, Protected Pauses, and civic roles depends on honest attestation from their networks; also the system's integrity against coordinated attestation rings. |\n> | **Failure risk** | Costless false attestation: without stake, attestors have no reason to refuse a favor or reciprocal arrangement before they are caught \u2014 and social reputation penalties are slow, socially mediated, and absorbable by dense networks. |\n> | **Evidence status** | Active \u2014 unproven |\n> | **Linked risks** | T-009; TR-07 (Contribution fraud / attestation rings); T-018 (PCRP False-Trigger Exhaustion); P-024; Annex AF (grace exploitation); Annex AI (Federated Ombuds); FC-080, FC-081, FC-082 |\n\n> **Provenance:** Implements [P-024 \u2014 Attestation-at-Risk Stake Mechanism] \u00b7 Addresses T-009, TR-07, and T-018 \u00b7 Status: **ACTIVE**\n\n**Status: ACTIVE \u2014 founding commitments bound (FC-080, FC-081, FC-082) \u2014 Proposal 9 close-out, 2026-04-18**\n**Governs:** contribution attestation, hardship attestation, civic identity attestation, and any Service Record or Voice allocation that depends on third-party verification.\n**Related:** Article VI civic-layer rules for Service Record; Annex AF (P-009 Grace Exploitation patches, hardship attestation); Humane Constitution Article VI multi-attestation and random-audit clauses; Threat Register T-018 (PCRP False-Trigger Exhaustion), TR-07 (Contribution fraud / attestation rings).\n\n---\n\n## Purpose\n\nAttestation is the infrastructure by which individuals without institutional standing can still produce legible evidence of contribution, hardship, identity, or need. Without attestation, the protocol excludes the undocumented, the informally-employed, and the isolated \u2014 the people the protocol most needs to reach. With attestation, the protocol exposes itself to a specific failure mode: **costless false attestation**.\n\nThe existing constitutional mitigations (multi-attestation, random audits, verifier reputation scoring, collusion-graph analytics) are necessary but not sufficient. They raise the probability of detection after a false attestation is made. They do not change the calculation *before* the attestation is made. An attestor with no stake in the outcome has no reason to refuse a favor, a reciprocal arrangement, or a sympathetic lie \u2014 until after they are caught, at which point reputational loss is a lagging, socially-mediated signal that can be absorbed by thick networks.\n\nThis annex adds **skin-in-the-game**. An attestor's Service Record (or Voice, for civic attestations) is placed at measurable risk when they attest, proportional to the claim size. False attestations \u2014 adjudicated through the Ombuds process or the Enforcement Panel \u2014 slash the stake. Slashed stake is redistributed to whistleblowers and to restitution for those harmed by the false claim. Honest attestations are returned with time; skilled attestors accrue reputation along with their returned stake.\n\nThe mechanism is calibrated via three Founding Commitments (FC-080, FC-081, FC-082) binding in `/founding/commitments.md`.\n\n---\n\n## Section 1 \u2014 Scope: What Counts as an Attestation\n\n**Attestation (protected term):** a statement by an identified civic participant (the *attestor*) about another participant (the *subject*) that is entered into the Service Record to support a claim the subject is making.\n\nCovered attestation classes:\n\n| Class | Subject claim | Typical attestor | Example |\n| :--- | :--- | :--- | :--- |\n| **Contribution attestation** | Stewardship or civic work that should accrue Service Record | Co-participant, recipient-of-service, or supervising civic body | \"I confirm Subject X staffed the distribution site on dates Y\u2013Z as the schedule records show.\" |\n| **Hardship attestation** | Qualification for Protected Pause or reduced-contribution accommodation | Household member, community worker, or healthcare provider | \"I confirm Subject X is caring full-time for a dependent who requires continuous supervision.\" |\n| **Identity attestation** | Identity assurance where institutional documentation is not available (P-003 / P-016) | Long-standing community member or trusted institution | \"I have known Subject X in community for \u22655 years and affirm their stated identity.\" |\n| **Civic-qualification attestation** | Eligibility for CRP seat, Ombuds role, audit panel, or other civic position requiring independent witness | Current or prior civic officeholders outside the nominee's direct network | \"I affirm Subject X has no disqualifying conflict for the [body] seat.\" |\n\n**Not covered** (out of scope of this annex): ordinary social statements not entered into the Service Record; character references for non-protocol purposes; statements by the subject about themselves (self-attestation is governed separately under Annex K multi-path verification rules).\n\n---\n\n## Section 2 \u2014 Stake Mechanism (FC-080 Attestation Stake Ratio)\n\n### 2.1 \u2014 Stake Placed at Attestation Time\n\nWhen an attestor submits an attestation covered by this annex, a stake is **placed** (locked, not spent) from the attestor's own civic balance:\n\n> **Stake placed = FC-080 \u00d7 Claim-size-scaled base**\n>\n> **FC-080 `ATTESTATION_STAKE_RATIO` = 0.20** (20% of attestor's own Voice or Service Record at the time of attestation, scaled to claim size)\n\nThe **claim-size-scaled base** is the fraction of the attestor's own Voice and Service Record proportional to the magnitude of the subject's claim:\n\n- **Small claim** (e.g., individual Service Record accrual \u2264 50 units, routine contribution verification): stake = 20% of attestor's Service Record \u00d7 0.1 = 2% of attestor's Service Record placed\n- **Mid claim** (e.g., Service Record accrual 50\u2013200 units, Protected Pause eligibility, identity assurance Tier 2): stake = 20% of attestor's Service Record \u00d7 0.3 = 6% of attestor's Service Record placed\n- **High claim** (e.g., Service Record accrual >200 units, civic-position qualification, high-impact Voice allocation, identity assurance Tier 3): stake = 20% of attestor's Service Record \u00d7 1.0 = 20% of attestor's Service Record placed\n\nRationale: the stake ratio FC-080 = 0.20 ensures meaningful skin-in-the-game (not trivial) without destroying attestor livelihoods on single errors (not ruinous). A 20% loss on a high claim is a genuine cost; a 2% loss on a small claim is a measurable signal without being disproportionate to the stakes of the routine verification.\n\nThe stake is placed against the attestor's existing balance at the time of attestation. Where an attestor's balance is sufficient, the stake is placed in the ordinary way, ensuring those with civic standing put real standing at risk. Where an attestor's balance is insufficient for the scheduled stake, the attestor is **not** thereby barred from attesting: they are routed instead to the guaranteed no-stake or reduced-stake path of \u00a72.6, so that lacking balance never silences a true witness.\n\n### 2.1a \u2014 Cost Relative to Means\n\nThe stake base and the slashing impact in \u00a72.4 must be calibrated **relative to the attestor's means**, not by absolute volume alone. The proportional figures in \u00a72.1 set the maximum; for low-balance attestors the realized stake and any slash are scaled down so that an honest attestation never costs the poor a larger fraction of their subsistence balance than it costs the rich. The cost of telling the truth is measured by what it takes from the giver, not by its absolute size: a stake or slash that would consume a low-balance attestor's subsistence floor is itself a respecter-of-persons failure and is prohibited. The Service Record ledger preserves each attestor's protected subsistence balance against placement or slashing, and \u00a77 reports slash impact as a fraction of remaining subsistence so that this calibration can be audited.\n\n### 2.2 \u2014 Stake Release (Honest Attestations)\n\nStake is **released** back to the attestor's available balance after the audit window expires (\u00a72.3) without a false-claim finding.\n\nReleased stake returns:\n- The original placed amount.\n- A **small reputation credit** recorded in the attestor's Service Record: +0.01 \u00d7 FC-080 \u00d7 claim-scaled-base per successful attestation, bounded at a lifetime cap so reputation accrual does not itself become a status-currency drift surface (see \u00a75.2).\n\nReputation credit is public (anonymised ledger) and visible to future subjects considering whom to ask for attestation \u2014 so consistently-accurate attestors become valued civic resources.\n\n### 2.3 \u2014 Audit Window (FC-081)\n\nSlashing is possible for **FC-081 `ATTESTATION_AUDIT_WINDOW` = 365 days** after the attestation is submitted (1-year civic cycle).\n\nThe 365-day window matches the civic-cycle duration. This is long enough for:\n- Contribution attestations to be verified against activity records, cross-attestation, and random audits.\n- Hardship attestations to be verified against subsequent behavior (e.g., does the subject's stated condition continue to manifest in ways consistent with the attestation?).\n- Identity attestations to surface through downstream usage (does the subject's activity consistent with their attested identity?).\n\nAnd short enough that:\n- Attestors get their stake back on a predictable schedule and can plan their participation.\n- The system does not accrue indefinite liabilities against attestor balances.\n\nAfter 365 days, the attestation is **final**. It cannot be retroactively slashed, though patterns of later-discovered falsehood may trigger investigation of newer attestations by the same attestor or of the subject's other claims.\n\n### 2.4 \u2014 Slashing (False-Claim Finding)\n\nA false-claim finding by the Ombuds (Annex AI) or the Enforcement Panel (Annex AJ \u00a74) during the audit window triggers **slashing** of the placed stake:\n\n| Finding | Slash amount |\n| :--- | :--- |\n| False attestation, inadvertent (attestor believed claim true; was deceived by subject) | 25% of placed stake slashed; remaining 75% released |\n| False attestation, negligent (attestor should have verified; did not) | 50% of placed stake slashed; remaining 50% released |\n| False attestation, knowing (attestor knew claim was false or recklessly indifferent) | 100% of placed stake slashed; attestor referred to Enforcement Panel under Annex AJ \u00a74.2 at AJ-2.2 severity (1.5\u00d7) for the functional gain created by the false attestation |\n| Attestation ring or coordinated false attestation | 100% of placed stake slashed for all ring members; Annex AJ \u00a74.2 AJ-2.2 + AJ-2.3 escalation; 2-year attestation disqualification; Service Record deduction per matrix |\n\n**Slashed stake distribution** (\u00a73). Slashing findings are appealable per the appeal spine ([ANNEX_L \u00a7L7](./ANNEX_L.md)); final adjudication lies with the Ombuds Plenum per Annex AI \u00a74.9, with stake escrowed until finality.\n\n### 2.5 \u2014 Pre-commit Transparency\n\nAttestors see the scheduled stake amount before submitting an attestation. The interface presents:\n- The claim the subject is making, in the subject's own framing.\n- The claim-size scaling that determines the stake base.\n- The attestor's current balance and the stake amount that would be placed.\n- The 365-day audit window and the slashing schedule in \u00a72.4.\n- The option to decline \u2014 declining to attest is a legitimate and costless choice; no civic penalty attaches to non-participation.\n\nDeclining to attest is *never* slashable. Only submitted false attestations are slashable. The purpose of the mechanism is not to punish non-participation but to require that participation reflect the attestor's actual knowledge of the subject.\n\n### 2.6 \u2014 Anti-Exclusion Floor (Operative)\n\nNo subject may be rendered un-vouchable, and no person may be rendered unable to attest, solely because they or their network lack sufficient civic balance to place a stake. This floor is **operative within this annex**: it binds at the point of attestation and is not deferred to downstream implementation.\n\nTo guarantee the floor, a stake-independent attestation path is always available:\n\n- **No-stake / reduced-stake community-verified path.** A low-balance or zero-balance attestor may attest through a community-verified route that requires no stake (or a reduced stake calibrated under \u00a72.1a), with the integrity assurance carried by augmented cross-attestation and random audit rather than by balance at risk.\n- **Tier 0 safe-harbor route.** Subjects with few or no balance-holding attestors in their network (new arrivals, the isolated, the recently displaced) qualify for the Tier 0 safe-harbor path, in which standing is established through documented community verification and elevated audit instead of staked attestation.\n- **Public attestor of last resort.** Where no eligible attestor is otherwise available, a designated public attestor (an institutional or civic body staking institutional rather than personal balance) ensures that a real person is never stranded without a path to recognition.\n\nThese paths carry the same legibility as staked attestation; they are not a lesser class of recognition. Exclusion of a subject because no one with sufficient balance knows them, or silencing of a true witness because they are civically poor, is an unacceptable failure mode that this section forecloses. The Article VI and Annex K multi-path verification clauses elaborate the operational detail of these routes, but the guarantee itself is binding here.\n\n### 2.7 \u2014 Restoration and Re-entry After a Non-Knowing Finding\n\nA slashing finding is a correction, not a permanent brand. An attestor found to have made an **inadvertent** or **negligent** false attestation (the non-knowing categories of \u00a72.4) has a documented path back to full attestation standing. After such a finding, and after a defined period of honest conduct \u2014 set by analogy to the Annex AF grace mechanisms and no longer than one civic cycle of accurate, unslashed attestation \u2014 the attestor's standing is restored: reputation accrual resumes under \u00a72.2 and any temporary limitation on their attestation rights lapses.\n\nThe 2-year ring disqualification of \u00a72.4 applies only to knowing or coordinated-ring findings and is not affected by this restoration path. For non-knowing findings, restoration is the rule: the mechanism seeks the return of the honest witness, not their permanent exclusion. Restoration is recorded in the attestor's ledger so that correction, completion, and re-entry are visible rather than the fault alone.\n\n---\n\n## Section 3 \u2014 Slashed Stake Distribution\n\nSlashed stake does not simply disappear \u2014 that would be deflationary and would eliminate the opportunity to compensate those harmed by the false attestation. Distribution:\n\n| Recipient | Share | Conditions |\n| :--- | :--- | :--- |\n| **Whistleblower** (the party who raised the complaint leading to finding) | **40%** | Direct transfer to whistleblower's Service Record balance. If complaint was anonymous, share is held in a whistleblower-reserve account and released on claim with identity verification. If complaint was automated (e.g., collusion-graph detection), share routes to the Article VII enforcement maintenance fund. |\n| **Subject harmed by false attestation** (when a false attestation harmed someone other than the subject of the attestation \u2014 e.g., someone excluded from a position the false claim helped secure) | **30%** | Restitution; paid into harmed party's Service Record. If no third-party harm is identified, share reallocates to the Article VII enforcement maintenance fund. |\n| **Article VII enforcement maintenance fund** | **20%** | Funds detection infrastructure (AF3 collusion-graph analytics, cross-attestation audit sampling, whistleblower protection infrastructure per P-021). |\n| **Service Record overall** (deflationary \u2014 permanently retired) | **10%** | A small deflationary share ensures the system does not reward detection without any cost to the civic-record aggregate. |\n\nThe distribution is executed automatically on finality of the finding (post-appeal, or appeal deadline lapsed).\n\n---\n\n## Section 4 \u2014 Attestation Graph Density (FC-082)\n\nIndividual-level stake mechanisms handle individual false attestations. They do not, by themselves, defeat coordinated attestation rings where every member is \"honest\" about the others within the ring but the ring as a whole is closed to outside verification.\n\n**FC-082 `ATTESTATION_GRAPH_DENSITY_THRESHOLD` = 0.40** (mutual cross-attestation ratio)\n\nThe Service Record system computes, for each attestor cohort of \u226510 participants, the **mutual cross-attestation ratio**: the fraction of pairs (A, B) in the cohort for which A has attested for B *and* B has attested for A within any overlapping 2-year window, divided by the total possible such pairs.\n\n**Null-model baseline.** A random graph with the same number of attestations distributed uniformly across eligible attestors would produce a mutual cross-attestation ratio of approximately k/n (where k is per-person attestations and n is cohort size). For realistic cohort sizes and activity rates, this baseline is typically under 0.05. A threshold of **0.40** is a large multiple of the null-model expectation \u2014 meaning attestor networks exceeding 0.40 are structurally distinct from independent attestors making unrelated judgments, and the deviation is statistically hard to explain without coordination.\n\n**Trigger consequence.** Cohorts above 0.40 enter **automatic review**:\n- All attestations within the cohort are flagged for manual audit.\n- New attestations from cohort members are accepted but held in audit queue pending cohort-level review.\n- The Ombuds (Annex AI) initiates a cohort-level investigation: is this a legitimate close-knit community (e.g., a small indigenous community where everyone knows everyone \u2014 legitimately high density), or is it a coordinated ring?\n- Cohort-level finding proceeds through the standard Ombuds + Enforcement Panel process. Legitimate close-knit communities are certified (with documentation) and exempted from the threshold; coordinated rings are slashed at the AJ-1.3 or AJ-2.2 severity.\n\n**Community safe harbor** (parallels Annex AF \u00a7hardship community-disaster safe harbor): attestor cohorts that are geographically co-located in an area with declared emergency status, or that meet documented small-community demographic criteria, are exempt from the 0.40 trigger automatically \u2014 the ratio is still computed and reported, but the trigger is gated on the Ombuds cohort-certification finding, not on the ratio alone.\n\n---\n\n## Section 5 \u2014 Interaction with Existing Mechanisms\n\n### 5.1 \u2014 Relationship to Article VI Multi-Attestation\n\nArticle VI already requires **multi-attestation** (multiple independent attestors) for mid- and high-impact claims. This annex does not replace multi-attestation; it **stakes** each of the multiple attestors.\n\nEffect: on a high claim requiring 3 attestations at 20% stake base each, the aggregate stake at risk across attestors is 60% of one attestor's balance (distributed across three people), or 20% \u00d7 3 = 60% aggregate equivalent. For the subject to obtain a false attestation set, they must find three attestors each willing to stake their own civic standing on a claim none of them can verify. This is qualitatively different from finding three people willing to sign a piece of paper at no cost.\n\n### 5.2 \u2014 Relationship to P-009 Grace Exploitation Patches\n\nAnnex AF \u00a7AF3 establishes collusion-graph analytics for hardship attestation networks with mutual-pair, star-cluster, and temporal-clustering triggers. This annex's FC-082 density threshold (\u00a74) **generalizes** AF3 to all attestation classes, not just hardship. The AF3-specific triggers remain the primary detection instrument for the hardship attestation domain; FC-082 is the broader network-structure threshold that applies across all attestation classes including contribution, identity, and civic-qualification.\n\n### 5.3 \u2014 Relationship to TR-07 Contribution Fraud\n\nThreat Register TR-07 addresses contribution fraud via multi-attestation + random audits + anomaly detection + reputation decay + sanctions. This annex adds the **pre-commitment stake** layer: sanctions become mechanical (automatic slashing on finding) rather than contingent on separate disciplinary action, and the economic cost of ring participation is calibrated to FC-080 regardless of whether social reputation penalties materialize.\n\n### 5.4 \u2014 Reputation Cap\n\nReputation credit accrued via honest attestation (\u00a72.2) is capped at a lifetime ceiling equivalent to **FC-083 = 2 civic cycles** of successful attestation reputation credit. This prevents the accumulation of reputation from becoming itself a status-currency surface for AJ-2.1 patterns (civic standing as allocation preference).\n\n---\n\n## Section 6 \u2014 Implementation Notes for Founding Coalition\n\n1. **Technical infrastructure.** The stake mechanism requires Service Record ledger support for:\n   - Atomic place/release/slash operations on attestor balances.\n   - Audit-window tracking (365-day cursor) per attestation.\n   - Attestation-graph density computation (FC-082) with the null-model baseline as a verifiable benchmark, recomputed monthly.\n   - Automatic distribution of slashed stakes per \u00a73.\n\n2. **Attestation UI.** The attestation submission interface must present the stake amount, the audit window, and the slashing schedule to the attestor *before* they submit. Attestors submitting without seeing this information (e.g., via automated tooling) constitute a failure of informed consent and invalidate the attestation.\n\n3. **Whistleblower infrastructure.** \u00a73 requires whistleblower complaints to be attributable to a party (for direct share) or routable to a reserve (for anonymous). The whistleblower-reserve account requires the same protections as identity recovery \u2014 secure, surveillance-resistant, with recovery through the Ombuds process if the whistleblower subsequently identifies themselves.\n\n4. **Pilot phase calibration.** Before full scale, the founding coalition runs a pilot cohort (\u22651,000 attestors, \u22656 months) to verify:\n   - FC-080 stake ratio produces measurable behavioral change (attestation rates, decline rates, detected falsehood rates compared to no-stake baseline).\n   - FC-082 density threshold does not over-flag legitimate small communities (false positive rate on community safe harbor).\n   - FC-081 audit window length is sufficient for realistic detection latencies across attestation classes.\n   Pilot findings are documented; any recommended recalibration proceeds through the Tier 2 amendment ladder.\n\n5. **Exclusion safety.** The anti-exclusion floor of \u00a72.6 is operative and binding: no attestor is barred and no subject is rendered un-vouchable for lack of balance. Where an attestor's balance is sufficient, the staked path applies; where it is not, the no-stake / reduced-stake community-verified path, the Tier 0 safe-harbor route, and the public-attestor-of-last-resort guarantee a real path to recognition. Implementation of these routes \u2014 institutional attestors who stake professional rather than personal balance, rotating-jury lightweight attestations for small claims, community-verified or self-declaration paths with augmented random audit \u2014 is detailed in the Article VI and Annex K multi-path verification clauses, but the guarantee that lacking balance never silences a true witness or strands a real person is fixed in \u00a72.6 and does not await that detail.\n\n---\n\n## Section 7 \u2014 Governance\n\n**This annex is governed as P-004 protected specification.** Core mechanisms (the place/slash/release architecture; the 365-day audit window structure; the graduated-culpability slashing schedule in \u00a72.4) cannot be modified without Tier 2 amendment with public redlines.\n\n**Founding Commitments bound:**\n- FC-080 `ATTESTATION_STAKE_RATIO` = 0.20 (Tier 2)\n- FC-081 `ATTESTATION_AUDIT_WINDOW` = 365 days (Tier 2)\n- FC-082 `ATTESTATION_GRAPH_DENSITY_THRESHOLD` = 0.40 (Tier 2)\n- FC-083 `ATTESTATION_REPUTATION_CREDIT_CAP` = 2 civic cycles (Tier 2)\n\nNumerical changes to these commitments proceed through the Tier 2 amendment ladder in `/founding/commitments.md`.\n\n**Annual audit.** The Enforcement Panel and the Ombuds produce a joint Annual Attestation Audit (parallel to the Annex AJ \u00a74.5 Annual Deterrence Audit) reporting:\n- Total attestations placed; total stake volume; aggregate balance at risk at year-end.\n- Slashing events by finding category; realized slash rate.\n- **Slash impact as a fraction of each attestor's remaining subsistence balance**, not only as absolute volume \u2014 reported across the attestor-wealth distribution so that the proportional cost borne by low-balance attestors is visible.\n- **Equity early-warning.** Any poverty-correlated trend \u2014 exclusion, decline, or slash impact falling disproportionately on low-balance attestors or on subjects whose networks are poor \u2014 is flagged as an early-warning that the mechanism is becoming a respecter of persons, and triggers review of the \u00a72.1a calibration and the \u00a72.6 floor.\n- Cohort-level density findings (cohorts above 0.40, certified vs. slashed).\n- Attestor exclusion rate (subjects who could not obtain staked attestation through insufficient balance of their network, and the rate at which they were routed to and recognized through the \u00a72.6 alternative paths); trend line over time.\n- Restoration and re-entry events under \u00a72.7 (non-knowing findings restored to standing); trend line over time.\n- Recommendations for calibration of FC-080, FC-081, or FC-082 if empirical behavior deviates from design assumptions.\n\n---\n\n*This document is Annex AS of the Humane Constitution. Operative as an ACTIVE specification as of Proposal 9 close-out (2026-04-18). Integration with Article VI and Annex AF proceeds through the ordinary implementation sequence.*\n",
       "headings": [
         {
           "level": 1,
@@ -10393,7 +10398,7 @@
           "slug": "section-7-governance"
         }
       ],
-      "wordCount": 3823,
+      "wordCount": 3852,
       "headingCount": 21
     },
     {
@@ -11126,7 +11131,7 @@
       "status": "",
       "statusBucket": "reference",
       "summary": "This annex governs the project's replacement wealth-and-public-finance architecture.",
-      "content": "# ANNEX D \u2014 Commons Return and Universal Stake\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Replaces the former progressive net-worth demurrage spine with a public-return system that collects value created by common inheritance, scarcity, legal privilege, and public infrastructure, then routes it through a protected Universal Stake and public commons lockbox. |\n> | **Who it protects** | Ordinary households, workers, caregivers, small operators, and vulnerable persons who need survival and dignity without having their income, savings, home, tools, or private life turned into the funding base. |\n> | **Failure risk** | A public-return system can become a hidden tax, a political dividend machine, a valuation bureaucracy, a surveillance surface, or a capture channel for asset holders who understate value and shift burden downward. |\n> | **Evidence status** | Active \u2014 unproven |\n> | **Linked risks** | T-025; T-029; P-023; P-029; Annexes X, J, AR, AT; Commons Return and Universal Stake Evidence Test Package. |\n\n---\n\n## Plain-language summary\n\nThis annex governs the project's replacement wealth-and-public-finance architecture.\n\nThe former active proposal used progressive net-worth demurrage: a continuous carrying cost on accumulated wealth above a participation floor. That model is superseded. It is no longer the load-bearing wealth instrument, no longer the ordinary funding source for Essential Access, and no longer a routine decay rule on personal balances.\n\nThe replacement is **Commons Return and Universal Stake**:\n\n- **Commons Return** collects public value from sources no person created alone: land/location value, natural resources, spectrum, monopoly licenses, unavoidable platform or network rents, public infrastructure uplift, and large succession transfers.\n- **Universal Stake** distributes a protected share of Commons Return to people as a civic inheritance, without converting survival into a political favor.\n- **Public Commons Lockbox** funds Essential Access, public infrastructure, basic payment rails, resilience reserves, and productive-asset restoration through published source-by-source accounting.\n- **Anti-capture gates** prevent ordinary labor, survival access, basic household exchange, ordinary savings, primary homes, working tools, and small operating reserves from becoming the routine revenue base.\n\nDemurrage may appear only as a dormant, pilot-gated backstop under \u00a7D9. It is not active routine policy.\n\n![Commons Return and Universal Stake](/images/V-015.svg)\n\n---\n\n## D1 \u2014 Supersession and Constitutional Posture\n\n**D1.1 Supersession.** This annex supersedes all active claims that Annex D imposes a routine progressive net-worth demurrage, a liquid-balance decay fee, or a continuous carrying cost on ordinary personal wealth. Older demurrage material may remain in audits, plans, or historical discussion only when it is clearly marked as superseded, historical, or dormant.\n\n**D1.2 Why the replacement was made.** The former demurrage spine overloaded one instrument. It tried to fund public operations, deter hoarding, prevent dynastic control, discipline idle balances, and force productive deployment through one valuation-heavy mechanism. That created avoidable risks: ordinary-wealth burden, illiquid-asset coercion, valuation bureaucracy, privacy exposure, capital flight, and confused public legitimacy.\n\n**D1.3 Replacement principle.** The public claim should fall first on value produced by the commons or by legally protected scarcity, not on ordinary labor, basic household exchange, modest savings, primary residence continuity, tools of work, caregiving, or survival access.\n\n**D1.4 Christ-centered dignity lens.** This annex is human-made and corrigible. Its moral test is whether it protects persons from domination, refuses to measure human worth by wealth, and keeps public provision from becoming a tower of pride or a coercive dependency. The system may collect public return from privilege and scarcity; it may not treat people as inventory, revenue targets, or instruments of policy.\n\n---\n\n## D2 \u2014 Source Bases for Commons Return\n\nCommons Return may be assessed only on named source bases. No unnamed revenue base may be implied from this annex.\n\n| Source base | Plain meaning | Core control |\n|---|---|---|\n| **Land and location value** | Value arising from site location, zoning, infrastructure, public services, and community presence rather than the holder's own labor. | Assess land/location value separately from primary dwelling continuity and working improvements. |\n| **Natural resources** | Extraction, depletion, or exclusive control of minerals, water, forests, fisheries, energy resources, and similar inherited commons. | Charge extraction or exclusive-use value; reserve restoration obligations before distribution. |\n| **Spectrum, airspace, and scarce licenses** | Publicly created or naturally scarce permission to use a limited channel, corridor, license, or franchise. | Auction, lease, or public-return share with renewal review and anti-monopoly limits. |\n| **Public infrastructure uplift** | Private gain created by public transit, utilities, roads, clinics, schools, safety systems, or remediation. | Capture a bounded share of uplift without punishing resident continuity or repair. |\n| **Network and platform rents** | Returns from unavoidable network position, gatekeeping, interoperability control, data lock-in, or monopoly access. | Treat gatekeeping rents as public-return eligible when users cannot realistically bypass the network. |\n| **Large succession transfers** | Dynastic transfer of concentrated control across generations. | Protect modest family continuity while charging large control transfers that reproduce permanent class position. |\n| **External-capital access to protected commons** | Foreign or external capital using protected local commons, essential sectors, or public rails. | Require reciprocity, public-return share, and no survival-leverage concessions. |\n\n**D2.1 No general wealth drag.** Commons Return is source-specific. It is not a blanket tax on all net worth.\n\n**D2.2 No ordinary-income base.** Ordinary labor income, small household exchange, survival access, and basic consumption are not routine Commons Return bases.\n\n**D2.3 No survival access charge.** Essential Access may not be taxed, clawed back, diminished, or conditioned to fund the system.\n\n---\n\n## D3 \u2014 Protected Ordinary Use\n\nCommons Return must distinguish extractive control from ordinary life.\n\n**Ordinary household guarantee.** Until the evidence package has passed, protected ordinary use is a design promise, not a proven funding system. The system may not shift the proof burden onto ordinary households by treating uncertainty itself as evidence of evasion.\n\nProtected ordinary use includes:\n\n- primary residence continuity, including modest family continuity in a home;\n- tools, equipment, land, inventory, and working assets in active productive use;\n- ordinary household savings and emergency reserves;\n- caregiver, disability, elder, family, mutual-aid, and faith-community support that is not a disguised commercial rent;\n- small-operator working capital needed for payroll, inventory, repair, seasonal volatility, and business continuity;\n- retirement, disability, and hardship reserves below published dignity thresholds.\n- customary, indigenous, subsistence, religious, and traditional stewardship use, unless there is evidence of rent extraction, hidden beneficial control, or artificial fragmentation of a source base.\n\n**D3.1 Burden of proof.** The system bears the burden of proving that a source base is public-return eligible. Ambiguity near ordinary household use resolves toward protection unless there is evidence of structured evasion, rent extraction, or concentrated control.\n\n**D3.2 No home-as-hostage rule.** A person may not lose primary shelter because a public-return assessment treats an illiquid home as spendable wealth. Where land/location value is assessed, payment design must preserve resident continuity through deferral, circuit breaker, community land trust conversion, or other non-displacement mechanism.\n\n**D3.3 Working-tools rule.** Productive tools are not treated as idle wealth merely because they have resale value. The question is whether the asset is being used for real work, service, production, repair, care, or community benefit.\n\n---\n\n## D4 \u2014 Universal Stake\n\nUniversal Stake is the people's protected share of Commons Return. It is a civic inheritance from shared resources and public-created value, not a wage, charity, welfare status, or reward for compliance.\n\n**D4.1 Distribution rule.** A published share of net Commons Return receipts must be routed to Universal Stake after restoration obligations, Essential Access lockbox minimums, and resilience reserves are funded.\n\n**D4.2 Non-convertibility limits.** Universal Stake may not buy Voice, Service Record standing, public office, identity priority, Essential Access priority, or review-body eligibility. It is an economic instrument only.\n\n**D4.2a Anti-assignment and private-capture limit.** Universal Stake may not be pledged, garnished, wage-offset, collateralized, lender-captured, employer-captured, landlord-captured, pre-sold, assigned to a third party, or treated as rent, credit underwriting, employment compensation, or compliance reward. Any contract that attempts to capture a person's Universal Stake in advance is void as against this annex. The purpose is to keep the public share from becoming private leverage over future need.\n\n**D4.3 Eligibility floor.** Universal Stake must not exclude people through digital fragility, documentation barriers, disability, safety-shielded enrollment, migration status disputes, or lack of conventional banking. Where identity is unresolved, the system must provide a bounded custodial or analog path that protects against duplicate capture without denying the person.\n\n**D4.4 Political capture limit.** Universal Stake may not become an election-cycle dividend controlled by incumbents. Formula, reserve rule, distribution cadence, and suspension criteria must be pre-published and governed by evidence gates rather than discretionary political timing.\n\n---\n\n## D5 \u2014 Public Commons Lockbox\n\nCommons Return receipts route through a public lockbox with source-by-source accounting.\n\nMinimum lockbox functions:\n\n1. Essential Access commons support.\n2. Public infrastructure maintenance and resilience.\n3. Basic public payment rails and fraud recovery.\n4. Productive-asset restoration for households near the floor.\n5. Resource restoration where extraction or depletion created the return.\n6. Reserves for downturns, disasters, and transition shocks.\n7. Universal Stake distribution after the above obligations are protected.\n\n**D5.1 No hidden deficit rule.** The lockbox may not hide future obligations off-ledger, borrow through shell entities, or shift costs to ordinary labor, survival access, or household exchange.\n\n**D5.2 Source disclosure.** Every settlement period must publish aggregate receipts by source base, exemptions, appeals, administrative cost, distribution, reserve movement, and lockbox balance.\n\n**D5.3 Fiscal adequacy gate.** The system may not claim scale readiness until the lockbox has a costed model showing Essential Access, delivery, resilience, payment rails, and governance operations can be funded without inflation, debasement, hidden debt, or prohibited tax-base migration beyond published tolerance.\n\n---\n\n## D6 \u2014 Assessment, Appeals, and Anti-Surveillance\n\nAssessment must be narrow, explainable, contestable, and purpose-limited.\n\n**D6.1 Minimum necessary data.** Assessors may collect only the data needed to determine the named source base, protected ordinary use, and beneficial control. Data collected for Commons Return may not be reused for policing, immigration enforcement, employment screening, credit scoring, marketing, political targeting, or social ranking.\n\nCommons Return assessment data is a monitoring stream for purposes of [P-069](../governance/Patch_Log.md) and the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md). Before any assessment stream operates, the Monitoring Purpose Register must name its source base, fields, lane, raw-access rule, retention clock, independent reviewer, join limits, forbidden uses, and appeal path.\n\n**D6.2 Public formulas, private details.** Public dashboards show aggregate receipts and burden distribution. Individual household and business details remain protected unless disclosure is required for a specific adjudicated enforcement action.\n\n**D6.3 Appeal right.** Every assessment must include a plain-language basis, evidence source, appeal path, hardship route, and non-displacement protection where applicable.\n\n**D6.4 Independent review.** Valuation methods, source-base definitions, and exemption decisions require recurring review by independent methodology classes under Annex AL-style independence rules.\n\n**D6.5 Investigation escalation.** Source-base review must proceed by escalation: public and aggregate records first; entity-level records second; personal or household-linkable records only after an independent written finding of source-base relevance, proportionality, and no less-intrusive alternative. Record compulsion, dataset joining, or privacy-piercing review without that finding is void.\n\n**D6.6 Plain notice and right to helper.** Every assessment or quarantine notice must be written in plain language, orally explainable, translated where needed, available offline, and paired with a named human reviewer. Elderly, disabled, low-literacy, rural, undocumented, safety-shielded, caregiver, and digitally fragile persons have a right to a trusted helper or community navigator without losing appeal rights.\n\n---\n\n## D7 \u2014 Anti-Avoidance and Beneficial Control\n\nCommons Return follows functional control, not labels.\n\nAvoidance routes include trusts, shell entities, nominee ownership, related-party debt, perpetual foundations, license relabeling, platform restructuring, foreign holding chains, and artificial fragmentation of land, resource, or network rights.\n\n**D7.1 Functional-effect test.** If an arrangement gives a person or coordinated group durable control over a public-return source base, the assessment follows that control even if legal title is dispersed.\n\n**D7.2 No ordinary association penalty.** Mutual aid, churches, worker cooperatives, family households, disability supports, and small community associations are not avoidance structures merely because they coordinate resources. The avoidance test requires durable rent extraction, hidden beneficial control, or artificial fragmentation of a source base.\n\n**D7.3 External-capital membrane.** External capital may participate in productive work, but may not use protected commons, essential-sector access, or public rails to extract unreturned scarcity rents or obtain survival-leverage concessions.\n\n---\n\n## D8 \u2014 Fiscal Sustainability Threat Gate\n\nCommons Return is not automatically sufficient. It must be costed.\n\nBefore any scale claim, the project must publish a fiscal sustainability dossier covering:\n\n- Essential Access basket cost by region and category;\n- delivery cost for hard-to-serve populations;\n- expected Commons Return receipts by source base;\n- Universal Stake distribution formula and reserve rule;\n- administrative and governance operating costs;\n- inflation/debasement risk from Flow issuance;\n- transition costs and legacy-law interface;\n- downside scenario where one or more major source bases underperform;\n- burden incidence by wealth band, income band, region, household type, disability status, age, and small-operator status;\n- tax or fee bases that remain necessary, if any, with explicit prohibited-base screening.\n\n**D8.1 Honest tax posture.** This annex does not declare that taxes are unnecessary. It narrows the preferred public-revenue base toward commons-created value and away from ordinary labor and survival. Residual taxes, fees, or charges may remain necessary during transition or at scale, but only if they are named, costed, screened against prohibited bases, and reviewed for dignity and incidence.\n\n**D8.2 Scale block.** If no costed model exists, if the model depends on inflation or debasement beyond published tolerance, or if burden shifts downward onto ordinary households, the project must block scale claims and downgrade public language.\n\n---\n\n## D9 \u2014 Dormant Backstops\n\nThe following instruments are not active routine policy. They may be studied, piloted, or activated only under the stated limits.\n\n| Backstop | Permitted use | Guardrail |\n|---|---|---|\n| **Harberger / COST-style self-assessment** | Hard-to-price illiquid assets where valuation hiding is a serious exploit. | Pilot-gated, asset-class specific, appealable, and never applied to primary shelter in a way that forces displacement. |\n| **Low-rate net-worth backstop** | Last-resort anti-avoidance when source-base rules fail against concentrated hidden control. | Non-load-bearing, low-rate, published incidence test, ordinary-household exemption, no survival-floor funding dependence. |\n| **Flow deflation circuit breaker** | Emergency monetary stabilization if issuance abuse threatens purchasing power. | Temporary, system-wide, independently triggered, and not a routine demurrage or public-finance tool. |\n\n**D9.1 No demurrage by default.** No routine balance decay, idle-money demurrage, progressive net-worth demurrage, or equivalent carrying cost may be introduced by interpretation. Any revival requires a new patch, fiscal/dignity evidence, public review, and the applicable amendment process.\n\n---\n\n## D10 \u2014 Evidence Package\n\nThe controlling evidence gate for this annex is the [Commons Return and Universal Stake Evidence Test Package](../governance/Commons_Return_Universal_Stake_Evidence_Test_Package.md).\n\nThe minimum tests are:\n\n- fiscal adequacy and downside revenue modeling;\n- incidence and dignity burden review;\n- source-base valuation red team;\n- legal-wrapper and beneficial-control avoidance review;\n- Universal Stake capture and election-timing simulation;\n- Essential Access lockbox sufficiency test;\n- small-operator, caregiver, elder, disability, and rural impact review;\n- privacy and surveillance-risk audit;\n- external-capital arbitrage test;\n- public comprehension test.\n\nNo stronger status may be claimed until these tests exist and residual risk is updated in the Claims and Evidence Register.\n",
+      "content": "# ANNEX D \u2014 Commons Return and Universal Stake\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Replaces the former progressive net-worth demurrage spine with a public-return system that collects value created by common inheritance, scarcity, legal privilege, and public infrastructure, then routes it through a protected Universal Stake and public commons lockbox. |\n> | **Who it protects** | Ordinary households, workers, caregivers, small operators, and vulnerable persons who need survival and dignity without having their income, savings, home, tools, or private life turned into the funding base. |\n> | **Failure risk** | A public-return system can become a hidden tax, a political dividend machine, a valuation bureaucracy, a surveillance surface, or a capture channel for asset holders who understate value and shift burden downward. |\n> | **Evidence status** | Active \u2014 unproven |\n> | **Linked risks** | T-025; T-029; P-023; P-029; Annexes X, J, AR, AT; Commons Return and Universal Stake Evidence Test Package. |\n\n---\n\n## Plain-language summary\n\nThis annex governs the project's replacement wealth-and-public-finance architecture.\n\nThe former active proposal used progressive net-worth demurrage: a continuous carrying cost on accumulated wealth above a participation floor. That model is superseded. It is no longer the load-bearing wealth instrument, no longer the ordinary funding source for Essential Access, and no longer a routine decay rule on personal balances.\n\nThe replacement is **Commons Return and Universal Stake**:\n\n- **Commons Return** collects public value from sources no person created alone: land/location value, natural resources, spectrum, monopoly licenses, unavoidable platform or network rents, public infrastructure uplift, and large succession transfers.\n- **Universal Stake** distributes a protected share of Commons Return to people as a civic inheritance, without converting survival into a political favor.\n- **Public Commons Lockbox** funds Essential Access, public infrastructure, basic payment rails, resilience reserves, and productive-asset restoration through published source-by-source accounting.\n- **Anti-capture gates** prevent ordinary labor, survival access, basic household exchange, ordinary savings, primary homes, working tools, and small operating reserves from becoming the routine revenue base.\n\nDemurrage may appear only as a dormant, pilot-gated backstop under \u00a7D9. It is not active routine policy.\n\n![Commons Return and Universal Stake](/images/V-015.svg)\n\n---\n\n## D1 \u2014 Supersession and Constitutional Posture\n\n**D1.1 Supersession.** This annex supersedes all active claims that Annex D imposes a routine progressive net-worth demurrage, a liquid-balance decay fee, or a continuous carrying cost on ordinary personal wealth. Older demurrage material may remain in audits, plans, or historical discussion only when it is clearly marked as superseded, historical, or dormant.\n\n**D1.2 Why the replacement was made.** The former demurrage spine overloaded one instrument. It tried to fund public operations, deter hoarding, prevent dynastic control, discipline idle balances, and force productive deployment through one valuation-heavy mechanism. That created avoidable risks: ordinary-wealth burden, illiquid-asset coercion, valuation bureaucracy, privacy exposure, capital flight, and confused public legitimacy.\n\n**D1.3 Replacement principle.** The public claim should fall first on value produced by the commons or by legally protected scarcity, not on ordinary labor, basic household exchange, modest savings, primary residence continuity, tools of work, caregiving, or survival access.\n\n**D1.4 Christ-centered dignity lens.** This annex is human-made and corrigible. Its moral test is whether it protects persons from domination, refuses to measure human worth by wealth, and keeps public provision from becoming a tower of pride or a coercive dependency. The system may collect public return from privilege and scarcity; it may not treat people as inventory, revenue targets, or instruments of policy.\n\n---\n\n## D2 \u2014 Source Bases for Commons Return\n\nCommons Return may be assessed only on named source bases. No unnamed revenue base may be implied from this annex.\n\n| Source base | Plain meaning | Core control |\n|---|---|---|\n| **Land and location value** | Value arising from site location, zoning, infrastructure, public services, and community presence rather than the holder's own labor. | Assess land/location value separately from primary dwelling continuity and working improvements. |\n| **Natural resources** | Extraction, depletion, or exclusive control of minerals, water, forests, fisheries, energy resources, and similar inherited commons. | Charge extraction or exclusive-use value; reserve restoration obligations before distribution. |\n| **Spectrum, airspace, and scarce licenses** | Publicly created or naturally scarce permission to use a limited channel, corridor, license, or franchise. | Auction, lease, or public-return share with renewal review and anti-monopoly limits. |\n| **Public infrastructure uplift** | Private gain created by public transit, utilities, roads, clinics, schools, safety systems, or remediation. | Capture a bounded share of uplift without punishing resident continuity or repair. |\n| **Network and platform rents** | Returns from unavoidable network position, gatekeeping, interoperability control, data lock-in, or monopoly access. | Treat gatekeeping rents as public-return eligible when users cannot realistically bypass the network. |\n| **Large succession transfers** | Dynastic transfer of concentrated control across generations. | Protect modest family continuity while charging large control transfers that reproduce permanent class position. |\n| **External-capital access to protected commons** | Foreign or external capital using protected local commons, essential sectors, or public rails. | Require reciprocity, public-return share, and no survival-leverage concessions. |\n\n**D2.1 No general wealth drag.** Commons Return is source-specific. It is not a blanket tax on all net worth.\n\n**D2.2 No ordinary-income base.** Ordinary labor income, small household exchange, survival access, and basic consumption are not routine Commons Return bases.\n\n**D2.3 No survival access charge.** Essential Access may not be taxed, clawed back, diminished, or conditioned to fund the system.\n\n---\n\n## D3 \u2014 Protected Ordinary Use\n\nCommons Return must distinguish extractive control from ordinary life.\n\n**Ordinary household guarantee.** Until the evidence package has passed, protected ordinary use is a design promise, not a proven funding system. The system may not shift the proof burden onto ordinary households by treating uncertainty itself as evidence of evasion.\n\nProtected ordinary use includes:\n\n- primary residence continuity, including modest family continuity in a home;\n- tools, equipment, land, inventory, and working assets in active productive use;\n- ordinary household savings and emergency reserves;\n- caregiver, disability, elder, family, mutual-aid, and faith-community support that is not a disguised commercial rent;\n- small-operator working capital needed for payroll, inventory, repair, seasonal volatility, and business continuity;\n- retirement, disability, and hardship reserves below published dignity thresholds.\n- customary, indigenous, subsistence, religious, and traditional stewardship use, unless there is evidence of rent extraction, hidden beneficial control, or artificial fragmentation of a source base.\n\n**D3.1 Burden of proof.** The system bears the burden of proving that a source base is public-return eligible. Ambiguity near ordinary household use resolves toward protection unless there is evidence of structured evasion, rent extraction, or concentrated control.\n\n**D3.2 No home-as-hostage rule.** A person may not lose primary shelter because a public-return assessment treats an illiquid home as spendable wealth. Where land/location value is assessed, payment design must preserve resident continuity through deferral, circuit breaker, community land trust conversion, or other non-displacement mechanism.\n\n**D3.3 Working-tools rule.** Productive tools are not treated as idle wealth merely because they have resale value. The question is whether the asset is being used for real work, service, production, repair, care, or community benefit.\n\n---\n\n## D4 \u2014 Universal Stake\n\nUniversal Stake is the people's protected share of Commons Return. It is a civic inheritance from shared resources and public-created value, not a wage, charity, welfare status, or reward for compliance.\n\n**D4.1 Distribution rule.** A published share of net Commons Return receipts must be routed to Universal Stake after restoration obligations, Essential Access lockbox minimums, and resilience reserves are funded.\n\n**D4.2 Non-convertibility limits.** Universal Stake may not buy Voice, Service Record standing, public office, identity priority, Essential Access priority, or review-body eligibility. It is an economic instrument only.\n\n**D4.2a Anti-assignment and private-capture limit.** Universal Stake may not be pledged, garnished, wage-offset, collateralized, lender-captured, employer-captured, landlord-captured, pre-sold, assigned to a third party, or treated as rent, credit underwriting, employment compensation, or compliance reward. Any contract that attempts to capture a person's Universal Stake in advance is void as against this annex. The purpose is to keep the public share from becoming private leverage over future need.\n\n**D4.3 Eligibility floor.** Universal Stake must not exclude people through digital fragility, documentation barriers, disability, safety-shielded enrollment, migration status disputes, or lack of conventional banking. Where identity is unresolved, the system must provide a bounded custodial or analog path that protects against duplicate capture without denying the person.\n\n**D4.4 Political capture limit.** Universal Stake may not become an election-cycle dividend controlled by incumbents. Formula, reserve rule, distribution cadence, and suspension criteria must be pre-published and governed by evidence gates rather than discretionary political timing.\n\n---\n\n## D5 \u2014 Public Commons Lockbox\n\nCommons Return receipts route through a public lockbox with source-by-source accounting.\n\nMinimum lockbox functions:\n\n1. Essential Access commons support.\n2. Public infrastructure maintenance and resilience.\n3. Basic public payment rails and fraud recovery.\n4. Productive-asset restoration for households near the floor.\n5. Resource restoration where extraction or depletion created the return.\n6. Reserves for downturns, disasters, and transition shocks.\n7. Universal Stake distribution after the above obligations are protected.\n\n**D5.1 No hidden deficit rule.** The lockbox may not hide future obligations off-ledger, borrow through shell entities, or shift costs to ordinary labor, survival access, or household exchange.\n\n**D5.2 Source disclosure.** Every settlement period must publish aggregate receipts by source base, exemptions, appeals, administrative cost, distribution, reserve movement, and lockbox balance.\n\n**D5.3 Fiscal adequacy gate.** The system may not claim scale readiness until the lockbox has a costed model showing Essential Access, delivery, resilience, payment rails, and governance operations can be funded without inflation, debasement, hidden debt, or prohibited tax-base migration beyond published tolerance.\n\n---\n\n## D6 \u2014 Assessment, Appeals, and Anti-Surveillance\n\nAssessment must be narrow, explainable, contestable, and purpose-limited.\n\n**D6.1 Minimum necessary data.** Assessors may collect only the data needed to determine the named source base, protected ordinary use, and beneficial control. Data collected for Commons Return may not be reused for policing, immigration enforcement, employment screening, credit scoring, marketing, political targeting, or social ranking.\n\nCommons Return assessment data is a monitoring stream for purposes of [P-069](../governance/Patch_Log.md) and the [Monitoring Administrative Safety Packet](../governance/Monitoring_Administrative_Safety_Packet.md). Before any assessment stream operates, the Monitoring Purpose Register must name its source base, fields, lane, raw-access rule, retention clock, independent reviewer, join limits, forbidden uses, and appeal path.\n\n**D6.2 Public formulas, private details.** Public dashboards show aggregate receipts and burden distribution. Individual household and business details remain protected unless disclosure is required for a specific adjudicated enforcement action.\n\n**D6.3 Appeal right.** Every assessment must include a plain-language basis, evidence source, appeal path, hardship route, and non-displacement protection where applicable. Appeals follow the appeal spine ([ANNEX_L \u00a7L7](./ANNEX_L.md)).\n\n**D6.4 Independent review.** Valuation methods, source-base definitions, and exemption decisions require recurring review by independent methodology classes under Annex AL-style independence rules.\n\n**D6.5 Investigation escalation.** Source-base review must proceed by escalation: public and aggregate records first; entity-level records second; personal or household-linkable records only after an independent written finding of source-base relevance, proportionality, and no less-intrusive alternative. Record compulsion, dataset joining, or privacy-piercing review without that finding is void.\n\n**D6.6 Plain notice and right to helper.** Every assessment or quarantine notice must be written in plain language, orally explainable, translated where needed, available offline, and paired with a named human reviewer. Elderly, disabled, low-literacy, rural, undocumented, safety-shielded, caregiver, and digitally fragile persons have a right to a trusted helper or community navigator without losing appeal rights.\n\n---\n\n## D7 \u2014 Anti-Avoidance and Beneficial Control\n\nCommons Return follows functional control, not labels.\n\nAvoidance routes include trusts, shell entities, nominee ownership, related-party debt, perpetual foundations, license relabeling, platform restructuring, foreign holding chains, and artificial fragmentation of land, resource, or network rights.\n\n**D7.1 Functional-effect test.** If an arrangement gives a person or coordinated group durable control over a public-return source base, the assessment follows that control even if legal title is dispersed.\n\n**D7.2 No ordinary association penalty.** Mutual aid, churches, worker cooperatives, family households, disability supports, and small community associations are not avoidance structures merely because they coordinate resources. The avoidance test requires durable rent extraction, hidden beneficial control, or artificial fragmentation of a source base.\n\n**D7.3 External-capital membrane.** External capital may participate in productive work, but may not use protected commons, essential-sector access, or public rails to extract unreturned scarcity rents or obtain survival-leverage concessions.\n\n---\n\n## D8 \u2014 Fiscal Sustainability Threat Gate\n\nCommons Return is not automatically sufficient. It must be costed.\n\nBefore any scale claim, the project must publish a fiscal sustainability dossier covering:\n\n- Essential Access basket cost by region and category;\n- delivery cost for hard-to-serve populations;\n- expected Commons Return receipts by source base;\n- Universal Stake distribution formula and reserve rule;\n- administrative and governance operating costs;\n- inflation/debasement risk from Flow issuance;\n- transition costs and legacy-law interface;\n- downside scenario where one or more major source bases underperform;\n- burden incidence by wealth band, income band, region, household type, disability status, age, and small-operator status;\n- tax or fee bases that remain necessary, if any, with explicit prohibited-base screening.\n\n**D8.1 Honest tax posture.** This annex does not declare that taxes are unnecessary. It narrows the preferred public-revenue base toward commons-created value and away from ordinary labor and survival. Residual taxes, fees, or charges may remain necessary during transition or at scale, but only if they are named, costed, screened against prohibited bases, and reviewed for dignity and incidence.\n\n**D8.2 Scale block.** If no costed model exists, if the model depends on inflation or debasement beyond published tolerance, or if burden shifts downward onto ordinary households, the project must block scale claims and downgrade public language.\n\n---\n\n## D9 \u2014 Dormant Backstops\n\nThe following instruments are not active routine policy. They may be studied, piloted, or activated only under the stated limits.\n\n| Backstop | Permitted use | Guardrail |\n|---|---|---|\n| **Harberger / COST-style self-assessment** | Hard-to-price illiquid assets where valuation hiding is a serious exploit. | Pilot-gated, asset-class specific, appealable, and never applied to primary shelter in a way that forces displacement. |\n| **Low-rate net-worth backstop** | Last-resort anti-avoidance when source-base rules fail against concentrated hidden control. | Non-load-bearing, low-rate, published incidence test, ordinary-household exemption, no survival-floor funding dependence. |\n| **Flow deflation circuit breaker** | Emergency monetary stabilization if issuance abuse threatens purchasing power. | Temporary, system-wide, independently triggered, and not a routine demurrage or public-finance tool. |\n\n**D9.1 No demurrage by default.** No routine balance decay, idle-money demurrage, progressive net-worth demurrage, or equivalent carrying cost may be introduced by interpretation. Any revival requires a new patch, fiscal/dignity evidence, public review, and the applicable amendment process.\n\n---\n\n## D10 \u2014 Evidence Package\n\nThe controlling evidence gate for this annex is the [Commons Return and Universal Stake Evidence Test Package](../governance/Commons_Return_Universal_Stake_Evidence_Test_Package.md).\n\nThe minimum tests are:\n\n- fiscal adequacy and downside revenue modeling;\n- incidence and dignity burden review;\n- source-base valuation red team;\n- legal-wrapper and beneficial-control avoidance review;\n- Universal Stake capture and election-timing simulation;\n- Essential Access lockbox sufficiency test;\n- small-operator, caregiver, elder, disability, and rural impact review;\n- privacy and surveillance-risk audit;\n- external-capital arbitrage test;\n- public comprehension test.\n\nNo stronger status may be claimed until these tests exist and residual risk is updated in the Claims and Evidence Register.\n",
       "headings": [
         {
           "level": 1,
@@ -11189,7 +11194,7 @@
           "slug": "d10-evidence-package"
         }
       ],
-      "wordCount": 2544,
+      "wordCount": 2553,
       "headingCount": 12
     },
     {
@@ -11289,7 +11294,7 @@
       "status": "",
       "statusBucket": "reference",
       "summary": "Design principle: belonging must be humane, capacity-aware, non-purchasable, and non-exploitable; the system must neither invite predation nor punish vulnerability.",
-      "content": "# ANNEX I \u2014 Residency, Migration, and Onboarding Article\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Defines who may enter, reside, onboard, and gain full civic standing \u2014 with staged rights-attachment, a humane survival floor for all persons physically present, and anti-purchase and anti-exploitation rules across all status classes. |\n> | **Who it protects** | Migrants, refugees, displaced persons, undocumented residents, children, dependents, trafficking survivors, and anyone whose belonging is precarious or contested. |\n> | **Failure risk** | Membership becomes a purchasable asset; capacity declarations are weaponized to exclude disfavored groups; employer or sponsor control over housing is used to coerce labor or identity transfer. |\n> | **Evidence status** | Designed |\n> | **Linked risks** | TR-11 Sybil attacks; TR-12 account takeover; P-003 proof-of-personhood; Annex P; Annex AK; founding preconditions in Annex N. |\n\n> **Provenance:** Foundational constitutional annex \u00b7 Governs residency, migration, onboarding, and humane membership continuity \u00b7 Status: **ACTIVE**\n**Purpose.** This annex defines who may enter, reside, onboard, and gain full civic standing in the system. It protects humane treatment, identity continuity, and family stability while preventing membership from becoming a purchasable asset, a political-stacking tool, or a backdoor pressure valve on Essential Access, housing, Voice, or Service Record.\n\n**Design principle: belonging must be humane, capacity-aware, non-purchasable, and non-exploitable;** the system must neither invite predation nor punish vulnerability.\n\n### I1. Status classes and anti-purchase rule\nEvery person physically present must be assigned a status class for continuity, service routing, and due-process purposes. Status assignment may affect onboarding sequence and queue priority, but it may not be used to deny the survival floor defined below.\n- **Core Resident** - a person with verified ordinary residence and settled membership in a region or the federation, entitled to ordinary Essential Access access and full public-service routing subject to the protocol.\n- **Provisional Resident** - a person in active onboarding who has established credible presence and domicile intent but has not yet completed the full residency pathway.\n- **Temporary Resident** - a person lawfully present for a bounded duration, assignment, study, caregiving, seasonal work, or other temporary purpose, with limited settlement rights unless later reclassified.\n- **Visitor / Transit Person** - a person present briefly for travel, passage, emergency landing, family visit, commerce, or similar short-duration purposes.\n- **Protected Entrant** - a person admitted or retained because return, expulsion, or non-admission would create a serious risk of death, persecution, trafficking, family rupture, or comparable grave harm.\n- **Dependent / Minor** - a child or dependent adult whose continuity follows a protected caregiver pathway and whose baseline care may not be interrupted by a status dispute involving another person.\n- **Identity-Compromised Person** - a person whose identity records are missing, conflicting, destroyed, or coerced; such a person must receive a continuity-safe interim status while verification proceeds.\n\n*No status class may be bought, sold, collateralized, or accelerated solely by Flow holdings, gifts, sponsorship payments, land control, or employer leverage. Sponsorship may support evidence of placement capacity, but it does not create ownership over a person.*\n\n### I2. Humane floor for all persons physically present\nNo person physically present may be left without a minimum continuity floor while status is determined or disputed. This floor is distinct from ordinary resident Essential Access and exists to prevent coercion, prevent avoidable death, and preserve due process.\n- **The survival floor includes** emergency food, potable water, sanitation access, urgent and stabilizing care, safe-shelter triage, violence protection, language access where practicable, and a written explanation of status decisions in understandable form.\n- **Children, pregnant persons, disabled persons, medically fragile persons, trafficking victims, and separated family members** receive priority continuity handling.\n- **No person may be detained, expelled, or denied** stabilizing services solely because they cannot immediately prove wealth, title, address, or documentary perfection.\n- **The survival floor does not by itself** create immediate entitlement to ordinary Essential Access balances, ordinary housing queue position, or Voice and Service Record participation, unless a protected-entry or dependency rule below says otherwise.\n\n### I3. Residency determination and evidence standards\nResidency must be determined by layered evidence rather than any single wealth-linked credential. Property ownership is neither necessary nor sufficient. Authorities must use the least intrusive combination of proofs that can reasonably establish continuity and prevent duplicate identity claims.\n- **Acceptable evidence** may include proof-of-personhood, verified continuous presence, declared domicile, dependent or caregiver linkage, school enrollment, healthcare continuity, public-service assignment, work authorization, public-institution sponsorship, or equivalent evidence defined by Tier 2 rules.\n- **No wealth test, land test, or employer-control test** may be used as a prerequisite for basic onboarding.\n- **When evidence conflicts**, the interim default must be the least harmful status consistent with fraud controls and public safety.\n- **A person with no community, sponsor, or witnesses** to attest for them retains a low-burden self-declaration fallback. Wherever an attestation or witness path is available to establish presence, domicile intent, or continuity, a self-declared equivalent must be available alongside it. Lacking a web of trust is never itself a disqualifier from provisional status or from the survival floor, and isolation alone may not defeat a self-declaration. Such declarations remain subject to ordinary deduplication and fraud controls, but the absence of corroborating persons may not be treated as evidence against the declarant.\n- **Existing Core Residents** are presumed continuous unless substantial contradictory evidence exists and due process is provided before downgrade.\n\n### I4. Onboarding phases and rights attachment\nOnboarding must be staged. Rights attach in layers so the system remains humane without making membership instantly purchasable or politically gameable.\n\n#### I4.1 Stage 0 - Intake and continuity triage (0-72 hours)\n- Issue a temporary continuity token or equivalent case identifier.\n- Provide the survival floor, immediate safety screening, anti-trafficking screening, and family-linkage screening.\n- Open a status case and record only the minimum necessary data to preserve continuity and prevent duplicate claims.\n- No ordinary Voice or Service Record rights exist at this stage. Ordinary Essential Access wallet issuance does not occur at this stage except where a protected-entry dependency rule explicitly requires it.\n\n#### I4.2 Stage 1 - Provisional presence (day 4 through day 90)\n- The person may receive provisional service routing, orientation, language support where available, continuity healthcare, and education access for minors.\n- The person may be authorized to work or provide services for Flow under rules that prohibit employer captivity, document withholding, or coercive housing tie-ins.\n- The person may enter emergency or transitional shelter queues, but not yet the ordinary long-term housing queue unless protected-entry, dependency, or medical-vulnerability rules require it.\n- No binding Voice participation exists at this stage, though public comment access may not be denied.\n\n#### I4.3 Stage 2 - Settled provisional residence (day 91 through day 180, or longer if review is pending)\n- A person who demonstrates continuous presence, credible domicile intent, and no unresolved fraud finding may be designated a Settled Provisional Resident.\n- Settled Provisional Residents may receive expanded healthcare continuity, education, local transit access, and region-assigned stabilization supports.\n- Ordinary Essential Access may begin at this stage only through one of three paths: protected-entry necessity, dependency continuity, or region/federated settlement assignment based on verified capacity. Otherwise the survival floor and stabilization supports continue until Core Resident activation.\n- Settled Provisional Residents may join the transitional housing queue and may receive region-assigned placement offers. Refusal of one offer does not extinguish rights, but repeated refusal of comparable safe offers may change queue priority under Tier 2 rules.\n\n#### I4.4 Stage 3 - Core Resident activation\n- Core Resident status activates when a person has completed at least 180 days of verified continuous residence and has either (a) a region-assigned settlement placement, (b) a protected-entry determination, (c) a dependency/family-unity basis, or (d) another Tier 2 lawful basis published in advance.\n- Core Residents receive ordinary Essential Access eligibility, ordinary public-service routing, and access to the ordinary housing queue under the same published rules that govern other residents.\n- Core Resident status may not be conditioned on wealth, ideology, employer sponsorship, land ownership, or religious/cultural conformity.\n- Core Resident status may be accelerated for protected entrants, family reunification cases, invited settlement programs, and medically urgent continuity cases, but every accelerated pathway must be published in advance and remain subject to anti-fraud review.\n\n#### I4.5 Civic Standing activation and Voice and Service Record eligibility\n- Ordinary Voice participation and Service Record earning or service eligibility begin only after four full quarters of verified Core Resident status plus completion of a published civic orientation and no unresolved fraud adjudication.\n- No person may accumulate retroactive Voice or Service Record for pre-activation time.\n- This waiting rule applies uniformly and may not be shortened for wealth, office, donor status, employer pressure, or electoral advantage.\n- Temporary Residents, Visitors, and persons still in provisional stages may speak, petition, and access public information, but they do not cast binding Voice-weighted decisions or enter Service Record-governed service pools.\n\n### I5. Capacity, placement, and region-at-capacity rules\nA humane system must also be capacity-honest. Regions may not promise settlement beyond verified capacity, but neither may they weaponize capacity claims to exclude disfavored people.\n- **Every region must publish** a privacy-preserving capacity dashboard covering baseline shelter, care, education, and placement bandwidth using the dashboard standards already defined elsewhere in the protocol.\n- **A region may declare** a temporary capacity constraint only through published criteria, evidence, and automatic review. False scarcity or discriminatory scarcity declarations are constitutional violations.\n- **What counts as shelter, care, education, and placement capacity** is fixed by a published baseline-bandwidth floor definition maintained at the federation level. A region may not narrow these definitions locally to manufacture honest-looking scarcity. A capacity-constraint declaration that would limit intake or services takes effect only when it is either certified at the federation level or measured against the published baseline-bandwidth floor; a region acting alone may not enact such a constraint on its own definitions.\n- **When a region is at capacity**, the federation must offer safe placement alternatives, travel continuity support, and family-unity handling. No person may be dumped into unsafe zones, punitive camps, or unsheltered transit as a substitute for placement.\n- **Existing Core Residents** may not be displaced from baseline shelter solely to make room for newcomers, except in a time-bounded emergency relocation process that preserves equal-or-better safety and due process.\n\n### I6. Housing queue access and land-use interface\n- All persons physically present may access emergency shelter triage when safety requires it.\n- Provisional and Protected Entrants may access transitional housing queues according to published vulnerability and continuity criteria.\n- Core Residents may access the ordinary housing queue and use-rights allocation system on equal published terms.\n- No employer, sponsor, or private host may use housing control to coerce labor, identity transfer, document surrender, or political behavior.\n- Because a person under coercion cannot be relied upon to report it, prohibition alone is insufficient. Sponsors, employers, and private hosts who hold placement or housing power over entrants are subject to periodic independent audits of those arrangements, conducted by reviewers who are not the placement party and not the region certifying the placement. A confidential worker-initiated reporting channel must be available to every entrant, reachable without the knowledge or permission of the sponsor, employer, or host, with anti-retaliation protection and victim-protective remedies. Audits and channel reports are coercion-detection mechanisms and operate independently of whether any complaint has been filed.\n- Regional preference rules are allowed only within published bounds and may not become disguised exclusion tools against protected groups, new Core Residents, or transferred households.\n\n### I7. Anti-fraud, anti-trafficking, and anti-stacking controls\n- Proof-of-personhood, deduplication, and continuity checks must be applied with due process and privacy minimization.\n- Bulk admissions, mass reclassifications, or accelerated civic activations in the period immediately preceding a quarterly cycle must trigger automatic review for political stacking risk.\n- Sponsor fraud, document trafficking, family-separation coercion, and employer captivity are high-severity violations subject to targeted sanctions and victim-protective remedies.\n- No public invitation or labor-shortage pathway may waive the Voice and Service Record waiting period, the anti-purchase rule, or the anti-surveillance rules.\n\n### I8. Appeals, review, and privacy protections\n- Every adverse status decision must be provided in writing with reasons, evidence basis, review path, and timeline.\n- Emergency review must begin within 72 hours where shelter loss, family separation, medical interruption, or expulsion risk is involved.\n- Ordinary status appeals must be available within 14 days of filing, with a written determination within 30 days unless the claimant requests more time.\n- Residency and migration data may be used only for continuity, routing, anti-fraud, safety, and lawfully published planning purposes. Individual-level exposure on public dashboards is prohibited.\n- The capacity dashboards and any migrant or entrant datasets are governed by data minimization, retention limits, and access controls. Only data necessary for the stated purpose is collected; it is retained no longer than that purpose requires and then deleted or irreversibly aggregated; access is limited to authorized roles and every access is logged. Such data may never be repurposed for enforcement, expulsion, deterrence, or any use beyond the lawful purposes named in this annex.\n- Privacy, anti-publicity, and anti-discrimination protections cover not only a person's individual records but also their status-classification data \u2014 which status class they are in. Status-class membership may not be published, disclosed, or made discoverable at the individual level, and may not be used as a basis for differential treatment outside the lawful service-routing and due-process purposes defined in this annex, so that a status class cannot harden into a public mark or stigma.\n- Children and protected entrants receive heightened confidentiality, and their data may not be publicized for deterrence theater or political messaging.\n\n### I9. Absence, exit, reentry, and continuity preservation\n- Routine travel, temporary caregiving, education, service deployment, medical treatment, or family emergency absence does not by itself break Core Resident continuity.\n- Ordinary Essential Access issuance may pause after a published absence threshold, but reactivation must be simple when continuity evidence exists and no fraud finding is present.\n- Civic Standing may pause after extended non-residence defined by Tier 2 rule, but reactivation must occur without restarting the entire residency pathway if personhood and domicile continuity are shown.\n- No child or dependent may lose baseline continuity solely because a caregiver crosses a paperwork threshold during reentry review.\n\n### I10. Bright-line constitutional limits\n- No ethnic, racial, religious, ideological, or wealth-based test may be used to grant or deny Core Resident activation or Civic Standing.\n- No region may sell, auction, or indirectly monetize residency status, settlement priority, or Voice and Service Record activation.\n- No residency or migration rule may reduce the survival floor below the minimum continuity obligations stated in this annex.\n- No status class may be used as a disguised caste system for labor exploitation, inferior justice, or permanent civil inferiority.\n- Any amendment that changes onboarding classes, waiting periods, survival-floor minima, capacity declarations, or Voice and Service Record activation rules is subject to the mandatory judicial review triggers in Annex H.\n\n---\n",
+      "content": "# ANNEX I \u2014 Residency, Migration, and Onboarding Article\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Defines who may enter, reside, onboard, and gain full civic standing \u2014 with staged rights-attachment, a humane survival floor for all persons physically present, and anti-purchase and anti-exploitation rules across all status classes. |\n> | **Who it protects** | Migrants, refugees, displaced persons, undocumented residents, children, dependents, trafficking survivors, and anyone whose belonging is precarious or contested. |\n> | **Failure risk** | Membership becomes a purchasable asset; capacity declarations are weaponized to exclude disfavored groups; employer or sponsor control over housing is used to coerce labor or identity transfer. |\n> | **Evidence status** | Designed |\n> | **Linked risks** | TR-11 Sybil attacks; TR-12 account takeover; P-003 proof-of-personhood; Annex P; Annex AK; founding preconditions in Annex N. |\n\n> **Provenance:** Foundational constitutional annex \u00b7 Governs residency, migration, onboarding, and humane membership continuity \u00b7 Status: **ACTIVE**\n**Purpose.** This annex defines who may enter, reside, onboard, and gain full civic standing in the system. It protects humane treatment, identity continuity, and family stability while preventing membership from becoming a purchasable asset, a political-stacking tool, or a backdoor pressure valve on Essential Access, housing, Voice, or Service Record.\n\n**Design principle: belonging must be humane, capacity-aware, non-purchasable, and non-exploitable;** the system must neither invite predation nor punish vulnerability.\n\n### I1. Status classes and anti-purchase rule\nEvery person physically present must be assigned a status class for continuity, service routing, and due-process purposes. Status assignment may affect onboarding sequence and queue priority, but it may not be used to deny the survival floor defined below.\n- **Core Resident** - a person with verified ordinary residence and settled membership in a region or the federation, entitled to ordinary Essential Access access and full public-service routing subject to the protocol.\n- **Provisional Resident** - a person in active onboarding who has established credible presence and domicile intent but has not yet completed the full residency pathway.\n- **Temporary Resident** - a person lawfully present for a bounded duration, assignment, study, caregiving, seasonal work, or other temporary purpose, with limited settlement rights unless later reclassified.\n- **Visitor / Transit Person** - a person present briefly for travel, passage, emergency landing, family visit, commerce, or similar short-duration purposes.\n- **Protected Entrant** - a person admitted or retained because return, expulsion, or non-admission would create a serious risk of death, persecution, trafficking, family rupture, or comparable grave harm.\n- **Dependent / Minor** - a child or dependent adult whose continuity follows a protected caregiver pathway and whose baseline care may not be interrupted by a status dispute involving another person.\n- **Identity-Compromised Person** - a person whose identity records are missing, conflicting, destroyed, or coerced; such a person must receive a continuity-safe interim status while verification proceeds.\n\n*No status class may be bought, sold, collateralized, or accelerated solely by Flow holdings, gifts, sponsorship payments, land control, or employer leverage. Sponsorship may support evidence of placement capacity, but it does not create ownership over a person.*\n\n### I2. Humane floor for all persons physically present\nNo person physically present may be left without a minimum continuity floor while status is determined or disputed. This floor is distinct from ordinary resident Essential Access and exists to prevent coercion, prevent avoidable death, and preserve due process.\n- **The survival floor includes** emergency food, potable water, sanitation access, urgent and stabilizing care, safe-shelter triage, violence protection, language access where practicable, and a written explanation of status decisions in understandable form.\n- **Children, pregnant persons, disabled persons, medically fragile persons, trafficking victims, and separated family members** receive priority continuity handling.\n- **No person may be detained, expelled, or denied** stabilizing services solely because they cannot immediately prove wealth, title, address, or documentary perfection.\n- **The survival floor does not by itself** create immediate entitlement to ordinary Essential Access balances, ordinary housing queue position, or Voice and Service Record participation, unless a protected-entry or dependency rule below says otherwise.\n\n### I3. Residency determination and evidence standards\nResidency must be determined by layered evidence rather than any single wealth-linked credential. Property ownership is neither necessary nor sufficient. Authorities must use the least intrusive combination of proofs that can reasonably establish continuity and prevent duplicate identity claims.\n- **Acceptable evidence** may include proof-of-personhood, verified continuous presence, declared domicile, dependent or caregiver linkage, school enrollment, healthcare continuity, public-service assignment, work authorization, public-institution sponsorship, or equivalent evidence defined by Tier 2 rules.\n- **No wealth test, land test, or employer-control test** may be used as a prerequisite for basic onboarding.\n- **When evidence conflicts**, the interim default must be the least harmful status consistent with fraud controls and public safety.\n- **A person with no community, sponsor, or witnesses** to attest for them retains a low-burden self-declaration fallback. Wherever an attestation or witness path is available to establish presence, domicile intent, or continuity, a self-declared equivalent must be available alongside it. Lacking a web of trust is never itself a disqualifier from provisional status or from the survival floor, and isolation alone may not defeat a self-declaration. Such declarations remain subject to ordinary deduplication and fraud controls, but the absence of corroborating persons may not be treated as evidence against the declarant.\n- **Existing Core Residents** are presumed continuous unless substantial contradictory evidence exists and due process is provided before downgrade.\n\n### I4. Onboarding phases and rights attachment\nOnboarding must be staged. Rights attach in layers so the system remains humane without making membership instantly purchasable or politically gameable.\n\n#### I4.1 Stage 0 - Intake and continuity triage (0-72 hours)\n- Issue a temporary continuity token or equivalent case identifier.\n- Provide the survival floor, immediate safety screening, anti-trafficking screening, and family-linkage screening.\n- Open a status case and record only the minimum necessary data to preserve continuity and prevent duplicate claims.\n- No ordinary Voice or Service Record rights exist at this stage. Ordinary Essential Access wallet issuance does not occur at this stage except where a protected-entry dependency rule explicitly requires it.\n\n#### I4.2 Stage 1 - Provisional presence (day 4 through day 90)\n- The person may receive provisional service routing, orientation, language support where available, continuity healthcare, and education access for minors.\n- The person may be authorized to work or provide services for Flow under rules that prohibit employer captivity, document withholding, or coercive housing tie-ins.\n- The person may enter emergency or transitional shelter queues, but not yet the ordinary long-term housing queue unless protected-entry, dependency, or medical-vulnerability rules require it.\n- No binding Voice participation exists at this stage, though public comment access may not be denied.\n\n#### I4.3 Stage 2 - Settled provisional residence (day 91 through day 180, or longer if review is pending)\n- A person who demonstrates continuous presence, credible domicile intent, and no unresolved fraud finding may be designated a Settled Provisional Resident.\n- Settled Provisional Residents may receive expanded healthcare continuity, education, local transit access, and region-assigned stabilization supports.\n- Ordinary Essential Access may begin at this stage only through one of three paths: protected-entry necessity, dependency continuity, or region/federated settlement assignment based on verified capacity. Otherwise the survival floor and stabilization supports continue until Core Resident activation.\n- Settled Provisional Residents may join the transitional housing queue and may receive region-assigned placement offers. Refusal of one offer does not extinguish rights, but repeated refusal of comparable safe offers may change queue priority under Tier 2 rules.\n\n#### I4.4 Stage 3 - Core Resident activation\n- Core Resident status activates when a person has completed at least 180 days of verified continuous residence and has either (a) a region-assigned settlement placement, (b) a protected-entry determination, (c) a dependency/family-unity basis, or (d) another Tier 2 lawful basis published in advance.\n- Core Residents receive ordinary Essential Access eligibility, ordinary public-service routing, and access to the ordinary housing queue under the same published rules that govern other residents.\n- Core Resident status may not be conditioned on wealth, ideology, employer sponsorship, land ownership, or religious/cultural conformity.\n- Core Resident status may be accelerated for protected entrants, family reunification cases, invited settlement programs, and medically urgent continuity cases, but every accelerated pathway must be published in advance and remain subject to anti-fraud review.\n\n#### I4.5 Civic Standing activation and Voice and Service Record eligibility\n- Ordinary Voice participation and Service Record earning or service eligibility begin only after four full quarters of verified Core Resident status plus completion of a published civic orientation and no unresolved fraud adjudication.\n- No person may accumulate retroactive Voice or Service Record for pre-activation time.\n- This waiting rule applies uniformly and may not be shortened for wealth, office, donor status, employer pressure, or electoral advantage.\n- Temporary Residents, Visitors, and persons still in provisional stages may speak, petition, and access public information, but they do not cast binding Voice-weighted decisions or enter Service Record-governed service pools.\n\n### I5. Capacity, placement, and region-at-capacity rules\nA humane system must also be capacity-honest. Regions may not promise settlement beyond verified capacity, but neither may they weaponize capacity claims to exclude disfavored people.\n- **Every region must publish** a privacy-preserving capacity dashboard covering baseline shelter, care, education, and placement bandwidth using the dashboard standards already defined elsewhere in the protocol.\n- **A region may declare** a temporary capacity constraint only through published criteria, evidence, and automatic review. False scarcity or discriminatory scarcity declarations are constitutional violations.\n- **What counts as shelter, care, education, and placement capacity** is fixed by a published baseline-bandwidth floor definition maintained at the federation level. A region may not narrow these definitions locally to manufacture honest-looking scarcity. A capacity-constraint declaration that would limit intake or services takes effect only when it is either certified at the federation level or measured against the published baseline-bandwidth floor; a region acting alone may not enact such a constraint on its own definitions.\n- **When a region is at capacity**, the federation must offer safe placement alternatives, travel continuity support, and family-unity handling. No person may be dumped into unsafe zones, punitive camps, or unsheltered transit as a substitute for placement.\n- **Existing Core Residents** may not be displaced from baseline shelter solely to make room for newcomers, except in a time-bounded emergency relocation process that preserves equal-or-better safety and due process.\n\n### I6. Housing queue access and land-use interface\n- All persons physically present may access emergency shelter triage when safety requires it.\n- Provisional and Protected Entrants may access transitional housing queues according to published vulnerability and continuity criteria.\n- Core Residents may access the ordinary housing queue and use-rights allocation system on equal published terms.\n- No employer, sponsor, or private host may use housing control to coerce labor, identity transfer, document surrender, or political behavior.\n- Because a person under coercion cannot be relied upon to report it, prohibition alone is insufficient. Sponsors, employers, and private hosts who hold placement or housing power over entrants are subject to periodic independent audits of those arrangements, conducted by reviewers who are not the placement party and not the region certifying the placement. A confidential worker-initiated reporting channel must be available to every entrant, reachable without the knowledge or permission of the sponsor, employer, or host, with anti-retaliation protection and victim-protective remedies. Audits and channel reports are coercion-detection mechanisms and operate independently of whether any complaint has been filed.\n- Regional preference rules are allowed only within published bounds and may not become disguised exclusion tools against protected groups, new Core Residents, or transferred households.\n\n### I7. Anti-fraud, anti-trafficking, and anti-stacking controls\n- Proof-of-personhood, deduplication, and continuity checks must be applied with due process and privacy minimization.\n- Bulk admissions, mass reclassifications, or accelerated civic activations in the period immediately preceding a quarterly cycle must trigger automatic review for political stacking risk.\n- Sponsor fraud, document trafficking, family-separation coercion, and employer captivity are high-severity violations subject to targeted sanctions and victim-protective remedies.\n- No public invitation or labor-shortage pathway may waive the Voice and Service Record waiting period, the anti-purchase rule, or the anti-surveillance rules.\n\n### I8. Appeals, review, and privacy protections\n- Every adverse status decision must be provided in writing with reasons, evidence basis, review path, and timeline.\n- Residency and migration data may be used only for continuity, routing, anti-fraud, safety, and lawfully published planning purposes. Individual-level exposure on public dashboards is prohibited.\n- The capacity dashboards and any migrant or entrant datasets are governed by data minimization, retention limits, and access controls. Only data necessary for the stated purpose is collected; it is retained no longer than that purpose requires and then deleted or irreversibly aggregated; access is limited to authorized roles and every access is logged. Such data may never be repurposed for enforcement, expulsion, deterrence, or any use beyond the lawful purposes named in this annex.\n- Privacy, anti-publicity, and anti-discrimination protections cover not only a person's individual records but also their status-classification data \u2014 which status class they are in. Status-class membership may not be published, disclosed, or made discoverable at the individual level, and may not be used as a basis for differential treatment outside the lawful service-routing and due-process purposes defined in this annex, so that a status class cannot harden into a public mark or stigma.\n- Children and protected entrants receive heightened confidentiality, and their data may not be publicized for deterrence theater or political messaging.\n- Status appeals run on the appeal spine ([ANNEX_L \u00a7L7](./ANNEX_L.md)), which carries the clocks (72h emergency / 14-day docket / 30-day determination); escalation follows the spine ladder.\n\n### I9. Absence, exit, reentry, and continuity preservation\n- Routine travel, temporary caregiving, education, service deployment, medical treatment, or family emergency absence does not by itself break Core Resident continuity.\n- Ordinary Essential Access issuance may pause after a published absence threshold, but reactivation must be simple when continuity evidence exists and no fraud finding is present.\n- Civic Standing may pause after extended non-residence defined by Tier 2 rule, but reactivation must occur without restarting the entire residency pathway if personhood and domicile continuity are shown.\n- No child or dependent may lose baseline continuity solely because a caregiver crosses a paperwork threshold during reentry review.\n\n### I10. Bright-line constitutional limits\n- No ethnic, racial, religious, ideological, or wealth-based test may be used to grant or deny Core Resident activation or Civic Standing.\n- No region may sell, auction, or indirectly monetize residency status, settlement priority, or Voice and Service Record activation.\n- No residency or migration rule may reduce the survival floor below the minimum continuity obligations stated in this annex.\n- No status class may be used as a disguised caste system for labor exploitation, inferior justice, or permanent civil inferiority.\n- Any amendment that changes onboarding classes, waiting periods, survival-floor minima, capacity declarations, or Voice and Service Record activation rules is subject to the mandatory judicial review triggers in Annex H.\n\n---\n",
       "headings": [
         {
           "level": 1,
@@ -11372,7 +11377,7 @@
           "slug": "i10-bright-line-constitutional-limits"
         }
       ],
-      "wordCount": 2479,
+      "wordCount": 2464,
       "headingCount": 16
     },
     {
@@ -11383,7 +11388,7 @@
       "status": "",
       "statusBucket": "reference",
       "summary": "This annex carries the ownership architecture that keeps Article V's anti-rent and anti-extraction logic from being defeated by legal form. Where Annex D addresses Commons Return and Universal Stake \u2014 public return from shared value, scarcity rents, and large succession transfers \u2014 this annex addresses control: who ultimately owns, who succeeds to ownership, and on what terms capital may claim a return. It works alongside Annex D, Annex X \u00a7X8 (public finance and commons revenue), Annex AR (contract-commitment architecture), and Annex V (housing and land use-rights). It is not evidence-backed until trust-law, beneficial-control, land-rights, and enterprise-control red teams pass.",
-      "content": "# ANNEX J \u2014 Anti-Dynasty, Stewardship, and Worker-Owned Enterprise Architecture\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Designed to block tested routes by which ownership of land, housing, and enterprise can harden into inherited class position. Counts beneficial ownership through to natural persons or mission-locked bodies, prohibits perpetual extractive wrappers, reframes ownership as stewardship rather than a perpetual tribute right, and gives worker-owned and mission-locked firms structural preference. |\n> | **Who it protects** | Future generations owed freedom from inherited advantage hardening into class position; current workers, tenants, and small operators exposed to dynastic landlordism and passive extraction; legitimate family continuity, which is protected in modest form rather than abolished. |\n> | **Failure risk** | Wealth persists as control through trusts, family offices, foundations, shell chains, mission-lock capture, land-control rights, or business-control workarounds not blocked by existing rules \u2014 recreating a rentier aristocracy behind compliant paperwork. |\n> | **Evidence status** | Designed |\n> | **Linked risks** | P-031, P-032, P-033; rentier and dynastic accumulation; trust / shell / beneficial-ownership capture; mission-lock capture; sham-cooperative gaming. |\n\nThis annex carries the ownership architecture that keeps Article V's anti-rent and anti-extraction logic from being defeated by legal form. Where Annex D addresses Commons Return and Universal Stake \u2014 public return from shared value, scarcity rents, and large succession transfers \u2014 this annex addresses *control*: who ultimately owns, who succeeds to ownership, and on what terms capital may claim a return. It works alongside Annex D, Annex X \u00a7X8 (public finance and commons revenue), Annex AR (contract-commitment architecture), and Annex V (housing and land use-rights). It is not evidence-backed until trust-law, beneficial-control, land-rights, and enterprise-control red teams pass.\n\n> **Provenance:** The ownership and anti-dynasty material consolidated here was drafted as Annex R and distributed in the 2026-04-25 review \u2014 the contribution-motivation clauses to Annex U, and the ownership architecture (\u00a7R1\u2013\u00a7R2) here. Section numbering (\u00a7R1, \u00a7R2) is preserved so existing cross-references resolve without change.\n\n---\n\n## J\u00b7R1 \u2014 Beneficial Ownership, Anti-Dynasty Limits, and Worker-Owned Preference\n\n**R1.1 Beneficial ownership counts through.** Ownership of land, housing, enterprise equity, and other productive or rent-bearing assets is always attributed to the natural persons who ultimately benefit, or to mission-locked or community bodies governed under published stewardship rules. No trust, holding company, foundation, nominee, shell chain, or equivalent structure may obscure or interrupt that attribution. Beneficial-ownership transparency is a precondition of holding, not a disclosure made only on demand.\n\nThe transparency precondition is calibrated to the structure held, not to ordinary households. A de minimis floor exempts holdings at or below a published ordinary-household threshold \u2014 a family renting an inherited room, a member's stake in a small co-op, and equivalent modest holdings \u2014 from the through-attribution and standing-disclosure regime that binds dynastic and rent-bearing structures. The de minimis floor is wired to the continuity carve-outs of R1.3: a home, the tools and instruments of a trade, and provision for dependents fall under the exemption and are not swept into the transparency precondition that governs trusts, holding chains, family offices, and equivalent dynastic structures. The floor lifts only where modest holdings are aggregated or layered into structures whose effect is dynastic accumulation, which then fall back under the full precondition.\n\n**R1.1a Functional-control test.** Control follows functional benefit and decision power, not title, label, sector, or formal ownership percentage. A person, family group, funder, family office, foundation, donor-advised vehicle, trust protector, creditor, manager, franchisor, licensor, platform operator, or affiliated entity is treated as controlling where it can materially direct economics, governance, use, disposition, succession, financing, pricing, data access, operating policy, or veto rights. Control includes voting rights, non-voting economic rights, preferred equity, board appointment rights, veto rights, debt covenants, powers of appointment, side letters, management-service agreements, IP or license dependency, related-party debt, supplier dependency, software or data control, and coordinated family-office or foundation action.\n\n**R1.1b Land-control rights.** Land and housing control includes title and title-like substitutes: long leases, ground leases, options, easements, occupancy derivatives, management rights, service-control contracts, related-party debt secured by land or use-rights, exclusive operating rights, and any arrangement whose economic effect is to reserve scarcity value, rental extraction, or future disposition power while avoiding title.\n\n**R1.2 No perpetual extractive succession.** Perpetual trusts, dynastic holding structures, absentee succession vehicles, and equivalent perpetual extractive wrappers may not preserve control of rent-bearing or enterprise assets across generations. Succession of such assets is subject to review against the anti-dynasty standard; structures whose economic effect is to perpetuate extractive control beyond a natural lifetime without active stewardship are prohibited.\n\n**R1.3 Family continuity is protected in modest form.** This annex does not abolish inheritance or punish ordinary family continuity. Homes, tools and instruments of a trade, provision for dependents, and mission-locked stewardship bodies pass under explicit continuity allowances. The prohibition targets dynastic landlordism, absentee succession structures, and perpetual extractive wrappers \u2014 not a family keeping its home, its tools, or a worker-governed enterprise.\n\n**R1.4 Worker-owned and mission-locked preference.** Worker-owned, cooperative, and mission-locked firms receive structural preference in PFCR-backed finance, public procurement, retained-earnings treatment, worker-buyout pathways, and founder-exit conversion rules (governed in detail by Article V, Annex X \u00a7X8, and Annex AR). Natural monopolies are moved to a separate regulated-utility track rather than left to private extractive ownership. Outside capital claims on preferred firms must be capped, redeemable, sunset, or otherwise bounded.\n\n**R1.5 Anti-gaming.** Preferential treatment under R1.4 is conditioned on governance-proof requirements, payout constraints, and beneficial-ownership transparency, so that a sham cooperative or a nominally mission-locked body controlled in substance by a private extractive owner does not qualify. Determinations are made against published criteria with documented appeal paths.\n\n**R1.6 Enterprise-control proxies.** Worker-owned, cooperative, and mission-locked forms fail the anti-gaming test if practical control remains with an outside actor through voting/non-voting share splits, preferred equity, board appointment rights, franchising, IP or brand licenses, common lender or insurer control, management-service agreements, supplier dependency, software or data control, founder golden-share rights, or side agreements. A firm may receive structural preference only after the reviewer can trace control, benefit, and veto power through the full arrangement.\n\n---\n\n## J\u00b7R2 \u2014 Stewardship Ownership Standard and Passive-Extraction Limits\n\n**R2.1 Ownership as stewardship.** Ownership across land, housing, and enterprise is held as stewardship rather than as a perpetual tribute right. Capital may be rewarded for genuine risk and genuine productive contribution. It may not claim endless passive extraction from necessity or from labor once the contributed risk and value have been fairly returned.\n\n**R2.2 Bounded capital claims.** Capital claims on stewarded assets are bounded \u2014 through anti-rent use-right logic for land and housing, capped and redeemable outside-capital instruments for enterprise, and judicially reviewable limits on passive extraction. The boundary distinguishes a fair return on contribution from a perpetual rent extracted because one holds the title.\n\n**R2.3 Passive-extraction prohibition is reviewable.** Whether a given arrangement is productive stewardship or prohibited passive extraction is a reviewable question, not a self-certification. Determinations rest on published criteria, are subject to appeal, and require mission-lock documentation where stewardship status is claimed. Valuation disputes about what counts as productive stewardship are resolved through that review process, not by the asserted intent of the holder.\n\nThe review is bound to a rule, not to discretion. The criteria distinguishing productive stewardship from prohibited passive extraction \u2014 and the line at which contributed risk and value have been fairly returned \u2014 are published in advance and applied as a standing rule to like cases alike, not improvised case by case. Those criteria live in a published stewardship standard set under Article V, itself open to challenge and revision through ordinary review; the adjudicating body applies that standard and does not author the boundary in the course of deciding a particular holding. The reviewer of any determination is independent of the parties and of any person who would benefit from the outcome, and recuses where a conflict exists. The burden of proof is bounded and stated in the published standard: a holder is not presumed to be a passive extractor, an honest steward is not put to an impossible proof, and the case for prohibition rests on the reviewing body against the published criteria. These constraints exist so that the boundary between protected stewardship and prohibited extraction is fixed by a rule announced beforehand, in the spirit of a fixed Jubilee release rather than a discretionary judgment that could be turned to advantage.\n\n**R2.4 Enforcement interfaces.** This standard is enforced through housing and commons use-right enforcement (Annex V), capital-instrument redesign and anti-monopoly enforcement (ACC), beneficial-ownership and succession review (R1), and Commons Return source-base review for scarcity rents, public-created value, and large succession transfers (Annex D). No single mechanism is sufficient alone; the standard depends on their combination.\n\n---\n\n## J\u00b7R3 \u2014 Honest Limits\n\nThis annex specifies a designed architecture; it is not yet evidence-backed. The decisive open work is legal and economic: trust-law analysis, a beneficial-ownership red-team, cooperative-ownership evidence, and property-use transition modeling capable of identifying any trust, shell, or beneficial-ownership structure that would preserve inter-generational extractive control outside these prohibitions (see Claims_Evidence_Register and Hardening_Queue). Until that work is done, no stronger public claim should be made than that the architecture is designed to close the anti-dynasty and passive-extraction gaps \u2014 not that it has been shown to close them.\n",
+      "content": "# ANNEX J \u2014 Anti-Dynasty, Stewardship, and Worker-Owned Enterprise Architecture\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Designed to block tested routes by which ownership of land, housing, and enterprise can harden into inherited class position. Counts beneficial ownership through to natural persons or mission-locked bodies, prohibits perpetual extractive wrappers, reframes ownership as stewardship rather than a perpetual tribute right, and gives worker-owned and mission-locked firms structural preference. |\n> | **Who it protects** | Future generations owed freedom from inherited advantage hardening into class position; current workers, tenants, and small operators exposed to dynastic landlordism and passive extraction; legitimate family continuity, which is protected in modest form rather than abolished. |\n> | **Failure risk** | Wealth persists as control through trusts, family offices, foundations, shell chains, mission-lock capture, land-control rights, or business-control workarounds not blocked by existing rules \u2014 recreating a rentier aristocracy behind compliant paperwork. |\n> | **Evidence status** | Designed |\n> | **Linked risks** | P-031, P-032, P-033; rentier and dynastic accumulation; trust / shell / beneficial-ownership capture; mission-lock capture; sham-cooperative gaming. |\n\nThis annex carries the ownership architecture that keeps Article V's anti-rent and anti-extraction logic from being defeated by legal form. Where Annex D addresses Commons Return and Universal Stake \u2014 public return from shared value, scarcity rents, and large succession transfers \u2014 this annex addresses *control*: who ultimately owns, who succeeds to ownership, and on what terms capital may claim a return. It works alongside Annex D, Annex X \u00a7X8 (public finance and commons revenue), Annex AR (contract-commitment architecture), and Annex V (housing and land use-rights). It is not evidence-backed until trust-law, beneficial-control, land-rights, and enterprise-control red teams pass.\n\n> **Provenance:** The ownership and anti-dynasty material consolidated here was drafted as Annex R and distributed in the 2026-04-25 review \u2014 the contribution-motivation clauses to Annex U, and the ownership architecture (\u00a7R1\u2013\u00a7R2) here. Section numbering (\u00a7R1, \u00a7R2) is preserved so existing cross-references resolve without change.\n\n---\n\n## J\u00b7R1 \u2014 Beneficial Ownership, Anti-Dynasty Limits, and Worker-Owned Preference\n\n**R1.1 Beneficial ownership counts through.** Ownership of land, housing, enterprise equity, and other productive or rent-bearing assets is always attributed to the natural persons who ultimately benefit, or to mission-locked or community bodies governed under published stewardship rules. No trust, holding company, foundation, nominee, shell chain, or equivalent structure may obscure or interrupt that attribution. Beneficial-ownership transparency is a precondition of holding, not a disclosure made only on demand.\n\nThe transparency precondition is calibrated to the structure held, not to ordinary households. A de minimis floor exempts holdings at or below a published ordinary-household threshold \u2014 a family renting an inherited room, a member's stake in a small co-op, and equivalent modest holdings \u2014 from the through-attribution and standing-disclosure regime that binds dynastic and rent-bearing structures. The de minimis floor is wired to the continuity carve-outs of R1.3: a home, the tools and instruments of a trade, and provision for dependents fall under the exemption and are not swept into the transparency precondition that governs trusts, holding chains, family offices, and equivalent dynastic structures. The floor lifts only where modest holdings are aggregated or layered into structures whose effect is dynastic accumulation, which then fall back under the full precondition.\n\n**R1.1a Functional-control test.** Control follows functional benefit and decision power, not title, label, sector, or formal ownership percentage. A person, family group, funder, family office, foundation, donor-advised vehicle, trust protector, creditor, manager, franchisor, licensor, platform operator, or affiliated entity is treated as controlling where it can materially direct economics, governance, use, disposition, succession, financing, pricing, data access, operating policy, or veto rights. Control includes voting rights, non-voting economic rights, preferred equity, board appointment rights, veto rights, debt covenants, powers of appointment, side letters, management-service agreements, IP or license dependency, related-party debt, supplier dependency, software or data control, and coordinated family-office or foundation action.\n\n**R1.1b Land-control rights.** Land and housing control includes title and title-like substitutes: long leases, ground leases, options, easements, occupancy derivatives, management rights, service-control contracts, related-party debt secured by land or use-rights, exclusive operating rights, and any arrangement whose economic effect is to reserve scarcity value, rental extraction, or future disposition power while avoiding title.\n\n**R1.2 No perpetual extractive succession.** Perpetual trusts, dynastic holding structures, absentee succession vehicles, and equivalent perpetual extractive wrappers may not preserve control of rent-bearing or enterprise assets across generations. Succession of such assets is subject to review against the anti-dynasty standard; structures whose economic effect is to perpetuate extractive control beyond a natural lifetime without active stewardship are prohibited.\n\n**R1.3 Family continuity is protected in modest form.** This annex does not abolish inheritance or punish ordinary family continuity. Homes, tools and instruments of a trade, provision for dependents, and mission-locked stewardship bodies pass under explicit continuity allowances. The prohibition targets dynastic landlordism, absentee succession structures, and perpetual extractive wrappers \u2014 not a family keeping its home, its tools, or a worker-governed enterprise.\n\n**R1.4 Worker-owned and mission-locked preference.** Worker-owned, cooperative, and mission-locked firms receive structural preference in PFCR-backed finance, public procurement, retained-earnings treatment, worker-buyout pathways, and founder-exit conversion rules (governed in detail by Article V, Annex X \u00a7X8, and Annex AR). Natural monopolies are moved to a separate regulated-utility track rather than left to private extractive ownership. Outside capital claims on preferred firms must be capped, redeemable, sunset, or otherwise bounded.\n\n**R1.5 Anti-gaming.** Preferential treatment under R1.4 is conditioned on governance-proof requirements, payout constraints, and beneficial-ownership transparency, so that a sham cooperative or a nominally mission-locked body controlled in substance by a private extractive owner does not qualify. Determinations are made against published criteria with documented appeal paths.\n\n**R1.6 Enterprise-control proxies.** Worker-owned, cooperative, and mission-locked forms fail the anti-gaming test if practical control remains with an outside actor through voting/non-voting share splits, preferred equity, board appointment rights, franchising, IP or brand licenses, common lender or insurer control, management-service agreements, supplier dependency, software or data control, founder golden-share rights, or side agreements. A firm may receive structural preference only after the reviewer can trace control, benefit, and veto power through the full arrangement.\n\n---\n\n## J\u00b7R2 \u2014 Stewardship Ownership Standard and Passive-Extraction Limits\n\n**R2.1 Ownership as stewardship.** Ownership across land, housing, and enterprise is held as stewardship rather than as a perpetual tribute right. Capital may be rewarded for genuine risk and genuine productive contribution. It may not claim endless passive extraction from necessity or from labor once the contributed risk and value have been fairly returned.\n\n**R2.2 Bounded capital claims.** Capital claims on stewarded assets are bounded \u2014 through anti-rent use-right logic for land and housing, capped and redeemable outside-capital instruments for enterprise, and judicially reviewable limits on passive extraction. The boundary distinguishes a fair return on contribution from a perpetual rent extracted because one holds the title.\n\n**R2.3 Passive-extraction prohibition is reviewable.** Whether a given arrangement is productive stewardship or prohibited passive extraction is a reviewable question, not a self-certification. Determinations rest on published criteria, are appealable per the appeal spine ([ANNEX_L \u00a7L7](./ANNEX_L.md)) with the independent stewardship reviewer as first instance, and require mission-lock documentation where stewardship status is claimed. Valuation disputes about what counts as productive stewardship are resolved through that review process, not by the asserted intent of the holder.\n\nThe review is bound to a rule, not to discretion. The criteria distinguishing productive stewardship from prohibited passive extraction \u2014 and the line at which contributed risk and value have been fairly returned \u2014 are published in advance and applied as a standing rule to like cases alike, not improvised case by case. Those criteria live in a published stewardship standard set under Article V, itself open to challenge and revision through ordinary review; the adjudicating body applies that standard and does not author the boundary in the course of deciding a particular holding. The reviewer of any determination is independent of the parties and of any person who would benefit from the outcome, and recuses where a conflict exists. The burden of proof is bounded and stated in the published standard: a holder is not presumed to be a passive extractor, an honest steward is not put to an impossible proof, and the case for prohibition rests on the reviewing body against the published criteria. These constraints exist so that the boundary between protected stewardship and prohibited extraction is fixed by a rule announced beforehand, in the spirit of a fixed Jubilee release rather than a discretionary judgment that could be turned to advantage.\n\n**R2.4 Enforcement interfaces.** This standard is enforced through housing and commons use-right enforcement (Annex V), capital-instrument redesign and anti-monopoly enforcement (ACC), beneficial-ownership and succession review (R1), and Commons Return source-base review for scarcity rents, public-created value, and large succession transfers (Annex D). No single mechanism is sufficient alone; the standard depends on their combination.\n\n---\n\n## J\u00b7R3 \u2014 Honest Limits\n\nThis annex specifies a designed architecture; it is not yet evidence-backed. The decisive open work is legal and economic: trust-law analysis, a beneficial-ownership red-team, cooperative-ownership evidence, and property-use transition modeling capable of identifying any trust, shell, or beneficial-ownership structure that would preserve inter-generational extractive control outside these prohibitions (see Claims_Evidence_Register and Hardening_Queue). Until that work is done, no stronger public claim should be made than that the architecture is designed to close the anti-dynasty and passive-extraction gaps \u2014 not that it has been shown to close them.\n",
       "headings": [
         {
           "level": 1,
@@ -11406,7 +11411,7 @@
           "slug": "jr3-honest-limits"
         }
       ],
-      "wordCount": 1606,
+      "wordCount": 1620,
       "headingCount": 4
     },
     {
@@ -11466,7 +11471,7 @@
       "status": "",
       "statusBucket": "reference",
       "summary": "Design principle: no single office should be able to quietly reinterpret the constitution.",
-      "content": "# ANNEX L \u2014 Judicial Architecture and Constitutional Review Institutions\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Constitutes the three-tier review architecture (Local Review Offices, Regional Constitutional Chambers, Constitutional Review Panel), defines CRP composition via sortition, sets standards of review for each tier, specifies the remedy ladder, and maps dispute classes to forum and appeal path. |\n> | **Who it protects** | Anyone who suffers an adverse decision \u2014 loss of Essential Access, identity denial, oracle dispute, emergency-power overreach \u2014 and needs a legible, fast-acting path to challenge it. |\n> | **Failure risk** | Without a constituted review body, the CRP remains implicit and therefore capturable; no single office can quietly reinterpret the constitution, but multiple offices in concert can if there is no independent check. |\n> | **Evidence status** | Designed |\n> | **Linked risks** | CRP capture scenarios (Annex S); amendment classification risk (Annex H \u00a7H4); sortition integrity; TR-08 verifier capture; TR-10 emergency pause abuse. |\n\n> **Provenance:** Foundational constitutional annex \u00b7 Constitutes judicial architecture and constitutional review institutions \u00b7 Status: **ACTIVE**\n\n**Purpose.** Annexes G and H require a review body, but a body this load-bearing cannot remain implicit. This annex constitutes the review architecture, forum selection, standards of review, and remedy ladder needed to keep tier boundaries, rights, and instrument separation enforceable.\n\n**Design principle:** no single office should be able to quietly reinterpret the constitution.\n\n### L1. Review bodies\n- **Local Review Offices** handle ordinary administrative appeals, evidence disputes, and continuity triage.\n- **Regional Constitutional Chambers** handle regional charter questions, inter-article or instrument disputes within region, and first-instance review of serious rights deprivations.\n- **The Constitutional Review Panel (CRP)** is the federation-level boundary guardian for amendment classification, Tier 1/Tier 2 drift, instrument separation, and mandatory pre-clearance review.\n\n### L2. Constitutional Review Panel composition\n- **The CRP shall contain 11 members.**\n- **Four seats:** jurists drawn by lot from qualified regional appellate pools.\n- **Three seats:** systems reviewers with demonstrated competence in public finance, identity/continuity, and capacity/oracle design, selected from certified pools through public lot with conflict screening.\n- **Two seats:** ombuds/public-interest advocates selected from an independent advocacy pool by lot.\n- **Two seats:** civic auditors selected through sortition from a trained civic review pool; these members may not currently hold executive office or major enterprise control.\n- **Terms are staggered**, non-renewable back-to-back, and subject to strict recusal, wealth/conflict disclosure, and anti-lobbying rules.\n- **The integrity of every feeding pool is itself a constitutional question.** Rules for certifying, training, and qualifying the regional appellate, certified systems-reviewer, independent advocacy, and civic-review pools are governed under Strict review; no pool may be constituted, narrowed, or disqualified except by a published standard subject to that standard.\n- **The bodies and persons who certify, train, or qualify these pools are themselves subject to the same recusal, wealth/conflict-disclosure, and anti-lobbying regime as panel members.** Their certification, training, and qualification decisions are recorded, publicly auditable except for protected personal data, and appealable to the Regional Constitutional Chambers, with constitutional review where pool integrity bears on Tier 1 invariants or sortition fairness.\n\n### L3. Capture resistance and self-protection\n- **Any single CRP member**, the Ombuds Office, one-third of a deliberative minority bloc, or a qualifying public petition may trigger temporary stay and full-chamber review for suspected misclassification or disguised convertibility.\n- **Trigger thresholds must be a real, accessible remedy, not a nominal gate.** The minority-bloc fraction and the qualifying-petition threshold are set low enough that an ordinary affected population can reach them, and are themselves reviewable for accessibility; where a threshold is shown to be unreachable in practice, it is reduced.\n- **Tier-sensitive determinations** require a supermajority of the full CRP plus a published opinion.\n- **Any CRP decision** weakening privacy, Essential Access continuity, or instrument separation automatically triggers external review by a rotating regional chamber panel. **That panel is drawn from a pool disjoint from the CRP's feeding pools**, so the external check is genuinely independent; no person who sits in, certifies, or feeds the CRP's pools may serve on the reviewing panel for the same matter.\n- **CRP opinions, dissents**, conflicts, and evidence packets are public except for protected personal data.\n\n### L4. Standards of review\n- **Strict review** applies to Tier 1 invariants, personhood/identity continuity, Essential Access narrowing, convertibility risk, surveillance expansion, and civic-rights restrictions.\n- **Heightened review** applies to Tier 2 changes affecting housing, migration, public finance, oracle thresholds, or major vendor/pricing rules.\n- **Ordinary reasonableness review** applies to Tier 3 operational adjustments that do not materially burden rights or cross article/instrument boundaries.\n- **Where uncertainty is high**, the burden remains on the authority that seeks to narrow access, expand data exposure, or create new coercive discretion.\n\n### L5. Remedy ladder\n- **Available remedies** include stay, reclassification upward, nullification, partial severance, rollback to last-known-valid rule, compensatory continuity order, and targeted institutional sanctions.\n- **No remedy may solve** an institutional error by cutting off survival-floor protections to the affected population.\n- **Software, oracle, and platform releases** that alter legal effect without authorization are void upon finding and must revert immediately.\n\n---\n\n## L6 \u2014 Justice, Appeals, and Constitutional Review (merged from former Annex G \u00a7G3)\n\n> **Provenance:** Originally drafted as Annex G \u00a7G3 (\"Justice, Appeals, and Constitutional Review\"). Annex G was retired in the 2026-04-25 review and held in Annex H pending redistribution; moved here in the 2026-04-25 follow-up because dispute classes, appeal paths, and remedies belong with the judicial architecture defined in L1\u2013L5.\n\nEvery materially adverse decision must be challengeable by a legible path. Automated decisions are never self-justifying; they must produce a reviewable record and a human-readable explanation.\n\n| Dispute class | Initial review | Appeal path | Typical remedies |\n| :--- | :--- | :--- | :--- |\n| **Identity / personhood** | Administrative identity tribunal or registrar review. | Independent personhood court; constitutional review if rights are implicated. | Record correction, restored continuity, temporary manual access, damages for wrongful denial. |\n| **Essential Access delivery / service access** | Service ombuds + rapid benefit review. | Regional administrative court with emergency relief window. | Immediate restoration, arrears / restitution, corrected routing, vendor sanctions. |\n| **Voice / Service Record attribution / contribution verification** | Contribution registry review with verifier challenge file. | Independent civic adjudicator; constitutional review if structural bias is alleged. | Re-score, nullification of fraudulent attestations, verifier penalties, published correction. |\n| **Vendor / commercial disputes** | Contract and market regulator review. | Commercial court / arbitration subject to public-law guardrails. | Specific performance, compensation, license conditions, procurement exclusion. |\n| **Oracle / capacity data disputes** | Technical audit panel and temporary conservative operating mode. | Independent review chamber; constitutional review if prolonged deprivation risk exists. | Data correction, rollback, model freeze, re-issuance / reconciliation. |\n| **Emergency powers / rights impacts** | Immediate judicial notice and rights-impact filing. | Constitutional court on expedited schedule. | Injunction, sunset enforcement, compensation, removal of unlawful measures. |\n\n- Burden of justification lies with the authority imposing deprivation, restriction, or adverse classification.\n- Severe consequences require notice, access to evidence, explanation of the rule invoked, and access to counsel or advocate support.\n- Counsel and advocate support extend to the commercial-court and technical-audit tracks, so that under-resourced parties receive qualified representation and independent expert assistance where expertise or cost asymmetry would otherwise undercut the burden-shift above.\n- Emergency relief windows should be measured in hours or days, not months, whenever survival access, identity continuity, or liberty interests are at stake.\n- Algorithmic systems must preserve the inputs, rules, and model / version state necessary for retrospective review.\n",
+      "content": "# ANNEX L \u2014 Judicial Architecture and Constitutional Review Institutions\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Constitutes the three-tier review architecture (Local Review Offices, Regional Constitutional Chambers, Constitutional Review Panel), defines CRP composition via sortition, sets standards of review for each tier, specifies the remedy ladder, and maps dispute classes to forum and appeal path; \u00a7L7 is the canonical appeal spine for every appeal context in the corpus. |\n> | **Who it protects** | Anyone who suffers an adverse decision \u2014 loss of Essential Access, identity denial, oracle dispute, emergency-power overreach \u2014 and needs a legible, fast-acting path to challenge it. |\n> | **Failure risk** | Without a constituted review body, the CRP remains implicit and therefore capturable; no single office can quietly reinterpret the constitution, but multiple offices in concert can if there is no independent check. |\n> | **Evidence status** | Designed |\n> | **Linked risks** | CRP capture scenarios (Annex S); amendment classification risk (Annex H \u00a7H4); sortition integrity; TR-08 verifier capture; TR-10 emergency pause abuse. |\n\n> **Provenance:** Foundational constitutional annex \u00b7 Constitutes judicial architecture and constitutional review institutions \u00b7 Status: **ACTIVE**\n\n**Purpose.** Annexes G and H require a review body, but a body this load-bearing cannot remain implicit. This annex constitutes the review architecture, forum selection, standards of review, and remedy ladder needed to keep tier boundaries, rights, and instrument separation enforceable.\n\n**Design principle:** no single office should be able to quietly reinterpret the constitution.\n\n### L1. Review bodies\n- **Local Review Offices** handle ordinary administrative appeals, evidence disputes, and continuity triage.\n- **Regional Constitutional Chambers** handle regional charter questions, inter-article or instrument disputes within region, and first-instance review of serious rights deprivations.\n- **The Constitutional Review Panel (CRP)** is the federation-level boundary guardian for amendment classification, Tier 1/Tier 2 drift, instrument separation, and mandatory pre-clearance review.\n\n### L2. Constitutional Review Panel composition\n- **The CRP shall contain 11 members.**\n- **Four seats:** jurists drawn by lot from qualified regional appellate pools.\n- **Three seats:** systems reviewers with demonstrated competence in public finance, identity/continuity, and capacity/oracle design, selected from certified pools through public lot with conflict screening.\n- **Two seats:** ombuds/public-interest advocates selected from an independent advocacy pool by lot.\n- **Two seats:** civic auditors selected through sortition from a trained civic review pool; these members may not currently hold executive office or major enterprise control.\n- **Terms are staggered**, non-renewable back-to-back, and subject to strict recusal, wealth/conflict disclosure, and anti-lobbying rules.\n- **The integrity of every feeding pool is itself a constitutional question.** Rules for certifying, training, and qualifying the regional appellate, certified systems-reviewer, independent advocacy, and civic-review pools are governed under Strict review; no pool may be constituted, narrowed, or disqualified except by a published standard subject to that standard.\n- **The bodies and persons who certify, train, or qualify these pools are themselves subject to the same recusal, wealth/conflict-disclosure, and anti-lobbying regime as panel members.** Their certification, training, and qualification decisions are recorded, publicly auditable except for protected personal data, and appealable to the Regional Constitutional Chambers, with constitutional review where pool integrity bears on Tier 1 invariants or sortition fairness.\n\n### L3. Capture resistance and self-protection\n- **Any single CRP member**, the Ombuds Office, one-third of a deliberative minority bloc, or a qualifying public petition may trigger temporary stay and full-chamber review for suspected misclassification or disguised convertibility.\n- **Trigger thresholds must be a real, accessible remedy, not a nominal gate.** The minority-bloc fraction and the qualifying-petition threshold are set low enough that an ordinary affected population can reach them, and are themselves reviewable for accessibility; where a threshold is shown to be unreachable in practice, it is reduced.\n- **Tier-sensitive determinations** require a supermajority of the full CRP plus a published opinion.\n- **Any CRP decision** weakening privacy, Essential Access continuity, or instrument separation automatically triggers external review by a rotating regional chamber panel. **That panel is drawn from a pool disjoint from the CRP's feeding pools**, so the external check is genuinely independent; no person who sits in, certifies, or feeds the CRP's pools may serve on the reviewing panel for the same matter.\n- **CRP opinions, dissents**, conflicts, and evidence packets are public except for protected personal data.\n\n### L4. Standards of review\n- **Strict review** applies to Tier 1 invariants, personhood/identity continuity, Essential Access narrowing, convertibility risk, surveillance expansion, and civic-rights restrictions.\n- **Heightened review** applies to Tier 2 changes affecting housing, migration, public finance, oracle thresholds, or major vendor/pricing rules.\n- **Ordinary reasonableness review** applies to Tier 3 operational adjustments that do not materially burden rights or cross article/instrument boundaries.\n- **Where uncertainty is high**, the burden remains on the authority that seeks to narrow access, expand data exposure, or create new coercive discretion.\n\n### L5. Remedy ladder\n- **Available remedies** include stay, reclassification upward, nullification, partial severance, rollback to last-known-valid rule, compensatory continuity order, and targeted institutional sanctions.\n- **No remedy may solve** an institutional error by cutting off survival-floor protections to the affected population.\n- **Software, oracle, and platform releases** that alter legal effect without authorization are void upon finding and must revert immediately.\n\n---\n\n## L6 \u2014 Justice, Appeals, and Constitutional Review (merged from former Annex G \u00a7G3)\n\n> **Provenance:** Originally drafted as Annex G \u00a7G3 (\"Justice, Appeals, and Constitutional Review\"). Annex G was retired in the 2026-04-25 review and held in Annex H pending redistribution; moved here in the 2026-04-25 follow-up because dispute classes, appeal paths, and remedies belong with the judicial architecture defined in L1\u2013L5.\n\nEvery materially adverse decision must be challengeable by a legible path. Automated decisions are never self-justifying; they must produce a reviewable record and a human-readable explanation.\n\n| Dispute class | Initial review | Appeal path | Typical remedies |\n| :--- | :--- | :--- | :--- |\n| **Identity / personhood** | Administrative identity tribunal or registrar review. | Independent personhood court; constitutional review if rights are implicated. | Record correction, restored continuity, temporary manual access, damages for wrongful denial. |\n| **Essential Access delivery / service access** | Service ombuds + rapid benefit review. | Regional administrative court with emergency relief window. | Immediate restoration, arrears / restitution, corrected routing, vendor sanctions. |\n| **Voice / Service Record attribution / contribution verification** | Contribution registry review with verifier challenge file. | Independent civic adjudicator; constitutional review if structural bias is alleged. | Re-score, nullification of fraudulent attestations, verifier penalties, published correction. |\n| **Vendor / commercial disputes** | Contract and market regulator review. | Commercial court / arbitration subject to public-law guardrails. | Specific performance, compensation, license conditions, procurement exclusion. |\n| **Oracle / capacity data disputes** | Technical audit panel and temporary conservative operating mode. | Independent review chamber; constitutional review if prolonged deprivation risk exists. | Data correction, rollback, model freeze, re-issuance / reconciliation. |\n| **Emergency powers / rights impacts** | Immediate judicial notice and rights-impact filing. | Constitutional court on expedited schedule. | Injunction, sunset enforcement, compensation, removal of unlawful measures. |\n\n- Burden of justification lies with the authority imposing deprivation, restriction, or adverse classification.\n- Severe consequences require notice, access to evidence, explanation of the rule invoked, and access to counsel or advocate support.\n- Counsel and advocate support extend to the commercial-court and technical-audit tracks, so that under-resourced parties receive qualified representation and independent expert assistance where expertise or cost asymmetry would otherwise undercut the burden-shift above.\n- Emergency relief windows should be measured in hours or days, not months, whenever survival access, identity continuity, or liberty interests are at stake.\n- Algorithmic systems must preserve the inputs, rules, and model / version state necessary for retrospective review.\n\n---\n\n## L7 \u2014 The Appeal Spine (P-074 consolidation)\n\n> **Provenance:** Consolidated under the Framework-First Intake rule (P-073, Acceptance_Protocol). ANNEX_L is the most general existing appeal instrument; this section makes it the single canonical spine. Domain annexes keep their first-instance bodies and substantive standards; they no longer carry their own filing rules, windows, or escalation procedure. Status: `Designed`. Domain documents name their first-instance body and substantive standard and cite this section for everything procedural; a domain document restating its own filing rule, window, or escalation path is in drift \u2014 the spine governs. New appeal contexts are added as a row in L7.5, never as new machinery (P-073). Changes to the spine's clocks, the imminent-serious-harm standard, or the deletion of an intake row receive Strict review (L4).\n\n### L7.1 One filing rule\n\nAny materially adverse determination under this corpus \u2014 a denial, reduction, suspension, flag, quarantine, classification, penalty, or refusal to act \u2014 is appealable by the person or body it burdens. One trigger: receipt (or constructive receipt) of the adverse decision with its written reasons. One window: **30 days** from that notice, extended automatically where notice was defective, inaccessible, or never reached the person. Filing is reachable without identity documents, literacy, fee, or counsel (INV-013); a trusted helper or community navigator may file without the appellant losing any right.\n\n### L7.2 What continues during appeal\n\n- **The survival floor always continues.** Any withholding of the Constitutional Survival Minimum \u2014 system-originated or host-instructed \u2014 is resolved toward provision while the appeal is pending (INV-013, INV-019). A withholding with no open appeal path is void.\n- **For everything else, the status quo ante continues:** the standing, access, housing continuity, issuance, or classification the person held before the adverse decision remains in force during appeal, except where a published, reviewable imminent-serious-harm standard is met (the ANNEX_U \u00a7U6 standard, generalized). Until the generalized imminent-serious-harm standard is published \u2014 authored and amended under the ANNEX_U \u00a7U5 threshold-setting discipline, and its publication a pre-launch gate \u2014 each domain's existing published interim measure (e.g., the ANNEX_X \u00a7X6 least-harm interim status) continues to operate during appeal; status quo ante does not vacate it. Invocation of the imminent-serious-harm exception is itself immediately appealable on the emergency clock (L7.4), with the burden on the invoking body, and it may never be invoked against the survival floor.\n- **Penalties and stakes:** license and access sanctions pause during appeal; monetary gain-recoupment proceeds during appeal **into escrow** per ANNEX_AJ \u00a74.4 \u2014 refunded with accrued return if the appeal succeeds \u2014 so appeal never becomes a window to dissipate gains; slashed-stake distribution does not execute until finality, the stake remaining escrowed (ANNEX_AI \u00a74.9). Stake under a false-claim finding is escrowed, not slashed, until final determination (ANNEX_AI \u00a74.9).\n\n### L7.3 The ladder\n\n1. **First instance \u2014 domain specialist body** (table in L7.5). The specialist applies its own published substantive standard; the spine governs only procedure and escalation.\n2. **Second instance \u2014 Regional Constitutional Chamber** (L1), on the record, with emergency relief authority.\n3. **Final instance \u2014 split by question:**\n   - **Constitutional questions** (Tier boundaries, invariant violation, instrument separation, rights deprivation): the **CRP** (L1\u2013L4 standards of review).\n   - **Enforcement and Ombuds-administered administrative questions** (Enforcement Panel penalties, attestation false-claim findings, manufactured-flag determinations): the **Ombuds Plenum** under FC-091 (ANNEX_AI \u00a73.2, \u00a74.8\u20134.9). These do not merge into the CRP ladder: folding them in would reduce the independence count bearing on enforcement outcomes (P-073's simplicity-presumption limit; INV-006). Residual cross-links are acknowledged honestly: the Enforcement Panel seats members from the Ombuds roster (ANNEX_AJ \u00a74.4) and sub-Ombuds Commissioners are confirmed by the CRP (ANNEX_AI \u00a72.1) \u2014 the split raises the independence count, it does not perfect it. A constitutional challenge to the Ombuds' own conduct runs up the CRP ladder, so neither final instance sits unaudited.\n\n   A single appeal raising both kinds of question is heard by its domain ladder, and the constitutional question is certified to the CRP; the appellant is never required to diagnose the split to file (one door, L7.1).\n\n### L7.4 Timing\n\n| Class | Clock |\n| :--- | :--- |\n| **Emergency** (shelter loss, floor interruption, family separation, medical interruption, expulsion, identity lockout) | Review begins within **72 hours**; interim relief decided in the same window. |\n| **Time-critical operational** (demand-context flags, PCRP co-certification, supply-shock action) | The Duty body acts immediately; full post-hoc review within **30 days** (ANNEX_AI \u00a73.1 urgency split, preserved). |\n| **Ordinary** | Appeal acknowledged and docketed within **14 days** of filing; written first-instance determination within **30 days** unless the appellant requests more time. |\n| **Escalation** | Each higher instance runs on the same 14/30 clocks from receipt of the escalated record. |\n\nA blown clock never costs the appellant: relief pending review continues until the late decision actually issues. On final affirmance of a monetary assessment, penalty, or quarantine, amounts and restrictions relieved during a blown-clock period are reinstated retroactively (escrow-settled), so delay relief is never a prize for the merits-loser. This reinstatement never applies to the survival floor (INV-013).\n\n### L7.5 Domain intake table\n\nThe L6 dispute-class table is the first-instance map for Essential Access, identity/personhood, Voice/Service Record, and emergency-powers appeals; the rows below add the contexts L6 does not name.\n\n| Appeal context | First instance | Escalates to chamber when | Final instance |\n| :--- | :--- | :--- | :--- |\n| Civic standing / residency status (ANNEX_I \u00a7I8) | Status review per \u00a7I8 | Adverse determination upheld | CRP |\n| Productive-status / stewardship determination (Productive Status Register; ANNEX_J \u00a7R2.3) | ANNEX_J independent stewardship reviewer (per \u00a7R2.3) | Determination upheld; INV-006 separation question | CRP |\n| Commons Return / CRUS assessment (FC-209) | Commons Return assessment review (per ANNEX_D \u00a7D6) | Assessed holder or excluded claimant unsatisfied; hardship route denied | CRP |\n| Monitoring flag / Flow quarantine (ANNEX_C, ANNEX_X \u00a7X6) | Named human reviewer in the Monitoring Purpose Register entry | Flag maintained past review clock | CRP |\n| Housing use-right renewal denial (ANNEX_U \u00a7U6) | Housing stewardship review (per ANNEX_U \u00a7U6) | Denial upheld | CRP |\n| Enforcement Panel penalty (ANNEX_AJ \u00a74) | Enforcement Panel determination record | \u2014 (no chamber tier) | **Ombuds Plenum**, FC-091 (ANNEX_AI \u00a74.8) |\n| Attestation false-claim / stake slashing (ANNEX_AS \u00a72.4) | Originating investigator record | \u2014 (no chamber tier) | **Ombuds Plenum**, FC-091 (ANNEX_AI \u00a74.9) |\n\nA context not listed here defaults to the nearest L6 dispute class; absence from this table is never a reason to refuse a filing. A filing made at any first-instance body, the Ombuds, or the floor-access point is a valid filing; the receiving body routes it to the correct first instance without loss of the filing date. Intake routing \u2014 including class assignment and any nearest-dispute-class default \u2014 is recorded with reasons, is itself challengeable on the spine, and a misrouting never consumes the appellant's window or clocks. Survival-floor cases are emergency-class automatically; other emergency-class intake may verify the published predicate, and a post-finding manufactured-emergency determination is sanctionable without ever conditioning the floor.\n\n",
       "headings": [
         {
           "level": 1,
@@ -11502,10 +11507,40 @@
           "level": 2,
           "text": "L6 \u2014 Justice, Appeals, and Constitutional Review (merged from former Annex G \u00a7G3)",
           "slug": "l6-justice-appeals-and-constitutional-review-merged-from-former-annex-g-g3"
+        },
+        {
+          "level": 2,
+          "text": "L7 \u2014 The Appeal Spine (P-074 consolidation)",
+          "slug": "l7-the-appeal-spine-p-074-consolidation"
+        },
+        {
+          "level": 3,
+          "text": "L7.1 One filing rule",
+          "slug": "l71-one-filing-rule"
+        },
+        {
+          "level": 3,
+          "text": "L7.2 What continues during appeal",
+          "slug": "l72-what-continues-during-appeal"
+        },
+        {
+          "level": 3,
+          "text": "L7.3 The ladder",
+          "slug": "l73-the-ladder"
+        },
+        {
+          "level": 3,
+          "text": "L7.4 Timing",
+          "slug": "l74-timing"
+        },
+        {
+          "level": 3,
+          "text": "L7.5 Domain intake table",
+          "slug": "l75-domain-intake-table"
         }
       ],
-      "wordCount": 1199,
-      "headingCount": 7
+      "wordCount": 2372,
+      "headingCount": 13
     },
     {
       "id": "docs__annexes__ANNEX_M_md",
@@ -11819,7 +11854,7 @@
       "status": "",
       "statusBucket": "reference",
       "summary": "Design principle: tighten the exception systems before they become the new capture layer.",
-      "content": "# ANNEX U \u2014 Operational Bypass Closure and Superseding Clauses\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Closes the bypass channels identified in adversarial review \u2014 founding-body conflicts, investment-channel shelters, oracle independence gaps, cumulative basket erosion, housing stewardship loopholes, civic-layer verification gaps, and the Shared Storehouse bridge \u2014 and supplies superseding clauses that override looser earlier language in Annexes H, I, K, M, N, P, Q, R, and S where they conflict. |\n> | **Who it protects** | Everyone who relies on the stated protections actually being unbypassable \u2014 founding promises that can be quietly circumvented offer false security, not real protection. |\n> | **Failure risk** | Exception systems become the new capture layer; each individually justified carve-out aggregates into a regime where the rules have more holes than substance; narrowing faces weaker friction than expansion. |\n> | **Evidence status** | Designed |\n> | **Linked risks** | P-022; P-024; Annex N \u00a7N3 (founding anti-capture); Annex D \u00a7D6 (productive-use / investment-channel exemptions); Annex M \u00a7M4 (oracle failure defaults); Annex K \u00a7K1 (basket contestation). |\n\n> **Provenance:** Foundational constitutional annex \u00b7 Closes operational bypass channels and supplies superseding clauses later extended by P-022 and P-024 \u00b7 Status: **ACTIVE**\n\n**Purpose.** This Annex closes operational bypass channels identified in adversarial review. Where Annex U conflicts with earlier language in Annexes H, I, K, M, N, P, Q, R, or S, Annex U governs.\n\n**Design principle: tighten the exception systems before they become the new capture layer.**\n\n### U1. Revision package status and scope\n- Completed in this revision package: founding safeguards, H-1 dual-key repair, investment-channel hardening, weighted oracle evidence with sub-5 fallback, cumulative Essential Access anti-erosion triggers, dispute-deprivation Shared Storehouse bridge, closed-list housing stewardship, scaled civic-layer verification, hardship-safe Protected Pause, transition mechanics scaffold, and worked identity cases.\n- This package is intentionally asymmetrical: narrowing, concentration, concealment, and founding discretion face stronger friction than expansion, continuity, transparency, and review.\n- Any implementer may propose a cleaner restatement later, but no restatement may weaken these protections without ordinary amendment review.\n- Annex U overrides looser language in nine other annexes, so control of future edits to Annex U is control of those protections. To prevent the master key from being downgraded through the lock it guards, amendments to Annex U are themselves asymmetric. Any amendment that weakens, narrows, removes, or creates an exception to a protection stated in this Annex may not travel the ordinary amendment path; it must clear the strictly higher narrowing-friction that \u00a7U5 imposes \u2014 stronger evidence burden, longer notice period, a higher approval threshold, and mandatory review by an independent body not controlling the amendment. Amendments that strengthen a protection, add transparency, or tighten an exception face only ordinary friction. Where doubt exists about whether an amendment weakens or strengthens, the narrowing-friction path governs.\n\n### U2. Founding safeguards and provisional authority limits\n- The provisional Constitutional Review Panel (CRP) has zero Tier 1 authority. It may not redefine invariants, ratify disguised convertibility, or permanently validate founding shortcuts.\n- Founding constitutional bodies must exclude current senior decision-makers, controlling beneficial owners, and paid chief advocates of legacy banks, major landlord blocs, dominant essential-goods vendors, central ministries directly administering the transition, and any entity above published market-share conflict thresholds.\n- Every provisional founding decision must publish sponsor list, conflict disclosures, written reasons, minority views, challenge path, and sunset date before taking effect.\n- No provisional ruling takes effect until a published challenge window closes and at least one independent external observer panel has attested that basic process rules were followed.\n- All founding decisions auto-expire after 8 quarters unless re-ratified through ordinary constitutional channels. Founding convenience is not precedent.\n- A founding audit is mandatory before any transition step may move from pilot authority to ordinary authority. The audit must test conflict patterns, omitted stakeholders, unexplained asset transfers, and any hidden side letters or procurement dependencies.\n\n### U3. Investment-channel hardening and protected-capital anti-abuse rules\n- Protected treatment begins only after pre-registration. Milestones, review cadence, capital class, declared purpose, success conditions, and reversion triggers must be published before funds enter protected status.\n- Milestone review must be conducted by independent auditors drawn from a rotating pool. Protected entities may not select, pay, or repeatedly re-use their own reviewers without external assignment rules.\n- Any protected balance above the published disclosure threshold must publish quarterly progress reports showing milestone status, material variance, conflicts, and remaining runway.\n- Long-Horizon Research Windows are finite. Default maximum protection term is 7 years; after that the project must convert to milestone-based Project Escrow, receive a specific constitutional extension, or revert to ordinary Flow treatment.\n- Actuarial and Catastrophe Reserves require published reserve logic, trigger conditions, payout authority, and evidence that the reserve is sized to real exposure rather than convenience hoarding.\n- Cooperative Retained Earnings Pools require mission lock, member-governance proof, payout constraints, and evidence that retained balances support resilience, tooling, payroll continuity, or member-approved expansion rather than passive accumulation.\n- Infrastructure Lifecycle Funds require asset registers, maintenance schedules, replacement assumptions, and public dashboarding tied to the underlying system.\n- Protected funds may not hop categories casually. Re-designation across protected capital classes requires review, public reasons, and anti-evasion screening.\n- If milestones are vague, circular, self-scored, or repeatedly deferred without justified cause, or materially disconnected from declared purpose, protected treatment ends and the balance enters stale-purpose review, Commons Return/source-base review where implicated, and evasion screening.\n\n### U4. Oracle evidence weighting, independence, and sub-5 fallback\n- Oracle publishers must declare evidence class for each data stream: directly observed, administratively reported, mixed, modeled, or estimated. Confidence intervals and known blind spots must be published alongside point estimates.\n- Publisher independence requires distinct governance, funding, data pipelines, and decision authority. Nominally separate bodies that rely on the same upstream source or sponsor do not count as independent without explicit disclosure and weighting penalty.\n- Quorum is weighted by evidence quality, not just raw publisher count. Direct observation and auditable primary records carry more weight than modeled or inferred estimates.\n- If a region cannot field 5 credible publishers for an essential category, the protocol enters sub-5 fallback mode: federal or cross-regional measurement support is added, conservative default tables are published, and an independent timed audit is automatically opened.\n- No disputed scarcity or tightening action may rest solely on a modeled estimate when direct-observation channels are materially missing and could reasonably be gathered within the emergency window.\n- A dispute that persists beyond the published limit automatically escalates from disagreement to audit. Authorities may not live forever in 'provisional measurement' while rights are quietly narrowed.\n\n### U5. Essential basket anti-erosion, explicit mental-health floor, and narrowing friction\n- Mental health is an explicit essential basket category from genesis, not an implied subcomponent hiding inside general healthcare. At minimum, the basket must include crisis intervention, annual baseline assessment access, and continuity of care for diagnosed conditions.\n- The existing per-change judicial review trigger remains in force, but cumulative narrowing also matters. Any combination of basket changes within a rolling 4-quarter window that reduces access by more than 10% for any essential category or protected group triggers mandatory judicial review.\n- Every basket narrowing must pass a functional floor test showing that the revised basket remains usable for median bottom-quintile households in real conditions, not merely compliant on paper.\n- Basket narrowing faces stronger friction than basket expansion. Evidence burden, notice period, and rights-impact analysis must all be at least as strict for narrowing as for any comparable expansion.\n- Substitution ladders may not be used to silently replace trained human care with unsupported digital or volunteer substitutes where continuity of professional care is the relevant need.\n- A closure is only as strong as the number that operates it. Several protections in this Annex delegate the operative value to a later threshold-setting act \u2014 including the market-share conflict thresholds of \u00a7U2, the disclosure threshold and protection-term defaults of \u00a7U3, the functional-floor and cumulative-narrowing thresholds of this section, the imminent-serious-harm standard of \u00a7U6, and the verification-burden and elevated-audit thresholds of \u00a7U7. Any act that sets or changes such a delegated threshold in a direction that narrows a protection or admits more conduct is governed by the narrowing-friction discipline of this section: it carries the same evidence burden, notice period, approval threshold, and mandatory independent review as the protection it parameterizes. The threshold-setting act is treated as an amendment to that protection, not as ordinary administration. Setting or moving a delegated threshold in a direction that strengthens a protection or admits less conduct faces only ordinary friction. Closing a bypass channel does not authorize loosening its number quietly.\n\n### U6. Housing stewardship closed-list rule and continuity appeal\n- Housing use-right renewal may be conditioned only on the closed list already stated in the main text: sustained vacancy beyond published threshold, physical damage beyond normal wear, verified illegal activity tied to the premises, and clearly defined health/safety violations after remediation opportunity.\n- No renewal decision may rely on aesthetics, lifestyle, political activity, lawful association, family structure, visitor profile, disability proxy, or any factor functioning as a substitute for protected characteristics.\n- Renewal denials must identify the exact closed-list basis, the evidence relied upon, the remediation path if one exists, and the appeal timeline.\n- Housing continuity remains in place during appeal except where a published and reviewable imminent-serious-harm standard is met.\n\n### U7. Civic-layer repair, scaled verification, and hardship-safe continuity\n- The verification burden must scale with claimed influence. Small stewardship claims may use lightweight community attestation; mid-range claims require structured evidence bundles; high-impact Voice allocations or near-cap Service Record-based service claims face intensive review and elevated audit probability.\n- Aggregate attestation-network maps shall be published in anonymized form so suspicious clustering can be studied without exposing ordinary people to behavioral dossiers.\n- Where a community has low institutional trust, high poverty, or concentrated verifier conflicts, claimants must have access to cross-regional rotating review panels rather than being trapped within local patronage networks.\n- Protected Pause during verified hardship preserves proportionate civic continuity. Anti-concentration decay applies to ordinary inactive high Voice or Service Record concentrations, not to documented incapacity, caregiving emergency, or disaster displacement.\n- Any H-1 repair that materially alters Voice or Service Record rules must satisfy the dual-key legitimacy check described in Annex H and may not rely on civic-weighted signaling alone when the issue in dispute is those civic instruments themselves.\n\n### U8. Dispute-deprivation Shared Storehouse bridge\n- If oracle dispute or conservative issuance reduces effective Essential Access below 85% of the normal baseline for more than 7 consecutive days in any essential category, this automatically constitutes a provisional scarcity finding sufficient to activate narrow Shared Storehouse for that category.\n- Shared Storehouse activated under this bridge must be category-specific, time-limited, and auto-terminate when ordinary measurement confidence or continuity supply is restored.\n- The burden of proof for refusing bridge activation lies with the authority resisting activation, which must publish an alternative continuity measure with equal or better protection.\n\n---\n\n## U9 \u2014 Failure-State, Rollback, and Dissolution Protocol (merged from former Annex G \u00a7G6)\n\n> **Provenance:** Originally drafted as Annex G \u00a7G6 (\"Failure-State, Rollback, and Dissolution Protocol\"). Annex G was retired in the 2026-04-25 review and held in Annex H pending redistribution; moved here in the 2026-04-25 follow-up because the failure-state ladder belongs with operational bypass closure and exception-system discipline.\n\nA durable system must specify how it fails without sacrificing the people it exists to protect. Emergency response therefore follows a bounded ladder: contain, continue essential functions manually if needed, roll back unsafe changes, and only then consider deeper structural intervention.\n\n| Level | Representative trigger | Immediate action | Time limit / exit rule |\n| :--- | :--- | :--- | :--- |\n| **Level 1 \u2014 Watch** | Localized anomalies, rising dispute rate, or dashboard signals outside normal bands. | Heightened monitoring, public notice, targeted audit, no rights reduction. | Expires when metrics normalize or escalate within one cycle. |\n| **Level 2 \u2014 Contained incident** | Single subsystem bug, vendor failure, or regional capacity shortfall with workaround available. | Freeze the affected parameter, preserve last-known-good access, activate manual fallback. | Review within 72 hours; written corrective action required. |\n| **Level 3 \u2014 Subsystem pause** | Oracle quorum failure, identity verification instability, or pricing system malfunction with material deprivation risk. | Pause the faulty subsystem, revert to conservative baseline mode, appoint independent incident lead. | Sunset within one quarter unless constitutional authority renews narrowly. |\n| **Level 4 \u2014 Regional continuity mode** | A region cannot sustain baseline services or logistics through ordinary controls. | Interregional support, reserve drawdown, temporary operational stewardship, mandatory public dashboard of continuity actions. | Ends when baseline service continuity is restored and reviewed. |\n| **Level 5 \u2014 Structural rollback / dissolution** | Persistent systemic failure, capture of multiple safeguard layers, or impossible contradiction between invariants and live institutions. | Activate constitutional convention / rollback mechanism with service-continuity guarantee. | Tier 1 rights remain intact throughout; dissolution cannot suspend the survival floor. |\n\n- If identity systems fail, access defaults to last-known-good continuity plus manual adjudication rather than hard lockout.\n- If oracle publication fails, the system may not raise obligations or tighten survival access on disputed data; it must default conservative and reviewable.\n- Every Level 3+ event requires a public incident file, post-mortem, and patch verification before the subsystem returns to normal mode.\n\n---\n\n## U10 \u2014 Motivation for Exceptional Contribution (merged from former Annex R \u00a7R3)\n\n> **Provenance:** Originally drafted as Annex R \u00a7R3 (\"Motivation for exceptional contribution\"). Annex R was retired in the 2026-04-25 review and held in Annex J pending possible move; moved here in the 2026-04-25 follow-up because compensation bands, anti-extraction limits, and the anti-conversion rule for Voice/Service Record fit U's anti-abuse and operational-bypass-closure scope.\n\nThe protocol rejects the claim that only extreme extractive upside can motivate excellence. It also rejects the opposite fantasy that intrinsic motivation alone is enough. Exceptional contribution is supported through a bounded mix of economic reward, mission alignment, autonomy, recognition, and reduced precarity.\n\n- **Flow compensation bands** may reward scarce expertise, difficult work, night burden, and mission-critical skill without permitting unlimited wealth-to-power conversion.\n- **Mission-critical premiums** may be used where failure to attract talent would threaten care, safety, or continuity.\n- **Professional autonomy**, protected research time, cooperative upside sharing, and public honor can reward excellence without converting into constitutional privilege.\n- **Voice and Service Record** may recognize stewardship but cannot become private income, office purchase, class rank, or a substitute for one-person-one-vote legitimacy on survival-adjacent matters.\n- **The system should attract** surgeons, engineers, researchers, and builders because excellence still matters \u2014 but because survival is guaranteed, excellence no longer requires others to remain desperate.\n",
+      "content": "# ANNEX U \u2014 Operational Bypass Closure and Superseding Clauses\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Closes the bypass channels identified in adversarial review \u2014 founding-body conflicts, investment-channel shelters, oracle independence gaps, cumulative basket erosion, housing stewardship loopholes, civic-layer verification gaps, and the Shared Storehouse bridge \u2014 and supplies superseding clauses that override looser earlier language in Annexes H, I, K, M, N, P, Q, R, and S where they conflict. |\n> | **Who it protects** | Everyone who relies on the stated protections actually being unbypassable \u2014 founding promises that can be quietly circumvented offer false security, not real protection. |\n> | **Failure risk** | Exception systems become the new capture layer; each individually justified carve-out aggregates into a regime where the rules have more holes than substance; narrowing faces weaker friction than expansion. |\n> | **Evidence status** | Designed |\n> | **Linked risks** | P-022; P-024; Annex N \u00a7N3 (founding anti-capture); Annex D \u00a7D6 (productive-use / investment-channel exemptions); Annex M \u00a7M4 (oracle failure defaults); Annex K \u00a7K1 (basket contestation). |\n\n> **Provenance:** Foundational constitutional annex \u00b7 Closes operational bypass channels and supplies superseding clauses later extended by P-022 and P-024 \u00b7 Status: **ACTIVE**\n\n**Purpose.** This Annex closes operational bypass channels identified in adversarial review. Where Annex U conflicts with earlier language in Annexes H, I, K, M, N, P, Q, R, or S, Annex U governs.\n\n**Design principle: tighten the exception systems before they become the new capture layer.**\n\n### U1. Revision package status and scope\n- Completed in this revision package: founding safeguards, H-1 dual-key repair, investment-channel hardening, weighted oracle evidence with sub-5 fallback, cumulative Essential Access anti-erosion triggers, dispute-deprivation Shared Storehouse bridge, closed-list housing stewardship, scaled civic-layer verification, hardship-safe Protected Pause, transition mechanics scaffold, and worked identity cases.\n- This package is intentionally asymmetrical: narrowing, concentration, concealment, and founding discretion face stronger friction than expansion, continuity, transparency, and review.\n- Any implementer may propose a cleaner restatement later, but no restatement may weaken these protections without ordinary amendment review.\n- Annex U overrides looser language in nine other annexes, so control of future edits to Annex U is control of those protections. To prevent the master key from being downgraded through the lock it guards, amendments to Annex U are themselves asymmetric. Any amendment that weakens, narrows, removes, or creates an exception to a protection stated in this Annex may not travel the ordinary amendment path; it must clear the strictly higher narrowing-friction that \u00a7U5 imposes \u2014 stronger evidence burden, longer notice period, a higher approval threshold, and mandatory review by an independent body not controlling the amendment. Amendments that strengthen a protection, add transparency, or tighten an exception face only ordinary friction. Where doubt exists about whether an amendment weakens or strengthens, the narrowing-friction path governs.\n\n### U2. Founding safeguards and provisional authority limits\n- The provisional Constitutional Review Panel (CRP) has zero Tier 1 authority. It may not redefine invariants, ratify disguised convertibility, or permanently validate founding shortcuts.\n- Founding constitutional bodies must exclude current senior decision-makers, controlling beneficial owners, and paid chief advocates of legacy banks, major landlord blocs, dominant essential-goods vendors, central ministries directly administering the transition, and any entity above published market-share conflict thresholds.\n- Every provisional founding decision must publish sponsor list, conflict disclosures, written reasons, minority views, challenge path, and sunset date before taking effect.\n- No provisional ruling takes effect until a published challenge window closes and at least one independent external observer panel has attested that basic process rules were followed.\n- All founding decisions auto-expire after 8 quarters unless re-ratified through ordinary constitutional channels. Founding convenience is not precedent.\n- A founding audit is mandatory before any transition step may move from pilot authority to ordinary authority. The audit must test conflict patterns, omitted stakeholders, unexplained asset transfers, and any hidden side letters or procurement dependencies.\n\n### U3. Investment-channel hardening and protected-capital anti-abuse rules\n- Protected treatment begins only after pre-registration. Milestones, review cadence, capital class, declared purpose, success conditions, and reversion triggers must be published before funds enter protected status.\n- Milestone review must be conducted by independent auditors drawn from a rotating pool. Protected entities may not select, pay, or repeatedly re-use their own reviewers without external assignment rules.\n- Any protected balance above the published disclosure threshold must publish quarterly progress reports showing milestone status, material variance, conflicts, and remaining runway.\n- Long-Horizon Research Windows are finite. Default maximum protection term is 7 years; after that the project must convert to milestone-based Project Escrow, receive a specific constitutional extension, or revert to ordinary Flow treatment.\n- Actuarial and Catastrophe Reserves require published reserve logic, trigger conditions, payout authority, and evidence that the reserve is sized to real exposure rather than convenience hoarding.\n- Cooperative Retained Earnings Pools require mission lock, member-governance proof, payout constraints, and evidence that retained balances support resilience, tooling, payroll continuity, or member-approved expansion rather than passive accumulation.\n- Infrastructure Lifecycle Funds require asset registers, maintenance schedules, replacement assumptions, and public dashboarding tied to the underlying system.\n- Protected funds may not hop categories casually. Re-designation across protected capital classes requires review, public reasons, and anti-evasion screening.\n- If milestones are vague, circular, self-scored, or repeatedly deferred without justified cause, or materially disconnected from declared purpose, protected treatment ends and the balance enters stale-purpose review, Commons Return/source-base review where implicated, and evasion screening.\n\n### U4. Oracle evidence weighting, independence, and sub-5 fallback\n- Oracle publishers must declare evidence class for each data stream: directly observed, administratively reported, mixed, modeled, or estimated. Confidence intervals and known blind spots must be published alongside point estimates.\n- Publisher independence requires distinct governance, funding, data pipelines, and decision authority. Nominally separate bodies that rely on the same upstream source or sponsor do not count as independent without explicit disclosure and weighting penalty.\n- Quorum is weighted by evidence quality, not just raw publisher count. Direct observation and auditable primary records carry more weight than modeled or inferred estimates.\n- If a region cannot field 5 credible publishers for an essential category, the protocol enters sub-5 fallback mode: federal or cross-regional measurement support is added, conservative default tables are published, and an independent timed audit is automatically opened.\n- No disputed scarcity or tightening action may rest solely on a modeled estimate when direct-observation channels are materially missing and could reasonably be gathered within the emergency window.\n- A dispute that persists beyond the published limit automatically escalates from disagreement to audit. Authorities may not live forever in 'provisional measurement' while rights are quietly narrowed.\n\n### U5. Essential basket anti-erosion, explicit mental-health floor, and narrowing friction\n- Mental health is an explicit essential basket category from genesis, not an implied subcomponent hiding inside general healthcare. At minimum, the basket must include crisis intervention, annual baseline assessment access, and continuity of care for diagnosed conditions.\n- The existing per-change judicial review trigger remains in force, but cumulative narrowing also matters. Any combination of basket changes within a rolling 4-quarter window that reduces access by more than 10% for any essential category or protected group triggers mandatory judicial review.\n- Every basket narrowing must pass a functional floor test showing that the revised basket remains usable for median bottom-quintile households in real conditions, not merely compliant on paper.\n- Basket narrowing faces stronger friction than basket expansion. Evidence burden, notice period, and rights-impact analysis must all be at least as strict for narrowing as for any comparable expansion.\n- Substitution ladders may not be used to silently replace trained human care with unsupported digital or volunteer substitutes where continuity of professional care is the relevant need.\n- A closure is only as strong as the number that operates it. Several protections in this Annex delegate the operative value to a later threshold-setting act \u2014 including the market-share conflict thresholds of \u00a7U2, the disclosure threshold and protection-term defaults of \u00a7U3, the functional-floor and cumulative-narrowing thresholds of this section, the imminent-serious-harm standard of \u00a7U6, and the verification-burden and elevated-audit thresholds of \u00a7U7. Any act that sets or changes such a delegated threshold in a direction that narrows a protection or admits more conduct is governed by the narrowing-friction discipline of this section: it carries the same evidence burden, notice period, approval threshold, and mandatory independent review as the protection it parameterizes. The threshold-setting act is treated as an amendment to that protection, not as ordinary administration. Setting or moving a delegated threshold in a direction that strengthens a protection or admits less conduct faces only ordinary friction. Closing a bypass channel does not authorize loosening its number quietly.\n\n### U6. Housing stewardship closed-list rule and continuity appeal\n- Housing use-right renewal may be conditioned only on the closed list already stated in the main text: sustained vacancy beyond published threshold, physical damage beyond normal wear, verified illegal activity tied to the premises, and clearly defined health/safety violations after remediation opportunity.\n- No renewal decision may rely on aesthetics, lifestyle, political activity, lawful association, family structure, visitor profile, disability proxy, or any factor functioning as a substitute for protected characteristics.\n- Renewal denials must identify the exact closed-list basis, the evidence relied upon, the remediation path if one exists, and the appeal timeline.\n- Housing continuity remains in place during appeal except where a published and reviewable imminent-serious-harm standard is met, per the appeal spine ([ANNEX_L \u00a7L7](./ANNEX_L.md)).\n\n### U7. Civic-layer repair, scaled verification, and hardship-safe continuity\n- The verification burden must scale with claimed influence. Small stewardship claims may use lightweight community attestation; mid-range claims require structured evidence bundles; high-impact Voice allocations or near-cap Service Record-based service claims face intensive review and elevated audit probability.\n- Aggregate attestation-network maps shall be published in anonymized form so suspicious clustering can be studied without exposing ordinary people to behavioral dossiers.\n- Where a community has low institutional trust, high poverty, or concentrated verifier conflicts, claimants must have access to cross-regional rotating review panels rather than being trapped within local patronage networks.\n- Protected Pause during verified hardship preserves proportionate civic continuity. Anti-concentration decay applies to ordinary inactive high Voice or Service Record concentrations, not to documented incapacity, caregiving emergency, or disaster displacement.\n- Any H-1 repair that materially alters Voice or Service Record rules must satisfy the dual-key legitimacy check described in Annex H and may not rely on civic-weighted signaling alone when the issue in dispute is those civic instruments themselves.\n\n### U8. Dispute-deprivation Shared Storehouse bridge\n- If oracle dispute or conservative issuance reduces effective Essential Access below 85% of the normal baseline for more than 7 consecutive days in any essential category, this automatically constitutes a provisional scarcity finding sufficient to activate narrow Shared Storehouse for that category.\n- Shared Storehouse activated under this bridge must be category-specific, time-limited, and auto-terminate when ordinary measurement confidence or continuity supply is restored.\n- The burden of proof for refusing bridge activation lies with the authority resisting activation, which must publish an alternative continuity measure with equal or better protection.\n\n---\n\n## U9 \u2014 Failure-State, Rollback, and Dissolution Protocol (merged from former Annex G \u00a7G6)\n\n> **Provenance:** Originally drafted as Annex G \u00a7G6 (\"Failure-State, Rollback, and Dissolution Protocol\"). Annex G was retired in the 2026-04-25 review and held in Annex H pending redistribution; moved here in the 2026-04-25 follow-up because the failure-state ladder belongs with operational bypass closure and exception-system discipline.\n\nA durable system must specify how it fails without sacrificing the people it exists to protect. Emergency response therefore follows a bounded ladder: contain, continue essential functions manually if needed, roll back unsafe changes, and only then consider deeper structural intervention.\n\n| Level | Representative trigger | Immediate action | Time limit / exit rule |\n| :--- | :--- | :--- | :--- |\n| **Level 1 \u2014 Watch** | Localized anomalies, rising dispute rate, or dashboard signals outside normal bands. | Heightened monitoring, public notice, targeted audit, no rights reduction. | Expires when metrics normalize or escalate within one cycle. |\n| **Level 2 \u2014 Contained incident** | Single subsystem bug, vendor failure, or regional capacity shortfall with workaround available. | Freeze the affected parameter, preserve last-known-good access, activate manual fallback. | Review within 72 hours; written corrective action required. |\n| **Level 3 \u2014 Subsystem pause** | Oracle quorum failure, identity verification instability, or pricing system malfunction with material deprivation risk. | Pause the faulty subsystem, revert to conservative baseline mode, appoint independent incident lead. | Sunset within one quarter unless constitutional authority renews narrowly. |\n| **Level 4 \u2014 Regional continuity mode** | A region cannot sustain baseline services or logistics through ordinary controls. | Interregional support, reserve drawdown, temporary operational stewardship, mandatory public dashboard of continuity actions. | Ends when baseline service continuity is restored and reviewed. |\n| **Level 5 \u2014 Structural rollback / dissolution** | Persistent systemic failure, capture of multiple safeguard layers, or impossible contradiction between invariants and live institutions. | Activate constitutional convention / rollback mechanism with service-continuity guarantee. | Tier 1 rights remain intact throughout; dissolution cannot suspend the survival floor. |\n\n- If identity systems fail, access defaults to last-known-good continuity plus manual adjudication rather than hard lockout.\n- If oracle publication fails, the system may not raise obligations or tighten survival access on disputed data; it must default conservative and reviewable.\n- Every Level 3+ event requires a public incident file, post-mortem, and patch verification before the subsystem returns to normal mode.\n\n---\n\n## U10 \u2014 Motivation for Exceptional Contribution (merged from former Annex R \u00a7R3)\n\n> **Provenance:** Originally drafted as Annex R \u00a7R3 (\"Motivation for exceptional contribution\"). Annex R was retired in the 2026-04-25 review and held in Annex J pending possible move; moved here in the 2026-04-25 follow-up because compensation bands, anti-extraction limits, and the anti-conversion rule for Voice/Service Record fit U's anti-abuse and operational-bypass-closure scope.\n\nThe protocol rejects the claim that only extreme extractive upside can motivate excellence. It also rejects the opposite fantasy that intrinsic motivation alone is enough. Exceptional contribution is supported through a bounded mix of economic reward, mission alignment, autonomy, recognition, and reduced precarity.\n\n- **Flow compensation bands** may reward scarce expertise, difficult work, night burden, and mission-critical skill without permitting unlimited wealth-to-power conversion.\n- **Mission-critical premiums** may be used where failure to attract talent would threaten care, safety, or continuity.\n- **Professional autonomy**, protected research time, cooperative upside sharing, and public honor can reward excellence without converting into constitutional privilege.\n- **Voice and Service Record** may recognize stewardship but cannot become private income, office purchase, class rank, or a substitute for one-person-one-vote legitimacy on survival-adjacent matters.\n- **The system should attract** surgeons, engineers, researchers, and builders because excellence still matters \u2014 but because survival is guaranteed, excellence no longer requires others to remain desperate.\n",
       "headings": [
         {
           "level": 1,
@@ -11877,7 +11912,7 @@
           "slug": "u10-motivation-for-exceptional-contribution-merged-from-former-annex-r-r3"
         }
       ],
-      "wordCount": 2426,
+      "wordCount": 2434,
       "headingCount": 11
     },
     {
@@ -11937,7 +11972,7 @@
       "status": "",
       "statusBucket": "reference",
       "summary": "Design principle: issue Flow against verified productive commitments, not against discretionary stock politics or financial privilege.",
-      "content": "# ANNEX X \u2014 Flow Issuance Architecture\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Defines how Flow comes into existence \u2014 against verified productive commitments only \u2014 specifying authorized channels (payroll, project escrow, essential services procurement, public infrastructure, continuity backstop), dual-key and third-signature controls, channel ceilings, anti-capture governance, and six red-team scenarios issuance must survive before scale-up. |\n> | **Who it protects** | Everyone harmed by money creation that inflates asset prices, rewards political allies, rescues failed speculation, or manufactures demand without linked productive capacity \u2014 and wage earners and essential providers who need error-correction to be staged, not sudden. |\n> | **Failure risk** | Fake payroll rings, circular invoice schemes, zombie rollovers, factional allocation, unwind shock, and offshore leakage \u2014 each a path by which the issuance system becomes a capture vehicle rather than a productive-economy instrument. |\n> | **Evidence status** | Designed |\n> | **Linked risks** | P-029; P-030; P-066; T-029; TR-09 smart-contract failure; Annex D (Commons Return and Universal Stake); red-team scenarios in \u00a7X7. |\n\n> **Provenance:** Implements [P-029 \u2014 Public Finance & Commons Revenue] (\u00a7X8) and [P-030 \u2014 Protocol-Only Money Creation and Household Finance Boundaries] (\u00a7X1\u2013X8) \u00b7 Status: **ACTIVE**\n\n**Purpose.** The protocol cannot be capture-resistant if the point of money creation remains vague. This annex defines how Flow comes into existence, who may authorize it, how issuance is bounded, and how issuance abuse is red-team tested. Where Annex X conflicts with looser issuance language elsewhere, Annex X governs.\n\n**Design principle: issue Flow against verified productive commitments, not against discretionary stock politics or financial privilege.**\n\n### X1. What Flow issuance is for\nFlow issuance exists to meet real productive demand: payroll settlement, milestone-bound project build-out, essential-services procurement, public infrastructure delivery, and tightly bounded continuity backstops during payment-system failure. Flow is not created to reward political allies, inflate asset prices, rescue failed speculation without conditions, or manufacture demand without linked capacity, delivery, or maintenance need. Any issuance channel must identify the concrete activity, continuity need, or productive commitment it is serving. Purpose ambiguity is itself a constitutional defect.\n\n### X2. Flow-based issuance rule and provenance\nNew Flow may be issued only against verified productive commitments rather than as a prior discretionary stock. The protocol treats money as a flow linked to work, provisioning, maintenance, and build-out, not as a sovereign hoard.\n- **Every issuance request** must publish or internally register, subject to privacy minimization: channel, sponsor, beneficial-control map, amount, duration, linked productive obligation, release schedule, prior unused protected balance, unwind path, reviewer signatures, and error-correction route.\n- **Monitoring-purpose gate:** no issuance provenance, beneficial-control map, stale-balance signal, or unwind-status record may operate until its exact fields, purpose, access roles, retention period, appeal path, and independent reviewer are registered in the Monitoring Purpose Register. Unregistered monitoring is void.\n- **All newly issued Flow** carries provenance tags at the audit layer. Flow remains user-fungible for ordinary market activity, but issuance source, channel, sponsor, and unwind status must remain visible only to purpose-bound oversight, post-mortem, and anti-capture review roles named in the Monitoring Purpose Register.\n- **No obligation** may be financed through more than one issuance channel at the same time. Duplicate financing of the same payroll run, invoice chain, milestone package, or emergency continuity need is prohibited.\n- **Unused, stale, or materially misdirected issuance** enters quarantine review. Flow created for a declared purpose may not drift indefinitely into idle accumulation without reclassification, reversion, or formal contract-commitment review.\n\n### X3. Authorized issuance channels\n\n**Payroll channel:**\nFlow may be created against verified net payroll obligations due within a short published window. Requests must reconcile headcount, compensation schedule, prior payroll float, and ordinary available Flow. Unused payroll issuance automatically reverts or is quarantined after the payroll window closes.\n\n**Project escrow channel:**\nApproved project escrows may activate Flow for facilities, tooling, R&D, housing construction, maintenance backlogs, and grid or water upgrades only through preregistered milestone tranches. Full upfront spendable issuance is prohibited absent explicit emergency authorization.\n\n**Essential-services procurement channel:**\nEssential-provider reimbursement, emergency logistics, and continuity-critical procurement may activate Flow only when tied to purchase orders, delivery obligations, or receipt-confirmed service windows. Advance issuance is capped and must convert to delivered-status accounting quickly.\n\n**Public infrastructure windows:**\nFederation or regional project accounts for published assets, schedules, lifecycle plans, and maintenance assumptions, with independent milestone review above the enhanced threshold.\n\n**Continuity backstop channel:**\nTightly bounded emergency issuance may preserve payments continuity during severe technical or institutional disruption, but expires automatically after the short emergency window unless renewed once under enhanced review with published reasons and unwind accounting. Continuity backstops may not become a standing subsidy class.\n\n### X4. Channel ceilings, dual-key review, and anti-capture governance\nNo single ministry, central bank analogue, private bank, donor-backed vehicle, or political office may unilaterally create Flow. Issuance authority must be polycentric, rule-bound, and reviewable.\n- **Threshold definitions:** The *de minimis threshold* is 1\u00d7 the published monthly Essential Access allocation for a single person at the Constitutional Survival Minimum. The *enhanced threshold* is the published household savings floor (18 months of regional median consumption expenditure). Both thresholds default to zero until the relevant founding commitments are published in `/founding/commitments.md`. Where the founding commitments have been published, the specific numeric values govern; where they have not, all issuance is treated as above the enhanced threshold pending publication.\n- **Every issuance** above the de minimis threshold requires dual-key approval: the sponsoring authority and an institutionally distinct independent reviewer.\n- **Issuance above the enhanced threshold** requires a third control signature from the published public-audit or counterparty-review layer.\n- **Issuance reviewers** must be distinct from the requesting issuer and operate under binding independence minimums in force directly here, not by analogy. The independent reviewer is the keystone control of this annex, and these minimums govern: reviewers rotate on a mandatory rotation period and may not serve consecutive terms beyond it; a cooling-off window applies both before and after any sponsor, affiliate, or beneficiary relationship, during which the person may neither review for nor be appointed by that side; no single appointing authority may staff both the sponsoring side and the reviewing side of the same issuance; and every reviewer must publish conflicts on appointment and on each material change, and must recuse from any obligation where the reviewer or an affiliate benefits materially. A reviewer who cannot satisfy these minimums is ineligible, and an issuance reviewed in their absence is not validly approved.\n- **Beneficial ownership** and control affiliations are aggregated for channel ceilings, concentration review, and repeat-issuer analysis. A sponsor may not evade ceilings by spraying issuance across nominally separate affiliates, shells, or contractor chains.\n- **No single sponsor or controlled affiliate group** may receive more than the published share of rolling channel issuance without enhanced review, public explanation, and fairness testing against sector, region, and sponsor concentration indicators. Until the founding commitments publish the operative share in `/founding/commitments.md`, a conservative default channel-share cap of 10% of rolling channel issuance per sponsor or controlled affiliate group binds in its place, so that concentration and factional-allocation review (\u00a7X7-4) is enforceable from day one. Where the founding commitments publish a tighter share, the published value governs; where they publish a looser one, the looser value takes effect only on publication, and concentration review never lapses to an undefined threshold in the interim. Any issuance channel that repeatedly privileges a narrow sector, sponsor class, or political faction automatically enters constitutional review for capture risk.\n\n### X5. Operating float, anti-evasion, and equivalence\nThe constitutional operating-float exemption supersedes prior generic publication language.\n- **Households** receive a safe harbor equal to 18 months of median regional consumption expenditure.\n- **Enterprises** receive the greater of 3 months average payroll or 3 months average direct operating costs measured on a rolling 12-month basis.\n- **Any higher protected balance** requires project escrow, catastrophe reserve, lifecycle fund, or other published protected-balance review. These channels do not create a shelter from Commons Return/source-base, stale-purpose, or beneficial-control review.\n- **Any asset or instrument** that functions as hidden control over a Commons Return source base is subject to equivalence review under Annex D regardless of label, wrapper, or legal form.\n- **Household thresholds**, privacy safe harbors, and minimization rules remain mandatory. Anti-evasion enforcement may not become a pretext for total asset surveillance.\n\n### X6. Error correction, unwind discipline, and public logs\n- **All issuance channels** must publish aggregate issuance logs, category totals, concentration indicators, stale-balance rates, unwind performance, and exception use on the public dashboard with privacy-preserving aggregation.\n- **Quarantine due process:** quarantine requires written notice, named channel rule, evidence basis, maximum review clock, human appeal, and a least-harm interim status. Unresolved suspicion may not freeze ordinary household access, payroll recipients, essential providers, or protected ordinary use.\n- **Mis-issued Flow** may be quarantined, reclassified, or unwound only through published procedures that minimize collateral harm to payroll recipients, essential providers, and innocent counterparties. No ordinary clawback may target wage earners or essential-service recipients absent fraud findings tied to them directly.\n- **Unwind must be staged** when needed to prevent payroll shock, provider insolvency, or sudden continuity collapse. Emergency correction that causes more harm than the original error is itself a design failure.\n- **Repeated issuance error** in the same channel triggers automatic audit, temporary channel throttling, and mandatory public post-mortem before ordinary operation resumes.\n\n### X7. Red-team scenarios and mandatory controls\n\n**Red-team scenario 1 - Fake payroll ring:**\n- Test whether shell employers, fabricated staff rosters, or recycled wage obligations can mint Flow.\n- **Required controls:** headcount reconciliation, payroll-window limits, anomaly sampling, affiliate aggregation, and rapid quarantine of unused payroll issuance.\n\n**Red-team scenario 2 - Circular invoice / project parking:**\n- Test whether affiliates can rotate invoices, declare vague milestones, or warehouse Flow inside protected project structures.\n- **Required controls:** preregistered milestones, independent rotating auditors, no dual-channel financing, and automatic reversion when milestones become circular, self-scored, or repeatedly deferred.\n\n**Red-team scenario 3 - Zombie rollover:**\n- Test whether failing enterprises can continuously renew payroll or continuity issuance without credible recovery.\n- **Required controls:** rollover counters, turnaround review after repeated draws, shrinking ceilings for repeated emergency use, and forced conversion to formal restructuring after the published limit.\n\n**Red-team scenario 4 - Factional allocation:**\n- Test whether one region, sector, sponsor class, or politically connected network receives disproportionate issuance.\n- **Required controls:** concentration dashboards, fairness thresholds, enhanced review above channel-share limits, and automatic constitutional review when favoritism patterns persist.\n\n**Red-team scenario 5 - Unwind shock:**\n- Test whether error correction or stale-balance cleanup causes payroll interruption, provider failure, or sudden contraction.\n- **Required controls:** staged unwind, protected retirement classes, temporary continuity buffers, and public correction sequencing.\n\n**Red-team scenario 6 - Offshore leakage and non-Flow parking:**\n- Test whether newly issued Flow is rapidly converted into foreign stores, art, collectibles, or durable stockpiles to avoid stale-purpose review, protected-float limits, source-base review, or Commons Return equivalence review.\n- **Required controls:** membrane flags, asset-equivalence review, protected-float limits, Commons Return equivalence review, and enhanced audit when issuance exits productive use too quickly.\n- *A system that cannot pass these issuance red-team tests is not scale-ready, regardless of how elegant its abstract monetary theory appears.*\n\n---\n\n## X8 \u2014 Public Finance & Commons Revenue Constitution (merged from former Annex G \u00a7G4)\n\n> **Provenance:** Originally drafted as Annex G \u00a7G4 (\"Public Finance & Commons Revenue Constitution\"). Annex G was retired in the 2026-04-25 review and held in Annex H pending redistribution; moved here in the 2026-04-25 follow-up because public-finance rules and revenue-source discipline belong with Flow issuance architecture.\n\nPublic institutions must be funded in a way that is transparent, capacity-aware, and resistant to quiet debt resurrection. The public side may spend, but it may not hide future obligations off-ledger, manufacture permanent emergency dependence, or fall back to taxing survival, ordinary labor, or basic household exchange.\n\n| Rule area | Default constitutional rule | Anti-capture control |\n| :--- | :--- | :--- |\n| **Revenue sources** | PFCR receipts may draw from Commons Return source bases, land and resource charges, scarce-license returns, public-infrastructure uplift, gateway fees, and bounded public issuance tied to real public production. | Every source must publish methodology, exemptions, aggregate receipts, and remaining-tax disclosure; hidden levies are void. Gateway fees may not become disguised household transaction taxes or survival-access charges. |\n| **Prohibited tax base** | Survival access, ordinary labor, and basic household exchange may not be taxed as routine revenue sources. | Any measure that functionally backfills PFCR through those bases triggers mandatory judicial review. |\n| **Operating budgets** | Public institutions receive Flow appropriations tied to published service plans, staffing assumptions, capacity evidence, and a declared PFCR source mix. | Quarterly variance reporting, source-by-source disclosure, and public change logs. |\n| **Recurring obligations** | Any recurring program expansion must identify a stable PFCR path and capacity plan before approval. | No unfunded permanent commitments and no quiet migration to prohibited taxes. |\n| **Capital projects** | Long-lived infrastructure may use time-bounded public borrowing only when tied to resilience, productive capacity, commons maintenance, or the public banking / payment rail. | Amortization schedule, public cost register, PFCR repayment path, and constitutional debt cap. |\n| **Payroll and compensation** | Public workers receive the universal Essential Access floor like everyone else and any additional compensation through the ordinary Flow wage system. | No privileged compensation channel or hidden civic bonuses. |\n| **Basic banking rails** | Payments, basic custody, wage receipt, bill pay, fraud recovery, and cash access are funded as public infrastructure with a guaranteed postal-bank or public-bank option and interoperable licensed providers. | Universal service obligations, retail fee caps above the free baseline, portability rights, and published uptime / recovery metrics. |\n| **Procurement** | Open standards, public bid logic, beneficial ownership disclosure, and conflict-of-interest rules apply by default. | Automatic audit triggers for concentration, overruns, and sole-source exceptions. |\n| **Deficits and emergency spending** | Emergency overspending must be explicitly tagged, time-limited, and paired with a restoration plan that does not rely on prohibited taxes or hidden bank privileges. | No rolling emergency status; mandatory sunset, post-mortem, and PFCR correction plan. |\n\n---\n\n## X9 \u2014 Intellectual Property and Knowledge Commons (merged from former Annex AA \u00a7AA3)\n\n> **Provenance:** Originally drafted as Annex AA \u00a7AA3 (\"Intellectual Property and Knowledge Commons\"). Annex AA was retired in the 2026-04-25 review and held in Annex N pending redistribution; moved here in the 2026-04-25 follow-up because knowledge-governance rules belong with Flow issuance and commons-revenue architecture.\n\nIntellectual property is a modern rent-seeking vector and shall not remain outside the protocol's anti-extraction logic. Article V therefore includes knowledge-governance rules that distinguish genuine productive creativity from blocking portfolios and perpetual licensing extraction.\n\n- **IP protection is time-limited** and use-rights based, not perpetual or dynastic.\n- **Essential goods and services** dependent on protected IP must be subject to compulsory licensing at published rates when refusal would undermine the survival floor, public health, or constitutional survival minimum.\n- **Blocking portfolios** without associated productive deployment are prohibited as rent-seeking instruments.\n- **Protected works and patents** expire into a commons unless renewed through a narrowly defined public-interest process that cannot recreate perpetual extraction.\n\n---\n\n*Annex Y \u2014 Constitutional Survival Minimum and Essential Access Continuity Architecture is maintained as a separate controlling document. See [ANNEX_Y.md](./ANNEX_Y.md). Where any language in this file conflicts with Annex Y, Annex Y governs.*\n\n*Annex D \u2014 Commons Return and Universal Stake is the controlling specification for the public-return and fiscal-sustainability architecture referenced throughout this annex. See [ANNEX_D.md](./ANNEX_D.md). Source bases, protected ordinary use, Universal Stake, lockbox rules, dormant backstops, and fiscal adequacy gates in Annex D govern over any summary language here. Older progressive-demurrage language is superseded unless explicitly marked historical or dormant. Any dormant backstop is non-operative unless revived by explicit patch, fiscal/dignity evidence, public review, and the applicable amendment process.*\n",
+      "content": "# ANNEX X \u2014 Flow Issuance Architecture\n\n> **At a glance**\n> | | |\n> |---|---|\n> | **Purpose** | Defines how Flow comes into existence \u2014 against verified productive commitments only \u2014 specifying authorized channels (payroll, project escrow, essential services procurement, public infrastructure, continuity backstop), dual-key and third-signature controls, channel ceilings, anti-capture governance, and six red-team scenarios issuance must survive before scale-up. |\n> | **Who it protects** | Everyone harmed by money creation that inflates asset prices, rewards political allies, rescues failed speculation, or manufactures demand without linked productive capacity \u2014 and wage earners and essential providers who need error-correction to be staged, not sudden. |\n> | **Failure risk** | Fake payroll rings, circular invoice schemes, zombie rollovers, factional allocation, unwind shock, and offshore leakage \u2014 each a path by which the issuance system becomes a capture vehicle rather than a productive-economy instrument. |\n> | **Evidence status** | Designed |\n> | **Linked risks** | P-029; P-030; P-066; T-029; TR-09 smart-contract failure; Annex D (Commons Return and Universal Stake); red-team scenarios in \u00a7X7. |\n\n> **Provenance:** Implements [P-029 \u2014 Public Finance & Commons Revenue] (\u00a7X8) and [P-030 \u2014 Protocol-Only Money Creation and Household Finance Boundaries] (\u00a7X1\u2013X8) \u00b7 Status: **ACTIVE**\n\n**Purpose.** The protocol cannot be capture-resistant if the point of money creation remains vague. This annex defines how Flow comes into existence, who may authorize it, how issuance is bounded, and how issuance abuse is red-team tested. Where Annex X conflicts with looser issuance language elsewhere, Annex X governs.\n\n**Design principle: issue Flow against verified productive commitments, not against discretionary stock politics or financial privilege.**\n\n### X1. What Flow issuance is for\nFlow issuance exists to meet real productive demand: payroll settlement, milestone-bound project build-out, essential-services procurement, public infrastructure delivery, and tightly bounded continuity backstops during payment-system failure. Flow is not created to reward political allies, inflate asset prices, rescue failed speculation without conditions, or manufacture demand without linked capacity, delivery, or maintenance need. Any issuance channel must identify the concrete activity, continuity need, or productive commitment it is serving. Purpose ambiguity is itself a constitutional defect.\n\n### X2. Flow-based issuance rule and provenance\nNew Flow may be issued only against verified productive commitments rather than as a prior discretionary stock. The protocol treats money as a flow linked to work, provisioning, maintenance, and build-out, not as a sovereign hoard.\n- **Every issuance request** must publish or internally register, subject to privacy minimization: channel, sponsor, beneficial-control map, amount, duration, linked productive obligation, release schedule, prior unused protected balance, unwind path, reviewer signatures, and error-correction route.\n- **Monitoring-purpose gate:** no issuance provenance, beneficial-control map, stale-balance signal, or unwind-status record may operate until its exact fields, purpose, access roles, retention period, appeal path, and independent reviewer are registered in the Monitoring Purpose Register. Unregistered monitoring is void.\n- **All newly issued Flow** carries provenance tags at the audit layer. Flow remains user-fungible for ordinary market activity, but issuance source, channel, sponsor, and unwind status must remain visible only to purpose-bound oversight, post-mortem, and anti-capture review roles named in the Monitoring Purpose Register.\n- **No obligation** may be financed through more than one issuance channel at the same time. Duplicate financing of the same payroll run, invoice chain, milestone package, or emergency continuity need is prohibited.\n- **Unused, stale, or materially misdirected issuance** enters quarantine review. Flow created for a declared purpose may not drift indefinitely into idle accumulation without reclassification, reversion, or formal contract-commitment review.\n\n### X3. Authorized issuance channels\n\n**Payroll channel:**\nFlow may be created against verified net payroll obligations due within a short published window. Requests must reconcile headcount, compensation schedule, prior payroll float, and ordinary available Flow. Unused payroll issuance automatically reverts or is quarantined after the payroll window closes.\n\n**Project escrow channel:**\nApproved project escrows may activate Flow for facilities, tooling, R&D, housing construction, maintenance backlogs, and grid or water upgrades only through preregistered milestone tranches. Full upfront spendable issuance is prohibited absent explicit emergency authorization.\n\n**Essential-services procurement channel:**\nEssential-provider reimbursement, emergency logistics, and continuity-critical procurement may activate Flow only when tied to purchase orders, delivery obligations, or receipt-confirmed service windows. Advance issuance is capped and must convert to delivered-status accounting quickly.\n\n**Public infrastructure windows:**\nFederation or regional project accounts for published assets, schedules, lifecycle plans, and maintenance assumptions, with independent milestone review above the enhanced threshold.\n\n**Continuity backstop channel:**\nTightly bounded emergency issuance may preserve payments continuity during severe technical or institutional disruption, but expires automatically after the short emergency window unless renewed once under enhanced review with published reasons and unwind accounting. Continuity backstops may not become a standing subsidy class.\n\n### X4. Channel ceilings, dual-key review, and anti-capture governance\nNo single ministry, central bank analogue, private bank, donor-backed vehicle, or political office may unilaterally create Flow. Issuance authority must be polycentric, rule-bound, and reviewable.\n- **Threshold definitions:** The *de minimis threshold* is 1\u00d7 the published monthly Essential Access allocation for a single person at the Constitutional Survival Minimum. The *enhanced threshold* is the published household savings floor (18 months of regional median consumption expenditure). Both thresholds default to zero until the relevant founding commitments are published in `/founding/commitments.md`. Where the founding commitments have been published, the specific numeric values govern; where they have not, all issuance is treated as above the enhanced threshold pending publication.\n- **Every issuance** above the de minimis threshold requires dual-key approval: the sponsoring authority and an institutionally distinct independent reviewer.\n- **Issuance above the enhanced threshold** requires a third control signature from the published public-audit or counterparty-review layer.\n- **Issuance reviewers** must be distinct from the requesting issuer and operate under binding independence minimums in force directly here, not by analogy. The independent reviewer is the keystone control of this annex, and these minimums govern: reviewers rotate on a mandatory rotation period and may not serve consecutive terms beyond it; a cooling-off window applies both before and after any sponsor, affiliate, or beneficiary relationship, during which the person may neither review for nor be appointed by that side; no single appointing authority may staff both the sponsoring side and the reviewing side of the same issuance; and every reviewer must publish conflicts on appointment and on each material change, and must recuse from any obligation where the reviewer or an affiliate benefits materially. A reviewer who cannot satisfy these minimums is ineligible, and an issuance reviewed in their absence is not validly approved.\n- **Beneficial ownership** and control affiliations are aggregated for channel ceilings, concentration review, and repeat-issuer analysis. A sponsor may not evade ceilings by spraying issuance across nominally separate affiliates, shells, or contractor chains.\n- **No single sponsor or controlled affiliate group** may receive more than the published share of rolling channel issuance without enhanced review, public explanation, and fairness testing against sector, region, and sponsor concentration indicators. Until the founding commitments publish the operative share in `/founding/commitments.md`, a conservative default channel-share cap of 10% of rolling channel issuance per sponsor or controlled affiliate group binds in its place, so that concentration and factional-allocation review (\u00a7X7-4) is enforceable from day one. Where the founding commitments publish a tighter share, the published value governs; where they publish a looser one, the looser value takes effect only on publication, and concentration review never lapses to an undefined threshold in the interim. Any issuance channel that repeatedly privileges a narrow sector, sponsor class, or political faction automatically enters constitutional review for capture risk.\n\n### X5. Operating float, anti-evasion, and equivalence\nThe constitutional operating-float exemption supersedes prior generic publication language.\n- **Households** receive a safe harbor equal to 18 months of median regional consumption expenditure.\n- **Enterprises** receive the greater of 3 months average payroll or 3 months average direct operating costs measured on a rolling 12-month basis.\n- **Any higher protected balance** requires project escrow, catastrophe reserve, lifecycle fund, or other published protected-balance review. These channels do not create a shelter from Commons Return/source-base, stale-purpose, or beneficial-control review.\n- **Any asset or instrument** that functions as hidden control over a Commons Return source base is subject to equivalence review under Annex D regardless of label, wrapper, or legal form.\n- **Household thresholds**, privacy safe harbors, and minimization rules remain mandatory. Anti-evasion enforcement may not become a pretext for total asset surveillance.\n\n### X6. Error correction, unwind discipline, and public logs\n- **All issuance channels** must publish aggregate issuance logs, category totals, concentration indicators, stale-balance rates, unwind performance, and exception use on the public dashboard with privacy-preserving aggregation.\n- **Quarantine due process:** quarantine requires written notice, named channel rule, evidence basis, maximum review clock, human appeal per the appeal spine ([ANNEX_L \u00a7L7](./ANNEX_L.md)), and a least-harm interim status. Unresolved suspicion may not freeze ordinary household access, payroll recipients, essential providers, or protected ordinary use.\n- **Mis-issued Flow** may be quarantined, reclassified, or unwound only through published procedures that minimize collateral harm to payroll recipients, essential providers, and innocent counterparties. No ordinary clawback may target wage earners or essential-service recipients absent fraud findings tied to them directly.\n- **Unwind must be staged** when needed to prevent payroll shock, provider insolvency, or sudden continuity collapse. Emergency correction that causes more harm than the original error is itself a design failure.\n- **Repeated issuance error** in the same channel triggers automatic audit, temporary channel throttling, and mandatory public post-mortem before ordinary operation resumes.\n\n### X7. Red-team scenarios and mandatory controls\n\n**Red-team scenario 1 - Fake payroll ring:**\n- Test whether shell employers, fabricated staff rosters, or recycled wage obligations can mint Flow.\n- **Required controls:** headcount reconciliation, payroll-window limits, anomaly sampling, affiliate aggregation, and rapid quarantine of unused payroll issuance.\n\n**Red-team scenario 2 - Circular invoice / project parking:**\n- Test whether affiliates can rotate invoices, declare vague milestones, or warehouse Flow inside protected project structures.\n- **Required controls:** preregistered milestones, independent rotating auditors, no dual-channel financing, and automatic reversion when milestones become circular, self-scored, or repeatedly deferred.\n\n**Red-team scenario 3 - Zombie rollover:**\n- Test whether failing enterprises can continuously renew payroll or continuity issuance without credible recovery.\n- **Required controls:** rollover counters, turnaround review after repeated draws, shrinking ceilings for repeated emergency use, and forced conversion to formal restructuring after the published limit.\n\n**Red-team scenario 4 - Factional allocation:**\n- Test whether one region, sector, sponsor class, or politically connected network receives disproportionate issuance.\n- **Required controls:** concentration dashboards, fairness thresholds, enhanced review above channel-share limits, and automatic constitutional review when favoritism patterns persist.\n\n**Red-team scenario 5 - Unwind shock:**\n- Test whether error correction or stale-balance cleanup causes payroll interruption, provider failure, or sudden contraction.\n- **Required controls:** staged unwind, protected retirement classes, temporary continuity buffers, and public correction sequencing.\n\n**Red-team scenario 6 - Offshore leakage and non-Flow parking:**\n- Test whether newly issued Flow is rapidly converted into foreign stores, art, collectibles, or durable stockpiles to avoid stale-purpose review, protected-float limits, source-base review, or Commons Return equivalence review.\n- **Required controls:** membrane flags, asset-equivalence review, protected-float limits, Commons Return equivalence review, and enhanced audit when issuance exits productive use too quickly.\n- *A system that cannot pass these issuance red-team tests is not scale-ready, regardless of how elegant its abstract monetary theory appears.*\n\n---\n\n## X8 \u2014 Public Finance & Commons Revenue Constitution (merged from former Annex G \u00a7G4)\n\n> **Provenance:** Originally drafted as Annex G \u00a7G4 (\"Public Finance & Commons Revenue Constitution\"). Annex G was retired in the 2026-04-25 review and held in Annex H pending redistribution; moved here in the 2026-04-25 follow-up because public-finance rules and revenue-source discipline belong with Flow issuance architecture.\n\nPublic institutions must be funded in a way that is transparent, capacity-aware, and resistant to quiet debt resurrection. The public side may spend, but it may not hide future obligations off-ledger, manufacture permanent emergency dependence, or fall back to taxing survival, ordinary labor, or basic household exchange.\n\n| Rule area | Default constitutional rule | Anti-capture control |\n| :--- | :--- | :--- |\n| **Revenue sources** | PFCR receipts may draw from Commons Return source bases, land and resource charges, scarce-license returns, public-infrastructure uplift, gateway fees, and bounded public issuance tied to real public production. | Every source must publish methodology, exemptions, aggregate receipts, and remaining-tax disclosure; hidden levies are void. Gateway fees may not become disguised household transaction taxes or survival-access charges. |\n| **Prohibited tax base** | Survival access, ordinary labor, and basic household exchange may not be taxed as routine revenue sources. | Any measure that functionally backfills PFCR through those bases triggers mandatory judicial review. |\n| **Operating budgets** | Public institutions receive Flow appropriations tied to published service plans, staffing assumptions, capacity evidence, and a declared PFCR source mix. | Quarterly variance reporting, source-by-source disclosure, and public change logs. |\n| **Recurring obligations** | Any recurring program expansion must identify a stable PFCR path and capacity plan before approval. | No unfunded permanent commitments and no quiet migration to prohibited taxes. |\n| **Capital projects** | Long-lived infrastructure may use time-bounded public borrowing only when tied to resilience, productive capacity, commons maintenance, or the public banking / payment rail. | Amortization schedule, public cost register, PFCR repayment path, and constitutional debt cap. |\n| **Payroll and compensation** | Public workers receive the universal Essential Access floor like everyone else and any additional compensation through the ordinary Flow wage system. | No privileged compensation channel or hidden civic bonuses. |\n| **Basic banking rails** | Payments, basic custody, wage receipt, bill pay, fraud recovery, and cash access are funded as public infrastructure with a guaranteed postal-bank or public-bank option and interoperable licensed providers. | Universal service obligations, retail fee caps above the free baseline, portability rights, and published uptime / recovery metrics. |\n| **Procurement** | Open standards, public bid logic, beneficial ownership disclosure, and conflict-of-interest rules apply by default. | Automatic audit triggers for concentration, overruns, and sole-source exceptions. |\n| **Deficits and emergency spending** | Emergency overspending must be explicitly tagged, time-limited, and paired with a restoration plan that does not rely on prohibited taxes or hidden bank privileges. | No rolling emergency status; mandatory sunset, post-mortem, and PFCR correction plan. |\n\n---\n\n## X9 \u2014 Intellectual Property and Knowledge Commons (merged from former Annex AA \u00a7AA3)\n\n> **Provenance:** Originally drafted as Annex AA \u00a7AA3 (\"Intellectual Property and Knowledge Commons\"). Annex AA was retired in the 2026-04-25 review and held in Annex N pending redistribution; moved here in the 2026-04-25 follow-up because knowledge-governance rules belong with Flow issuance and commons-revenue architecture.\n\nIntellectual property is a modern rent-seeking vector and shall not remain outside the protocol's anti-extraction logic. Article V therefore includes knowledge-governance rules that distinguish genuine productive creativity from blocking portfolios and perpetual licensing extraction.\n\n- **IP protection is time-limited** and use-rights based, not perpetual or dynastic.\n- **Essential goods and services** dependent on protected IP must be subject to compulsory licensing at published rates when refusal would undermine the survival floor, public health, or constitutional survival minimum.\n- **Blocking portfolios** without associated productive deployment are prohibited as rent-seeking instruments.\n- **Protected works and patents** expire into a commons unless renewed through a narrowly defined public-interest process that cannot recreate perpetual extraction.\n\n---\n\n*Annex Y \u2014 Constitutional Survival Minimum and Essential Access Continuity Architecture is maintained as a separate controlling document. See [ANNEX_Y.md](./ANNEX_Y.md). Where any language in this file conflicts with Annex Y, Annex Y governs.*\n\n*Annex D \u2014 Commons Return and Universal Stake is the controlling specification for the public-return and fiscal-sustainability architecture referenced throughout this annex. See [ANNEX_D.md](./ANNEX_D.md). Source bases, protected ordinary use, Universal Stake, lockbox rules, dormant backstops, and fiscal adequacy gates in Annex D govern over any summary language here. Older progressive-demurrage language is superseded unless explicitly marked historical or dormant. Any dormant backstop is non-operative unless revived by explicit patch, fiscal/dignity evidence, public review, and the applicable amendment process.*\n",
       "headings": [
         {
           "level": 1,
@@ -11990,7 +12025,7 @@
           "slug": "x9-intellectual-property-and-knowledge-commons-merged-from-former-annex-aa-aa3"
         }
       ],
-      "wordCount": 2616,
+      "wordCount": 2624,
       "headingCount": 10
     },
     {
diff --git a/docs/annexes/ANNEX_AI.md b/docs/annexes/ANNEX_AI.md
index 2b0c465..4cf7249 100644
--- a/docs/annexes/ANNEX_AI.md
+++ b/docs/annexes/ANNEX_AI.md
@@ -241,7 +241,7 @@ One sub-Ombuds rotates into the 3-member arbitration panel convened within 72 ho
 
 *Protocol-level — Plenum vote required per §3.2 item 4.*
 
-Any party subject to a §4.2 Graduated Penalty may appeal to the Federation within 30 days of determination. The Plenum hears the appeal and decides under FC-091 (4 of 5 to overturn). If the Plenum overturns, the penalty is vacated; if remanded (3 of 5), the Enforcement Panel re-investigates; if affirmed (<3 affirmative for overturn), the penalty stands.
+Any party subject to a §4.2 Graduated Penalty may appeal to the Federation on the appeal spine ([ANNEX_L §L7](./ANNEX_L.md) — one filing rule, L7.1). The Plenum hears the appeal and decides under FC-091 (4 of 5 to overturn). If the Plenum overturns, the penalty is vacated; if remanded (3 of 5), the Enforcement Panel re-investigates; if affirmed (<3 affirmative for overturn), the penalty stands.
 
 Appeals are heard de novo on the evidentiary record. The Plenum may also issue binding interpretive guidance to the Enforcement Panel with each appeal decision.
 
diff --git a/docs/annexes/ANNEX_AJ.md b/docs/annexes/ANNEX_AJ.md
index 0abe21d..f744754 100644
--- a/docs/annexes/ANNEX_AJ.md
+++ b/docs/annexes/ANNEX_AJ.md
@@ -272,7 +272,7 @@ Penalty adjudication is administered by the **Enforcement Panel** (a sub-body of
 2. **Gain quantification.** The enforcement body quantifies the functional gain per §4.1. Quantification methodology is documented and subject to the P-017 oracle-independence standards (Annex AL) where gain estimation requires measurement of market prices or cohort comparisons.
 3. **Notice and response.** The accused actor receives notice with the factual finding, the gain quantification, and the scheduled penalty. Actor has 30 days to contest findings or accept.
 4. **Adjudication.** Contested cases proceed to the Enforcement Panel. Panel composition: 3 seats drawn from the Article VII enforcement staff, 2 seats drawn from the Ombuds roster per Annex AI, 1 seat drawn from the affected-party advocacy roster. No Enforcement Panel member may have a prior relationship with the accused actor within 3 years.
-5. **Appeal.** Adjudicated penalties are appealable once, through the federated Ombuds process per Annex AI §4.8 (Enforcement Panel Appeals). Appeal pauses license actions but not gain-recoupment until resolved.
+5. **Appeal.** Adjudicated penalties are appealable once, on the appeal spine ([ANNEX_L §L7](./ANNEX_L.md)) via the federated Ombuds process per Annex AI §4.8 (Enforcement Panel Appeals) — the Plenum, not the CRP ladder, is the final instance (ANNEX_L §L7.3). Appeal pauses license actions but not gain-recoupment: recoupment proceeds during appeal **into escrow**, refunded with accrued return if the appeal succeeds (ANNEX_L §L7.2) — so appeal never becomes a window to dissipate gains, and a successful appellant is made whole.
 6. **Publication.** Final findings are published on the Enforcement Ledger (Article VII) in aggregate form, with individual findings published only where necessary for statutory notice or where the actor has consented. PII is stripped per Annex AM.
 
 ### 4.5 — Deterrence Audit
diff --git a/docs/annexes/ANNEX_AS.md b/docs/annexes/ANNEX_AS.md
index 8c1de2f..de1c304 100644
--- a/docs/annexes/ANNEX_AS.md
+++ b/docs/annexes/ANNEX_AS.md
@@ -106,7 +106,7 @@ A false-claim finding by the Ombuds (Annex AI) or the Enforcement Panel (Annex A
 | False attestation, knowing (attestor knew claim was false or recklessly indifferent) | 100% of placed stake slashed; attestor referred to Enforcement Panel under Annex AJ §4.2 at AJ-2.2 severity (1.5×) for the functional gain created by the false attestation |
 | Attestation ring or coordinated false attestation | 100% of placed stake slashed for all ring members; Annex AJ §4.2 AJ-2.2 + AJ-2.3 escalation; 2-year attestation disqualification; Service Record deduction per matrix |
 
-**Slashed stake distribution** (§3).
+**Slashed stake distribution** (§3). Slashing findings are appealable per the appeal spine ([ANNEX_L §L7](./ANNEX_L.md)); final adjudication lies with the Ombuds Plenum per Annex AI §4.9, with stake escrowed until finality.
 
 ### 2.5 — Pre-commit Transparency
 
diff --git a/docs/annexes/ANNEX_D.md b/docs/annexes/ANNEX_D.md
index 866f496..ea846f3 100644
--- a/docs/annexes/ANNEX_D.md
+++ b/docs/annexes/ANNEX_D.md
@@ -136,7 +136,7 @@ Commons Return assessment data is a monitoring stream for purposes of [P-069](..
 
 **D6.2 Public formulas, private details.** Public dashboards show aggregate receipts and burden distribution. Individual household and business details remain protected unless disclosure is required for a specific adjudicated enforcement action.
 
-**D6.3 Appeal right.** Every assessment must include a plain-language basis, evidence source, appeal path, hardship route, and non-displacement protection where applicable.
+**D6.3 Appeal right.** Every assessment must include a plain-language basis, evidence source, appeal path, hardship route, and non-displacement protection where applicable. Appeals follow the appeal spine ([ANNEX_L §L7](./ANNEX_L.md)).
 
 **D6.4 Independent review.** Valuation methods, source-base definitions, and exemption decisions require recurring review by independent methodology classes under Annex AL-style independence rules.
 
diff --git a/docs/annexes/ANNEX_I.md b/docs/annexes/ANNEX_I.md
index 9ebca41..6422d3e 100644
--- a/docs/annexes/ANNEX_I.md
+++ b/docs/annexes/ANNEX_I.md
@@ -98,12 +98,11 @@ A humane system must also be capacity-honest. Regions may not promise settlement
 
 ### I8. Appeals, review, and privacy protections
 - Every adverse status decision must be provided in writing with reasons, evidence basis, review path, and timeline.
-- Emergency review must begin within 72 hours where shelter loss, family separation, medical interruption, or expulsion risk is involved.
-- Ordinary status appeals must be available within 14 days of filing, with a written determination within 30 days unless the claimant requests more time.
 - Residency and migration data may be used only for continuity, routing, anti-fraud, safety, and lawfully published planning purposes. Individual-level exposure on public dashboards is prohibited.
 - The capacity dashboards and any migrant or entrant datasets are governed by data minimization, retention limits, and access controls. Only data necessary for the stated purpose is collected; it is retained no longer than that purpose requires and then deleted or irreversibly aggregated; access is limited to authorized roles and every access is logged. Such data may never be repurposed for enforcement, expulsion, deterrence, or any use beyond the lawful purposes named in this annex.
 - Privacy, anti-publicity, and anti-discrimination protections cover not only a person's individual records but also their status-classification data — which status class they are in. Status-class membership may not be published, disclosed, or made discoverable at the individual level, and may not be used as a basis for differential treatment outside the lawful service-routing and due-process purposes defined in this annex, so that a status class cannot harden into a public mark or stigma.
 - Children and protected entrants receive heightened confidentiality, and their data may not be publicized for deterrence theater or political messaging.
+- Status appeals run on the appeal spine ([ANNEX_L §L7](./ANNEX_L.md)), which carries the clocks (72h emergency / 14-day docket / 30-day determination); escalation follows the spine ladder.
 
 ### I9. Absence, exit, reentry, and continuity preservation
 - Routine travel, temporary caregiving, education, service deployment, medical treatment, or family emergency absence does not by itself break Core Resident continuity.
diff --git a/docs/annexes/ANNEX_J.md b/docs/annexes/ANNEX_J.md
index 945e6d6..1895593 100644
--- a/docs/annexes/ANNEX_J.md
+++ b/docs/annexes/ANNEX_J.md
@@ -43,7 +43,7 @@ The transparency precondition is calibrated to the structure held, not to ordina
 
 **R2.2 Bounded capital claims.** Capital claims on stewarded assets are bounded — through anti-rent use-right logic for land and housing, capped and redeemable outside-capital instruments for enterprise, and judicially reviewable limits on passive extraction. The boundary distinguishes a fair return on contribution from a perpetual rent extracted because one holds the title.
 
-**R2.3 Passive-extraction prohibition is reviewable.** Whether a given arrangement is productive stewardship or prohibited passive extraction is a reviewable question, not a self-certification. Determinations rest on published criteria, are subject to appeal, and require mission-lock documentation where stewardship status is claimed. Valuation disputes about what counts as productive stewardship are resolved through that review process, not by the asserted intent of the holder.
+**R2.3 Passive-extraction prohibition is reviewable.** Whether a given arrangement is productive stewardship or prohibited passive extraction is a reviewable question, not a self-certification. Determinations rest on published criteria, are appealable per the appeal spine ([ANNEX_L §L7](./ANNEX_L.md)) with the independent stewardship reviewer as first instance, and require mission-lock documentation where stewardship status is claimed. Valuation disputes about what counts as productive stewardship are resolved through that review process, not by the asserted intent of the holder.
 
 The review is bound to a rule, not to discretion. The criteria distinguishing productive stewardship from prohibited passive extraction — and the line at which contributed risk and value have been fairly returned — are published in advance and applied as a standing rule to like cases alike, not improvised case by case. Those criteria live in a published stewardship standard set under Article V, itself open to challenge and revision through ordinary review; the adjudicating body applies that standard and does not author the boundary in the course of deciding a particular holding. The reviewer of any determination is independent of the parties and of any person who would benefit from the outcome, and recuses where a conflict exists. The burden of proof is bounded and stated in the published standard: a holder is not presumed to be a passive extractor, an honest steward is not put to an impossible proof, and the case for prohibition rests on the reviewing body against the published criteria. These constraints exist so that the boundary between protected stewardship and prohibited extraction is fixed by a rule announced beforehand, in the spirit of a fixed Jubilee release rather than a discretionary judgment that could be turned to advantage.
 
diff --git a/docs/annexes/ANNEX_L.md b/docs/annexes/ANNEX_L.md
index d327613..0643428 100644
--- a/docs/annexes/ANNEX_L.md
+++ b/docs/annexes/ANNEX_L.md
@@ -3,7 +3,7 @@
 > **At a glance**
 > | | |
 > |---|---|
-> | **Purpose** | Constitutes the three-tier review architecture (Local Review Offices, Regional Constitutional Chambers, Constitutional Review Panel), defines CRP composition via sortition, sets standards of review for each tier, specifies the remedy ladder, and maps dispute classes to forum and appeal path. |
+> | **Purpose** | Constitutes the three-tier review architecture (Local Review Offices, Regional Constitutional Chambers, Constitutional Review Panel), defines CRP composition via sortition, sets standards of review for each tier, specifies the remedy ladder, and maps dispute classes to forum and appeal path; §L7 is the canonical appeal spine for every appeal context in the corpus. |
 > | **Who it protects** | Anyone who suffers an adverse decision — loss of Essential Access, identity denial, oracle dispute, emergency-power overreach — and needs a legible, fast-acting path to challenge it. |
 > | **Failure risk** | Without a constituted review body, the CRP remains implicit and therefore capturable; no single office can quietly reinterpret the constitution, but multiple offices in concert can if there is no independent check. |
 > | **Evidence status** | Designed |
@@ -70,3 +70,57 @@ Every materially adverse decision must be challengeable by a legible path. Autom
 - Counsel and advocate support extend to the commercial-court and technical-audit tracks, so that under-resourced parties receive qualified representation and independent expert assistance where expertise or cost asymmetry would otherwise undercut the burden-shift above.
 - Emergency relief windows should be measured in hours or days, not months, whenever survival access, identity continuity, or liberty interests are at stake.
 - Algorithmic systems must preserve the inputs, rules, and model / version state necessary for retrospective review.
+
+---
+
+## L7 — The Appeal Spine (P-074 consolidation)
+
+> **Provenance:** Consolidated under the Framework-First Intake rule (P-073, Acceptance_Protocol). ANNEX_L is the most general existing appeal instrument; this section makes it the single canonical spine. Domain annexes keep their first-instance bodies and substantive standards; they no longer carry their own filing rules, windows, or escalation procedure. Status: `Designed`. Domain documents name their first-instance body and substantive standard and cite this section for everything procedural; a domain document restating its own filing rule, window, or escalation path is in drift — the spine governs. New appeal contexts are added as a row in L7.5, never as new machinery (P-073). Changes to the spine's clocks, the imminent-serious-harm standard, or the deletion of an intake row receive Strict review (L4).
+
+### L7.1 One filing rule
+
+Any materially adverse determination under this corpus — a denial, reduction, suspension, flag, quarantine, classification, penalty, or refusal to act — is appealable by the person or body it burdens. One trigger: receipt (or constructive receipt) of the adverse decision with its written reasons. One window: **30 days** from that notice, extended automatically where notice was defective, inaccessible, or never reached the person. Filing is reachable without identity documents, literacy, fee, or counsel (INV-013); a trusted helper or community navigator may file without the appellant losing any right.
+
+### L7.2 What continues during appeal
+
+- **The survival floor always continues.** Any withholding of the Constitutional Survival Minimum — system-originated or host-instructed — is resolved toward provision while the appeal is pending (INV-013, INV-019). A withholding with no open appeal path is void.
+- **For everything else, the status quo ante continues:** the standing, access, housing continuity, issuance, or classification the person held before the adverse decision remains in force during appeal, except where a published, reviewable imminent-serious-harm standard is met (the ANNEX_U §U6 standard, generalized). Until the generalized imminent-serious-harm standard is published — authored and amended under the ANNEX_U §U5 threshold-setting discipline, and its publication a pre-launch gate — each domain's existing published interim measure (e.g., the ANNEX_X §X6 least-harm interim status) continues to operate during appeal; status quo ante does not vacate it. Invocation of the imminent-serious-harm exception is itself immediately appealable on the emergency clock (L7.4), with the burden on the invoking body, and it may never be invoked against the survival floor.
+- **Penalties and stakes:** license and access sanctions pause during appeal; monetary gain-recoupment proceeds during appeal **into escrow** per ANNEX_AJ §4.4 — refunded with accrued return if the appeal succeeds — so appeal never becomes a window to dissipate gains; slashed-stake distribution does not execute until finality, the stake remaining escrowed (ANNEX_AI §4.9). Stake under a false-claim finding is escrowed, not slashed, until final determination (ANNEX_AI §4.9).
+
+### L7.3 The ladder
+
+1. **First instance — domain specialist body** (table in L7.5). The specialist applies its own published substantive standard; the spine governs only procedure and escalation.
+2. **Second instance — Regional Constitutional Chamber** (L1), on the record, with emergency relief authority.
+3. **Final instance — split by question:**
+   - **Constitutional questions** (Tier boundaries, invariant violation, instrument separation, rights deprivation): the **CRP** (L1–L4 standards of review).
+   - **Enforcement and Ombuds-administered administrative questions** (Enforcement Panel penalties, attestation false-claim findings, manufactured-flag determinations): the **Ombuds Plenum** under FC-091 (ANNEX_AI §3.2, §4.8–4.9). These do not merge into the CRP ladder: folding them in would reduce the independence count bearing on enforcement outcomes (P-073's simplicity-presumption limit; INV-006). Residual cross-links are acknowledged honestly: the Enforcement Panel seats members from the Ombuds roster (ANNEX_AJ §4.4) and sub-Ombuds Commissioners are confirmed by the CRP (ANNEX_AI §2.1) — the split raises the independence count, it does not perfect it. A constitutional challenge to the Ombuds' own conduct runs up the CRP ladder, so neither final instance sits unaudited.
+
+   A single appeal raising both kinds of question is heard by its domain ladder, and the constitutional question is certified to the CRP; the appellant is never required to diagnose the split to file (one door, L7.1).
+
+### L7.4 Timing
+
+| Class | Clock |
+| :--- | :--- |
+| **Emergency** (shelter loss, floor interruption, family separation, medical interruption, expulsion, identity lockout) | Review begins within **72 hours**; interim relief decided in the same window. |
+| **Time-critical operational** (demand-context flags, PCRP co-certification, supply-shock action) | The Duty body acts immediately; full post-hoc review within **30 days** (ANNEX_AI §3.1 urgency split, preserved). |
+| **Ordinary** | Appeal acknowledged and docketed within **14 days** of filing; written first-instance determination within **30 days** unless the appellant requests more time. |
+| **Escalation** | Each higher instance runs on the same 14/30 clocks from receipt of the escalated record. |
+
+A blown clock never costs the appellant: relief pending review continues until the late decision actually issues. On final affirmance of a monetary assessment, penalty, or quarantine, amounts and restrictions relieved during a blown-clock period are reinstated retroactively (escrow-settled), so delay relief is never a prize for the merits-loser. This reinstatement never applies to the survival floor (INV-013).
+
+### L7.5 Domain intake table
+
+The L6 dispute-class table is the first-instance map for Essential Access, identity/personhood, Voice/Service Record, and emergency-powers appeals; the rows below add the contexts L6 does not name.
+
+| Appeal context | First instance | Escalates to chamber when | Final instance |
+| :--- | :--- | :--- | :--- |
+| Civic standing / residency status (ANNEX_I §I8) | Status review per §I8 | Adverse determination upheld | CRP |
+| Productive-status / stewardship determination (Productive Status Register; ANNEX_J §R2.3) | ANNEX_J independent stewardship reviewer (per §R2.3) | Determination upheld; INV-006 separation question | CRP |
+| Commons Return / CRUS assessment (FC-209) | Commons Return assessment review (per ANNEX_D §D6) | Assessed holder or excluded claimant unsatisfied; hardship route denied | CRP |
+| Monitoring flag / Flow quarantine (ANNEX_C, ANNEX_X §X6) | Named human reviewer in the Monitoring Purpose Register entry | Flag maintained past review clock | CRP |
+| Housing use-right renewal denial (ANNEX_U §U6) | Housing stewardship review (per ANNEX_U §U6) | Denial upheld | CRP |
+| Enforcement Panel penalty (ANNEX_AJ §4) | Enforcement Panel determination record | — (no chamber tier) | **Ombuds Plenum**, FC-091 (ANNEX_AI §4.8) |
+| Attestation false-claim / stake slashing (ANNEX_AS §2.4) | Originating investigator record | — (no chamber tier) | **Ombuds Plenum**, FC-091 (ANNEX_AI §4.9) |
+
+A context not listed here defaults to the nearest L6 dispute class; absence from this table is never a reason to refuse a filing. A filing made at any first-instance body, the Ombuds, or the floor-access point is a valid filing; the receiving body routes it to the correct first instance without loss of the filing date. Intake routing — including class assignment and any nearest-dispute-class default — is recorded with reasons, is itself challengeable on the spine, and a misrouting never consumes the appellant's window or clocks. Survival-floor cases are emergency-class automatically; other emergency-class intake may verify the published predicate, and a post-finding manufactured-emergency determination is sanctionable without ever conditioning the floor.
+
diff --git a/docs/annexes/ANNEX_U.md b/docs/annexes/ANNEX_U.md
index 2ca2894..4722ca6 100644
--- a/docs/annexes/ANNEX_U.md
+++ b/docs/annexes/ANNEX_U.md
@@ -60,7 +60,7 @@
 - Housing use-right renewal may be conditioned only on the closed list already stated in the main text: sustained vacancy beyond published threshold, physical damage beyond normal wear, verified illegal activity tied to the premises, and clearly defined health/safety violations after remediation opportunity.
 - No renewal decision may rely on aesthetics, lifestyle, political activity, lawful association, family structure, visitor profile, disability proxy, or any factor functioning as a substitute for protected characteristics.
 - Renewal denials must identify the exact closed-list basis, the evidence relied upon, the remediation path if one exists, and the appeal timeline.
-- Housing continuity remains in place during appeal except where a published and reviewable imminent-serious-harm standard is met.
+- Housing continuity remains in place during appeal except where a published and reviewable imminent-serious-harm standard is met, per the appeal spine ([ANNEX_L §L7](./ANNEX_L.md)).
 
 ### U7. Civic-layer repair, scaled verification, and hardship-safe continuity
 - The verification burden must scale with claimed influence. Small stewardship claims may use lightweight community attestation; mid-range claims require structured evidence bundles; high-impact Voice allocations or near-cap Service Record-based service claims face intensive review and elevated audit probability.
diff --git a/docs/annexes/ANNEX_X.md b/docs/annexes/ANNEX_X.md
index 8fad498..6a536b9 100644
--- a/docs/annexes/ANNEX_X.md
+++ b/docs/annexes/ANNEX_X.md
@@ -62,7 +62,7 @@ The constitutional operating-float exemption supersedes prior generic publicatio
 
 ### X6. Error correction, unwind discipline, and public logs
 - **All issuance channels** must publish aggregate issuance logs, category totals, concentration indicators, stale-balance rates, unwind performance, and exception use on the public dashboard with privacy-preserving aggregation.
-- **Quarantine due process:** quarantine requires written notice, named channel rule, evidence basis, maximum review clock, human appeal, and a least-harm interim status. Unresolved suspicion may not freeze ordinary household access, payroll recipients, essential providers, or protected ordinary use.
+- **Quarantine due process:** quarantine requires written notice, named channel rule, evidence basis, maximum review clock, human appeal per the appeal spine ([ANNEX_L §L7](./ANNEX_L.md)), and a least-harm interim status. Unresolved suspicion may not freeze ordinary household access, payroll recipients, essential providers, or protected ordinary use.
 - **Mis-issued Flow** may be quarantined, reclassified, or unwound only through published procedures that minimize collateral harm to payroll recipients, essential providers, and innocent counterparties. No ordinary clawback may target wage earners or essential-service recipients absent fraud findings tied to them directly.
 - **Unwind must be staged** when needed to prevent payroll shock, provider insolvency, or sudden continuity collapse. Emergency correction that causes more harm than the original error is itself a design failure.
 - **Repeated issuance error** in the same channel triggers automatic audit, temporary channel throttling, and mandatory public post-mortem before ordinary operation resumes.
diff --git a/docs/governance/Identity_Recovery_Evidence_Test_Package.md b/docs/governance/Identity_Recovery_Evidence_Test_Package.md
index b13583a..d06e5b0 100644
--- a/docs/governance/Identity_Recovery_Evidence_Test_Package.md
+++ b/docs/governance/Identity_Recovery_Evidence_Test_Package.md
@@ -479,6 +479,8 @@ If the survival floor is interrupted during recovery (i.e., Essential Access fal
 - at least one person with lived experience of identity exclusion, displacement, or documentation barriers;
 - access to the full appeal record including staff notes and reason codes.
 
+Appeal structure: identity-recovery appeals run on the appeal spine (ANNEX_L §L7) — first instance the administrative identity tribunal, escalation to the Regional Constitutional Chamber, constitutional review by the CRP. The T-4 ceilings above are the pass/fail evidence gates on that spine, not a separate procedure.
+
 **Evidence basis:** Human-review requirement — adapted from EU AI Act Article 14 (human oversight for high-risk AI decisions). Delay ceiling — precautionary, no direct analogue. Independent reviewer requirement — adapted from ombudsman and tribunal independence standards (UK Administrative Court practice direction).
 
 **Breach escalation:** Exceeding any appeal failure ceiling:
diff --git a/docs/governance/Parameter_Calibration_Register.md b/docs/governance/Parameter_Calibration_Register.md
index 2061e30..ccdfa25 100644
--- a/docs/governance/Parameter_Calibration_Register.md
+++ b/docs/governance/Parameter_Calibration_Register.md
@@ -42,7 +42,7 @@ Every high-risk parameter should eventually have:
 | FC-206 Universal Stake eligibility rule | Reserved — bind before first distribution | Tier 1 / pre-launch gate | Keeps the Stake universal and non-convertible (no sale, assignment, garnishment, pledge, inheritance, or purchase of membership/priority/standing/office/Voice). | Eligibility narrowed to exclude the inconvenient; conversion pathways laundered through legal wrappers. | Non-convertibility red team. | Any conversion pathway clears. | ANNEX_D; ANNEX_AK; INVARIANTS INV-002/INV-017. |
 | FC-207 CRUS anti-capture gates | Reserved — bind before CRUS activation | Tier 1 / pre-launch gate | Public accounting, no patronage discretion, data minimization, auditability, appeal rights. | Fund administrators become patronage allocators. | Capture Dashboard drill. | Discretionary or targeted allocation observed. | ANNEX_D; Capture Dashboard Specification. |
 | FC-208 PFCR / lockbox reserve and routing rule (formerly registered here as FC-054) | Reserved | Tier 2 / pre-launch gate | Splits Commons Return receipts between Essential Access support, public rails, restoration, resilience reserves, infrastructure, and Universal Stake. | Too much to one channel creates fiscal dependency; too little weakens commons funding or turns Universal Stake into political dividend timing. | Fiscal adequacy model, source-base revenue model, lockbox sufficiency test, and burden-incidence review. | PFCR becomes dependent on inflation, hidden debt, or prohibited tax bases; or cannot fund baseline commons. | ANNEX_D; Article V; SPECIFICATIONS; founding/commitments.md FC-208. |
-| FC-209 CRUS appeal path | Reserved — bind before assessment or distribution | Tier 1 / pre-launch gate | Human appeal for assessed holders and excluded claimants without letting high-value actors stall assessment. | Procedural delay as avoidance; appeal priced out of reach of the poor claimant. | Appeal-path drill (both directions). | Appeals stall assessment or exclude the unrepresented. | ANNEX_D; Federated Ombuds. |
+| FC-209 CRUS appeal path | Bound to the appeal spine (ANNEX_L §L7): first instance Commons Return assessment review per ANNEX_D §D6, escalation per the spine — appeal-path drill still required pre-launch | Tier 1 / pre-launch gate | Human appeal for assessed holders and excluded claimants without letting high-value actors stall assessment. | Procedural delay as avoidance; appeal priced out of reach of the poor claimant. | Appeal-path drill (both directions). | Appeals stall assessment or exclude the unrepresented. | ANNEX_L §L7; ANNEX_D §D6; Federated Ombuds. |
 | FC-210 CRUS review cadence | Reserved — bind before CRUS activation | Tier 2 / pre-launch gate | Scheduled review of incidence, eligibility, valuation, bases, distribution, reserves, capture metrics; a missed cadence is itself a failure. | Review quietly skipped in good years. | Cadence compliance audit. | Missed cadence or missing data. | ANNEX_D; Capture Dashboard Specification; Pilot Evidence Roadmap. |
 | Dormant §D9 backstop schedule (no live FC ID; a revival patch would assign one) | Superseded as an active parameter; no routine balance or net-worth decay schedule is operative unless a new patch, fiscal/dignity evidence, public review, and applicable amendment process revive a narrow dormant backstop. | Dormant / not operative | Preserves historical traceability for the retired demurrage designs without letting old rates govern by accident. The retired idle-balance parameters are tombstoned in founding/commitments.md FC-050–FC-052, FC-054. | If treated as active, it can burden ordinary households, illiquid owners, or working savers while bypassing the Commons Return source-base test. | Dormant-backstop incidence model, dignity review, household burden model, and explicit amendment activation record before any use. | Any document or implementation treats old rates or λ brackets as active, funds Essential Access from them, or applies routine balance/net-worth decay by interpretation. | ANNEX_D §D1 and §D9; SPECIFICATIONS. |
 | FC-055 issuance ceiling function | Reserved | Tier 1 / pre-launch gate | Links Flow supply to verified productive commitments. | Too loose inflates claims; too tight starves production. | Flow issuance simulation and productive-commitment audit. | Circulation detaches from real production or needed projects cannot clear. | Article V; SPECIFICATIONS. |
diff --git a/docs/governance/Patch_Log.md b/docs/governance/Patch_Log.md
index a335db4..64fb268 100644
--- a/docs/governance/Patch_Log.md
+++ b/docs/governance/Patch_Log.md
@@ -1,6 +1,6 @@
 # Patch Log
 
-**Running change ledger aligned to the Humane Constitution · Current through P-073 (P-071 reserved)**
+**Running change ledger aligned to the Humane Constitution · Current through P-074 (P-071 reserved)**
 
 ---
 
@@ -90,6 +90,7 @@
 | P-070 | T-033 | **ACTIVE** | Critical | Founding Legitimacy Prerequisite Definition Gate: reconciles consent thresholds, defines admissible non-coercive consent evidence, defines independent civil-society reviewer qualification, and blocks Gate A until consent and review are independently evidenced. |
 | P-072 | T-025 | **PROPOSED** | High | Productive Status Register: one canonical "productive" determination shared by Flow issuance (ANNEX_X) and the Commons Return exemption (ANNEX_D §D3), with settle-forward escrow closing the temporal double-dip. Remains PROPOSED / pilot-gated until its evidence test passes; binds nothing until then. |
 | P-073 | structural — no threat row | **ACTIVE** | High | Framework-first intake (anti-accretion rule): FAP intake gate requiring any new mechanism to extend the most general existing instrument for its protective function or carry a published justification; published return record with adversarial-panel escalation; simplicity presumption bounded by independence count and protected-person path equivalence. Amends Acceptance_Protocol.md. |
+| P-074 | structural — no threat row | **ACTIVE** | High | Appeal Spine consolidation: ANNEX_L §L7 becomes the single canonical appeal procedure (one filing rule, floor + status-quo-ante continue during appeal, one ladder with the Ombuds Plenum kept separate for independence); seven scattered appeal procedures become spine pointers (with ANNEX_I's duplicate clocks and ANNEX_AI §4.8's duplicate window deleted); the ANNEX_AW §AW3.3 orphan appeal window (RRE-011) is a named follow-up, not yet absorbed. First P-073-mandated consolidation of an entire mechanism family. |
 
 ---
 
@@ -698,7 +699,7 @@ The following terms are added to the P-004 protected vocabulary: *milestone*, *p
 
 ## Current Threat/Patch Linkage
 
-This table is the single source of truth for threat→patch traceability. It covers every patch in the current inventory through P-073. Reserved IDs (P-007, P-010, P-028, P-071) and the draft-only P-063 review packet are listed in the Reserved / Never-Assigned Patch IDs table above. "Multiple" has been replaced with enumerated threat (or PRD-/IC-/INV-/ACL-) references throughout; patches with no standalone threat row are marked "structural — no threat row."
+This table is the single source of truth for threat→patch traceability. It covers every patch in the current inventory through P-074. Reserved IDs (P-007, P-010, P-028, P-071) and the draft-only P-063 review packet are listed in the Reserved / Never-Assigned Patch IDs table above. "Multiple" has been replaced with enumerated threat (or PRD-/IC-/INV-/ACL-) references throughout; patches with no standalone threat row are marked "structural — no threat row."
 
 | Threat ID | Patch ID | Status | Master Reference |
 | :--- | :--- | :--- | :--- |
@@ -770,6 +771,7 @@ This table is the single source of truth for threat→patch traceability. It cov
 | T-033 | P-070 | **ACTIVE** | Founding Consent and Civil-Society Review Evidence Test Package · Founding Legitimacy Dossier |
 | P-072 | T-025 supplement | **PROPOSED** | Productive Status Register (operative T-025 control remains P-023 ACTIVE) |
 | structural — no threat row (anti-accretion intake gate) | P-073 | **ACTIVE** | Acceptance_Protocol.md Framework-First Intake |
+| structural — no threat row (appeal spine) | P-074 | **ACTIVE** | ANNEX_L §L7 |
 
 ---
 
@@ -1574,4 +1576,21 @@ A full-corpus simplification audit (2026-06-12, three independent single-role re
 
 **Panel process:** four independent single-role reviewers (adversarial systems designer, Christ-centered, corpus-fit, minimalist) reviewed the applied diff in parallel; all four returned APPROVE WITH FIXES and every required fix was incorporated (return-record discipline, anti-laundering tier rule, independence-count bound, protected-person clause, corrigibility clause, functional test replacing a closed family list, P-073 provenance). Christ-centered review recorded as Session 25 in `Christ_Centered_Evaluation.md`.
 
-**Consolidation program landings (running record):** 2026-06-12 — the status spine landed (first program step under this gate): `Status_Model.md` deleted, its vocabulary and edge rules absorbed into the Claims and Evidence Register's Status methodology section (now the canonical status spine); the Hardening Queue stripped of duplicated status tracking (worklist only, references owners); Threat Register restated patch-statuses converted to pointers. Net ~−95 lines; vocabulary-definition sites reduced from five to one. Evidence Ladder deliberately retained standalone (it defines evidence *levels*, a different axis, and its level numbers are cited by app code and seven documents). Named follow-ups: Patch Log single-row mini-tables (same-file restatement, checker-covered) and a single convention for Threat Register per-entry Status lines.
+**Consolidation program landings (running record):** 2026-06-12 — the status spine landed (first program step under this gate): `Status_Model.md` deleted, its vocabulary and edge rules absorbed into the Claims and Evidence Register's Status methodology section (now the canonical status spine); the Hardening Queue stripped of duplicated status tracking (worklist only, references owners); Threat Register restated patch-statuses converted to pointers. Net ~−95 lines; vocabulary-definition sites reduced from five to one. Evidence Ladder deliberately retained standalone (it defines evidence *levels*, a different axis, and its level numbers are cited by app code and seven documents). Named follow-ups: Patch Log single-row mini-tables (same-file restatement, checker-covered) and a single convention for Threat Register per-entry Status lines. 2026-06-12 — the appeal spine landed (P-074, ANNEX_L §L7): seven appeal procedures → one spine + a domain intake table (the ANNEX_AW §AW3.3 orphan appeal window, RRE-011, is a named follow-up); FC-209's reserved appeal path closed by binding it to the spine.
+
+
+---
+
+### P-074 — Appeal Spine Consolidation (ANNEX_L §L7)
+
+**Threat addressed:** structural — no threat row (appeal-path fragmentation as a systemic failure mode)
+**Status:** ACTIVE | **Priority:** High
+
+The same simplification audit that produced P-073 counted at least eight separate appeal machineries across the corpus — each with its own filing rule, window, ladder, and clock. Fragmented appeal procedure is itself an exclusion mechanism: the person most likely to need an appeal is the person least equipped to discover which of eight procedures applies to them. This patch is the first P-073-mandated consolidation of an entire mechanism family.
+
+- **Introduced design:** ANNEX_L §L7, the canonical appeal spine: one filing rule and 30-day window (L7.1); the survival floor and the status quo ante continue during appeal, with penalties and stakes paused or escrowed until finality (L7.2); a single three-instance ladder with the Ombuds Plenum deliberately kept as a separate final instance for enforcement and attestation questions (L7.3); one timing table (L7.4); a domain intake table replacing scattered procedure (L7.5); and a drift rule in the §L7 provenance note making the spine govern over any domain restatement. Pointer rewrites in ANNEX_J, ANNEX_I, ANNEX_X, ANNEX_D, ANNEX_U, ANNEX_AJ, ANNEX_AS, the Productive Status Register, the Identity Recovery Evidence Test Package, and the Parameter Calibration Register (FC-209 bound to the spine) replace local appeal machinery with first-instance intake plus a spine citation: seven scattered appeal procedures become spine pointers (with ANNEX_I §I8's duplicate clocks and ANNEX_AI §4.8's duplicate filing window deleted in favor of the spine); the ANNEX_AW §AW3.3 orphan appeal window (RRE-011) is a named follow-up, not yet absorbed.
+- **Claim discipline:** No claim that appeals are accessible, timely, or capture-resistant in practice until the appeal-path drills (including the FC-209 both-directions drill) actually run. The spine is `Designed`; consolidation reduces procedure count, not uncertainty.
+- **New risks introduced:** A single procedural spine is a single point of procedural capture — whoever controls the spine's clocks and intake controls every appeal (bounded by the Plenum/CRP split in L7.3 and the spine-discipline drift rule in the §L7 provenance note, which makes deviation visible rather than silent). The status-quo-ante rule (L7.2) could be exploited to freeze adverse-but-correct decisions in place during appeal (bounded by the published, reviewable imminent-serious-harm carve-out generalized from ANNEX_U §U6). The generalized imminent-serious-harm standard is itself unpublished — until it is authored under the ANNEX_U §U5 threshold-setting discipline and published (a pre-launch gate), each domain's existing published interim measure governs during appeal, so there is no absolute status quo ante.
+- **Residual risk:** The body names in L7.5 are designed institutions with no pilot evidence behind any of them; the 72-hour, 14-day, and 30-day clocks are design estimates, not measured capabilities. Whether one door genuinely lowers the filing barrier for the least-resourced appellant is unproven until drilled.
+
+**Numbering note:** the held Voice/Service-Record redline provisionally cited P-074 for its civic-misuse proposal; per that redline's own renumbering caveat, it takes the next free number at intake.
diff --git a/docs/governance/Productive_Status_Register.md b/docs/governance/Productive_Status_Register.md
index fa7a3de..c08204b 100644
--- a/docs/governance/Productive_Status_Register.md
+++ b/docs/governance/Productive_Status_Register.md
@@ -18,7 +18,7 @@ The deeper flaw is **temporal**: Flow mints at commitment *start*; the Commons R
 
 **Payroll/escrow fast-path (no bottleneck).** Time-critical issuance below the ANNEX_X de-minimis threshold proceeds on a *provisional* productive status; the register catches up and settle-forward governs the exemption. Issuance is never blocked waiting on an adjudication; the double-dip stays closed because the exemption is escrowed regardless.
 
-**The determiner is humble and correctable.** A productive-status determination is appealable through the ANNEX_J independent-review path; the determiner publishes its basis and the criterion applied, bears the bounded burden of proof (a holder is not presumed an extractor; an honest steward is not put to impossible proof), and is itself audited by a structurally independent party (INV-006, "no apex may sit unaudited"). It applies the published standard; it does not author the boundary while deciding a case.
+**The determiner is humble and correctable.** A productive-status determination is appealable per the appeal spine ([ANNEX_L §L7](../annexes/ANNEX_L.md)), first instance the [ANNEX_J](../annexes/ANNEX_J.md) independent stewardship reviewer; the determiner publishes its basis and the criterion applied, bears the bounded burden of proof (a holder is not presumed an extractor; an honest steward is not put to impossible proof), and is itself audited by a structurally independent party (INV-006, "no apex may sit unaudited"). It applies the published standard; it does not author the boundary while deciding a case.
 
 **Status classifies the activity, never the person.** Productive status is a classification of an asset or commitment, never a standing judgment of a person's worth (INV-003), and stays within the ANNEX_D §D6 minimum-necessary-data rule (no new surveillance surface).