How the network fits together

The reserve is not a vault. It lies scattered across batteries in sheds, neighbourhood batteries on street corners and industrial storage at the province. This chapter is about how that hangs together and who decides what.

---

Three layers, from your shed to the country

Hauling electricity over long distances costs electricity. So the reserve sits close to where it is used, in three layers resting on each other:

The country. Keeps the national money supply, watches the total backing ratio and checks the provinces. This is bookkeeping, not storage.

The province. The big storage: flywheels, water basins, compressed air, flow batteries. This absorbs the peaks and troughs of a whole region.

The neighbourhood and the house. The battery on the corner, your home battery, the car at the charging point. Together this is the largest layer, spread across thousands of addresses.

Physical Reserve Hierarchy

100% Backed Architecture

Local District Battery & Home EV: Physical energy stays local wherever possible. Immediate feed-in and consumption take place right in your neighborhood.

---

Who does what

The bank measures and counts, and owns nothing. It adjusts the rules, tracks the backing ratio and records what goes in and out. The batteries are not its own: it rents them from provinces and from people. A bank without a vault is harder to rob and harder to hijack.

Provinces and cooperatives run the big storage. They agree with the bank how much capacity they make available.

People rent out their own battery. Anyone with a home battery or an electric car can offer up space and gets paid for it, plus a fee for the wear. You are then a customer and a keeper of the reserve at the same time.

That settles per interval: you make space available now, you are paid now. So you get no promised income for the years ahead that you could sell on. The auction sets the price, not an entitlement. If you want to stop, you stop, and the payment stops with you (duties, not promises).

---

Who checks the checkers

A bank that marks its own homework is not a bank but a promise. So the oversight sits in layers that do not need each other:

The ledger publishes levels, not lives. Public are the system numbers: the reserve, the backing ratio, the power coverage, the flows per storage station (aggregated only), and every payment the bank itself makes. Never public, in any form and not even pseudonymously: individual balances, transactions, calls, queue positions and delivery records. That is not a matter of good manners but a building block: there is no place in the ledger where an account sits, not even under a number. Of your own entries you receive a private proof that they were counted correctly in the sum.

Who does the recomputing depends on the scale. In a field test of two hundred households an ordinary member cannot check the books themselves, because the series you would need point at exactly those two hundred people. There the work is done by an independent auditor, by at least three independent witnesses co-signing every interval, and by a verifier under confidentiality. When full public recomputability returns does not depend on a number of participants but on how widely holdings are spread: only once the largest anonymous holding stays below a fixed threshold for twelve months running may all four core numbers go out again. More on that in governance.

Those outsiders have no button. They co-sign, they may sound the alarm and publish, and nothing beyond that. Because whoever is allowed to intervene can also be bought. And they do not get access to everything: a member of staff technically cannot reach the file of their own household, address or first-degree family, and a bulk export takes two pairs of hands.

A mistake that is found has to go out. A difference outside the tolerance may not be quietly polished away: it goes into the public alarms automatically, and the label flips to under-backed until an external audit publishes the cause. There is deliberately no finder's fee attached. Every payout from the reserve lowers the reserve, and only a fixed, short list of events is allowed to touch the reserve; inventing a bounty pot on top would open that lock for a purpose that does not need it.

And the looking is watched too. The bank knows more about you than your own bank does: your verified identity, your meter series, your deliveries. So every consultation of a member file traces to a named member of staff, is recorded in a log you cannot alter unnoticed, and you are notified within five days. Anyone sharing your household, address or first-degree family cannot reach it at all. This sits in the architecture and not among the house rules, because it is a property of the system rather than a promise from a board.

Punishing is not the bank's job. That lies with the courts, entirely separate from the system itself. The bank measures and reports; the courts judge.

Governance & Audit Oversight

3-Layer Protection

The Central Bank: Solely measures energy reserves and publishes data. The bank has zero secrecy and cannot self-approve funds.

---

Why cheating is hard

Minting money without electricity runs into physics here, and physics is a stricter auditor than any supervisor.

The grid always adds up. What comes out must have gone in somewhere; a power grid balances continuously. There is no kilowatt-hour that appears out of nothing.

The layers check each other. What the meters in people's homes add up to has to match what the province and the country measure. The rule set names no fixed percentage for how far that may drift: the bank publishes its tolerance in advance, and at unchanged meters it may only tighten, towards one fixed end point that is the measurement uncertainty of its own meter fleet. Drift outside it and an investigation starts automatically. Sloppy measurement is no way out either: a wider tolerance immediately lowers the published reserve, so all you do is make yourself poorer.

Minting extra is possible, minting extra quietly is not. If the bank does print extra coins to pay for something, the backing ratio visibly drops and from that moment the currency publicly carries the status under-backed (colloquially: fiat). The market adjusts the exchange rate, and federation partners settle against that audited backing ratio instead of against the nominal value. The deception is not forbidden, it is made harder: minting quietly still shows up as a visible drop in the backing ratio, but a bank that recomputes the backing ratio itself on the rounded display value of the reserve publishes exactly the same kind of number as an honest one. Nobody sees that difference from the outside; the auditor signs off on it separately.

---

Two lungs, one grammar

The network breathes with two lungs that at first sight do not go together. One sells certainty, the other freedom, and they share one language.

The first lung is the central system. Large and formal, with guarantees: the Basic Pulse arrives, tomorrow as well. Strong in stability, vulnerable because everything comes together in one place.

The second lung is the swarm. Neighbourhood cooperatives and small grids, loose from each other. Nobody can switch those off centrally, but they cannot promise anyone national certainty either.

Walking away, and coming back

They work loose from each other, but speak the same grammar: backing of one kilowatt-hour per coin, open audits, and redemption against the meter reading. Because the language is the same, they can come apart and back together without translation.

Walking away is allowed. If the central bank turns corrupt, breaks down or gets hacked, people pull their electricity out and let the neighbourhood run on its own. Paying and delivering inside that neighbourhood carry on as usual. That is not an emergency measure but a built-in right: the bank run here is not the disaster but the fire exit.

Coming back is allowed too. Because everyone speaks the same grammar, a neighbourhood that has broken off can reconnect later: to a restored central bank, or to a brand new one that people set up themselves.

Two Lungs, One Grammar

Dual Architecture

🏛️ Central Bank (Sells Certainty)

Strict 1:1 backing, audited public meters, guaranteed basic pulse for housing and subsistence.

Citizen Right: Citizens who want absolute stability rely on the Central Bank.

What crosses a border, and what does not

Federating sounds like "wiring everything to everything". Here it is not, and that boundary is part of the design.

Instances check each other's sums, not each other's people. Two instances that couple verify each other's signed totals, fingerprints and attestations, plus a sample by an auditor bound to professional secrecy. Data at the level of a connection, account or person never crosses a border: not live, not from the archive, and not as a sample either. So no instance can look into another instance's meters. What crosses are totals and signatures, and those are enough to see whether somebody is lying about their backing.

Your enrolment does not travel with you. The stamp that enforces "one person, one floor" is scoped per instance and not federation-wide. Move to another instance and you enrol again there with a new stamp that cannot be linked to your old one, and your status history does not come along. That stamp list is nowhere public, by the way: all anyone sees of it is a signed fingerprint, the distribution of assurance levels and some aggregates. A second enrolment bounces off a proof that you are not yet in it, and no list has to be passed around for that.

That is a deliberate trade, and the price is stated. You give up the portability of your enrolment: switching costs you a fresh enrolment round. What you get is that no public federation-wide number exists that follows you everywhere. One honest exception: instances that run the duplicate check do keep one encrypted check value per person that matches across instances. It is never published, it leaves an instance only inside a protocol whose only answer is yes or no, and it is destroyed as soon as you leave or as soon as a safety flag stands. It is the last federation-wide thread in this design, and it is named here rather than denied.