CBER-1: The Grammar

Status: DRAFT · v0.15 · 2026-08-22 · author: Robin Genis · test vectors executable (71/71 pass)

Engelstalige specificatie

Specificaties en standaard-drafts schrijven we in het Engels, de voertaal van protocollen en review. Dit is een levend werkdocument: commentaar is welkom.

In plain words

Money today is a promise with nothing behind it. CBER makes money that stands for something you can measure: stored electricity. One coin is a claim on a proportional share of a shared battery reserve. The target backing is 1 kWh per coin, but the coin is never a claim on a fixed number of kWh. One public number, the backing ratio B, tells everyone how solid that claim is right now: redemption always yields B kWh per coin.

This document is not the handbook (that lives at cber.robingenis.com). This is the rule set: the smallest set of rules a system must obey to be "a CBER," written precisely enough that different people could each build one and have them agree. Like the grammar of a language: everyone who follows it understands everyone else, while each community keeps its own accent (its "house rules").

Since v0.4 the rule set is cut in two. Part I: Core is normative: the monetary heart, as compact as possible. Part II: Horizon is non-normative: federation, secession, Gatekeeper, rent guarantee and growth path. The Horizon is design direction, not an admission test. Every rule in the Core earns its place by blocking a concrete way to cheat; Annex A lists the attacks and points to the answering rule.

Requirements

The key words "MUST", "MUST NOT", "SHOULD", "SHOULD NOT", "MAY", "REQUIRED" and "OPTIONAL" are to be interpreted as described in [RFC2119].

An implementation that satisfies every MUST in Part I (§1 through §15) is a conforming CBER instance; Annexes A and B are commentary and test material and do not bind (see the closing sentence of §15). Part II does not bind; parts of it become normative the moment an instance federates, and then move into the Core of a next major version. The federation layer is designed to ride ActivityPub-style rails and is intended to be split out as one or more FEPs, a sibling of FEP-Guardians.

---

Part I: Core (normative)

1. Terms

• Instance: the cooperative running this rule set: the single authority over one ledger and one reserve (legal form: §12).
• Settlement interval: the fixed, public period at whose close the instance reconciles meters, publishes commitments, applies leakage and (in federation) settles. All per-interval invariants are checked at interval close.
• Metering boundary: the sealed AC grid-connection point of each reserve site (§4). Mint and burn are measured at this boundary only.
• Reserve (R): a stock, not a flow: the AC-deliverable stored energy content at interval close, per battery string R = min(E_content, SoH x nameplate capacity x usable DoD window x derate(T_site)), expressed in AC kWh at the metering boundary and valued at the conservative lower bound of measurement uncertainty. E_content is tracked from the sealed flow balance and re-anchored at least monthly at a published calibration point (§4). SoH x nameplate capacity x usable DoD window x derate(T_site) is the audited ceiling on R, never its value. Nameplate alone never counts as R; it enters the ceiling only through the audited SoH, DoD and derate factors.
• R_book and R_display: R_book is the reserve as defined above, valued at the lower bound of measurement uncertainty; it is the only R any rule computes with (B, headroom H of §5, I1, I2 and the deduction of the running unexplained sum). R_display is R_book rounded downward to a published display quantum q_R, with U95(R) / 2 <= q_R <= U95(R) on the content-determination budget, fixed at commissioning and monotonically non-increasing at unchanged metering hardware (§4), and is the only R that appears in public. R_display feeds nothing (§4, I11).
• eta_rt: the audited conversion-chain round-trip efficiency of the reserve, measured on a rolling 90-day basis under a published reference protocol (§4) and published next to B.
• Content factor: the temperature-resolved reference product (eta_charge_ref x eta_discharge_ref)(T_site) of §4, the factor by which AC intake becomes recognised content. It is the cap on the mint coefficient of §5.
• R_close, M_close: R and M at interval close, after the current interval's mint, as used in the headroom formula of §5.
• Floor draw: delivery of kWh from the reserve to the Basispuls without coin mutation, published live as its own meter category (I9).
• Guaranteed callable power (P_g): the guaranteed simultaneously callable AC power of the reserve, published live next to B (§6).
• Claim / coin (CBER): a transferable claim on a proportional share of R, paid out at the current B. The coin is a floating claim from first issuance; it is never a claim on a fixed number of kWh (target backing: 1 kWh). Acquiring coins counts as acceptance of this definition and of the power of flagged issuance under §6.1.
• Outstanding claims (M): the instance's total circulating coins.
• Backing ratio (B): B = (R - D) / M. The single public health number; without a queue (D = 0) this reduces to R / M. B = 1 is exactly 1:1. There is exactly one B: every rule in this document that computes with B computes with this net B.
• Delivery queue (D): the sum of settled but not yet physically delivered redemption entitlements, in kWh; deducted from R in every published balance and in B (§6). An entitlement in the queue is pari passu with the coin, never senior to it: every fall of R_book that is not physical delivery out of D writes the queue down by the same factor that reaches the coin (I4, I8, I9).
• R_net: R_book - D, the booked net reserve. It is a booked quantity like R_book itself: it is signed to the auditor and the witnesses every interval and it is never published as a live per-interval level, because published live beside an unblurred B it fixes M = R_net / B exactly and returns the degree of freedom I11 removes (I11, §6).
• Realised fall of R_book (dR_book): the decrease of R_book over an interval from any cause other than physical delivery out of D. Since R_book = min(E_content, audited ceiling) - the running unexplained sum (I1, I7), a measured physical loss L and dR_book are not the same quantity: where the audited ceiling binds, part or all of L never reaches R_book. Every write-down and every levy in this grammar stands on dR_book, never on L.
• Queue write-down factor: the factor by which every entitlement in the queue is written down on a fall of R_book, identical for the first and the last in line (I4). It is zero wherever R_book does not fall. Where the channel carries a levy, the factor is dR_book / (D_ne + B x M_ne) on the non-exempt queue and zero on the exempt part, with M_ne the non-exempt coin mass and D_ne the part of the queue settled out of non-exempt balances; with nothing exempt, D_ne + B x M_ne = R_book and the factor is dR_book / R_book. Where the channel carries no levy, the factor is dR_book / R_book over the whole queue. Both forms are set out in I4.
• Exempt and non-exempt mass: the Basispuls and working capital up to N days of average own consumption are leakage-free under I8; everything else is non-exempt. M_ne is the non-exempt coin mass and D_ne the part of the queue settled out of non-exempt balances. An entitlement carries the exemption of the balance it was settled out of (I4, I8).
• Pro-forma rate: (R_book - D) / (M + f x base), the rate at which redemption settles between the decision and the effectuation of a fractional issuance, where f is the decided fraction and base is M at the record date net of flagged issuance decided in the rolling window (I2, I6, §6.1). It is the one rate the grammar names for that window.
• Record-date pro-forma: B_record / (1 + f), the figure published at the record date. It equals the pro-forma rate exactly at the record date, where M = M_record, and is the figure a reader recomputes from the published B and the published exact f (I6, §6.1).
• Status label: fully backed (B >= 1) or under-backed (B < 1), with hysteresis (§6). In public communication the under-backed status is also known as fiat status.
• Meter rate: the audited net B ((R - D) / M, §6) of the interval in which a redemption is settled (I5).
• Basispuls (Basic Pulse): a non-transferable use-right on R for primary subsistence, per natural person. The Basispuls is a delivery priority, not a guarantee (§7).
• Reference kWh: a slow multi-year moving average of energy value, used as the pricing unit for goods and contracts (§6.2). Distinct from B: prices are quoted in Reference kWh, redemption follows the meter rate.
• Identity: the account-level subject to which a Basispuls attaches (§7). One natural person is entitled to exactly one Basispuls.
• Grammar / house rule: see §2.

2. Grammar versus house rules (the central distinction)

A rule is grammar if breaking it would let one instance deceive another, or break the promise to a holder. Grammar is non-negotiable and is the admission test for federation (Part II, H1). Everything else is a house rule: free per instance, priced by the market of migration.

No pre-built linkability. An instance MUST NOT build any facility whose purpose is to link pseudonyms to persons in advance and without concrete cause (I12). No law obliges a private party to create traceability it does not already have, and in phase 0 the membership register already answers the only question a lawful order can ask, so an escrow chain there would add a second unmasking path and no protection at all.

The cut runs between creation and destruction. Where the grammar has to choose what is published exactly and what is protected, the line is not between the money stock M and the delivery queue D but between creation and destruction. Creation is the act of the issuer: minting, headroom and flagged issuance are published per interval, exactly, as a fraction of M, because an issuance quota contains no term that depends on the queue. Destruction and the queue are the behaviour of participants: settlement, burn, floor draw and D are protected, aggregated and published on a cadence. That gives a reader full dilution control at interval frequency without a single fact about who is waiting, and it is the line I11 draws in detail.

The verification model, and its honest price. CBER buys its proof of honesty with publication, and at a scale of 50 to 200 households every published series built from person-bound deliveries is personal data. Those two cannot both be had, so the grammar chooses: nothing per account is published, in any form (I12), and the public series are aggregates under the k thresholds of I11. The price is stated rather than written away: below roughly 1000 participants the promise that anyone can recompute the books does not hold, and verification falls back on delegated verifiers, namely the auditor of §11, the external witnesses of §10 and any independent verifier under a confidentiality agreement. Full public recomputability of the floor formula is incompatible with member-level measurement, and this grammar chooses the aggregate plus attestation (§7).

Grammar (MUST, to be a CBER)	House rule (free per instance)
Honest sealed metering at the AC grid boundary, lower-bound valuation, GUM-based tolerance (§4)	Dashboard design
Public ledger, signed tree heads with external witnesses, audit rights (§10)	Choice of witnesses (provided they are independent)
Nothing published per account, in any form; k-anonymity on every person-derived series with an explicit suppression notice (I11, I12)	The published k above the grammar minimum
Non-public metering-point register; the trough verifiable from signed aggregates (§7, A3)	The aggregation regions, above the minimum
Redemption at the meter rate, forward pricing, record date (I4, I5, I6)	(none)
Backing ratio B is public and live (§6)	(none)
Atomic flag, quantity caps, recovery path on flagged issuance (§6.1)	Communicative detail of the playbook
Untouchable Basispuls with seniority, per person (§7, I9)	The height of the floor
One person, one floor (§7; federation-wide: H3)	The identity anchor and its assurance level
Claims never silently exceed R (I2); buffer issues nothing (§8)	Buffer target level
Tax never touches the floor; flat rate plus large-holdings levy (§9, I10)	Rate heights and thresholds
Dependency ceiling, including funding counterparties (§8, I13)	The size of the share
Quarterly attestation, role separation, sanctions (§11)	Choice of auditor
Cooperative, kWh-in/kWh-out, statutory pro-rata on dissolution (§12)	Further statutory design
Open code, reproducible builds, quorum-signed releases incl. an external signer (§14); slow public parameter protocol	Language and stack; quorum size; parameter values
Status changes via published hysteresis; a B drop caused by issuance switches immediately (§6)	Window length and margin
Reference kWh computed algorithmically from archived public inputs (§6.2)	Formula, window and sources
Nothing per account published; disclosure only on a lawful order, with a public counter and a private inclusion proof (§10, I12)	(none)
No facility that links pseudonyms to persons in advance without cause (§2, I12)	(none)
Internal access authenticated, logged and disclosed to the member; data role separation (I14)	Which named staff hold which role
Retention maxima per data category, the datasets I14 creates included (§10, §14)	The chosen term below each maximum
No recruitment or enrolment at a confidential address before the safety route runs, both conditions published (§7, §11, §15)	(none)
Counters about the instance's own conduct published in fixed bands and including zero; counts about events at persons suppressed, zero included (I11, I12)	Band widths above the published minimum
Publication or suppression decided on a slow announced cadence, never changed by a safety flag (I11, §7)	The cadence, at annual or slower

3. The monetary core: invariants

A conforming instance MUST hold all invariants below at every settlement interval.

• I1: Conservation. Every change in M MUST correspond to a signed ledger event of exactly one kind: mint (§5), burn (§5), leakage (§5, I8), tax flow (§9) or transfer. Floor draw (I9), physical delivery out of the delivery queue D (§6) and the pari passu write-down of the queue on a measured physical reserve loss (I4, I8) are the meter categories that change R or D without a change in M; each enters the interval balance as its own signed, declared term and is never an unexplained delta. The write-down term is signed and declared exactly like the leakage levy it runs beside, and it makes no individual entitlement publishable: it is a factor applied to the whole queue, not an entry against a claim. Cadence, for three terms and not for two. All three terms are signed and delivered to the auditor and the witnesses every interval, so the balance closes per interval and nothing is lost to the audit. Publication of the first two follows I9 and §6 instead: periodic, k-thresholded and quantised, and suppressed where the thresholds are not met. The write-down term is not published in any form. It is signed to the auditor and the witnesses every interval and published neither as a figure, nor as a series, nor as an aggregate over any period, and it is enumerated in the set of published series derived from D under I11 so that no other figure carries it either. The reason is arithmetic and not caution: the term is the write-down factor times D, and on the levy channels the factor is read directly against the measured leakage L, which is public under I8(b) and (c), so the term divided by L is D_ne / M_ne-scaled and on the unexempt case exactly D / R_book. Beside the published R_display that pins the booked queue depth to within q_R x D / R_book, an order finer than the sqrt(6) quantum §6 requires on D itself, and the protection §6 buys would be handed back by a term published for tidiness. The earlier version of this clause read "Both terms" while the sentence above it named three categories, and the third accordingly had no publication regime at all. Where an interval balance and a privacy rule cannot both be satisfied by the same publication, the privacy rule governs what is published and the audit route carries what is verified; the earlier requirement that these terms be live-published per interval is withdrawn, because at field-test scale a live per-interval floor-draw term is a per-person signal and the conservation proof does not need it to be public, only to be signed and checkable. The monetary council has answered this. Measurement noise and the tolerance band do not blur the derivation and never did: R is booked at the lower bound of a published uncertainty budget and reduced by the published running unexplained sum, so the deviation is deterministic and publicly invertible, and the derivation itself uses published values on both sides, where the measurement error is common mode and cancels. The derivability is closed by removing a degree of freedom from the published set rather than by coarsening any figure: at most one of M and D is a public per-interval series, the level of M is not published at all, and R appears in public only as R_display while every rule computes on R_book (I11, §4). The signed per-interval delivery of all three meter categories to the auditor and the witnesses is unchanged, and neither is any part of the cadence clause above. The closing control is named, never folded in. Each interval the auditor and the witnesses attest, and each quarter the auditor confirms publicly, as an item named in its own right and never carried inside a general statement of conformity, that the published B was computed on the booked R, D and M and on no published, rounded or quantised value whatever, that every settlement in a record-date window was priced on the exact decided f and not on the m / 5-quantised published quota (I2, I6), and that the published D is not lower than the booked D (§6, §11). f is in this list because it is the one rule input this generation of the grammar added and the earlier wording covered R, D and M and was silent on it. A B that is silently recomputed on a display value is the one break this whole construction cannot see from the outside, so the attestation says the words. Per interval the balance MUST close against the net signed delta of the sealed meters, within the published tolerance (§4). The tolerance applies to the per-interval energy balance at the metering boundary. At unchanged metering hardware it is monotonically non-increasing; its end point is 2x the combined GUM standard uncertainty of the installed meter fleet, and no fixed end figure appears in the rule set. The sum of signed unexplained deltas over any rolling 12 months MUST NOT exceed the fleet's combined expanded GUM uncertainty (k=2) computed over the same 12 months of gross metered throughput, with correlation between meters explicitly modelled. The running 12-month signed sum of unexplained deltas carries the same cadence clause as the two terms above: signed and delivered to the auditor and the witnesses every interval close, and published periodically, k-thresholded and quantised under I11, suppressed where the thresholds are not met. The re-anchor deviation series follows that clause too. The earlier unconditional requirement that the running sum be published at every interval close is withdrawn, because I11 brought that same sum under the thresholds in the same version and two invariants cannot both govern one publication. Where the sum is positive (ledger ahead of meters), it is deducted in full from the lower-bound valuation of R until an external audit publishes the cause: unexplained room is never mintable. That deduction is itself a publication of the sum, since R is public, so it falls under the derivability rule of I11 and the composed publication error required there; suppressing the series while publishing the deduction moves the channel instead of closing it, and this sentence exists to say so. The deduction is applied to R_book, so it stays visible through B (§4). Re-anchor deviations of E_content (I7) form their own delta class: the running signed sum of re-anchor deviations over any rolling 12 months MUST NOT exceed in magnitude the expanded uncertainty (k=2) of the content determination itself, which scales with stored capacity, never with throughput. Three consecutive same-sign re-anchor deviations, evaluated after the published temperature correction, raise the public audit alarm regardless of magnitude; "consecutive" means consecutive scheduled calibration anchors under the cadence of I7, counted within the same rolling 12-month window as the class sum, so a skipped anchor can neither create nor break a strike sequence. Exceeding either cumulative cap (the unexplained-delta cap or the signed re-anchor class cap) automatically sets the label to under-backed until an external audit publishes the cause. The uncertainty budget is itself a published audit object and is the same budget that sets the lower-bound valuation of R (§4). At unchanged metering hardware it may only tighten; it may widen only through the slow parameter protocol (§14) with a published metrological justification (added or changed hardware, new calibration data), and any widening takes effect in the lower-bound valuation of R in the same interval, so a wider budget always shows as a lower R, never as room. A discrepancy outside tolerance MUST be raised publicly (audit alarm), never absorbed.

• I2: Backing ceiling and quantity caps. At interval close M MUST NOT exceed R - D, except by issuance explicitly and publicly flagged as unbacked (§6.1). Silent over-issuance is the forbidden act. Flagged issuance is hard-capped: at most 5% per emergency mandate and at most 10% cumulative per rolling 12 months. An issuance decision is denominated as a fraction, not as a number of coins. Every issuance decision states its size as a fraction f of M at the record date of I6, and every cap, every published quota and the dilution figure of §6.1 is expressed the same way. An issuance decision denominated in coins is not conforming, because reading it against the caps would require the level of M, which is exactly the quantity the publication set no longer carries. One base, written here, in I6 and in §6.1 in the same words. Both caps, the decided size, the pro-forma denominator and the cumulative fraction sum are computed on one base and one only: base = M_record - the flagged issuance decided within the same rolling twelve months, where M_record is the level of M at the record date of I6. The decided size is f x base coins and it does not change afterwards. The record date is the close of the settlement interval preceding the publication of the decision and is never chosen by the issuer; an instance that reads a decision against any other level of M has not held this invariant. The earlier clause, which computed both caps on the smaller of M at the decision and M at effectuation, is withdrawn. It could not stand beside a size pinned to the record date: any settlement inside the window lowers M, so f x base then exceeds f of the effectuation M while the dilution it measures has already been priced into every settlement in that window, and unwinding the decision would change a rate retroactively, which I6 forbids. The two sentences were both live in v0.14 and could not both be true; the reference engine ran neither of them on this route. At effectuation the decision is re-tested against the same base, which is idempotent on the caps and exists to catch a mint stop (§6.1) that arose after the decision: a decision MUST NOT be effectuated into a standing mint stop, and a decision so refused releases its fraction from the cumulative sum. The cumulative test is a fraction sum: the sum over issuances of each fraction f against its own base MUST NOT exceed 10%. A mandate not effectuated within one settlement interval of its decision lapses, and a lapsed mandate releases its fraction from the cumulative sum. f is published exactly. f is a rule input: I6 prices every settlement in the window on it and both caps of this invariant are read on it, so limit two of I11 (no rule is evaluated on a quantised, sticky or noised series) applies to it directly. The m / 5 clause of I11 is a minimum resolution on the published quota series and never a licence to blur a rule input: at m = 2 per cent that grid is 0.4 per cent against an f capped at 5 per cent, which is up to 8 per cent relative on f and about 0.4 per cent on the rate a holder is paid. The closing control of §11 and I1 covers f beside R, D and M for that reason. What is publicly recomputable, stated honestly. What a reader recomputes from the published series is f, the record-date pro-forma B_record / (1 + f) and the cumulative fraction sum; the cap test itself is not publicly recomputable, because the base is a level of M, and the auditor attests it as a named item (§11, I11). The earlier claim that the fractional denomination makes the caps publicly checkable is withdrawn as untrue. Raising these caps is possible only through the slow parameter protocol (§14), never through the emergency mandate itself. Exceeding the caps is the same forbidden act as covert issuance (§15).

• I3: Atomic flagging. An unbacked mint without a simultaneous flag on the backing meter, recorded in the same transaction, is protocol-invalid, not merely forbidden. The flag is an atomic part of the issuance itself; no valid state exists in which unflagged coins circulate.

• I4: Redemption at the meter rate. Redeeming one coin MUST entitle the holder to B kWh (the net meter rate, §1) and MUST burn that coin at settlement: M falls and the entitlement is booked in kWh into the delivery queue D. Physical delivery within the declared public delivery term T (§6) then lowers R and D together. B is invariant under both steps, so the first and the last in line receive the same rate. The coin is a claim on a proportional reserve share, never on a fixed number of kWh; the value entitlement is fixed at the moment of settlement, subject only to the pari passu write-down below, which applies the same factor to every entitlement in the queue. Pari passu, not senior. Every fall of R_book that is not physical delivery out of D MUST be borne pro rata by the queue and the coin holders together. The rule is written on dR_book and not on a measured physical loss L, and it is not scoped on physical loss at all. Two things follow, and both are repairs of the version that introduced this rule. The grandeur it stands on. The factor stands on the realised fall of R_book in the interval, never on the measured loss. Under I7 R = min(E_content, audited ceiling) less the running unexplained sum of I1, so where the ceiling binds a measured loss need not lower R_book at all. Written on L the rule then destroyed claims, wrote the queue down and left R standing, so B rose and the mintable headroom of §5 grew: a physical loss bought the issuer room. The factor is zero wherever R_book does not fall, and an instance that writes the queue down while R_book has not fallen has not held this invariant. The channels it runs on. R_book falls along five routes and only one of them is a physical loss between settlement and delivery: (a) the quarterly leakage levy of I8, (b) the measured-minus-levied reconciliation of I8(b), (c) a negative re-anchor deviation of I1 and I7, which this grammar expressly declines to call a physical loss and gives its own delta class, (d) the deduction of the running unexplained sum under I1, and (e) a write-down of the audited ceiling or of SoH under §4. Scoped on (e) alone, as the first version of this rule was, it repaired the case in which no one runs and left standing the case in which everyone does: a run forms on an announced booking correction, not on a fire, and (a) to (d) are exactly the announced booking corrections. The two factors. Where the channel carries a levy, the exemptions of I8 hold: the Basispuls and working capital bear nothing, an entitlement bears the factor of the balance it was settled out of and therefore zero for the exempt part, and the factor on the non-exempt side is lambda = dR_book / (D_ne + B x M_ne). That is exactly I8's own scaling of the rate on non-exempt balances so that it covers the exempt share, now applied to the queue and the coin in one number, and under it B is exactly invariant: the queue loses lambda x D_ne kWh and the coin lambda x M_ne coins worth lambda x B x M_ne kWh, which together are dR_book. With nothing exempt, D_ne + B x M_ne = R_book and the factor reduces to dR_book / R_book, the form this invariant carried before. Where the channel carries no levy (a negative re-anchor deviation, the deduction of the unexplained sum, a ceiling or SoH write-down), no coin is burned, the fall shows in B, and the queue is written down by dR_book x D / R_book over the whole queue with nothing exempt, because a fall in B is not a levy and no balance is exempt from it either. Under that factor B lands exactly on the level it would have reached had the settlement never taken place, which is the definition of neither party gaining by the other's exit. In both forms the factor is identical for every entitlement that carries it, so the first and the last in line still hold the same rate. The entitlement is thereby pari passu with the coin instead of senior to it, and it is no longer exempt from the leakage levy of I8 while remaining exempt exactly where the balance it came from was. The write-down runs only on attributed loss. A loss that I8 has not yet attributed to physical storage loss, or has attributed to operator consumption, theft or an unexplained cause, falls on the instance's own balance and touches neither the queue nor the balances (I8(b)); writing the queue down while no levy runs makes the entitlement junior, which is the mirror of the defect this rule repairs, and it is not conforming. The reason is stated rather than left implicit: without this rule, redeeming early is weakly dominant for anyone who intends to consume at all, because it swaps a leakage-bearing coin for a leakage-free entitlement fixed in kWh and standing ahead of every holder. That maximises the queue structurally, and together with a queue the public meter no longer shows (I11, §6) it is a run in slow motion on an instrument that has stopped displaying it. The write-down is its own signed, declared term in the I1 balance, exactly like the leakage levy beside it, and it makes no individual entitlement publishable.

• I5: Forward pricing. Redemption MUST be settled at the B of the next audited settlement interval, never at the last published B. Whoever sees a reserve loss coming therefore by definition redeems at the corrected meter rate. No ceiling on the single settlement per identity per interval. For as long as this invariant prices per interval, an instance MUST NOT publish or apply a ceiling on the single settlement per identity per interval, in any form and under any name. Such a ceiling fragments the rate of a large holder across intervals, so the holder receives the average of the backing ratio over the fragmentation window instead of one rate, which breaks the rule of I4 that every tranche of one entitlement settles at the same rate and reopens the front-running question this invariant closed. The ceiling is the strongest lever anyone has proposed against the size of the largest single entitlement, and it is refused on the merits rather than left unmentioned: it is a restriction of the redemption right, not of publication, and this grammar does not buy privacy with the redemption right.

• I6: Record date. Dilution by flagged issuance takes effect at the moment of decision, not of execution. One rate, written here, in I2 and in §6.1 in the same words. From publication of an issuance decision until effectuation, redemption MUST be settled at the pro-forma rate r = (R_book - D) / (M + f x base), with f the decided fraction and base the one base of I2 (M at the record date net of flagged issuance decided in the rolling window). That is the only rate under which the first and the last in line receive the same rate, and the reason is arithmetic: settling x coins at r removes x from M and x r from R_book - D in the same proportion, so r is unchanged and r is the unique fixed point of r = (R_book - D - x r) / (M - x + f x base). The published figure and its honest limit. At the record date M = M_record and the rate equals B_record / (1 + f) exactly; that is the record-date pro-forma, and it is the figure published and recomputed from the published B and the published exact f. Inside the window the live published B runs ahead of the rate actually paid, by the factor M_record / M, because B rises as coins burn while the decided coin count does not. An instance that settles later callers on the live B / (1 + f) pays each of them more than the first: at a 5 per cent decision and one settlement of about a tenth of M, 0.559 per cent more. Waiting inside the window would then be strictly better, which breaks the rule of I4 that the first and the last in line receive the same rate and the rule of this invariant that front-running yields nothing, and it breaks them on the published formula rather than on the booked one. The earlier text, which set the settlement rate itself at B / (1 + f) and sold it as recomputable against the live published B, is withdrawn: the two cannot both hold, and the rate that keeps I4 wins. The residual is named rather than denied: the rate paid inside the window is not publicly recomputable without the level of M, and it is attested instead, by name, under the closing control of §11 together with the exact f. Front-running an announced issuance therefore yields nothing by definition, and neither does waiting.

• I7: Honest measurement. R MUST be derived from sealed, signed, MID-conformant meters at the metering boundary (§4), per battery string as R = min(E_content, SoH x nameplate capacity x usable DoD window x derate(T_site)) in AC kWh at that boundary, valued at the lower bound of measurement uncertainty (always conservative toward the reserve). E_content is tracked from the sealed flow balance and MUST be re-anchored at least monthly at a published calibration point (full charge followed by a rest-period OCV check under the test protocol). SoH x nameplate capacity x usable DoD window x derate(T_site) is the audited ceiling on R, established by an at least annual audited capacity test under the condition-bound protocol of §4, with the write-down regime of §4 between tests; it is never R's value. Every full-cycle test re-anchors book R to measured content; the deviation is published and counts in the re-anchor delta class of I1 (stock-scaled, never throughput-scaled). SoC estimation uncertainty is part of the GUM uncertainty budget of I1, and the SoC data source (BMS) falls under sealing and the audit right, or is replaced by independent DC-side sealed metering per string. Nameplate alone never counts as R; it enters the ceiling only through the audited SoH, DoD and derate factors.

• I8: Leakage. Storage leakage (self-discharge, auxiliary consumption, degradation write-down) MUST be levied pro rata across balances at a rate fixed in advance per quarter at the measured average of the preceding quarter; retroactive application is forbidden. The delivery queue is not exempt, and it carries the rate its own balance carried. Entitlements standing in D bear their pro rata share of every fall of R_book through the write-down of I4, at the same factor a balance of the same kind bears, and the two together are what keep B exactly invariant on the levy channels. The earlier text put the queue on the average factor L / R_book while this invariant scales the rate on non-exempt balances upward so that it covers the exempt share; those two sentences could not both hold, and the gap between them was real money in both directions. A non-exempt holder swapped a dearer-taxed position for a cheaper-taxed one, so redeeming early stayed weakly dominant and the sign of the incentive that the pari passu rule exists to reverse was unchanged; at household scale, where working capital up to N days is a large part of M, the scaling factor is of order 1.4 to 2 and the gap is not marginal. At the same time a household staying inside its exempt working capital began paying, in the queue, a levy it did not pay as a balance, over a term this grammar has since lengthened. Therefore: the write-down factor per entitlement equals the leakage factor that applied to the balance it was settled out of. It is zero for the part settled out of a Basispuls or working-capital balance and the scaled non-exempt factor for the rest, exactly as I4 sets it out, and B stays exactly invariant in the total because the scaling covers the exempt share on the queue side in the same way it does on the balance side. The exemption therefore survives settlement instead of lapsing at the moment it is exercised. The factor stands on the realised fall of R_book, never on the measured loss L (I4): where the audited ceiling of I7 binds, a measured loss that does not reach R_book levies nothing and writes nothing down. The only leakage-free positions in this grammar are the Basispuls and working capital up to N days, named below, together with the part of the queue settled out of them; an entitlement settled out of a non-exempt balance is not among them, and the earlier silence on that point was read, correctly, as an exemption. Transport and conversion loss MUST be attributed to the consuming transaction, not smeared across balances. The Basispuls and working capital up to N days of average own consumption (N is a public house rule) are leakage-free; the rate on non-exempt balances is scaled so that it covers the total measured storage leakage including the exempt share. Additionally: (a) per reserve site the instance publishes in advance a leakage budget per technology (self-discharge in %/month, auxiliary consumption in kWh/day, conversion loss outside eta_rt), substantiated with factory data and the annual capacity test; the budget is a house-rule parameter under §14, published before the quarter it governs: it may be tightened at any time but may be widened only through the slow parameter protocol, supported by a measurement performed or witnessed by a body accredited per §4. Measured leakage above budget plus a published margin is not levied automatically but raises a public audit alarm (same regime as I1), and structural overrun sets the label to under-backed until an external audit publishes the cause; (b) the difference between measured physical storage leakage and levied leakage of a quarter is booked on a public reconciliation account and settled in the next quarter's rate, except the portion above budget plus margin under (a): that portion is parked on the reconciliation account and MUST NOT be settled into any future rate until the external audit has attributed it; only the share the audit attributes to physical storage loss may then be levied, and any share attributed to operator consumption, theft or unexplained cause is charged to the instance's own balance and never to holders. The account counts in the I1 balance as its own, explained meter category and does not consume the cap on unexplained deltas, which applies only to the residual that remains unexplained after reconciliation; the account's own bound is the leakage budget plus published margin of (a), whose breach raises the I8 audit alarm. A B decline caused by this timing difference counts as a physical fluctuation (hysteresis, §6), not a violation of I2; (c) between capacity tests the storage component is named modelled write-down, not measured loss, and is published as such; (d) a quarterly leakage above 1.5x the rolling annual average, or above a pre-published absolute bound, automatically triggers an external audit; the anomaly bound is evaluated both against the rolling annual average and against the budget as first published at commissioning, scaled to the currently installed §14-approved capacity per technology, so that the baseline neither ratchets along with creeping widening at unchanged hardware nor turns lawful fleet expansion into a permanent quarterly alarm. Leakage never becomes an unbounded closing residual.

• I9: Basispuls seniority. The Basispuls is defined in kWh and at B < 1 holds seniority on the physical reserve, ahead of any other redemption; this subordination of other holders is stated permanently next to the meter. Unbacked issuance MUST NOT serve to finance or sustain the Basispuls. Floor draw at B < 1 is its own published meter category: delivery of kWh from the reserve without coin mutation (R falls, M is unchanged, B falls), shown separately next to B as a rolling aggregate over a pre-published window and at a grain where no single entitlement contributes more than 1/k_identity of the published figure. Where the number of active entitlements lies below k_identity, floor draw is published as a monthly total only. Individual admissions, dormant transitions and scale-downs are never published, not even indirectly as a change in a published divisor. Floor draw falls outside the quantity caps of I2 and requires no emergency mandate; its ceiling is the floor size of §7 itself (which is P10-ratcheted), with the rationing ladder as the sequel. Unbacked mint for the benefit of the floor remains forbidden. Floor draw entries MUST reconcile per interval against the metered sum of Basispuls deliveries at the delivery points, or against a blinded per-identity sum that opens only in aggregate. Per-identity delivery records MUST NOT be retained at a resolution finer than one calendar day, MUST be deleted within 90 days of reconciliation, and MUST NOT be processed for any purpose other than that reconciliation; any use of Basispuls delivery data for fraud detection, profiling or targeting is a grammar break (§15). The reconciled sum is published next to the meter category as a single aggregate figure under the k thresholds of I11, and any residual between booked floor draw and reconciled deliveries counts as an unexplained delta under I1. On physical shortage despite seniority, the pre-published public rationing ladder takes effect, not the mint (§7). The Basispuls is the only seniority in this grammar. The delivery queue D is denominated in kWh and deducted from R before B is computed, which for as long as it stood unqualified made a settled entitlement senior to every coin holder and exempt from the leakage levy. That second, undeclared seniority is removed rather than declared: under the pari passu rule of I4 the queue carries the same write-down factor as the coin on every fall of R_book that is not physical delivery, so after a settlement a later reserve loss, levy, reconciliation, negative re-anchor deviation, unexplained-sum deduction or ceiling write-down no longer falls wholly on the remaining holders. The sentence is written on all five channels rather than on physical loss alone, because a version that scoped it on physical loss alone left the queue senior on the four routes along which R_book actually falls in ordinary operation, and this invariant then asserted a seniority that did not exist on three of them. The council weighed two alternatives and adopted neither. Burning the coin at physical delivery instead of at settlement would remove the seniority together with the queue as a monetary term, but it makes the redemption rate depend on the delivery order and therefore on the instance's own dispatch, contrary to the rule of I4 that the first and the last in line receive the same rate. Merely publishing the size of the transfer per percentage point of reserve loss beside the meter would have declared a seniority instead of ending it, and the run incentive would have survived the declaration intact. (Editorial note: the council's economist maintains a dissent on this route and argued for a separate sub-cap within the I2 quantity caps instead; the council chose the floor-draw route because floor draw is physically not issuance.)

• I10: Tax scope. A tax MAY consist of a flat transaction fee on luxury trade plus a progressive levy on large holdings recorded in the non-public holdings register of §9, and MUST NOT touch the Basispuls (§9). Identities demonstrably trading for the account of a third party are aggregated for the levy (anti-straw-man).

• I11: Openness, at system level only. The ledger MUST publish, as system-level series and never per account (I12): R_display (§1, §4), B, eta_rt, the delivery queue D as an aggregate on the cadence of §6, the running signed unexplained sum, the re-anchor deviation series, the reconciled floor-draw sum, flows per reserve site, the per-interval cryptographic commitments as signed tree heads, the concentration meter (§8), the issuance quotas as fractions of M (§6.1) with the decided fraction f published exactly, the autonomy figure of §6 on the same cadence as D and built from R_display and the published D alone, and every payment the instance itself makes. Two quantities named elsewhere in this grammar are not in this enumeration and are published in no form whatever: the booked net reserve R_net of §1, and the pari passu write-down term of I1, which divided by the publicly known measured leakage yields D / R_book exactly and would hand back the protection §6 buys on D. Both are signed to the auditor and the witnesses each interval. M is not in this enumeration and is not a public per-interval series, as a level or as a mutation; it is signed to the auditor and the witnesses each interval and published only under the conditions of the derivability rule below. k-anonymity is grammar on every published series built from person-bound deliveries or measurements: per-station flows, the floor-draw sum, the delivery queue D, the SoC residual, the running signed unexplained sum, the re-anchor deviation series and any published cause accompanying them. The thresholds are conjunctive per series type, never alternatives: a metering-derived series MUST have at least k_station = 5 registered metering points behind it, and a person-bound series MUST additionally have at least k_identity = 20 contributing identities behind it; a series that is both meets both. No series is published at a grain finer than the published aggregation window, and every person-derived series is published quantised to a published quantum larger than the largest single contribution, or with a published noise budget serving the same purpose. k-anonymity is not claimed to defeat differencing: it raises the cost of singling out, while a departure or an admission remains a level shift that change-point detection can find in a series that reappears every interval. Quantisation, the aggregation window and the suppression rule below are what bound that channel, and the residual is named rather than denied. Where a threshold is not met the series is suppressed and replaced by a suppression notice of fixed, content-independent form: it names the series and states that a threshold was not met, and it says nothing more. It does not name which threshold, does not state the count, and does not change when the underlying count changes, since a notice that varies with the population is itself a series about that population. A count of zero falls under the same suppression and is never published as a zero, because zero is the most identifying number in a small cohort. The dividing line between suppression and the canary. Counts about events at persons follow the suppression above, zero included. Counts about the instance's own conduct (demands received, demands refused, disclosures honoured, consultations of the membership register per role, status openings, and the roles holding standing query access) follow the canary logic of I12 instead: they are published on a fixed cadence and also when the count is zero, because the party a canary protects there is the instance's counterparty and not a participant, and without the published zero silence is not falsifiable and a demand disappears into the noise. Where the two rules meet on the same figure, the rule protecting persons wins. This is the reconciliation FEP-5fcf already carries; it is taken over here rather than left to the reader, since two invariants that oblige the opposite about one number oblige nothing. Publication is decided on a slow cadence, and suppression is sticky. Whether a series is published or suppressed MUST be decided on a pre-announced cadence no faster than annual, and never as an interval-by-interval consequence of the current count, because the transition from published to suppressed is itself a one-bit series about the population behind it: a station series that goes quiet this week says that the handful of addresses behind it lost a contributor this week. Once suppressed, a series stays suppressed for a published minimum term, which does not end early because the count recovered. No safety flag ever changes the publication policy of a series (§7). A series is published, aggregated over a wider whole, or not published at all, on grounds that hold regardless of who is flagged; setting, standing or lifting a flag MUST NOT make a series appear, disappear, change grain or change its notice. A protection that is recognisable by its engaging is not a protection. The derivability rule: the publication set, not the published precision. Where a quantity is derivable from other published series, its own threshold protects nothing, and neither does the published precision of the series it is derived from. B = (R - D) / M is an identity with three degrees of freedom: publishing three of the four quantities fixes the fourth exactly, whatever quantum is placed on it, so precision is the wrong instrument and the publication set is the right one. The publication error, not the measurement uncertainty. Measurement uncertainty contributes nothing at all here, because the derivation uses published values on both sides and the measurement error is common mode and cancels; under I7 and §4 R is moreover booked at the lower bound of a published uncertainty budget and under I1 reduced by the published running unexplained sum, so the deviation between the booked and the physical value is deterministic and publicly invertible rather than stochastic. Only a deliberate difference between the booked value and the published value protects a derivable quantity. The instance MUST NOT present measurement noise, the tolerance band or the uncertainty budget as a protective measure. What protects a derivable quantity is publication error together with the removal of degrees of freedom from the published set. Therefore: the instance MUST publish B at the resolution §6 needs for the label, the hysteresis margin m, the target path and the price anchor; it MUST publish at most one of M and D as a public per-interval series, the other being signed to the auditor and the witnesses every interval and never published as a per-interval level; and the default choice is D public and quantised under §6, with M off the public set. B, the label, the headroom formula and every quantity a rule is evaluated on are never published quantised, sticky or noised, because a rule evaluated on a coarsened series is not a rule, and B never carries a privacy blur of any kind. The level of M is not published, in any period or any band. Neither annually nor as a band nor as an order of magnitude: on the day such a figure appears, R and B stand exactly and D = R - B M follows to within the width of that figure, which at any width fine enough to be worth publishing is finer than the quantum §6 requires on D itself. An annual M at one per cent is the mirror image of the precision route this rule replaces: that route was too coarse for the label by a factor of four to seventy-five, and a one per cent M is too fine for the queue by a factor of four to seventy-four. What appears in public instead is: per interval, every mint and issuance category as a fraction of M, together with the auditor's attestation that the caps of I2 were held. m / 5 is an upper bound on the coarseness of that quantum and never the decree that sets it. What sets it is the composed condition below, computed over the enumerated set of series that are functions of M and over the whole horizon; m / 5 binds only where that condition leaves room. Read as a decree, "no coarser than m / 5" is an instruction to publish finely a series that is a function of the one quantity this version protects, which is the wrong direction, and it lets an instance record the resolution of the attack as a test it passed. The decided fraction f itself is published exactly and is never on that grid. The quota series is a published series and falls under the condition above; f is a rule input, evaluated on by I6 for every settlement in the record-date window and by both caps of I2, so limit two of this invariant applies to it directly and a quantum on it is a rule evaluated on a coarsened series. At m = 2 per cent the grid is 0.4 per cent against an f capped at 5 per cent: up to 8 per cent relative on f and about 0.4 per cent on the rate a holder is paid, which is real money on every settlement in the window. The closing control of §11 and I1 covers f for that reason. The annual growth rate of M is not a standing publication. It is published only where the composed condition is met over that whole enumerated set including the quota series, because the growth rate together with the per-interval quotas and the levy rate fixed in advance per quarter (I8) yields the annual burn sum, which is the annual total of settled entitlements, and a cumulative total of a protected quantity is forbidden two paragraphs below. Where the condition is not met, the growth rate is signed to the auditor and the witnesses like the level itself and does not appear in public. The level itself becomes public when the escape hatch below opens, and not before. The genesis anchor falls under the same omission. The one-off build-up issuance of §6.1, including the existing legacy money, is published as a fraction and not as a fixed absolute amount for as long as the hatch is shut, because a published absolute anchor plus a published series of quotas integrates back to the level of M after the fact, and an omission with a published starting point is not an omission. R_book and R_display. R_book is exact, carries the lower-bound valuation of I7 and the deduction of the running unexplained sum of I1, and feeds B, the headroom H of §5, I1 and I2. R_display is R_book rounded downward to a published quantum q_R with U95(R) / 2 <= q_R <= U95(R), and is the only R that appears in public. No rule whatever is evaluated on R_display, and B never carries the blur: the five grounds on which a display split was earlier refused (the label, the hysteresis margin, the target path, the price anchor and the backing ceiling of I2) are every one of them functions of B and not of R, so no monetary function requires a public R at full resolution. The difference is bounded, announced and one-sided, and the instance publishes the expected difference q_R / 2 beside the series. The escape hatch. An instance MAY publish all four quantities where the largest holding share on the concentration meter (§8, §9) over the trailing twelve months is at most m / 5 of M, using the m in force under §6 and never a value adopted for this purpose. The test runs over holdings, never over realised settlements: a realised-settlement trigger is steerable by the instance itself through dispatch and settlement timing, and steering it harms precisely the largest holder. The test runs on the booked meter and never on the published series. The condition is evaluated on the concentration meter as it is signed to the auditor and the witnesses each interval, and it MUST NOT be evaluated on the published anonymised series. Limit two below forbids evaluating any rule on a quantised series, and this invariant itself quantises every person-derived series to a quantum larger than the largest single contribution; on a series of shares the largest single contribution is the largest share, so the published meter necessarily carries a quantum at least as large as the quantity the hatch tests, and the test is undecidable at published resolution. The one method that can convert the entire publication set is therefore the one method that MUST ask where its number came from. The same holds for every other rule standing on that meter: the progressive levy of §9 and the dependency ceiling of I13 are rules, so they run on the booked meter too, and the published meter stays a published series and nothing else. What is published is the outcome, not the share. The instance publishes a pass or fail of the hatch condition on the cadence at which the hatch is evaluated, and never the share the test ran on, because a share published on the hatch cadence is the same person-derived series at a finer grain than the meter it came from. The auditor attests the hatch condition as an item named in its own right, beside the closing control of I1 and §11. Opening the hatch arithmetically removes the protection §6 places on D. With all four quantities public, D = R_book - B M follows exactly, so the cadence per T and the sqrt(6) quantum of §6 are void as arithmetic rather than merely weakened. An instance that opens the hatch MUST publish that consequence in the same act, and from that moment a second condition stands for as long as the hatch is open: at least k_identity settlements per publication interval, so that a step in D cannot be attributed to a single entitlement. The first condition is about the distribution of holdings and says nothing about the step, which is the protected fact; the second is about the step. Where the second condition fails, the hatch shuts at the next evaluation point and the level of M stops being published. Opening and shutting are publication decisions like any other, so they are taken on a pre-announced cadence no faster than annual and never as an interval-by-interval consequence of the current count. m is never changed on a publication ground, which is the exact mirror of the rule that the uncertainty budget is never widened on a privacy ground (§4, §14). Where M is the unpublished quantity, the caps of I2, the dilution figure of §6.1 and the recipient list are expressed as fractions of M. The cut runs between creation and destruction, not between M and D. Creation is the act of the issuer: minting, headroom and flagged issuance are published per interval, exactly, as a fraction of M, because an issuance quota contains no term that depends on the queue and therefore leaks nothing about it. Destruction and the queue are the behaviour of participants: settlement, burn, floor draw and D are protected, aggregated and published on a cadence. That line gives full dilution control at interval frequency while telling a reader nothing about who is waiting, and it is the line this grammar draws wherever the two are confused. The condition holds over the series, not over the single publication. For every quantity the grammar protects (D, floor draw, the running unexplained sum, the re-anchor deviation series and M) the instance MUST enumerate every published series that is a function of it, cumulative totals, ratios and derived operational figures included, and the publication error propagated into any derivable value, composed over that whole set and over the whole published horizon, MUST exceed the largest single contribution to that value. M stands in that enumeration, and this version puts it there. The list named D, the floor draw, the running unexplained sum and the re-anchor deviation series because it was written in the version that still published M annually; the version that takes M off the public set is the version in which the one rule that protects a quantity against an observer averaging across publications MUST reach it. The largest single contribution to M is the largest single mint or issuance posting inside the window over which the composed error is computed, which is the same window the quota series publishes on. Three published series are functions of M, and they are named here rather than left to the enumeration to find: the per-interval issuance quotas of §6.1, the annual growth rate of M, and R_display, which stands in an exact identity with M on every interval on which B and a queue figure also stand. All three are subject to the composed condition over the whole horizon, and none of them takes its quantum by decree. Where the composed condition cannot be met for a series inside the band its own section allows, that series stops rather than keeps leaking, exactly as for a spent noise budget. This paragraph does not by itself decide which of R, B, D and M leaves the public set: it decides that the set is tested, per instance and over the horizon, instead of asserted. How much a set of quantised series gives away over a long horizon is the parametric question H8 names, and it stays named there rather than settled here. On the choice of word. It is publication error and not uncertainty, and the change of word is the whole repair: under the old wording every existing instance complied on the day it was written, because the GUM budget it already held did the arithmetic and protected nothing. A bound that holds per publication is no bound at all against an observer who averages across publications. A cumulative total of a protected quantity MUST NOT be published, because its increments are exact and the difference of two published totals defeats any quantum on the series itself. Sticky quantisation with hysteresis is not a defence. A series that stands still for twelve intervals and then moves is a dated, co-signed notice that the underlying quantity crossed a band edge with margin, which is exactly the construction this invariant forbids elsewhere in a publication bit that switches with the population. It MAY remain as a presentation form; the defence is a composed noise budget with a published horizon, computed by a deterministic algorithm on a fixed seed that the auditor can recompute, and that budget can run out, whereupon the series stops rather than keeps leaking. Three machine-testable limits. One, and it runs on metrologically determined quantities only (R, the flow series, eta_rt): no published quantum on such a quantity may exceed the U95 of the same quantity, since above that line the instance destroys information it demonstrably holds. Scope. Quanta on booked quantities are outside it and fall under the opposite requirement of this invariant instead, namely larger than the largest single contribution. The quantum on D under §6, the fixed bands on the conduct counters, the grain on the floor draw under I9 and the quota resolution above all stand on quantities the instance knows exactly, whose U95 is zero or undefined; read across them, limit one would forbid precisely the quanta §6 and this invariant oblige, and a limit that forbids what its own document requires obliges nothing. The moment of evaluation. The limit is evaluated against the maximum U95 over the same window over which the quantum is held constant, never against the U95 of one interval. q_R is taken as the maximum of U95(R) over the calibration cycle and held constant within it (§4), so it passes with equality; evaluated against the U95 of the interval just after an anchor it would alarm on a conforming instance for most of the cycle, which is the defect this sentence carried in v0.14, and two MUSTs that oblige the opposite about one number oblige nothing. The limit sits on the publication path, not beside it. Every path that emits a quantum runs it: the queue of §6, the person-derived series of this invariant, the conduct counters, the quota series of §6.1 and the display quantum of §4. A quantum that has not been through it is not published. Where a figure is published at a resolution finer than its own U95, that U95 is published beside it and the digits below it are stated to be bookkeeping digits rather than a metrological claim. Two: no rule is evaluated on a quantised, sticky or noised series. Three: privacy is never a valid ground for widening the uncertainty budget under §14, and the metrological grounds named in I1 (added or changed hardware, new calibration data) are exhaustive. The published quantum on the flow series and the mint attribution, from which M would otherwise be reconstructible together with the published mint coefficient and the published p, MUST be at least the largest single queued entitlement. On a monthly flow of the order of 27 MWh a quantum of 63 kWh is 0.23% relative and no monetary function notices it, whereas the same absolute protection placed on B destroys the label and the caps of I2: that difference is the whole argument for putting the precision requirement where it is free. Flows and payments whose counterparty is a natural person are published as class aggregates only; legal persons are named. The ledger MUST also publish counters about the watching party, because a transparency ladder that measures holdings and never gaze is only half a ladder: consultations of the membership register per role, status openings, demands received and demands refused, and the list of roles holding standing query access with the number of natural persons in each. These are counts about the instance's own conduct, so they follow the canary side of the dividing line above and not the k_identity threshold: they are published as periodic counts in fixed published bands per role category, and also when the count is zero. Under the thresholds they would be suppressed permanently at field-test scale, since a role in a cooperative of 50 to 200 households has one to three holders, and every new power this grammar granted would keep the power and lose the counter that was its price. The price of the exception is stated rather than written away: where a role has a single holder, a band about that role is a band about that person, so the band width is chosen and published with that in mind, and the exact counts go to the auditor, to the data protection officer and, for their own record, to the member concerned (I14), never to the public. Roots MUST be co-signed each interval by at least three independent external witnesses (§10), from day one. B MUST be recomputable by the auditor and the witnesses from the published system-level series together with the terms signed to them each interval, M, R_book and the delivery queue D included; below roughly 1000 participants that recomputation does not rest on any individual member and is not publicly reproducible, which §2 and I12 already state and which this rule does not widen.

• I12: Privacy and the publication unit. No datum traceable to a natural person is published, on any carrier, in any form. That principle governs the enumeration that follows; where the two ever appear to differ, the principle wins and the series is suppressed. A queue never names or ranks persons, and no series may be used to single out who is waiting, who was admitted or who left. The ledger publishes system levels only: R_display, B, eta_rt, D as a total on the cadence of §6, the running unexplained sum, the re-anchor series, the reconciled floor-draw sum as a single figure, flows per station meeting the k thresholds of I11, the concentration meter as percentages, the issuance quotas as fractions of M, and the per-interval commitments. M is not in this enumeration and is not a public per-interval series, as a level or as a mutation; it is signed to the auditor and the witnesses each interval and published only under the conditions of the derivability rule of I11. Individual accounts, balances, transactions, calls, positions in the delivery queue and delivery records MUST NEVER be published, in any form, pseudonymous included. A holder receives a private inclusion proof of their own mutations. "Levels, not lives" means: system levels public, account levels never. Conservation is demonstrated in phase 0 by auditor attestation plus the published commitments, and the instance MUST state publicly that conservation is auditor-attested and not publicly recomputable; the claim that system verification requires zero insight into persons MUST NOT be made until a homomorphic scheme with a per-interval sum proof actually runs (candidate work in H9). No pre-built linkability (phase 0). An instance MUST NOT build a facility whose purpose is to link pseudonyms to persons in advance and without concrete cause. In phase 0 there is no separate linking record built for that purpose: the instance already knows its members through the membership register, which is the principal linking point and falls under the ordinary retention and security rules (§10, I14). The earlier word "single" is withdrawn as untrue: the exclusion and allow lists, the household and family graph that the exclusion rule of I14 necessarily implies, and the safety flag are linking records standing beside the register. They exist as safeguards and not as a linking facility, which is exactly why the prohibition above is written on purpose rather than on effect: building a facility in order to link pseudonyms to persons in advance is forbidden outright, while a safeguard that unavoidably links is bound instead by the minimisation, the retention maximum (§10) and the necessity test of I14. Stating this is not a weakening of the escrow decision: the argument that carried it is that a lawful order can ask only what the instance already holds, and each of these records is held for a named protective purpose rather than to answer that question in advance. A threshold escrow is permitted only where the instance genuinely does not know its members (the federation phase), and then only with trustees inside the EEA or under an adequacy decision, never with a trustee subject to extraterritorial production law, and with a published transfer impact assessment. Disclosure and its transcript. A lawful order of the competent authority under applicable law (in the Netherlands including a public prosecutor's demand, not only a court order) compels disclosure of what the instance holds. Every disclosure leaves a trace in two parts. Public and immediate, on a fixed cadence and also when the count is zero: the number of requests and of honoured disclosures per interval, the category of the demanding authority and the legal basis, with no pseudonym, account or case detail. Private and immediate: an inclusion proof to the data subject, unless a competent authority has ordered deferred notification, in which case the proof is released automatically when that deferral expires; until then the identifying part rests under a salted commitment, which the data subject may open at any time. Where an escrow is in use, trustees MUST NOT release a share without an inclusion proof of the request in the log, and MUST NOT make any disclosure that would reveal an ongoing investigation. This enforcement is procedural, not cryptographic, and the privacy notice says so. Full anonymity MUST NOT be offered. Admission. A completed DPIA under art. 35 GDPR is an admission requirement per instance; where the DPIA finds a high residual risk after mitigation, prior consultation under art. 36 GDPR MUST be completed before the first enrolment, as H6 states it, and the instance publishes the date and the outcome of that consultation (§10, H6). The earlier wording "before any processing starts" is withdrawn: a project already processes personal data before it enrols anyone (a website has server logs), so that MUST was broken on the day it was written, and a MUST that is broken at the moment of writing weakens the MUSTs that decide something.

• I14: Internal access to member-identifying records. The instance holds more about a member than a bank does (verified identity, the member-to-account link, the transaction history, metering data per connection, delivery records, attestations and payout details), and until now nothing in this grammar constrained who inside the instance may look at it. Every consultation of a member-identifying record (membership register, enrolment record, delivery record, metering series, transaction history) MUST be authenticated to a named natural person, MUST be recorded in a tamper-evident internal access log, and MUST be disclosed to the member concerned within five days, a term in days precisely so that it does not move with the settlement interval. Disclosure goes only to the data subject whose record was consulted, and never to the counterparty in a two-party record. Notification never reaches a person against whom a safeguarding review or a suspicion of coercion runs, and where this invariant and §7 meet on the same event, §7 governs: the safeguarding review of the gift valve is addressed exclusively to the giver, on a channel established under the rule below, and never to the recipient, because telling the recipient that a coercion review is running tells the suspected coercer (§7, §15). The earlier formulation, which sent the notification to "the person under review" rather than the person the review protects, is withdrawn: it was wrong under either reading of who is under review, and the reference engine had implemented the §7 rule all along. Deferral, taken verbatim from I12: notification may be deferred where a competent authority has ordered deferred notification, in which case the disclosure is released automatically when that deferral expires, and until then the identifying part rests under a salted commitment. The commitment exists so that the public aggregate can be shown while the identifying side stays illegible; the data subject's own opening becomes available when the deferral lapses, automatically and without a request, and not before, since an opening on demand would cancel the very deferral a competent authority ordered. Without this clause the invariant would force the instance to choose between a secrecy order and a grammar break, and would contradict I12 in the same version. The confirmed channel is the compromised channel on the day of flight, so setting a flag suspends notification. "Confirmed in advance" means confirmed during the period in which the adversary was reading along, and in intimate-partner violence a shared device with a known PIN is the norm rather than the exception. At the moment a safety flag is set, all notification to the person under this invariant is suspended until a fresh channel has been confirmed by the person themselves, or by the accredited body acting for them; the accredited body MAY itself be that channel. Suspended notices are not cancelled: they are held and delivered in full once the fresh channel stands, with the log intact, so the person still learns who looked at what. Until then no notice goes to any address, device or account known from before the flag, and never to a household address or a shared device. The safeguarding assessment of §7 fires before any flag exists, so it MUST NOT make contact at all until a safe channel has been established, with the shelter or the accredited body as the route. A protective measure that can reach her at home is more dangerous than no measure. Exclusion runs on history, not on the present tense: anyone who shares, or in the past five years shared, a household or an address with the data subject, and anyone with a first-degree family tie or a former partner relationship, is technically excluded from that subject's records. Writing this in the present tense would drop the exclusion on the day the subject moves out, which is the day of maximum danger. A member MAY exclude further named persons without giving reasons, and the instance MUST NOT volunteer that listing to the person excluded. The listing is not, however, absolutely secret: a private party cannot create an absolute restriction of a data subject right, because art. 23 GDPR reserves that to a legislative measure. Where the excluded person exercises their own art. 15 right, what applies is the weighing of art. 15(4) and recital 63, per case, with reasons recorded: the rights and freedoms of the excluding member against the access right of the person excluded, as much disclosed as can be disclosed without defeating those rights, and every withholding written down with its ground and open to the role outside the operation of §9. Where a safety flag stands, that weighing has a standing outcome in favour of withholding, and the standing outcome is itself recorded rather than improvised at the counter. Where a safety flag stands, the circle inverts: access runs on an allow-list of named persons rather than an exclusion list. The list is never empty and never blocks day zero. At the moment a flag is set, the allow-list is seeded by default with the person themselves, the accredited body that set the flag, and one named assessor outside the operation who can execute the connectionless delivery of §7; the person may narrow or widen it afterwards. An absent or empty list falls back to that seed and never to refusal, because a refusal on the day of flight blocks the very delivery this grammar promises within 24 hours. Every seeded access is logged and disclosed to the person like any other, and that list is not set by the instance alone. Carve-out for representation: where a representative acts for a minor or another represented person under §7, the household and family exclusion would otherwise make the guardianship route unworkable, so the representative retains access strictly to what practical delivery requires, under substitute supervision by an assessor outside the operation, logged like any other access. Empty-set fallback: where the exclusion rules leave no one competent to act, the instance MUST route the case to a named assessor outside the operation rather than silently widening access; an empty authorised set is never a reason to disable the rule. Bulk export requires two authenticated persons acting together, is published as an event in the witness-co-signed log (never its contents), and MUST record its scope and size and notify each affected member separately: an export logged as a single event tells no one afterwards whether one record or the whole register left the building. Role separation applies to data as it applies to money (§11): no one holds the membership register and the ledger at the same time, and the holder of the metering data is a third role. The internal access log is itself an audit object under §11, and a member MAY request their own access log at any time. Security baseline (grammar). Member-identifying records are encrypted at rest, the access model is documented and published in outline, a data-breach procedure with a stated notification deadline exists, and an external technical test is carried out annually. The registers this invariant creates are themselves processing. The access log, the exclusion and allow lists, the household and family graph that the exclusion rule necessarily implies, the safety flag, the gift register of §7 and the disclosure counter of §9 are each recorded as a processing activity with a purpose, a retention maximum under §10 and an access rule. Minimisation of the household and family graph is grammar and not a house rule. It holds only what the exclusion rule needs: a derived exclusion flag per pair, its ground category and the period the ground rests on. It holds no free text, no notes and no detail about the third party beyond that flag. It is never used for any other purpose, and in particular never in a dispute, never in a safeguarding assessment, never in an anti-straw-man aggregation and never in fraud detection. It is never exported, never shared and never published, and it carries a maximum retention term like every other category (§10). It describes people who are not members, who never agreed to anything and who mostly do not know the file exists, so it is the thinnest dataset in the instance or it is not lawful. Whether it may exist at all is not settled by this grammar: the necessity test under art. 5(1)(c) and art. 25 goes to the data protection officer, with the exclusion list the member names themselves as the less intrusive alternative to be measured against, and where that alternative reaches the same purpose the graph is deleted rather than trimmed. A protection that quietly builds a relationship map is not a protection. Access without a log entry is not a procedural lapse but a grammar break (§15): the record was read, and the reading was hidden.

• I13: Dependency ceiling. An instance MUST NOT let more than a set share of the guaranteed floor depend on any single counterparty: supplier, storage site or funding source. That the floor never rests on one throat is grammar; the size of the share is a house rule. The ceiling is evaluated on the booked concentration meter as it is signed to the auditor and the witnesses each interval, and never on the published anonymised series, since a rule evaluated on a quantised series is not a rule (I11, limit two). What is published is that the ceiling holds or does not hold, and the action taken where it does not.

4. Reserve and measurement

• Metering boundary. The metering boundary is the sealed AC grid-connection point of each reserve site. All losses inside that boundary (DC conversion, auxiliary consumption, self-discharge, transformer loss) are reserve self-consumption under measured leakage (I8, subject to the loss partition below). Mint and burn are measured at this boundary only.
• Metering-boundary topology. A reserve site is either (a) a dedicated storage grid connection with no other load or generation behind the boundary, or (b) a battery system with its own sealed MID class B meter mounted directly at the battery inverter's AC terminals, which then constitutes the metering boundary for that store. Net household metering is never a mint or burn basis. In phase 0, R consists exclusively of the park.
• Metrology. Settlement meters are MID-conformant: at least class B at household level, 0.2S with class 0.2 instrument transformers at park level; sealed by a recognised body, with a published re-verification or sampling regime. Measurement reports fall under the audit right (§11 and, in federation, H1). Capacity tests, DoD-window determinations, temperature-derate-curve determinations and eta_rt reference measurements are performed or witnessed by a body accredited by the national accreditation body under ISO/IEC 17025 (testing) or ISO/IEC 17020 (inspection), following IEC 62620 or IEC 61427-2 as applicable; the accreditation scope is cited in every public test report. A derate curve is valid only after at least one audited verification discharge at or below the site's P10 winter cell temperature and at no less than the string's pro-rata share of the live-published P_g of §6, per battery technology generation; the curve states its validity C-rate, and where the power derate at P10 temperature is stricter than the energy derate, P_g takes the power-validated value. Absent that verification, the most conservative published manufacturer derate applies.
• The temperature reading that indexes derate(T_site). Since the mint coefficient of §5 is capped at the temperature-resolved reference product, the live cell-temperature measurement is mint-determining and not merely ceiling-determining. It therefore falls under sealing and the audit right on the same footing as the SoC data source (I7), contributes an explicit term to the GUM uncertainty budget of I1, and has a published calibration cadence. Aggregation over a settlement interval is fixed and conservative toward the reserve: the interval uses the lowest temperature-resolved reference value occurring within the interval, or the intake-weighted value where the instance publishes that choice in advance, and the same value feeds both the content update (§4 loss partition) and the mint coefficient (§5), so the guarantee that the coefficient never exceeds the recognised content increase rests on one reading rather than on two.
• Loss partition. eta_rt is exclusively the conversion-chain round-trip efficiency (rectifier, battery, inverter, transformer under load), measured under a published reference protocol at rated power and determined between equal-SoC points within the rolling window; auxiliary consumption, self-discharge and degradation write-down are charged exclusively through leakage (I8) and MUST NOT also be embedded in eta_rt. Every measured loss kWh has exactly one ledger route. There is exactly one E_content update rule: E_content is AC-deliverable content, and per interval it increments by AC intake x (eta_charge_ref x eta_discharge_ref) and decrements by AC output, where the reference pair is the audited decomposition of eta_rt, temperature-resolved from the same audited derate-curve family as the SoH regime below (so that anchor residuals are zero-mean measurement residuals), re-anchored at each calibration anchor, after the published temperature correction, to the rolling 90-day audited eta_rt within its published uncertainty, and changeable only through §14. The reference split equals that audited eta_rt at reference conditions and serves only to decompose it; it is never an alternative update path. The rolling 90-day audited eta_rt remains the audited cross-check, together with the SoC-implied stock (I7); the residual counts in the re-anchor delta class of I1. The mint coefficient of §5 is capped at this same temperature-resolved reference product, so minting never exceeds the recognised content increase. Where the mint coefficient is lower than the reference eta_rt, the difference (intake x (eta_rt - mint coefficient)) is unminted backing, never leakage and never an unexplained delta; it becomes mintable headroom under §5 only after the next calibration anchor confirms E_content at or above book value, and until that anchor it is published as unminted backing and excluded from H. The gate releases only at the first confirming anchor; an anchor below book value writes down through the re-anchor delta class of I1 and never releases the gate. Per interval and per site the balance equation applies: AC intake minus AC output minus change in stored content = internal loss; the reference round-trip loss (intake x (1 - eta_rt)) is deducted from the measured internal loss, and only the remainder is storage leakage under I8. The eta_rt measurement protocol is a public audit object.
• SoH regime (the audited ceiling). The ceiling on R is SoH x nameplate capacity x usable DoD window x derate(T_site) per battery string; R itself is the minimum of tracked content and this ceiling (I7). SoH is established at least annually via an audited full-cycle test under a published, condition-bound protocol: the test is measured at the sealed AC boundary, discharged at no less than the greater of the string's pro-rata share of the live-published P_g of §6 and the C-rate underlying the string's term in the audited ceiling (for the first test of a string without a prior audited ceiling: at no less than the pre-published design discharge power, at least the continuous manufacturer specification, which then anchors the first P_g publication), and at the site's P10 winter cell temperature or corrected downward via a published, audited derate curve (R always takes the derated value); test temperature, C-rate and rest periods appear in every public test report. The usable DoD window is fixed in the published test protocol and changes only through the slow parameter protocol (§14); a widening takes effect only after an audited test demonstrates delivery over the widened window at rated power. Between annual full tests: (a) at least 25% of strings undergo an audited partial-capacity reference cycle each quarter, rotating so every string is tested annually with detection latency under 3 months; (b) the write-down rate is the maximum of the modelled rate and the worst measured decile of the fleet's own test history; (c) any string unavailable or fault-flagged for more than 72 hours is written out of R immediately until retested; (d) the signed BMS event log falls under the audit right; (e) each interval the instance publishes the residual between the SoC-implied stock change and the metered flow balance. Test reports are public and signed.
• Booked reserve and displayed reserve. R_book is the reserve of I7: the lower-bound valuation, reduced by the running unexplained sum of I1, carrying the haircut exactly once. It feeds B, the headroom H of §5, I1, I2 and the deduction of the unexplained sum, and it is signed to the auditor and the witnesses every interval. R_display is R_book rounded downward to a published quantum q_R with U95(R) / 2 <= q_R <= U95(R), and it is the only R that appears in public (I11). R_display feeds no monetary calculation whatever, so the display quantum is never charged twice against the reserve and never lands on the redemption rate. Because R_display feeds nothing, the display costs the reserve nothing at all: it is charged neither against the redemption rate nor against the headroom, which is computed on R_book like every other term of H (§5). The earlier sentence, that the cost of the display fell on the headroom and on nothing else, is withdrawn. It was a remnant of the variant in which R_display still entered a calculation, and standing beside "R_display feeds nothing" and "every term in that formula is a booked term" it made the two halves of one version answer differently to the reader who checks whether the split counts twice. The instance publishes q_R, the expected difference q_R / 2, and the fact that R_display lies at or below B x M + D by construction, so the visible inconsistency between the published series is bounded, announced and one-sided. q_R is taken as the maximum of U95(R) over the calibration cycle and held constant within that cycle, because a quantum that breathes with the anchor cadence discloses its own phase and is weakest immediately after an anchor. Limit one of I11 is evaluated against that same maximum over that same window, so the construction passes with equality instead of alarming for most of the cycle.
• Which uncertainty budget feeds q_R, and the ratchet on it. U95(R) here is the expanded uncertainty (k=2) of the content determination of I7: the budget that scales with stored capacity and never with throughput (I1). It is not the meter-fleet tolerance on the per-interval energy balance at the metering boundary, which is the budget §14 may widen on a metrological ground. This grammar carries both and named them in one phrase; the display quantum follows the content determination, and the phrase in I1 about the budget that sets the lower-bound valuation of R is read accordingly rather than as an identification of the two. The ratchet. q_R is fixed at commissioning, is at unchanged metering hardware monotonically non-increasing, and is never re-derived upward out of a widened budget. Without that ratchet a widening would for the first time buy something other than a lower R: it would buy a coarser public reserve, so slack measurement would buy blur and better measurement would cost privacy, which is exactly the failure mode this section and §14 say they have shut when they say that slack measurement is not a compliance credit. With it, widening buys only a lower R and a lower B again, and the sole route to a coarser q_R is added or changed hardware, published with its metrological ground under §14 like any other change. This is the ratchet I1 already places on the tolerance, and the mirror of the rule that m never moves on a publication ground (I11).
• Quantum on the published flow series. The per-site flow series and the mint attribution MUST be published at a quantum of at least the largest single queued entitlement, because M is otherwise reconstructible from them together with the published mint coefficient and the published p (I11). This is the precision requirement placed where it is free: 0.23% relative on a monthly flow of the order of 27 MWh, against a requirement on B that would destroy the label.
• Tolerance is self-policing. The instance publishes its tolerance in advance; at unchanged metering hardware it may only tighten, and it may widen only through §14 with metrological justification (I1). Privacy is never a valid ground for widening the uncertainty budget: the metrological justifications named in I1 (added or changed hardware, new calibration data) are exhaustive. Slack measurement is not a compliance credit, and a published quantum is never accepted in place of a measurement the instance is able to make. The mirror of that rule holds on the monetary side: m is never changed on a publication ground (§6, I11). The GUM uncertainty budget that sets the I1 tolerance end point is the same budget that sets the lower-bound valuation of R, and that budget is itself a public audit object: widening it lowers reported R and thus B in the same interval, so it can hide nothing, it only makes the instance look worse. That self-policing survives only because the deduction and the haircut are applied to R_book and stay visible through B, which is published unblurred; a quantum laid on B would swallow both signals, and this is why no such quantum exists. The cumulative 12-month cap on signed unexplained deltas (I1) makes printing up to the tolerance limit self-defeating: the running unexplained sum is deducted from published R, so tolerated drift can never back a coin.
• Anti-fake-generation. Sources are registered and metering is hierarchical and independently cross-checked: each network layer is metered by a different party than the layer below, and a layer's total must reconcile with the sum of its children within tolerance. A phantom injection at the edge fails to close the parent layer and becomes an alarm (I1). Net injection per connection earns mint, not gross throughput: wash cycling yields nothing.
• Reserve versus floor. Any measured energy may count in R (and thus back claims), but only energy from durable renewable sources MAY raise the Basispuls floor (the ratchet, §7). Hydrogen counts in R at exergy value net of conversion loss; hydrogen from fossil input MUST NOT raise the floor.

5. Money lifecycle and the mint function

• Mint. Mint = measured AC intake at the metering boundary x the mint coefficient, where the mint coefficient is the minimum of the rolling 90-day audited eta_rt, the P25 of the trailing 12 monthly eta_rt values and the temperature-resolved reference product (eta_charge_ref x eta_discharge_ref)(T_site) of the same interval (a summer-heavy window can therefore never inflate winter minting, and the coefficient never exceeds the content factor of §4 by construction); with fewer than 12 monthly values, the minimum of the available monthly values applies. The purchase price p_i (coin per delivered kWh, 0 < p_i <= 1) applies to the already corrected amount. Mint follows the recognised increase of R, never raw intake: AC intake that would push E_content above the audited ceiling MUST NOT mint, and refused or curtailed intake is published as its own meter line, expressed in recognised content kWh (the AC-boundary equivalent is that amount divided by the content factor). That line is determined from the signed curtailment or setpoint log of the inverter, falls under the audit right, and is a declared and not a measured quantity: the energy never crossed the sealed boundary, so the line does not enter the I1 balance and is never one of its meter categories. The instance MAY then mint up to the remaining headroom H = (R_close - D) / (1 + m) - M_close - anchor-gated unminted backing (§4), in fully backed coins, publicly attributed, for operations or the floor (the purchase margin). Every term in that formula is a booked term: R_book and the booked queue depth, never R_display and never the published queue depth (§4, §6, I11). Capping H at the return threshold 1 + m rather than at 1 keeps the instance off the switching edge and keeps the return condition of §6 attainable: minting never pushes B below 1 + m. The exact-threshold form above is used rather than R_close - D - (1 + m) M_close, which overshoots and leaves the covered equilibrium just below 1 + m. Minting beyond H is flagged issuance and falls under §6.1.
• Suspension of minting against over-backing. Every mint against over-backing is suspended while the label is under-backed: headroom minting under this section, the automatic minting of over-backing above the target path, and buffer replenishment. The purchase mint against recognised intake continues, since it is the recovery route itself: every recognised kWh then closes the gap instead of becoming a new coin. Without this suspension an instance that mints its full headroom pins B by construction, and the under-backed label becomes permanent while the reserve is in fact recovering. Minting resumes once the published label is fully backed again, by whichever route set it: the hysteresis of §6 for a B-driven label, the expiry of the minimum term that a delivery default puts on the label (§6, which does not end early because the default was cured), or the publication of the cause by the external audit (I1, I8). The margin not minted during the suspension does not lapse. It is accrued and signed to the auditor and the witnesses each interval, and it is published as a single figure at the moment of release, together with the release size and the dates announced in advance. It MUST NOT be published as a running cumulative total, because the difference of two published totals yields the per-interval headroom H_t exactly, H_t is an exact per-interval constraint linking the two protected quantities D and M, and the increment of a cumulative total defeats any quantum laid on the series itself (I11). The coverage blockade of the p-rule does not trigger where the suspension is the only reason its coverage test fails, and in no case does it touch the purchase mint.
• Reachability of the return (tested every interval during a suspension, signed to the auditor and the witnesses, and never published as a per-interval bit). Suspension is necessary but not sufficient. Under pure purchase minting B converges to (e X - F) / (c p X), with e the content factor, c the mint coefficient, p the purchase price, X the intake per interval and F the floor draw of I9; a p close to 1, or a large floor stream, can hold that steady state below 1 + m no matter how long the suspension lasts. While a suspension runs, the instance MUST compute each interval the steady-state attainable B under its own p and floor stream and sign it, with its inputs, to the auditor and the witnesses. The value itself is not published, because B_ss = (e X - F) / (c p X) inverts to F = dM (e / (c p) - B_ss) with every term on the right already public, which would publish the floor draw of I9 exactly and per interval, in precisely the period in which it is largest and the drawing population most exposed. The pass or fail is not published either, and the earlier requirement that it be published each interval is withdrawn. The test is B_ss >= 1 + m, which is F <= X (e - (1 + m) c p), and every term on the right is public: the mint coefficient and p under this section, e as the reference product of §4, X from the per-site flow series. The threshold is therefore a known threshold that moves with X, and a dated per-interval bit about the position of a slow-moving F against it, sorted by threshold height, is a binary search on the floor draw, run in exactly the period §5 itself names as the period in which F is largest. I11 forbids that form in as many words: a series that stands still and then moves is a dated, co-signed notice that the underlying quantity crossed a band edge with margin, and a one-bit indicator cannot meet the composed publication error that the same invariant requires of every series derived from the floor draw. What is published is the action, not the test. Where the test fails, the instance MUST lower p or revise the recovery path (§6.1), and that decision is published as its own signed item, because it is a statement about the instance and not about the drawing population. The pass or fail, its inputs and the computed B_ss are signed to the auditor and the witnesses every interval and go nowhere else, per interval or aggregated over any period. Both the test and the action stand in the enumerated set of published series derived from the floor draw (I11), and the composed publication error over that set and over the whole horizon MUST exceed the largest single floor draw before the action item is published at all; where it does not, the action too is signed rather than published and the public signal is the label consequence of §6. The residual is named rather than denied. p is public under the p-rule below, so a lowering of p is visible whether or not it is announced, and a reader who knows the recovery rule can infer that the test failed in the quarter p moved. What removing the per-interval bit buys is resolution: one dated bit per quarter, on a quantity that moves quarterly, instead of one per interval on the interval cadence the binary search needs. The published target path and every recovery path MUST end at or above 1 + m, so a B pinned to the path can still satisfy the return condition.
• The p-rule. Each quarter the instance publishes its full cost stack per delivered AC kWh: storage LCOS, the shadow cost of the backing SoC floor given the reserve deployment rule (not gross flexibility revenue), and operating costs, in euro, with an explicit valuation basis for one coin: the avoided member cost of one delivered kWh under the applicable tax and grid-fee regime, sources archived as under §6.2. p is then set such that the supplier receives at least their published opportunity cost and (1 - p) plus headroom covers the instance's cost stack. If no p in (0, 1] satisfies both, the instance publishes a coverage blockade instead of minting (H8 holds the open business-case question). The instance states honestly that the business case closes only to the extent that the avoided member cost exceeds wholesale value (the regulatory wedge of taxes and levies); a change in that wedge is a named threat (Annex A). As long as the instance itself carries euro-denominated costs, it publishes a euro cash-flow statement next to the coin ledger; covering euro costs from coin revenue requires a published conversion basis or a named euro funding source under I13.
• Reserve deployment rule. The reserve MAY trade on the euro flexibility market within a public, signed mandate; net euro proceeds are mandatorily converted into additional storage capacity (raising R).
• B target path (anti-hoarding). B follows a published target path, which MUST lie at or above 1 + m. Over-backing above the path is automatically minted and distributed pro rata to the shared pot; under-backing below the path is governed by the suspension rule of this section, which covers this automatic mint as well. Coin appreciation above the target path is thereby ruled out as policy. The target path and its update cadence are house-rule parameters under §14; during an active recovery path (§6.1) the recovery path prevails, and the expected appreciation along it is an acknowledged holding premium, bounded by the recovery fraction on inflow and stated in every issuance decision.
• Burn. Claims MUST be destroyed at settlement (I4); the entitlement then lives on in kWh in the delivery queue D until physical delivery, which lowers R and D together. Claims consumed directly die the moment the kWh leaves the reserve.
• Leakage is the mirroring burn. When R falls through physical loss (not consumption), luxury balances shrink by the measured loss under the split and quarterly rate of I8. Thus I2 holds even when the reserve shrinks by physics rather than redemption; a timing difference between measured and levied leakage runs through the public reconciliation account of I8 and counts as a physical fluctuation, not an I2 violation.
• Netting. Simultaneous generation and consumption creates no money; only the net stock change mints or burns.

6. Backing ratio, status label and price anchor

• The instance MUST publish B live, at full monetary resolution and never quantised, sticky or noised. B is computed on R_book and on the booked queue depth; the R that appears beside it is R_display (§1, §4, I11). The margin m of the hysteresis below is never changed on a publication ground.
• Power coverage, minimal variant. The instance MUST publish live, next to B: the guaranteed simultaneously callable power P_g (the sum over sites of min(C-rate x usable capacity x derate(T_site), inverter power at site temperature, grid-connection value), where usable capacity is the audited ceiling of §4 before temperature derate (so the derate enters exactly once) and derate(T_site) is the same published, audited temperature-derate curve as in §4; the published winter value of P_g is computed at the site's P10 winter cell temperature, and for sites under topology (b) the grid-connection term is the connection capacity net of the contracted simultaneous household load) and the delivery queue D: published only as aggregate depth in kWh, on a published cadence no faster than one publication per delivery term T and never at interval close, since an entitlement stands in the queue until T and a series that reappears every interval hands the observer repeated views of one standing claim to average over. The published figure is the booked depth rounded upward to a published quantum, because a published queue that understates itself overstates backing, which is the failure mode the whole queue deduction is written against. B, the headroom of §5 and the ceiling of I2 are computed on the booked depth and never on the published one, and the instance publishes that the published depth lies at or above the booked depth, so the visible difference between the series is bounded, announced and one-sided. The quantum MUST be at least sqrt(6) times the largest single queued entitlement, because the protected fact is the step in D at a settlement and the first difference of a series quantised at q carries a noise of only q / sqrt(6), so a step of q shows up in a single release at a signal-to-noise ratio of about 2.45. The expected waiting time is not published as a second series, because two coarsened views of one quantity halve the error. Whether this series is published at all is decided under the slow cadence of I11 and never on the standing count. The decision is pre-announced, taken no faster than annual, sticky for a published minimum term that does not end early because the count recovered, and never taken as an interval-by-interval consequence of the number of entitlements standing at that moment. This section sets no threshold of its own on the current count. The earlier sentence here, which suppressed the series wherever fewer than k_identity entitlements stood in the queue, is withdrawn: the count moves at every settlement, so a suppression that follows it is a one-bit series about the queue population published on the cadence of the very settlements it is meant to hide, and I11 forbids that construction in the same version in which this sentence required it. Two invariants that oblige the opposite about one number oblige nothing, and I11 supplies the measure by which this one is decided. The count itself is signed to the auditor and the witnesses every interval and is what the decision point reads. The limit is stated rather than denied: below k_identity simultaneous entitlements no choice of published precision protects the individual event, so an instance standing below that count at its decision point suppresses the series for the whole term rather than switching it off in the interval the count drops, and what protects the event meanwhile is the cadence, the size of the largest single entitlement and the instance's own share of the queue. The instance MAY book its own delivery obligations under the flexibility mandate of §5 as its own signed category inside D, which lowers B honestly and makes a step in D ambiguous between a member and the instance; the auditor sees the split, the public sees the total, and the instance publishes its own annual volume. The accrued queue depth is never published as a running cumulative total (I11). Individual calls, their timing, their priority class and their connection are never public (I12). From settlement onward D is deducted in every published balance and in B (B = (R - D) / M, the one B of §1), and the sealed flow balance of §4 reconciles against E_content + D, so an undelivered queue never inflates backing; a physical loss between settlement and delivery writes the queue down pari passu with the coin (I4, I8, I9). The delivery term T of I4 is a declared, public house-rule parameter with a published maximum; that maximum changes only through the slow parameter protocol (§14) and MUST NOT be shorter than the dark-period horizon as defined, measured and published under §7. A shorter T converts an energy shortage into a delivery default and a label flip driven by the weather rather than by solvency, and it removes the delivery planning that protects the Basispuls against a run. Autonomy, on the cadence and never live. The instance MUST publish the autonomy (R_display - D_published) / (annual banded daily floor delivery + contracted simultaneous load) at the P10 winter derate, on the same cadence as D in this section and never live and never at interval close. Three things about that formula are load-bearing. Its numerator is built from two figures that are already public, so the series adds no degree of freedom to the publication set; it is not R_net, which is the booked net reserve of §1 and is never published as a live per-interval level, because published live beside an unblurred B it fixes M = R_net / B exactly and hands back the degree of freedom I11 removes, and it fixes D_book to within q_R besides. Its denominator carries no live head count: the floor-delivery term is an annually published, banded design value under §14 that does not move within the year, and I9 forbids publishing admissions, dormant transitions and scale-downs "not even indirectly as a change in a published divisor", which a live daily floor delivery in a divisor is exactly. And it is enumerated in I11 among the published series that are functions of D and of the floor draw. The previous version of this sentence required a live R_net over a live floor-delivery divisor and defined R_net nowhere in the document; it was withdrawn on both counts rather than patched. Any settled redemption not physically delivered within T is a delivery default. The count of defaults is a count of events at persons and follows the suppression side of the dividing line in I11, zero included: it is signed to the auditor, the witnesses and the data protection officer and is not published in any form, per interval or aggregated over any period. What is published is the label consequence, which is a statement about the instance and not about the members concerned: while a default stands the label is under-backed regardless of B, and that label is the public signal. That consequence is applied at the next scheduled evaluation point of the hysteresis window of this section, never in the interval of the default itself, and once applied it stands for a published minimum term of one full evaluation window and does not end early because the default was cured. This makes the teeth harder rather than softer and stops the label from timing one member's call. A default is one identifiable member's call that was not met, so at a scale of 50 to 200 households an event-level publication would be the loudest person-bound signal in the whole ledger, amplified by the label flip. The principle at the head of I12 governs the older wording here rather than the other way round. The residual is named rather than denied: an under-backed label at B >= 1 still tells a reader that a delivery was not met somewhere in the preceding window, and no choice of published precision on R, B or M touches that bit. The full power-coverage invariant (queue mechanics, second status number) keeps maturing in H8 and becomes normative at any scale-up beyond the field test.
• B >= 1: status fully backed.
• B < 1: status under-backed. This is a status change, not fraud, and MUST be shown, not hidden. Redemption continues at the meter rate (I4, I5). In public communication the under-backed status is also known as fiat status.
• Hysteresis on the label (anti-flapping). The reserve breathes with the seasons. Status transitions therefore use published hysteresis: fully backed to under-backed only after B < 1 has persisted for a full evaluation window, and back only after B >= 1 + m has persisted likewise. Window length and margin m are house-rule parameters under §14, with a published maximum on the window length and a published minimum on m (the mirror of the delivery-term construction of this section); that they exist and are published in advance is grammar. The values in force at the moment of the first breach govern the whole episode and MUST NOT be changed while the label is under-backed, so an instance cannot release itself by republishing its own switching parameters. Exception: hysteresis applies only to B movements from physical reserve fluctuations; a B movement caused by growth of the delivery queue D counts as such a physical fluctuation (the delivery default of this section remains the hard boundary), while a B drop caused by unbacked issuance switches the label immediately and without hysteresis. The label consequence of a delivery default is applied at the next scheduled evaluation point of this window and then stands for a published minimum term of one full window. That is a timing rule and not a softening: it removes the timestamp of one member's unmet call from the public signal and makes the tooth last longer rather than shorter. Redemption is never touched by the label: hysteresis smooths the status, never the math. The suspension of §5 is what keeps the return condition from being pinned shut by the instance's own minting: an instance that keeps minting to B = 1 would never satisfy B >= 1 + m. Suspension alone does not make the return attainable, however; whether it is attainable also depends on the purchase price and the floor stream, which is why §5 requires the steady-state attainable B to be computed, signed and acted on each interval during a suspension, with the action taken as the public part and the test itself signed to the auditor and the witnesses (§5, I11).
• Price anchor (market consequence, not a rule to enforce). Redemption always yields B kWh per coin; arbitrage therefore caps the price of power at ~1/B coin per kWh. Only at B = 1 does the ceiling of ~1 coin per kWh hold. Below B = 1 the coin is a pro-rata share in the reserve, not a kWh claim, and is named as such in all public communication.
• Crisis playbook. For the label change to under-backed and for every emergency-mandate activation there exists a pre-established, public playbook: who communicates, within what deadline, with which fixed elements (size, recovery path, and what does not change: the redemption math and the Basispuls seniority).

6.1 Flagged issuance: an instrument with teeth

Openly flagged unbacked issuance is more honest than silent inflation and sometimes necessary (an acute crisis, the one-off genesis item below). Who may decide is politics under §14; that it is flagged, capped and recovery-bound is grammar.

• Recovery path (with teeth). Every issuance decision contains a public recovery path: maximum duration and intermediate B targets per measurement period. If B sits below the path for two consecutive measurement periods, the following take effect automatically: (a) a full mint stop (headroom minting and flagged issuance included); the purchase mint against recognised intake continues, since it is the route by which the gap closes; (b) mandatory burning of buffer claims (§8) toward the path, and extension of the path duration only through the public revision of (c); the recovery fraction itself stays at 0.2 and MAY be changed only through the slow parameter protocol, because raising the levy on inflow suppresses exactly the behaviour that closes the gap (§13); (c) a mandatory public path revision through the slow protocol. No new unbacked issuance while the label is under-backed, except through a new emergency mandate with a supermajority; never while an existing recovery path is being violated. This gate is on the same label as the suspension of §5, so no window exists in which the unbacked route is open while the fully backed one is shut.
• Quantity caps, on one base. See I2: at most 5% per emergency mandate, 10% cumulative per rolling 12 months, both read on one base and one only: base = M_record - the flagged issuance decided within the same rolling twelve months, where M_record is the level of M at the record date of I6. The decided size is f x base coins and it does not change afterwards; the record date is the close of the settlement interval preceding the publication of the decision and is never chosen by the issuer. The clause reading the caps against the smaller of M at the decision and M at effectuation is withdrawn (I2). At effectuation the decision is re-tested on the same base, and a decision MUST NOT be effectuated into a standing mint stop. The body that declares the crisis is not the body that spends the proceeds.
• Emergency-mandate cooldown. An emergency mandate is not consecutively renewable; renewal requires the full slow protocol. The same crisis ground cannot carry a new emergency mandate within 12 months. Successive mandates count under the cumulative cap.
• Genesis clause. "Liquidity for a young economy" does not exist as an issuance ground. There is one single, pre-capped build-up issuance, fixed in the charter, including the existing legacy money as a separately labelled item on the meter. That item is published as a fraction and not as an absolute amount for as long as the escape hatch of I11 is shut, and the absolute figure is signed to the auditor and the witnesses like every other term of M. The earlier requirement to publish it as a fixed absolute amount is withdrawn, because a published absolute anchor plus the published series of issuance quotas integrates back to the level of M after the fact, and an omission with a published starting point is not an omission. The amount becomes public in the same moment the level of M does and not before (I11). This ground lapses definitively on the charter date or the first time B reaches 1; later shortfalls can never be booked as legacy or build-up items.
• Distributional honesty. Dilution is direct, pro rata per coin and visible; the burden falls on holders of coins, not on members as such. Every issuance decision is denominated as a fraction f of M at the record date (I2, I6), publishes that f exactly and never on the m / 5 grid, states the estimated levy per 100 coins, states the resulting record-date pro-forma as B_record / (1 + f) so that any reader can check that one figure against the published B at the record date, and carries a public recipient list. Settlement inside the window runs at the pro-forma rate (R_book - D) / (M + f x base) of I6, which equals the record-date pro-forma at the record date and diverges from the live B / (1 + f) thereafter; the decision states which figure is the published one and which is the rate paid, because publishing only the first and paying the second is what made waiting inside the window profitable in the version this replaces. Outside the emergency mandate, pro-rata distribution to all holders is the default; targeted spending is possible only under an emergency mandate.
• Indexation realism (commentary to I2). The real yield of flagged issuance falls as prices and contracts index to B or to kWh; under full indexation the yield is zero and the residual burden falls on non-indexed holders. Crisis plans must therefore never count on more real yield than the non-indexed share of the circulation, to be estimated and published per issuance decision.

6.2 The Reference kWh (the pricing index)

Prices are quoted in the Reference kWh (§1); whoever controls that index holds price-level power, so it is bound like everything else:

• The index MUST be computed algorithmically from published, archived inputs (e.g. day-ahead wholesale prices and the instance's own auction results), with the formula, the multi-year window and the update cadence fixed as parameters under §14. No discretionary adjustment path exists.
• The inputs MUST be archived so that anyone can recompute the index bit for bit. This bar survives the privacy rebuild of v0.9 precisely because the index takes no person-bound input: it is built from market prices and auction aggregates, never from metering points or accounts. Where B is concerned the bar is lower by necessity (auditor attestation plus commitments, I12); the index is the one number that stays fully public and fully recomputable.
• The index MUST NOT be used for redemption. Redemption follows the meter rate (I4, I5): the index prices goods, the meter prices claims.

7. The Basispuls

• No destination binding on the floor (payout route). The floor MUST NOT be paid to any party other than the entitled person: not to a landlord, not to a housemate, and not to the holder of the household energy contract, who in a coercive household is structurally not the person at risk. In the field test the Basispuls is paid as an energy-cost guarantee on the participant's own energy bill where the participant holds that contract themselves, outside the ledger and outside any provider: a destination-bound payment hands the recipient's subsistence status to the party with the most power over them, and stopping such a stream announces a status change to a landlord before the person can explain it. Should destination binding return later (H5), then only as a bundled periodic payment per property or per portfolio without any per-resident breakdown; the instance MUST NOT disclose an individual's floor status to a provider, not even implicitly by stopping a stream, and on scale-down or a dormant transition the payment to the provider continues unchanged until the end of the objection period. Payments to registered providers are published only as a total per interval across all providers, never per provider and never per payment.

• Delivery without a connection (the third form, grammar). A payout route that presumes an energy contract presumes a household, and the person fleeing one usually has neither. Every instance MUST therefore support a third delivery form: delivery to the person themselves without any connection, as a counter card, prepaid credit, or payment to an account that is not tied to an address. It MUST be available within 24 hours of a safety flag being set, without attestations, without a waiting period and without disclosing a destination to anyone. Without this form the safety route is a redirection mechanism with nowhere to redirect to, and since the energy component expires on a daily cycle the floor of the person who flees is zero from day zero, which is precisely when it is needed. Sole control, not the absence of an address. The test the payment instrument MUST meet is that the person alone controls it: address-free is not the same as hers alone, since a joint account carries no address either and a shared banking app on the other person's device carries none. Where the instrument cannot be shown to be solely controlled, the counter card or prepaid route applies instead. A neutral description. The payment MUST carry no description, reference or counterparty name from which the floor, the status of the recipient or the identity of the cooperative can be derived: a line reading "energy-cost guarantee" on a statement is itself a subsistence-status datum for everyone who sees the statement, including whoever reads along at home. A handover that is not a person in the village. At least one variant of the physical form MUST be obtainable without the instance handing it over itself in the locality, for example through the accredited body, a shelter or a postal or pickup route, because a counter is staffed by a neighbour and a handover is a person who sees her. The instance publishes only the number of floors delivered in this form, as an aggregate under the thresholds of I11 and on the slow publication cadence of that invariant, never who receives one: at field-test scale that count is zero or one, and a bullet that orders it published is a mine rather than a transparency measure.

• Safety route (protected persons), an acknowledged exception to I11. Where a person declares, or a designated safeguarding body declares on their behalf, that disclosure of their location or of a change would endanger them, the destination of their Basispuls MUST be redirectable immediately: without public announcement, without a waiting period, without an objection right for the incumbent binding, and without fresh community attestations. A single attestation by an accredited institutional attester (shelter, general practitioner, municipality, police safeguarding desk) substitutes for the full set of community attestations. Who designates the safeguarding body, and who accredits the attester. Accreditation happens at federation level and never by the instance being checked: an instance that accredits its own controller has appointed its own supervisor, and in a cooperative of 50 to 200 households the adversary can sit on the board. An instance MUST NOT accredit, prefer, exclude or de-accredit a body itself, and de-accreditation never operates retroactively on a standing safety flag or on a valid attestation, so that a flag cannot be made to lapse by withdrawing the body that set it. Each context MUST keep at least one accredited institutional attester per region actually reachable for the person, and at least two where the route for a person whose documents are not in their own possession requires two attestations; where only one is reachable, the instance publishes that fact, and the recruitment bar below stands until it is no longer the only one. What the instance may record about the attester. The instance verifies that a valid institutional attestation exists and until when, and MUST NOT record which institution issued it or the category of that institution: the category (shelter, general practitioner, police safeguarding desk) is art. 9 data, and it is also the reason a person changed route, which is the one thing a route change must not reveal. While the safety flag stands, every authorised status opening and the enrolment record MUST continue to return the previous destination and the previous status unchanged. There is no public view per person in which that decoy could live, because I12 forbids one in any form; the earlier wording here, which required a "public view" to keep showing the previous state, is withdrawn as a MUST standing against a MUST. Every attempted opening of that entry MUST be recorded and disclosed to the person, under the suspended-notification rule of I14: held while no fresh channel stands, then delivered in full, never sent to a channel confirmed before the flag. A dispute filed against a safety-flagged change never freezes delivery back to the old destination. The flag is revocable only by the person or the safeguarding body, never by the instance. This is a deliberate break with the openness of I11 and with the aesthetic of the rest of this document: every other mechanism here publishes, and this one must show a decoy, because the most dangerous adversary is often inside the same house and a public waiting period is then itself the flight alarm. The break is stated rather than reasoned away. Bounds on the decoy. It never operates against a demanding authority: a lawful order receives the true state, and the decoy is a defence against a household, never against the law. It is bounded to the status and enrolment layer only, and that bound is a consequence rather than a preference: on the money layer I1 requires the interval balance to close and I9 requires floor draw to reconcile against the metered sum, so a decoy there would produce an unexplained delta and an alarm, which is why none is specified and none may be improvised. Where the decoy causes loss or error, the loss falls on the instance and never on the protected person, who is never held to a state the system chose to display. Accuracy, art. 5(1)(d), stated rather than left to be found. The decoy is deliberate processing of inaccurate personal data toward an authorised third party, so the accuracy principle is engaged and is not silently set aside: the ground is art. 6(1)(d), the vital interests of the data subject herself, and accuracy is yielded for exactly as long and as far as is needed to avert a risk to life and physical integrity. The bounds above are what keep the exception proportionate: never against a demanding authority, never on the money layer, never binding on the protected person, never longer than the flag stands. The instance records that assessment in its DPIA as its own risk item, keeps the true state accurate internally and available to the person, and corrects the displayed state as soon as the flag is lifted. A route that has a good answer under art. 5(1)(d) should write it down rather than wait for a supervisory authority to find the gap. No station series changes because a flag is set. The earlier rule here, which suppressed any station series behind a flagged person, made the protection recognisable by its engaging: the series vanished in the week she flagged, with a notice naming it. At field-test scale the instance therefore publishes no station series at all, or aggregates every such series over a wider whole regardless of flags, and either way the choice is fixed on the slow publication cadence of I11 and does not respond to a flag being set, standing or lifted.

• No recruitment where the route does not exist (grammar). An instance MUST NOT enrol, and MUST NOT recruit for enrolment, any person living at a confidential address or any person whose safety would depend on the safety route of this section, unless both of the following hold at that moment: (a) at least one accredited institutional attester is actually under contract and reachable for that person's region, and at least two where the route for a person whose documents are not in their own possession requires two attestations; and (b) the connectionless delivery form above is actually available as a working facility, exercised end to end at least once, rather than described in a specification. The instance publishes both conditions, with the name of the contracted body once there is one and the date the delivery form was last exercised, so that the bar is checkable from outside. This is the rule the rest of this section rests on: a grammar may only oblige communities to build routes for people in danger because it also forbids leaning on those routes before they run, and recruiting someone whose safety depends on an unbuilt provision is the failure this grammar exists to prevent. H6 carries the same rule as a go criterion, but Part II does not bind and a go criterion is not a MUST, so the binding form lives here. Enrolment or recruitment in breach of this bullet is a named act under §11 and §15, on a par with reading a member record without a log entry.

• The floor is untouchable, as a delivery priority. The Basispuls MUST be a use-right, not property: non-transferable (except the gift exception below), non-seizable, never collateral. The energy component expires on a daily cycle. At scarcity, available energy is attributed to the Basispuls first, ahead of any other redemption (I9). The floor MAY only rise when structural income (tax plus margin) and durable sources support it; it MUST NOT be lowered to cover a gap, save for the automatic contraction path below. The Core Basispuls covers energy only; the rent guarantee is a Horizon goal (H5).

• The Sustainable Ratchet. The ratchet is defined on the rolling P10 winter trough per capita over three years, with a pre-published automatic contraction path: if the P10 trough falls below the sizing level, the Basispuls automatically scales down pro rata by that formula. This is a rule, not a decision, and does not count as a ratchet break. The winter trough is the lowest sum of net renewable production over a rolling 14 x 24 hour window, computed from the sealed production meters of registered durable sources (same MID regime as §4). The metering-point register is not public: it falls under the audit right of §11 and is open to the auditor and the witnesses, never to the public, because a metering point resolves to an address and an hourly production series is a fingerprint of the building that can be matched from the street. Output of storage installations never counts as production in the window sums; storage appears in the floor calculation only through the reserve, never through the trough. The P10 trough is the 10th percentile of the per-winter (1 November through end of February) lowest window sums over the most recent three winters; with fewer than three winters of history the minimum applies. The per-capita divisor is the number of active Basispuls entitlements on 1 November of the current winter, minors included (§7), published once a year and only rounded to multiples of 10, or as a band, so that a single admission, departure or dormant transition is never readable from a change in the divisor. The register behind it is not public. The window sum advances in steps of one hour over the archived hourly meter series. The percentile is nearest-rank, so with exactly three winters the P10 trough equals the lowest of the three per-winter minima. Formula, window and cadence are parameters under §14. The trough MUST be recomputable from published aggregate series per technology and per region, each covering at least k_station = 5 registered metering points that are not attached to a household or a person (the station threshold of I11, since those are metering points and not identities), together with a signed attestation from the accreditation body and from the witnesses over the underlying raw series, which they see and the public does not. Anything attached to a household or a person meets both thresholds, k_station and k_identity, and never the station threshold alone: this section calls such a series occupancy behaviour in its own reasoning, and a series that is occupancy behaviour is person-bound by definition. The cut this section already makes on the retention side (source and park meters not attached to a household on one side, household-bound series on the other) runs identically on the publication side, so that the conjunctive repair of I11 is not quietly disjunctive again for the one series the specification itself says can be matched to a building from the street. Fallback where no conforming aggregate can exist. In a park-only phase 0 there may be fewer than k_station registered points per technology and region, in which case no conforming series exists; the instance then publishes no aggregate series at all, publishes the suppression notice of I11, and the trough is verified solely by the signed attestation of the accreditation body and the witnesses, who recompute it from the raw series. The floor formula stays checkable by those verifiers; it does not stay publicly recomputable, which is the same accepted price as elsewhere (§2). Retention. The three-winter series requires history that the 90-day limit on sub-daily metering data would otherwise forbid, so the two are reconciled explicitly: production meters of registered sources that are not attached to a household or a person (park-scale and source meters) fall outside that limit and are retained for the three winters the formula needs, while any metering series attached to a household remains bound by §10 and never enters this calculation at sub-daily grain. Sites under metering-boundary topology (b) (a battery behind a household connection, §4) are excluded from individual publication entirely and appear only inside an aggregate meeting both k_station and k_identity, since their series is occupancy behaviour and the clause that says so is exactly the reason the station threshold alone does not carry it. This is a deliberate trade: the bit-for-bit public recomputability that earlier versions required is given up because its inputs are hourly series per metering point, and verifiability is obtained from signed aggregates plus attestation instead (§2). Under diluting inflow the floor freezes and new admission enters a queue until newly built reserve covers the floor again. That queue is not public: only its length is published, and only as a band, never as an ordered list, never with positions and never with timing, since a queue that can be read backwards names the people who joined and the people who left (I12).

• The dark-period horizon (definition, measurement rule and figure). The delivery term T of §6 is bounded below by a horizon that v0.14 referred to and never defined, which left the parameter deciding how long a person waits for power, and how often the label flips, hanging on a definition that was not in the document. It is defined here, and it is measured on the series this section already keeps. A dark hour is an hour in which the net production of the registered durable sources, summed over the same published aggregate series per technology and per region from which the trough above is recomputable, is at or below a published share theta of the median winter hour of those same sources over the same three-winter history. theta is a parameter under §14, published in advance and never set by the decision that would use it. A dark period is a maximal run of consecutive dark hours. The dark-period horizon is the longest dark period per winter (1 November through end of February, the winters the ratchet already uses), taken over the most recent three winters at the ninetieth percentile, nearest rank, and rounded upward to whole days. The percentile runs the opposite way from the trough on purpose: production is dangerous when it is low and a dark period is dangerous when it is long, so the tenth percentile of the one is the ninetieth of the other, and a tenth percentile of durations would size the delivery term on the mildest of the three winters. With exactly three winters of history the horizon is therefore the longest of the three per-winter longest runs; with fewer than three, the maximum of what exists applies; and until one full winter is archived the horizon is five days. The determination method, the archived window, theta and the resulting figure in days are published, and the horizon is recomputable by the auditor and the witnesses from the raw series exactly as the trough is, fallback included: where fewer than k_station conforming points exist per technology and region, no aggregate series is published, the suppression notice of I11 stands in its place, and the horizon is verified solely by the signed attestation of the accreditation body and the witnesses. The horizon carries no per-capita divisor and no head count: it is a statement about the weather over the registered sources, so it is not a person-derived series and it does not step when someone is admitted, goes dormant or leaves (I9, I11). It is never shortened on a delivery-term ground, the same mirror this grammar uses elsewhere: m never moves on a publication ground and the uncertainty budget never widens on a privacy ground. A lower bound that the bounded party may redefine is not a lower bound.

• Rationing ladder. On physical shortage despite seniority, a pre-established public rationing ladder takes effect (rationing in kWh), never the mint (I9). The ladder is public as a rule and never as an execution: which entitlements are served, deferred or curtailed is not published, not per person and not per station, and is available to the auditor only.

• Manual admission: no one loses their floor by refusing the identity layer. Every instance MUST offer a manual admission route in which a human assessor establishes uniqueness without publication of any token and without community attestations. Refusing the identity layer, the anchor, the nullifier or the attestation economy is a choice a person may make about their own data, and it MUST NOT cost them their subsistence minimum; a route that exists only for people who accept the technology is not a route.

  What this route decides about the legal basis of the identity layer. Necessity under art. 6(1)(b) GDPR is an objective test: a controller that itself shows the purpose is reachable by a less intrusive means can no longer call the intrusive means necessary for that purpose. By writing down that a human can establish uniqueness with no token published and no attestations, this grammar establishes that the anchor, the nullifier and the attestation economy are not necessary for performance of the member agreement, and they therefore lose art. 6(1)(b) as their basis. What carries them instead is consent, which is genuinely free precisely because this route stands beside it. The consequences are grammar and not commentary. Consent is withdrawable under art. 7(3), so moving to the manual route MUST be possible at any moment, without penalty, without loss of the floor and without a fresh admission procedure; the instance carries its own duty to inform about that choice before enrolment; and tying is forbidden, meaning the technical route MUST NOT buy any advantage in floor, priority, fee or service that the manual route does not have. In phase 0 this does not bite, because the anchor stack is not built there; at federation it bites at once, which is why it is decided here instead of deferred.

  The exclusion circle of I14 applies to the assessor. I14 governs the consultation of an existing record, while manual admission is the act that creates the record, so without this sentence the household, address, five-year-history and former-partner exclusions would not bite on the one person a fleeing applicant meets first. They do apply: an assessor who would be excluded from that applicant's records under I14 MUST NOT assess them, the case routes to a named assessor outside the operation, and an applicant MAY object to a named assessor without giving reasons and without that person being told.

  Refusal, reasons and appeal. A refusal is a decision about a person's subsistence minimum and falls under the art. 22 bullet of §10 in full: prior notification, human assessment with written reasons, a published appeal route with a deadline to a role outside the operation, and suspensive effect, so that a provisional floor runs while the appeal runs. A route with no way to say "you are wrong" is a gate, not a route.

  Bounds on what the assessor may ask. Only what uniqueness needs. The assessor MUST NOT require the document the applicant refused on the technical route, a residential address, a relationship history, or a reason for choosing this route. The minimal substantiation retained is described in advance, is the least the decision can rest on, and carries a maximum retention term under §10.

  The route MUST NOT be legible. That a person was admitted manually MUST NOT be readable as a route marker in the member record, in any exported field, in any status, or in any published distribution. A route change is exactly the datum that betrays that someone is in trouble, and the attestation layer forbids the same legibility for the same reason.

  A ceiling, a ratchet, and a named source for the kWh. "The instance carries the residual sybil risk" means nothing without a mechanism to carry it with, and without one the risk runs through floor draw (I9) and through the per-capita divisor of the Sustainable Ratchet to every participant, hardest to whoever is already on the floor. Three rules carry it. (a) A published ceiling on manual admissions per rolling 12 months, expressed both as a share of active entitlements and as an absolute number so that a small instance is not closed off, raised only through the slow parameter protocol (§14) and never by the decision that would use it. (b) A ratchet on the rate: admissions above a published rate per interval are not refused but enter the ordinary admission queue of this section, so the route never shuts and never opens without bound. (c) A named source for the kWh: a manual admission not yet confirmed by the annual audit does not enter the per-capita divisor of the Sustainable Ratchet, and its floor draw is charged to the instance's own purchase margin and to the buffer (§5, §8), never to a lower floor for everyone else. Where margin and buffer cannot carry it, the instance publishes a coverage blockade (§5) rather than scaling the floor down: the cost of the route falls on the party that decided to offer it.

  Only the number of manual admissions is published, as an aggregate under the thresholds of I11 and on the slow publication cadence of that invariant; nothing about who was admitted this way, or why, is published or disclosed internally beyond the assessor and the audit right of I14.

• One person, one floor. Exactly one Basispuls exists per natural person; that is grammar. In phase 0 (closed cooperative, §12) the membership register enforces this: the instance knows its members. How uniqueness is proven federation-wide and privacy-preservingly lives in Part II (H3) and is a house rule per instance with a declared assurance level. Sybil resistance MUST NOT be bought: stake, deposit or proof-of-work as a floor gate is forbidden, because the Basispuls is unconditional.

• Minors. A Basispuls accrues to every natural person, minors included. The rule is "one person, one floor" and the floor is a subsistence minimum, so age cannot be the line that excludes someone from it; a household with children also has the larger energy need. For minors: uniqueness is established without publication of any token, in a separate, non-shared context; their entitlement is never substantiated with community attestations; the representation relationship follows the guardianship protocol (FEP-633c) and gives the representative no control over the floor itself, only over its practical delivery; at majority the entitlement carries over without a new enrolment and without fresh attestations. The token does not carry over, and the earlier promise that it would is withdrawn as impossible: a nullifier is per context, the minor context is deliberately separate and non-shared, and migration to the adult context requires a fresh live session, which by construction yields a different value. What is guaranteed is continuity of the floor, never continuity of the token; the anchor specification already describes the minors decision this way and this sentence is brought into line with it. Minors count in full in the per-capita divisor of the Sustainable Ratchet below, so the floor is sized on the population it actually serves; the divisor is published rounded or as a band and yearly, exactly as for adults, so a birth or a departure is never readable from it.

• Gift ceiling, bounded against coercion. Ration MAY be transferred for free to other verified identities within a public monthly ceiling (gift, no sale); above it the unused part lapses to the shared pot. The valve makes non-transferability enforceable, but an unbounded valve is an extortion channel for whoever shares the house, so three limits are grammar and not house rules: (a) a per-recipient cap well below the monthly ceiling, so no single recipient can absorb a person's floor; (b) a confirmation delay of at least 24 hours between request and effect, revocable by the giver at any moment within it, with the instance sending the recipient no notice of the revocation; the grammar does not promise that the revocation goes unnoticed, and the withdrawal of exactly that promise a few lines below governs this bullet too, so that the same paragraph does not offer and retract one guarantee; (c) a standing, one-action, permanent block ("no one may receive my ration", or "this identity may never receive my ration") that takes effect immediately and is never disclosed to the blocked party. Transfers from the same giver to the same recipient in three consecutive months raise a safeguarding review, carried out by a human outside the operational staff of the instance. That review is addressed exclusively to the giver and never to the recipient, and it makes contact only once a safe channel for the giver has been established. A channel confirmed in advance does not qualify by itself here: this review fires before any safety flag exists, so the channel it would otherwise use is the household channel of a person who may be under coercion at home, and a review that announces itself at that address is more dangerous than no review. The accredited body or a shelter of the safety route above is therefore the route of first resort (I14). Telling the recipient that a review into possible coercion is running tells the suspected coercer, so tipping off in any form, including by visibly changing a stream, is forbidden and is a grammar break (§15). Review records are kept no longer than 12 months and serve no other purpose. The permanent block is permanent against the blocked party, not against the person who set it: the giver MAY lift it at any time through the same one-action route, again without any notice to the blocked party, so that someone under escalating pressure is never locked out of their own valve. The earlier promise that revoking a pending gift reaches the recipient unnoticed is withdrawn as unachievable: in a shared household the absence of the transfer is itself the message, and the grammar says so rather than pretending otherwise. Gift patterns are never published and are never disclosed to any party except under I14.

• Recoverability. The Basispuls is identity-bound, not key-bound, and MUST be recoverable on re-authentication of the person: a lost device costs no one their floor. The recovery baseline lives in Part II (H4, K1) and MUST be closed before any field test.

• Status expiry and status history. A disputed status expires automatically after a published maximum term and reverts to active, unless a competent authority has ordered otherwise; a dormant status set without a completed human review expires likewise. Status history is never published, never travels between instances, and is never disclosed on a status opening: an opening returns the current status only. A person MAY request a fresh assurance determination at any instance, and the receiving instance MUST NOT condition it on the history of the entry. Without this, a status set by the instance someone fled follows them to the next one, and there is no clean slate for the person who moves.

• No automated extinguishing (art. 22 GDPR). Extinguishing or scaling down a Basispuls on the ground of absent attestations is never a fully automated decision. Before the end of the grace period the person is notified and a human review takes place; during an objection the floor stays active. The grace period is at least 90 days. The status transition to dormant is a proposal to a human reviewer, never an automatic legal effect.

• Luxury Capacity is the transferable coin: born at net storage, shrinking with leakage, dying at redemption.

8. Claims never spiral

• The buffer issues nothing, and absorbs by burning. The claim buffer is a shock absorber funded from existing tax claims, with a fixed public target level. Buffer holdings count in M (ordinary backed claims held by the system), so the published B already includes them: no hidden cushion. After an unexpected reserve loss the instance burns buffer claims to restore B. The buffer MUST NOT issue new claims and MUST NOT be spent as income; when full, tax flows straight to the floor.
• Reserve ceiling. See I2: no mechanism (buffer, tax, credit) creates claims without measured backing.
• No fractional credit. Lending MUST move existing claims from a willing holder; an instance MUST NOT create claims through lending.
• Dependency ceiling. See I13; it applies to suppliers, storage and funding counterparties of the reserve alike (§13). Above the ceiling, extra concentration is simply not purchased for the floor (the luxury market may still use it). The concentration meter is public as an anonymised series, quantised like every other person-derived series (I11), and no rule is evaluated on that published series: the ceiling of I13, the progressive levy of §9 and the escape hatch of I11 all run on the booked meter signed to the auditor and the witnesses, and what the public sees of a rule standing on it is the outcome and the action, never the share the rule ran on.

9. Tax

• Base. A flat transaction fee on luxury trade, plus a progressive levy on large holdings above the concentration threshold. Holdings above the threshold are recorded in a register that is not generally public. For natural persons the concentration meter publishes anonymised shares only, quantised under I11 to a quantum larger than the largest single contribution, which on a series of shares is the largest share itself. The levy is assessed on the booked meter and never on that published series (I11, limit two): the published series carries the outcome, never the assessment basis, and a levy computed on a coarsened share is not a levy. The identity behind a share is disclosed solely to a requester who states and substantiates a legitimate interest. That interest is weighed by a role outside the operation of the instance, never by the staff who hold the register, and the weighing has an explicit ground of refusal: the request is refused where the interest is insufficient, where it is disproportionate to the position held, or where it appears aimed at locating a person rather than at scrutinising power. The holder is heard in advance, unless a lawful order prevents it, and is notified of every disclosure. Where a safety flag stands, the route is closed outright: no disclosure is made about a flagged person, on any interest. The refusal has a fixed, ground-independent form. Every refusal is communicated in one published wording that states no ground, so that "the route is closed because a flag stands" is indistinguishable from "the interest is insufficient" and from "the request is disproportionate". Without that, the disclosure desk is an oracle that answers on request whether a person carries a safety flag, which is the same defect I11 removed with the content-independent suppression notice and §7 removed with the decoy. The ground is recorded internally and put to the role outside the operation; it never reaches the requester. Every disclosure and every refusal is logged under I14 and counted in the public counters of I11, so that the regime cannot quietly become the escrow it replaced. Legal persons are named publicly. The threshold is expressed both as a share and as an absolute kWh figure, and both MUST be exceeded, so that no natural person is exposed merely because the instance is small. No public notice period is published for a natural person leaving: outflow risk is published only as a quarterly aggregate, never as an identifiable departure with a date. This is the CJEU C-37/20 line applied to a citizen with batteries, and it replaces the earlier 'already-public' framing.
• Anti-straw-man. Identities demonstrably trading for the account of a third party MAY be aggregated for the levy, but only on the basis of the holdings register below and of facts established in a procedure with the person heard in advance, before a court or an independent dispute body. The instance MUST NOT run relationship or pattern analysis over the transaction graph for this purpose, and MUST NOT retain transaction data for it beyond settlement plus any statutory term (§10, art. 22 bullet). Straw-man routing remains an honestly named residual weakness of any pseudonymous levy: that is accepted rather than chased with profiling.
• Routing. Tax flows first to the claim buffer (§8), then to the shared pot and the floor.
• No per-identity tax aggregates. Under the flat fee no monthly spending total per person is needed, so the instance MUST NOT compute or retain a per-identity spending total: the fee is settled per transaction and nothing beyond that settlement is kept. The dataset that earlier versions bounded with a purpose limitation is now simply abolished, which is the stronger minimisation.

10. Audit, verification and privacy

• Openness. See I11. Per-interval commitments MUST be published as signed tree heads; client software MUST verify inclusion proofs for its own mutations and consistency proofs between consecutive roots; roots MUST be co-signed each interval by at least three independent external witnesses (no monetary counterparties; absent federation peers, named third parties such as a transparency log, an archival institution and a newspaper). This applies from day one of any pilot, not only at federation. Code MUST be open and signed.
• Verifiable, and by whom. The auditor of §11, the external witnesses of §10 and any independent verifier under a confidentiality agreement MUST be able to recompute B and verify the commitment chain, from the published series together with the terms signed to them each interval: M, R_book and the booked delivery queue D (I11). Below roughly 1000 participants that is the whole of it: no member can recompute the books from public data, because the series that would allow it are exactly the series that identify people at this scale, and because the publication set deliberately holds one degree of freedom fewer than the identity needs (§2, I11, I12). Those verifiers also carry the closing control of §11, named in its own right: that the published B was computed on the booked values and that the published D is not lower than the booked D. This is the accepted price of the publication unit, stated here rather than written away. An independent audit tool operated by those verifiers remains the credibility keystone, and the promise of universal recomputability returns only when a scheme like H9 actually runs.
• Privacy. See I12. In phase 0 the membership register is the only linking point and no additional linking facility may be built; a lawful order of the competent authority compels disclosure of what the instance holds, and every disclosure produces the public counter and the private inclusion proof of I12. Where an escrow exists at all (federation phase only), silent decryption is technically impossible for any coalition below the quorum m, while at or above the quorum the transcript is enforced procedurally, and that residual trust is stated in the privacy notice.
• GDPR. The shared nullifier set (H3) contains pseudonymised personal data without direct identifiers; the phrase "no personal data" is incorrect and is not used. A completed DPIA under art. 35 GDPR is an admission requirement per instance. The public ledger contains no direct identifiers and no per-account entries in any form (I12); a member verifies their own mutations through the private inclusion proof, not through a public entry. It does not follow that the published series are outside the GDPR: at this scale a k-thresholded series over a known population is pseudonymised personal data until a written re-identification assessment concludes otherwise for that specific series. Anonymity is therefore a conclusion per series and never a blanket claim: each published series carries a named legal basis, a retention term, and its place in the DPIA and, where applicable, in the art. 36 consultation. Where the assessment cannot conclude anonymity, the series is either suppressed or published under that basis with those safeguards. Personal data (identity binding, contact details) lives off-ledger, encrypted and erasable; an erasure request does not touch the on-ledger commitments.
• Retention limits and data minimisation (grammar, not house rule). Retention is a principle under art. 5(1)(e) and is not delegable to a house rule, so maxima are grammar and only the choice below each maximum is free. Metering data per connection at a resolution finer than one calendar day: at most 90 days, thereafter only as a daily or coarser series. Per-identity Basispuls delivery records: at most 90 days after the reconciliation of I9. Transaction records: at most 24 months traceable to an account, after which they are irreversibly aggregated, unless a statutory retention duty prescribes longer and then only for that purpose. Attestations: destroyed when their validity expires. Membership register: at most 24 months after the end of membership, save where a statutory retention duty prescribes longer and then only for that purpose. This is the category I12 names as the principal linking point in phase 0, so leaving it as the only one without a maximum would put no bound at all on the most sensitive dataset in the instance. The datasets the privacy rebuild itself created carry maxima too. I14 obliges each of them to have a retention term, and a term without a maximum is a house rule, which the first sentence of this bullet has just said retention is not. Internal access log (I14): kept in identifying form only as long as the audit object of §11 requires and at most 24 months, after which it is irreversibly aggregated into the counters of I11 and the identifying part is destroyed. This is the most sensitive of the six: held without a bound, a who-looked-at-whom series in a village becomes precisely the honeypot I14 was written against. Exclusion list and allow-list (I14): for as long as the membership or the safety flag they serve stands, and at most 12 months thereafter. Household and family graph (I14): the derived exclusion flags only and never the underlying history, at most 60 months measured from the ground each flag rests on (the five-year window the exclusion rule needs), and destroyed within 30 days of the end of membership. Safety flag (§7): while it stands, and at most 12 months after the person or the safeguarding body revokes it, so that someone who returns is not made to prove their case from scratch while a lapsed flag does not linger as a marker. Disclosure log of §9: at most 24 months, after which only the public counters of I11 remain. Gift and safeguarding review records (§7): at most 12 months, as that section already states. Exceeding any of these is a grammar break (§15), on a par with a broken meter promise. The settlement interval length is a §14 parameter with a published minimum, because it is the knob that decides whether a published series is an aggregate or a household load curve.
• No automated decision with significant effects (art. 22). This applies to every decision touching a person's access to the Basispuls, their payout destination or their fiscal position, including at least: the transition to dormant, placement in the rationing ladder, freezing on a disputed nullifier, and aggregation under the anti-straw-man rule. In all of these: prior notification, human assessment with reasons, suspensive effect of an objection, and at least 90 days of grace where the floor is concerned. For the rationing ladder, where suspensive effect would be physically meaningless, an immediate human escalation route with a hard response deadline applies instead. Aggregation under the anti-straw-man rule follows only from a procedure in which the person is heard in advance and the instance states its grounds in writing; it never follows from automated graph analysis (§9).
• Rights of data subjects (grammar). The instance publishes a procedure with deadlines for arts. 15, 16, 17, 18, 20 and 21 GDPR. Rectification on the ledger happens through a signed correcting entry referring to the original; the original is never rewritten. For each data category the instance publishes whether erasure is possible and with what consequence, and where erasure of the enrolment record demonstrably ends the recovery route, that consequence is communicated in advance and confirmed separately by the person. Two categories are named here because they are the ones a member is most likely to be told do not exist: a member's own internal access log (I14) and a member's own listing on an exclusion list, an allow-list or the holdings register of §9 are personal data of that member and fall under art. 15. They are provided on request, and the weighing of art. 15(4) and recital 63 is applied only to the part that would disclose another person's rights and freedoms, never as a blanket refusal (I14). These rights are enforceable through the member agreement, and H1 tests them at federation and at secession rather than treating them as an annex matter.
• Special categories (art. 9). Consumption and delivery data per person are inferable to health and religion (dialysis, oxygen concentrators, nocturnal restlessness, fixed fasting or observance patterns) and are therefore treated as art. 9 risk data. The instance MUST NOT retain a time resolution finer than one calendar day per identity; the per-interval reconciliation of I9 runs over the metered sum, over encrypted partial sums with an aggregate proof, or otherwise over daily totals. Inferring, profiling or segmenting on consumption pattern is forbidden and is a grammar break (§15).
• Minimal tax disclosure. For the flat fee the instance needs to know only the amount due per transaction, no counterparties or contents, and no per-identity total (§9). The large-holdings levy rests on the instance's own administration and on the anonymised concentration meter, never on public naming of natural persons (§8). Purpose binding and destruction: §9.

11. Enforcement

• Attestation. Reserve and coin circulation are attested at least quarterly by an auditor independent of the issuer; the attestation is public and so is the auditor's identity.
• The closing control on B, on f and on the caps, named in its own right. Each interval the auditor and the witnesses attest, and each quarter the auditor confirms publicly, that the published B was computed on the booked R, D and M and on no published, rounded or quantised value whatever, that every settlement in a record-date window was priced on the exact decided f and not on the published m / 5-quantised quota, that the pro-forma rate applied was (R_book - D) / (M + f x base) on the one base of I2, and that the caps of I2 were read on that same base (I1, I2, I6, §6, I11). The cap test is on this list because it is not publicly recomputable: it stands on a level of M, which the publication set no longer carries, so what a reader gets is f and what carries the caps is this attestation. This item MUST be stated by name and MUST NOT be carried inside a general statement of conformity. It exists because the display split of §4 and the queue cadence of §6 both create a value that looks like the real one, and an instance that quietly recomputes B on a display value produces exactly the same published number as an honest one. Nothing else in this grammar can see that substitution from the outside.
• Role separation. Management and audit of the meter are institutionally separated from the issuance power; no one holds two of the three roles mint, meter management and audit.
• Data conduct: a proportional ladder. Monetary breaches have a sanction ladder and data breaches had none, which left the strongest new invariant without consequences. On an established breach of I12, of I14 or of the recruitment bar of §7, proportionate to gravity and repetition: (a) an internal finding, publication of the aggregate fact, and notification of every affected member; (b) withdrawal of the standing query access of the persons involved and a review of the role allocation; (c) permanent loss of every role touching member-identifying data, alongside any statutory liability; (d) suspension of admissions and of federation settlement until an external assessment is complete. Publishing a person-identifying series, reading a record without a log entry, tipping off a person under a safeguarding review, recruiting or enrolling a person at a confidential address before the two conditions of §7 hold, and profiling on consumption pattern are named acts under §15 rather than operational lapses. For the recruitment bar the ladder starts at (d) rather than at (a): admissions are suspended at once, because every further enrolment enlarges exactly the harm, and the enrolled person is offered the connectionless delivery of §7 or an exit without penalty.
• Sanctions on established covert over-issuance: (a) immediate recomputation and publication of the true B; (b) suspension of federation settlement until an external audit completes; (c) joint and several liability of the decision-makers toward every holder for the dilution loss, without prejudice to criminal complaint; (d) permanent loss of every role in issuance, meter management and audit; (e) the recovery-path regime of §6.1 takes effect mandatorily.

12. Legal form and scope

• The issuer MUST be a cooperative legal entity. Decisions on flagged issuance are taken by the statutorily designated body under §14.
• Coins are issued solely to members who have contractually accepted CBER-1 in advance, including the floating-claim definition (§1) and the emergency dilution rules (§6.1).
• Coins come into existence solely against physically delivered and measured kWh or through flagged issuance. The issuer sells no coins for currency and never redeems into currency: strictly kWh-in/kWh-out.
• On dissolution or insolvency the reserve is distributed by statute pro rata per outstanding coin; every coin claim is statutorily limited to that share.
• Custodian foundation. The physical reserve MUST be held by a separate custodian foundation for the joint holders, with segregated assets or a pre-established right of pledge on the storage installations or the claims to them. On insolvency of the instance the reserve falls outside the estate and is paid out pro rata at the meter rate. The foundation is established and the title or pledge is vested before the first issuance in any field test.
• Member-identifying data is never part of the estate. On dissolution, secession or insolvency, personal data is destroyed within a published term, or transferred exclusively to a successor bound by an identical, published data regime including I14. Sale, pledge and inclusion in a bankruptcy estate of member-identifying data are excluded in the statutes of both the cooperative and the custodian foundation, and the member agreement states this in plain language. On secession the departing group receives no member-identifying data about the members who stay, and the staying instance receives none about those who leave: only aggregate settlement data crosses (H2). The insolvency and secession scenarios are a mandatory part of the DPIA.
• MiCAR position. A written, reasoned MiCAR position is part of the admission requirements (primary: the ledger is not DLT or similar technology, since a single administrator keeps it and witnesses co-sign commitments only; subsidiary: qualification as an asset-referenced token under the small-issuer route of art. 16(2) MiCAR with its whitepaper and notification duties). The position is adopted in writing before the first issuance in any field test; the substantive analysis lives in the legal annex.
• Euro firewall. No euro payment from or to a member (contribution, subsidy, reimbursement) is directly or indirectly linked to the acquisition or redemption of coins; both money flows are kept strictly separate administratively, and the separation is an audit object.
• Phase 0 is strictly closed: members only, no acceptance by non-members, no federation settlement with non-members, redemption in kind only (delivered kWh to the member itself, no euro payout). Any step beyond this requires prior written guidance from the financial regulators (in the Netherlands: DNB/AFM) or a changed statutory basis. A legal annex with the full qualification analysis (EMD2, PSD2, MiCAR, AML, national financial law) per phase is in preparation (H8).

13. Operating sustainability and honest weaknesses

• Operating costs (battery rent, audits, infrastructure) MUST be met from real revenue: the tax, the purchase margin and, during phase 0, public funding; never from unbacked mint (I2, I9).
• The honest failure mode, stated openly: if revenue durably falls below cost, operators withdraw storage, R falls, B falls, all visible on the meter. The grammar does not promise the operating model always closes; it promises the failure is slow and public, never silent and sudden.
• No credit, exogenous funding. CBER deliberately has no credit; all capacity expansion is financed externally, in euros. That dependency is stated here explicitly, and the dependency ceiling (I13) therefore also applies to funding counterparties of the reserve.
• Acknowledged incentive tension. The recovery fraction taxes exactly the behaviour (delivering) that closes the gap; waiting, or delivering elsewhere, can be rational. The 0.8/0.2 parameters are re-weighed at the first evaluation against this stress test.

14. Governance and grammar versioning

• Parameter protocol. House-rule parameters (non-exhaustive: tax rate, tolerance schedule, floor height, buffer target, ceiling shares, leakage-N, the leakage budget, the delivery-term maximum, eta_charge_ref/eta_discharge_ref, the uncertainty budget and the settlement interval length (with a published minimum, §10); every parameter the Core designates as §14-bound falls under this protocol) MUST change only through a slow, public, signed process with a cool-off period and automatic sunset, and MUST NOT push the instance across a grammar invariant.
• Two grounds that are never valid. Privacy is never a valid ground for widening the uncertainty budget: the metrological justifications named in I1 (added or changed hardware, new calibration data) are exhaustive, so slack measurement is not a compliance credit and a published quantum is never accepted in place of a measurement the instance is able to make (§4, I11). A widening never re-derives the display quantum upward either: q_R carries its own ratchet under §4, so a widening buys a lower R and a lower B and never a coarser public reserve, which is the route by which a privacy gain could otherwise be bought on a metrological ground. Its mirror: the hysteresis margin m is never changed on a publication ground (§6, I11). m sets the label, the return condition and, through m / 5, the upper bound on the coarseness of every quota and the threshold of the escape hatch, so an instance that could move m to widen what it may publish would be setting its own privacy budget and its own solvency threshold with one parameter.
• Emergency mandate. Quantity caps, cooldown and role separation: I2, §6.1, §11. The crisis playbook (§6) must be pre-established and public.
• Release signing. Code MUST be built reproducibly and signed by a published quorum of m-of-n distinct keyholders, at least one external to management. Nodes MUST refuse unsigned or under-quorum releases.
• Grammar is versioned; self-amendment is by exit, not decree. Each instance advertises its grammar version. Federation requires compatible core invariants (I1 through I14), even where house rules differ. Changing a core invariant is a new major version; those who disagree leave (secession, H2). There is no central authority over the grammar.

15. Fraud (narrow, on purpose)

Fraud in the monetary sense is exactly this and no more: lying about measurement (falsified sealed-meter data), covert over-issuance (creating claims without measured backing or without the atomic flag, I2/I3, including exceeding the quantity caps), and theft from the reserve. Operating openly under-backed is not fraud (§6). Data conduct is judged separately and on its own ladder (§11): publishing a datum traceable to a natural person, reading a member record without a log entry, tipping off a person under a safeguarding review, exceeding a retention maximum, recruiting or enrolling a person whose safety depends on the safety route of §7 before that route demonstrably runs, and profiling on consumption pattern are grammar breaks in their own right, not lesser cousins of the monetary ones. The instance measures and publishes; external eyes (auditor, witnesses, peers) verify; justice punishes (§11).

The annexes that follow are commentary and test material; only §1 through §15 bind.

Annex A: Threats and how the grammar answers them (non-binding)

Attack or failure	Answer
Silent money printing by the bank	I2 ceiling plus I3 atomic flag; public B; enforcement §11
Salami issuance, serial emergency mandates	Quantity caps (I2), emergency-mandate cooldown, declarer is not the spender (§6.1)
Front-running an announced issuance	Record date: redemption at pro-forma B from the decision onward (I6)
Measurement-window run (redeeming at stale B, stale-NAV)	Forward pricing against the next audited interval (I5)
Round-trip loss mints more claims than deliverable	Mint = AC intake x min(rolling eta_rt, P25 of 12 monthly values, temperature-resolved reference product of the same interval) (§5)
SoH ageing shows backing that no longer physically exists	Audited ceiling SoH x nameplate x DoD x derate, annual condition-bound capacity test, quarterly string rotation, 72-hour write-out (I7, §4)
Book R above physical content (SoC drift or manipulation)	R = min(E_content, audited ceiling); monthly calibration anchors; 12-month windowed, stock-scaled signed re-anchor cap with automatic label; three strikes after temperature correction (I1, I7, §4)
Seasonal bias of the content update rule fires false alarms and labels	Temperature-resolved reference pair as the single update rule (zero-mean anchor residuals); rolling eta_rt stays the cross-check (§4, I1)
Full store keeps minting against curtailed intake (unflagged overhang)	Mint follows the recognised R increase; intake above the ceiling never mints; refused or curtailed intake published as its own meter line (§5, I7)
Capacity test gamed via conditions (warm, slow, widened DoD window)	Condition-bound protocol: sealed AC boundary, rated power, P10 winter temperature or audited derate; DoD window only via the slow protocol (§4)
Operator hides own consumption or theft in the leakage residual	Per-site leakage budget under §14 (widening only via the slow protocol with accredited measurement), audit alarm above budget, 1.5x anomaly bound against rolling average and commissioning budget; above-budget portion parked and never levied until audit attribution (I8)
Meter operator prints inside the tolerance	Running signed unexplained sum signed to auditor and witnesses every interval, published on the thresholded cadence of I11, and, when positive, deducted in full from R_book: tolerated drift never backs a coin and the deduction stays visible through B, which carries no blur; the deduction falls under the derivability rule of I11 and the composed publication error required there, so suppression does not merely move the channel into R; re-anchor deviations in their own stock-scaled delta class (I1)
Delivery queue inflates B between settlement and delivery	The one B = (R - D) / M everywhere, incl. meter rate, pro-forma, I2 test and headroom; flow balance reconciles against E_content + D; delivery default beyond T sets under-backed regardless of B (§6, §1)
Fake generation, phantom kWh at the edge	Registered sources plus hierarchical independent reconciliation (§4)
Wash cycling to farm mint	Net injection per connection earns mint, not gross throughput (§4, §5)
Widening tolerance to hide issuance	Lower-bound valuation makes looser only look worse (§4)
Bank run	Redemption at the meter rate (I4): first == last; forward pricing closes the information window (I5); P_g and the delivery queue published live, D deducted from B (§6). Full power-coverage invariant: H8
Basispuls becomes a printing press at B < 1	Seniority on the physical reserve; floor draw as its own live meter category capped by the floor size; rationing ladder; never from mint (I9)
Genesis or "young economy" window stays open	One-off capped genesis item; ground lapses definitively once B first reaches 1 (§6.1)
Fresh issuance decision hides behind the label	Hysteresis applies to physical fluctuations only; issuance switches immediately (§6)
Bank shows two ledgers	Signed tree heads, inclusion and consistency proofs, three external witnesses from day one (§10)
Straw-man tax evasion (smurfing, wallet splitting)	Flat fee plus levy on large holdings recorded in a register that is not generally public; anonymised shares for natural persons, legal persons named, both thresholds must be exceeded; aggregation rule via the courts, on a contradictory procedure and never by automated graph analysis (§9, §10)
One holder captures the guarantee	I13 dependency ceiling, funding sources included; concentration meter
Sybil draws multiple floors (incl. across federation)	One person, one floor (§7); shared nullifier set (H3); anchor is a house rule with declared assurance level
Chip-data cloning, enrolment front-running, floor hijack	Live chip session (CA/AA) mandatory at enrolment and recovery; see FEP-5fcf
Lost keys wipe out savings	Basispuls identity-bound and recoverable (§7, H4); Luxe via standard protections
Forgotten secret creates a second identity	Seed regenerates from the stable anchor; same nullifier (H3)
Nullifier grinding ("is this X?")	Threshold OPRF, blind evaluation, rate limits; residual risk honestly stated in FEP-5fcf (H3)
Targeted membership test on the public nullifier set	Evaluation requires the same live-session derivation proof as enrolment; see FEP-5fcf (H3)
Buying or coercing a floor slot	Liveness and residency attestations (H3); the payout no longer runs to a third party, so a bought slot pays to the holder's own energy bill and the coercion route through the destination is closed (§7). Attestation as a gate is itself under review (council 8, A6, not in this version)
Corrupt document issuer	Assurance downgrade and floor-context suspension in coupling contracts (H3)
Decoy betrays itself: an unchanged view plus a known departure identifies the safety route	Decoy bounded to the status and enrolment layer with the reason stated, never against a demanding authority, accuracy yielded openly under art. 6(1)(d) and art. 5(1)(d), loss from the decoy falls on the instance (§7)
A protection is recognisable by its engaging: a series vanishes, a counter turns one, a refusal names its ground	No safety flag ever changes the publication policy of a series; publish-or-suppress decided on a slow announced cadence and sticky once suppressed; the §9 refusal has a fixed ground-independent form; the third-form counter carries the I11 clause (I11, §7, §9)
Recruiting a person at a confidential address into a route that does not exist	Binding recruitment bar in §7 with both conditions published (contracted attester reachable per region, connectionless delivery exercised), named act in §11 and §15 with the ladder starting at suspension of admissions
Accountability counters silenced by the very threshold that protects persons	Counts about the instance's own conduct follow the canary and are published in fixed bands including zero; counts about events at persons stay suppressed, zero included; the price for a single-holder role is stated (I11, I12)
Sybil floor bought through the manual route lands on everyone else	Published ceiling per rolling 12 months, rate ratchet into the ordinary queue, unconfirmed manual admissions kept out of the per-capita divisor and their floor draw charged to margin and buffer, coverage blockade rather than a lower floor (§7, §5, §8)
The assessor at the counter is the wrong person for someone fleeing	The I14 exclusion circle applies to the assessor who creates the record, the case routes to a named assessor outside the operation, and the applicant may object without giving reasons (§7, I14)
I14 exclusion expires exactly when the subject moves out	Exclusion runs on history (five years of shared household or address, first-degree ties, former partners), and a standing safety flag inverts the circle into a named allow-list (I14)
Access regime becomes the escrow it replaced, with the instance judging itself	Weighing by a role outside the operation, explicit ground of refusal, holder heard in advance, route closed entirely for a flagged person, requests and refusals counted publicly (§9, I11)
Refusing the identity layer costs the subsistence minimum	Manual admission as grammar: a human establishes uniqueness with no token published and no community attestations, switching to it possible at any time without penalty (art. 7(3)), no tying, refusal appealable with suspensive effect, only the count published (§7)
Person fleeing has no floor on day zero	Third delivery form without a connection (counter card, prepaid, address-free account) within 24 hours of a safety flag, no attestations, sole control rather than mere address-freeness, no revealing payment description, one handover route that is not the instance in the village (§7)
I14 notification forces tipping off under a secrecy order	Deferral clause taken verbatim from I12, automatic release on expiry (I14)
The confirmed channel is the abuser's channel on the day of flight	Setting a flag suspends all notification until a fresh channel is confirmed by the person or by the body acting for them, the accredited body may be that channel, held notices delivered in full afterwards; the §7 safeguarding review makes no contact before a safe channel exists (I14, §7)
Suppression notice becomes a series about the smallest cohort	Fixed content-independent notice, no count, unchanged when the count changes, zero suppressed like any other value (I11)
Derived quantity defeats its own threshold (D from R, B and M)	The publication set has three degrees of freedom, so at most one of M and D is a public per-interval series and the level of M is not published at all; publication error rather than measurement uncertainty, which is common mode and contributes nothing; R public only as R_display while every rule computes on R_book; escape hatch on the largest holding share at m/5 (I11, §4, §6)
Observer averages a quantised series across publications until the step reappears	The condition holds over the whole enumerated set of derived series and the whole horizon, not per publication; no cumulative total of a protected quantity; sticky quantisation with hysteresis is a presentation form and never a defence; the noise budget has a published horizon and can run out, after which the series stops (I11)
Redeem early to swap a leakage-bearing coin for a leakage-free senior claim	Pari passu: a physical loss between settlement and delivery writes the queue down by the same factor as the coin, B stays exactly invariant, and the queue is no longer exempt from the I8 levy, so early redemption stops being weakly dominant (I4, I8, I9)
B quietly recomputed on the display value once a display split exists	The closing control is attested per interval and confirmed publicly per quarter as an item named in its own right, never inside a general statement: published B computed on booked R, D and M, and published D at or above booked D (I1, §11)
Escape-hatch trigger steered by the instance's own dispatch	The test runs over the largest anonymised holding share on the concentration meter, never over realised settlements, and a ceiling on the single settlement per identity per interval is forbidden outright under forward pricing (I11, I5)
Insider looks up a neighbour in the membership or metering records	I14: authenticated to a named person, tamper-evident access log, disclosed to the member within an interval; household, address and first-degree relatives technically excluded; bulk export needs two people and is published as an event
Operator holds ledger and membership register in one hand	Data role separation on a par with the monetary one (I14, §11)
Data outliving its purpose, or a per-identity spending profile accumulating	Retention maxima as grammar (90 days sub-daily metering and delivery records, 24 months traceable transactions and membership register, attestations at expiry) and the same for the datasets I14 created: access log 24 months then aggregated, exclusion and allow lists 12 months after they lapse, household graph 60 months and destroyed 30 days after membership ends, safety flag 12 months after revocation, §9 disclosure log 24 months; per-identity tax aggregates abolished (§10, §9)
The access log itself becomes the who-looked-at-whom honeypot	Maximum of 24 months in identifying form, then irreversible aggregation into the counters of I11, with the audit object of §11 as the only ground to hold it that long (§10, I14)
Coerced monthly gift of a housemate's ration	Per-recipient cap, 24-hour revocable delay, one-action permanent block never disclosed to the blocked party, safeguarding review after three consecutive months, gift patterns never published (§7)
Abuser uses the public destination change as a flight alarm	Safety route: immediate redirection, no announcement or waiting period, authorised status openings and the enrolment record keep returning the previous destination and status (there is no public view per person, I12), opening attempts logged and disclosed under the suspended-notification rule (§7, I14, acknowledged I11 exception)
Delivery default names the one member whose call was not met	The count is not published in any form and goes to the auditor, the witnesses and the data protection officer; only the label consequence is public, applied at the next scheduled evaluation point and standing for a full window; the residual bit at B >= 1 is named rather than denied (§6, I11, I12)
Naming a citizen with batteries in a public wealth register	Non-public holdings register, anonymised shares only for natural persons, identity on substantiated legitimate interest with logged access and notice, dual relative and absolute threshold, no public departure date (§9, C-37/20)
A status set by the instance someone fled follows them	Disputed and unreviewed dormant expire automatically; status history never published, never transferred, never returned on a status opening (§7)
Member data sold or crossing a border in a bankruptcy or secession	Member-identifying data never part of the estate; destruction or transfer only under an identical published regime including I14; only aggregates cross on secession (§12)
Peer instance pulls raw ledger or meter feeds across the boundary	Mutual audit over signed aggregates, tree heads and attestations plus sampled redacted verification; no connection, account or identity level data crosses in any form; art. 26 and art. 46 instruments; access lapses on decoupling (H1)
Automated dormant, ration placement or straw-man aggregation	Art. 22 bullet: prior notification, human assessment with reasons, suspensive objection, 90 days grace for the floor, escalation route for the ladder; no automated graph analysis (§10, §9)
Re-identification from published aggregates at village scale	Nothing published per account in any form; k thresholds (5 stations, 20 identities) with an explicit suppression notice; grain never finer than the published window (I11, I12)
Differencing on the floor-draw sum against the entitlement count	Floor draw as a rolling aggregate where no entitlement contributes more than 1/k; monthly total only below k; divisor rounded to tens or published as a band, yearly (I9, §7)
Matching a production series to an address	Metering-point register not public; trough recomputable from signed aggregates per technology and region plus accreditation and witness attestation; topology (b) never published individually (§7, A3 trade)
Floor status leaking through the payment stream to a landlord	No destination binding: payment as an energy-cost guarantee on the member's own bill, outside ledger and provider; bundled and unchanged until the end of the objection period if it ever returns (§7)
Queue position or ration placement exposing an individual	Queue published only as aggregate depth, on a cadence no faster than one publication per delivery term T, rounded upward to a quantum of at least sqrt(6) times the largest single entitlement, suppressed under k_identity, with no second series for the waiting time; ladder public as rule, never as execution (§6, §7)
Consumption pattern inferring health or religion	Per-identity delivery data at most daily, deleted within 90 days, reconciliation only; profiling or segmenting on consumption pattern is a grammar break (I9, §10, §15)
Surveillance via the open ledger	System levels only, account levels never; no pre-built linking facility in phase 0; disclosure only on a lawful order of the competent authority, with a public counter and a private inclusion proof to the subject (I12)
GDPR erasure versus immutable ledger	No direct personal data on-ledger; off-ledger erasable; DPIA mandatory (§10)
Exporting dilution in the audit window	Settling at the minimum of audited and live B including decided issuances (H1)
Replay of a settlement message	Signed, nonced, idempotent settlement (H1)
Secession drains the remainder's backing	Conservation: claims and reserve share leave together, both B unchanged (H2)
Faking a better exchange rate	Rate = audited B under mutual audit; lying triggers decoupling (H1)
Operating model runs dry	Real revenue only; failure slow and public (§13); costed assurance budget with its own coverage blockade (H6)
Change in the regulatory wedge (taxes and levies) collapses the business case	Named honestly: quarterly p-publication with explicit valuation basis; coverage blockade instead of minting (§5, §13)
Hostile grammar fork	Federation requires compatible core invariants; incompatible simply does not couple (§14)
Seasonal breathing flaps the label	Hysteresis (§6); floor sized to the P10 winter trough (§7)
Under-backed label becomes permanent because minting against over-backing eats every recovery	Every mint against over-backing suspended while under-backed, so the return condition is no longer pinned shut by the instance's own minting; resumption by whichever route set the label (§5, §6)
Return unreachable through the purchase price or the floor stream rather than through minting	Steady-state attainable B published every interval during a suspension; p MUST fall or the recovery path be revised where it lies below 1 + m; target and recovery paths end at or above 1 + m (§5, §6.1)
Index manipulation (Reference kWh)	Algorithmic index, archived inputs, slow parameter path (§6.2)
Buffer as a slush fund	Buffer counts in M, absorbs only by burning, never income (§8)
Rogue maintainer ships a backdoor	Reproducible builds plus m-of-n release quorum incl. external signer (§14)

Annex B: Worked examples (test vectors, non-binding)

The vectors exist in machine-readable form (test-vectors.json) with a minimal reference engine (audit_cli.py). Every vector in test-vectors.json passes; the authoritative count and result are whatever python3 audit_cli.py prints on its last lines, never a number written out here. The specification is thereby not only readable but runnable.

Two kinds of vector, and the difference matters. Each heading below carries a mark, and the engine prints the same mark per vector and tallies both at the end of a run.

• (computing): the vector supplies inputs only, and the engine derives the asserted figure by arithmetic on ledger state: R, M, D, B, a settlement rate, a write-down factor, a rounded quantum, a mean over a series. Such a vector can falsify the arithmetic.
• (declarative): the vector supplies the fact under test as an argument, such as a label, a contributor count, a ground string or a holding share, and the engine routes it to the right alarm. Such a vector proves that a rule is wired, not that the arithmetic holds.

The distinction is written here because a previous version presented both in one undifferentiated list under the claim that the whole set is executable proof of internal consistency. For the monetary invariants that claim held; for part of the publication layer it did not, and a vector that receives its own conclusion as an argument is not proof of anything. Counting green ticks is not counting proofs, and the mark is what keeps the two apart.

TV1: Mint with round-trip efficiency and purchase margin (computing)

Start R = 0, M = 0, eta_rt = 0.88. AC intake 10 kWh at p = 0.8. → Reserve rises by 10 x 0.88 = 8.8 kWh; the supplier receives 8.8 x 0.8 = 7.04 coins. Headroom is capped at the return threshold: H = 8.8 / 1.02 - 7.04 = 1.5875; the instance mints that amount fully backed for operations → R = 8.8, M = 8.6275, B = 1.02. Minting never pushes B below 1 + m, so the instance never sits on the switching edge.

TV2: Redemption keeps B constant (under-backed) (computing)

Start M = 11 000 000, R = 10 000 000 → B = 0.9091 (under-backed, shown). A holder redeems 1 000 coins → entitled to 909.1 kWh, 1 000 burned. → M = 10 999 000, R = 9 999 090.9, B = 0.9091. Unchanged: standing first in line gains nothing (I4).

TV3: Secession conserves backing (Horizon, H2) (computing)

Instance R = 1000, M = 1000, B = 1. A district holding 200 coins leaves. → Departing: R = 200, M = 200, B = 1. Remaining: R = 800, M = 800, B = 1. Both unchanged.

TV4: Leakage mirrors physical loss (computing)

Luxury balance 1000; measured storage loss this interval 0.4% (quarterly rate fixed in advance, I8). → Balance 996; the reserve fell in step, B holds. Basispuls untouched.

TV5: Covert over-issuance is caught (computing)

The bank mints 1 000 000 claims with no ΔR and no flag. M rises, R does not → B drops below 1, the label shows under-backed the same interval, and under I3 the mint is protocol-invalid. The event has no meter delta, so I1 alarms too.

TV6: Phantom injection is caught (computing)

An edge meter reports +500 kWh that did not physically occur. The independent parent meter shows no matching delta → the layer sum fails to reconcile within tolerance → I1 alarm; the mint is withheld.

TV7: Amnesia does not fork a person (Horizon, H3) (computing)

Re-scanning a (renewed) document re-derives the same seed → same nullifier → existing enrolment found → floor intact, no second entry.

TV8: Hysteresis keeps a winter dip from flapping the label (computing)

Window 30 intervals, margin 0.02. B dips to 0.98 for 12 intervals and recovers. → The label stays fully backed (dip shorter than the window); every redemption during the dip still pays the instantaneous meter rate. A dip of 30+ intervals would have switched the label; back only after 30 intervals of B >= 1.02.

TV9: Capacity test re-anchors the ceiling; R = min(content, audited ceiling) (computing)

Book content R = 900, M = 850. The annual audited, condition-bound test measures nameplate 1000, SoH 0.92, usable DoD window 0.9. → New ceiling 1000 x 0.92 x 0.9 = 828; R = min(900, 828) = 828, B = 0.974: the silent ageing becomes visible on the meter. Then half the content leaks or is delivered (R = 414, M = 425) and the test is re-run: the ceiling is still 828 but R = min(414, 828) = 414 stays content-limited. Capacity is a ceiling, never a value: an aged park shows its ageing, and an empty park never shows full backing (I7).

TV10: A coin-denominated decision is not conforming, and the pro-forma never leaves the rate (computing)

R = 1000, M = 1000, B = 1. The instance decides on a flagged issuance of 100 coins. A holder redeems 100 coins before effectuation. → I2-issuance-denominated-in-coins: I2 declares this denomination non-conforming, and until v0.15 the engine ran it without a word. The act is still carried through so the vector can show the pricing. Settlement at the pro-forma rate = 1000 / 1100 = 0.9091: payout 90.91 kWh, not 100. After effectuation (atomically flagged): R = 909.1, M = 1000, B = 0.9091, label immediately under-backed (no hysteresis, §6). Whoever waited redeems at exactly the same rate: front-running yields nothing (I6). The pro-forma figure now returns that same 0.9091 rather than the undiluted 1.000 it used to return on this route, so the two functions in the engine can no longer disagree about the number I6 prices on (I2, I6).

TV11: Forward pricing closes the measurement window (computing)

R = 1000, M = 1000, last published B = 1.0. A holder sees a reserve loss coming and redeems 100 coins; the next audited interval measures R = 900. → Settlement at the new meter rate B = 0.9: payout 90 kWh → R = 810, M = 900, B = 0.9. The remaining holders do not carry the loss alone (I5).

TV16: The delivery queue never inflates backing (computing)

R = 1000, M = 1000. A holder settles 200 coins → burned at the net rate, entitlement into the queue: D = 200, M = 800, published B = (1000 - 200) / 800 = 1.0, invariant. A headroom mint of 150 is refused: gross R - M = 200 would allow it, but net H = R - D - M = 0 (I2-headroom-exceeded); no minting against energy already owed to the queue. Delivery of 100 lowers R and D together (R = 900, D = 100, B = 1.0, invariant again). The remaining entitlement passes the delivery term T. → The label goes under-backed regardless of B = 1.0. What is public is that label consequence and nothing else: the count of defaults is a count of events at persons, it goes to the auditor, the witnesses and the data protection officer, and the consequence is applied at the next scheduled evaluation point and stands for a full window. The residual is named rather than denied: an under-backed label at B >= 1 still tells a reader that some delivery was not met in the preceding window, and no choice of published precision touches that bit (§6, I4, I11).

TV17: The mint coefficient takes the P25; the difference is anchor-gated headroom (computing)

Twelve monthly eta values, eight summer months at 0.90 and four winter months at 0.84; the rolling 90-day average is a summer-heavy 0.90. An intake of 100 kWh (reference eta 0.88, p = 1). → The mint coefficient is min(rolling 0.90, P25 0.84, temperature-resolved reference product 0.88) = 0.84: the supplier receives 84 coins, not 90, while content books 88 (R = 88, M = 84). The unminted difference of 4 is not mintable headroom yet: a headroom mint of 4 is refused (I2-headroom-exceeded). After the calibration anchor confirms content at book value, the same mint lands → R = 88, M = 88, B = 1.0 (§4, §5).

TV18: The reconciliation account is explained; above-budget leakage alarms instead of levying (computing)

R = 1000, M = 1000; leakage budget 10 per quarter, margin 2, levied rate fixed in advance at 4. Quarter one measures 8: the difference of 4 lands on the reconciliation account as its own explained category; the unexplained-delta cap is untouched. Quarter two measures 20, above budget plus margin. → Alarm I8-leakage-budget-alarm instead of a levy: the within-bound difference (8) settles into the account (total 12), the above-bound portion (8) is parked and MUST NOT be settled into any future rate until the external audit has attributed it. R = 972, M = 992, unexplained sum still 0 (I8).

TV12: Quantity cap per mandate is machine-enforced (computing)

R = 1000, M = 1000. A flagged issuance of 60 coins (6% of M) is attempted under one emergency mandate. → Above the 5% per-mandate cap: the mint is protocol-invalid, alarm I2-cap-exceeded, M unchanged (I2, §6.1).

TV13: Cap base, mint stop and the forbidden act, on one rule (computing)

R = 900, M = 1000 (under-backed, flagged). A first mandate of 50 passes (base 1000, fraction 5%). A second mandate of 52 is refused with I2-cap-exceeded: its base is the decision-moment M net of window issuance (1000), not the inflated gross M of 1050 (I2, discriminating step). A second valid mandate of 50 passes (fraction sum exactly 10%). B then sits below the published recovery path for two consecutive periods → automatic mint stop (§6.1). A third issuance of 30 is attempted. → Refused twice over: the mint stop is active, and the fraction sum would pass 10% → I2-forbidden-act, the same forbidden act as covert issuance (I2, §15). M stays 1100, B = 0.818.

TV14: The re-anchor class: three strikes and the windowed signed cap (computing)

Book content R = 900, M = 850, audited ceiling 1000. Three consecutive anchors each measure 20 kWh below book (sum -60, at the stock-scaled k=2 cap of 60): the third same-sign deviation raises I1-reanchor-three-strikes regardless of magnitude. A fourth anchor measures -40. → The rolling 12-month signed sum (-100) exceeds the cap: I1-reanchor-cap-exceeded, and the label switches automatically to under-backed until an external audit publishes the cause (I1, I7). R = 800, B = 0.941.

TV15: A full store never mints against curtailed intake (computing)

R = 800, M = 800; the capacity test sets the ceiling at 828. An AC intake of 100 kWh at eta = 0.88, p = 0.8 would push content to 888. → Only the recognised R increase mints: 28 kWh are accepted (R = 828, alarm I7-ceiling-clamp), 60 recognised content kWh (AC-boundary equivalent 68.2 kWh) are published as curtailed intake, and the supplier receives coins for the accepted energy only (M = 822.4). B = 1.007: no unflagged overhang, M never exceeds R - D (I2, I3, §5).

TV19: The P25 route under a binding ceiling pays only for recognised intake (computing)

R = 800, M = 800; the capacity test sets the ceiling at 828. An intake of 100 kWh arrives with rolling eta 0.90, a P25 of 0.84 over the trailing twelve monthly values and a content factor of 0.84, at p = 1.0. → The ceiling accepts 28 recognised content kWh and refuses the rest: R = 828, alarm I7-ceiling-clamp, curtailed intake 56 recognised content kWh. Coins are minted over the accepted intake only, so M = 828 and B = 1.0 exactly. A route that paid for the offered intake would mint 884 against a reserve of 828, which is the unflagged overhang I2 and I3 forbid (§5, I7).

TV20: A cold month lets the temperature-resolved reference set the mint coefficient (computing)

R = 0, M = 0; rolling eta 0.90 and all twelve monthly values 0.90, but the temperature-resolved reference product of this interval is 0.83, at p = 1.0 on 100 kWh. → The coefficient is the minimum of all three terms, so it follows the reference: R = M = 83, B = 1.0 exactly, no alarm. Without the third term the coefficient would be 0.90 and the instance would mint 90 coins against 83 kWh of recognised content, B = 0.922, silently and unflagged (§4, §5).

TV21: A re-anchor deviation older than twelve months leaves the window (computing)

An anchor books a deviation of -40 against a stock-scaled cap of 60, followed by eleven conforming monthly anchors with no deviation and then a second anchor of -40 twelve months after the first. → The rolling 12-month signed sum drops the first deviation and stands at -40, inside the cap: no alarm and no label change. An implementation that accumulates without a window reaches -80, exceeds the cap and fails this vector. The intermediate monthly anchors keep the modelled instance conforming with the cadence of I7, so "consecutive" in the strike counter means consecutive scheduled anchors (I1, I7).

TV22: The suspension loop closes, including the return (computing)

R = 1000, M = 1000, hysteresis window 3 intervals, margin 0.02, label fully backed. A measured storage loss of 100 is not yet levied, so B = 0.9; three observed intervals below 1 flip the label to under-backed. Purchase minting continues during the suspension: 700 kWh at p = 0.8 lifts the reserve to 1600 against 1560 coins, so B = 1.0256, above 1 + m, while the label still lags. → In that band a headroom mint of 5 is refused with I2-headroom-suspended-under-backed even though headroom is positive (8.63), which is the materially distinguishing case: without the suspension the same mint would land. Three further intervals at or above 1.02 return the label to fully backed, and the identical mint then succeeds: R = 1600, M = 1565, B = 1.0224, label fully backed (§5, §6).

TV23: A below-book anchor writes down and keeps the gate shut (computing)

R = 0, M = 0; an intake of 100 kWh at content factor 0.88 with a P25 of 0.84 books 88 kWh of content, 84 coins and 4 of anchor-gated unminted backing. The next calibration anchor measures 80, below book value. → The anchor is a real anchor: content is written down to R = 80 and the deviation of -8 enters the re-anchor delta class of I1, while the gate stays shut, so the 4 of unminted backing remains excluded from H and the following headroom mint is refused. An engine that treats a below-book anchor as a silent no-op keeps R = 88 and fails this vector (§4, I1, I7).

TV24: Unminted backing follows the accepted intake, not the offered intake (computing)

R = 800, M = 800 with an audited ceiling of 828. An intake of 100 kWh arrives at content factor 0.88 with a P25 of 0.84, so the coefficient is 0.84 while the content factor is higher. → The ceiling accepts 28 recognised content kWh out of 88 offered (curtailed 60). Coins follow the accepted intake: M = 826.73. The unminted difference is computed over that same accepted intake, giving 1.27, not the 0 that the offered-intake formula yields; B = 1.0015, alarm I7-ceiling-clamp. This is the second half of the recognised-intake rule, which no earlier vector exercised (§4, §5).

TV25: k-anonymity gates every person-derived series (declarative)

A station series with 3 registered metering points behind it, a second with 5, a floor-draw sum over 12 identities, a SoC residual over 20, and a station series with 40 points but published at a grain finer than the aggregation window. → Only the series clearing their threshold are published (station with 5, residual with 20). The other three are suppressed, each with an explicit suppression notice, and the too-fine grain also raises I11-grain-finer-than-window. Silence about a series is itself published, so suppression cannot be used to hide an inconvenient period (I11, I12).

TV26: Floor draw reconciles against the metered sum, at daily grain (computing)

Booked floor draw reconciled against the metered sum of Basispuls deliveries: first exactly equal, then 60 booked against 58 metered, then an attempt to reconcile against per-identity records at quarter-hour resolution. → The matching interval passes silently; the 2 kWh difference lands in the running unexplained sum with I1-floor-draw-residual; the sub-daily attempt is refused with I9-resolution-finer-than-day, since per-identity delivery data at that grain is art. 9 risk data and is not needed for the reconciliation (I9, §10).

TV27: The delivery queue is an aggregate, decided slowly, never an account (computing)

A suppression decided on the annual cadence at a standing count of 8; the same series offered as published inside the minimum term at a count of 25; the same offer on a six-month decision cadence; the same offer after the minimum term; then an attempt to publish one holder's queue position. → The suppression decision stands and is published as a notice. Reversing it inside the minimum term raises I11-suppression-decision-within-min-term, and a decision cadence faster than annual raises I11-suppression-decision-faster-than-annual: the count moves at every settlement, so a suppression that follows it is a one-bit series about the queue population published on the cadence of the settlements it is meant to hide. After the term, a booked depth of 63.4 kWh is published rounded upward to the published quantum of 65 kWh, on a cadence of one publication per delivery term, so no individual settlement event is derivable and the published depth never understates the booked one. The quantum clears sqrt(6) times the largest single entitlement of 25 kWh. The per-account publication is rejected outright with I12-account-level-publication: account-level publication does not exist in any form (§6, I11, I12).

TV28: Internal access is authenticated, logged, disclosed and conflict-free (declarative)

Six attempts on member-identifying records: a clean one, one without a log entry, one by a clerk sharing a household with the subject, one by an unauthenticated actor, a bulk export by a single person, and the same bulk export by two. → Only the clean access and the two-handed bulk export land in the access log, each disclosed to the member. The others are refused with I14-access-without-log, I14-conflicted-access-refused, I14-unauthenticated-access and I14-bulk-export-needs-two. Reading a record without leaving a trace is a grammar break, not a lapse: the record was read and the reading was hidden (I14).

TV29: Retention maxima are grammar, and the per-identity tax aggregate is gone (declarative)

Sub-daily metering data held for exactly 90 days, delivery records for 120, traceable transaction records for 900, and an attempt to compute a per-identity spending total. → The 90-day hold passes; the two overruns raise I14-retention-exceeded per category; the spending total raises S9-per-identity-tax-aggregate, because under the flat fee that dataset is abolished rather than purpose-bound (§9, §10).

TV30: The gift valve is bounded against coercion (declarative)

A gift within the per-recipient cap, one above it, one with a two-hour confirmation delay, one that is the third consecutive month between the same pair, and one from a giver who has set a standing block. → Two gifts are accepted. The others raise S7-gift-per-recipient-cap, S7-gift-delay-too-short, S7-gift-safeguarding-review (the transfer itself still lands, but a human outside the operation reviews it) and S7-gift-blocked. The block takes effect immediately in one action and is never disclosed to the blocked party (§7).

TV31: A status opening returns the current status, and a decoy under a safety flag (declarative)

Three openings: one that tries to return the status history, one ordinary, and one on an entry carrying a safety flag. → The history request is refused with S7-status-history-disclosed; the ordinary opening returns the current status; the safety-flagged opening returns the previous status instead, so an observer cannot read a protected person's move from a change in the view (§7, A23 and the acknowledged I11 exception of A5).

TV32: Conjunctive thresholds, quantisation, and a derived series that publishes (declarative)

Five candidate series against a public set holding R_display and B: a person-bound sum with 5 metering points but only 4 identities, a conforming one with 6 and 25, an unquantised one, the queue D declared as derived from R, B and M, and a pure station series with 5 points. → The 5-point person-bound series is suppressed because the thresholds are conjunctive and not alternatives; the unquantised one raises I11-unquantised-person-series; both suppressions produce the same fixed notice form. The queue D publishes, and this is the resolution of the contradiction between engine and specification that the council found in v0.13: with M off the public set, D = R - B M has two unknowns, so the derived series is no longer a leak and §6 and I11 stop obliging the opposite about one number. Precision never enters the test (I11, §6, A34, A54).

TV33: Exclusion on history, allow-list under a flag, guardianship carved out (declarative)

Five access attempts on member records: an ex-partner who shared the household within five years, the same person as a former partner, a clerk under a standing safety flag without being on the allow-list, a named helper who is on it, and a parent acting for a minor under substitute supervision. → Both ex-partner attempts are refused, so the exclusion no longer lapses on the day the subject moves out; the clerk is refused with I14-not-on-allow-list because a safety flag inverts the circle; the named helper and the supervised representative pass and are logged. All three refusals land as private findings and never as public alarms, because a published refusal tells the excluded person that they are excluded and a published allow-list refusal announces that a flag stands. Without the carve-out the guardianship route of §7 would be unworkable, since a parent shares household, address and a first-degree tie (I14, §7, A79, A83).

TV34: Deferred notification, and a review that never reaches the recipient (declarative)

A register consultation under an ordered deferral, a safeguarding review notified to the recipient, the same review notified to the giver, then a gift block, a blocked gift, a lift of the block, and the same gift again. → The deferred consultation is logged without notifying the member yet, counted as a deferred notice for automatic release on expiry. Notifying the recipient raises S7-safeguarding-tipping-off, since telling the recipient of a coercion review tells the suspected coercer; notifying the giver lands as a private alarm rather than a public one. The block silences the gift, the lift restores it, and neither event is disclosed to the blocked party (I14, §7, A30, A49, A55).

TV35: The membership register is bounded like every other category (declarative)

The register held for exactly 24 months after membership ends, then for 1000 days. → The first passes and the second raises I14-retention-exceeded(membership-register). This was the one category left without a maximum while I12 names it as the principal linking point in phase 0 (§10, A38).

TV36: Day zero, a fresh flag and no allow-list yet (declarative)

A named assessor outside the operation touches the payout setup of a person who has just set a safety flag and given no list; then a bystander tries the same against a list naming only that assessor. → The assessor passes on the seeded list (the person themselves, the body that set the flag, the assessor who can execute the connectionless delivery of §7), so the 24-hour delivery is not blocked on the day of flight; the bystander is refused, and the refusal is a private finding rather than a public alarm. Without the seed the two amendments of the same round would have cancelled each other on this person's worst day (I14, §7, A59).

TV37: Every dataset the rebuild created is bounded, not merely termed (declarative)

Nine retention checks over the access log, the exclusion and allow lists, the household graph, the safety flag, the §9 disclosure log and the gift review. → Five raise I14-retention-exceeded(...) and four pass. I14 obliged these files to have a retention term, which is a house rule; §10 says maxima are grammar, so a term without a maximum left the most sensitive of them, a who-looked-at-whom series in a village, with no bound at all (§10, I14, A65).

TV38: The five-day disclosure term is enforced by something (declarative)

Three consultations: one disclosed after five days, one after six, one under an ordered deferral disclosed after forty. → The second raises I14-notice-term-exceeded; the deferred one is counted as a deferred notice and its long delay is lawful. Until this vector the five-day term existed in the engine as a field that was set and never read, so the term was enforced by nothing (I14, A41, A83).

TV39: The canary and the threshold, on one rule (declarative)

Two conduct counters at zero, one at three, one published unbanded, and a person-bound series whose cohort is zero. → The banded conduct counters publish, zero included, because a counter about the instance's own conduct is a canary and silence about it is not falsifiable; the unbanded one raises I11-conduct-counter-unbanded; the person-bound zero stays suppressed. This is the dividing line taken over from FEP-5fcf, and it is what keeps the counters that were the price of three new powers from being permanently unpublishable at field-test scale (I11, I12, A62, A63).

TV40: Suppression is sticky (declarative)

A station series suppressed at four metering points, then offered again at six inside the minimum term, then offered again after it. → The second attempt raises I11-suppression-lifted-early and stays suppressed; the third publishes. A series that returns the moment its count recovers makes the transition itself a one-bit report about the handful of addresses behind it, which is the pattern this round was swept for (I11, §7, A79).

TV41: Pari passu leaves B exactly invariant (computing)

R = 1200, M = 800. A holder settles 200 coins at the rate 1.5, so D = 300, M = 600 and B = (1200 - 300) / 600 = 1.5. A measured physical loss of 120 kWh then hits the reserve before delivery. → Nothing here is exempt and the ceiling does not bind, so the realised fall of R_book is the whole 120 kWh and the factor dR_book / (D_ne + B x M_ne) reduces to 120 / 1200 = 0.1. The queue is written down by 30 kWh (D = 270) and the levy takes the same 10 per cent of the coin, so M = 540. The result is B = (1080 - 270) / 540 = 1.5, exactly the pre-loss value and not merely close to it: with k = 1 - 0.1 the numerator is k (R - D) and the denominator k M. The write-down is its own signed, declared term of 30 kWh in the I1 balance, it names no entitlement, and it is published in no form (I1, I4, I8, I9). TV75 and TV76 run the same act under a binding ceiling, where the measured loss and the realised fall part company; TV81 runs it with exempt mass.

TV42: The regime this version removes (computing)

The same start and the same 100 kWh loss on a queue of 200, but with the queue standing senior and exempt from the levy, which is what the grammar said for as long as it said nothing. → I8-queue-exempt-from-levy. The holders who stayed drop to B = (900 - 200) / 800 = 0.875 against the 0.900 they would have held had the settlement never happened: a transfer of 2.78% out of the remaining holders and into one settler, for a loss neither of them caused. That number is why redeeming early was weakly dominant, and why the queue could not be made less visible before it was made pari passu (I4, I8, §6).

TV43: The published queue depth feeds nothing (computing)

R = 1200, M = 800, D = 200 booked. The queue publishes at a quantum of 65 kWh, so the public figure is ceil(200 / 65) x 65 = 260. A headroom mint of 150 follows. → The mint lands: on the booked depth H = (1200 - 200) / 1.02 - 800 = 180.4, so 150 fits. On the published depth H would be 121.6 and the same mint would be refused. The engine computes B and the ceiling of I2 on the booked depth in every case, the published depth lies above it by construction, and the closing control attests exactly that (§6, §5, I1).

TV44: The closing control, named in its own right (declarative)

Four attestations: one where B was computed on the display value of R, one where the published D lies below the booked D, one folded into a general statement of conformity, and one clean. → I1-B-computed-on-published-value, S6-published-D-below-booked and S11-closing-control-not-named; only the fourth lands as an attestation. An instance that quietly recomputes B on a display value publishes exactly the same number as an honest one, so this is the one break the construction cannot see from the outside and the attestation has to say the words (I1, §11). This vector is declarative and marked as such: it hands the engine the string "display" and catches a vector containing the word display, which proves the rule is wired and nothing about the arithmetic. TV87 is the computing counterpart, in which the engine derives both candidate ratios itself; TV83 adds f to the same control.

TV45: Two settlements inside one record-date window receive the same rate (computing)

A decision for f = 0.05 of M at the record date, R = 1000, M = 1000. Two holders settle 105 coins each between decision and effectuation. → Both are paid 900 / 945 = 0.95238, the pro-forma rate (R_book - D) / (M + f x base), so 105 coins yield exactly 100 kWh into the queue for the first and for the second alike. The record-date pro-forma stands at 1 / 1.05 and is the published figure; it is asserted before effectuation, since effectuation clears the pending fraction and an assertion after it reduces to B == B. After effectuation M = 840 and B = (1000 - 200) / 840 = 0.95238. The predecessor of this vector ran a single settlement and checked the pro-forma after effectuation, so it proved neither half of what it claimed; TV74 carries the divergence the single-settlement version hid (I2, I4, I6, §6.1).

TV46: Three degrees of freedom (declarative)

R_display and B are public levels. The queue D, declared as a function of R, B and M, is offered three times: with M off the set, with M published beside it, and with the escape hatch open. → First it publishes, because D = R - B M has two unknowns. Publishing the level of M raises I11-M-level-published, and the next offer of the queue is suppressed with I11-publication-set-overdetermined: three of four quantities fix the fourth exactly, whatever quantum stands on it. With the hatch open at a largest holding share of 0.003 against m / 5 = 0.004, all four may be published and the queue returns. Note that R_display counts as publishing R for this test: coarsening removes no degree of freedom, which is the whole finding (I11).

TV47: The hatch runs over holdings, not over settlements (declarative)

The hatch tested on realised settlements, then on holdings at 1% of M, then on holdings at 0.4%; a published ceiling on the single settlement per identity; a change of m on a publication ground. → I11-hatch-tested-on-settlements, because a realised-settlement trigger is steerable by the instance through dispatch. The hatch opens only at 0.4%, which is exactly m / 5. The settlement ceiling raises I5-per-identity-settlement-cap-forbidden: under forward pricing it fragments the rate of a large holder across intervals and breaks the equality between tranches of one entitlement. m does not move (I11-margin-changed-on-publication-ground), the mirror of the rule that the uncertainty budget never widens on a privacy ground (I11, I5, §14).

TV48: Limit one, on the quantities it actually governs (declarative)

A booked quantum of 65 kWh on D against a largest single entitlement of 25; one of 20 against the same; the same booked quantum carrying an asserted U95 of 80; a display quantum of 120 against a maximum U95(R) of 120 over the window in which it is held constant; one of 150 against the same; the same 120 evaluated against a single interval instead; a rule evaluated on a quantised B; a widening of the uncertainty budget on a privacy ground; and one on new calibration data. → The booked quantum of 65 passes: on a booked quantity the requirement is the opposite one, larger than the largest single contribution, and I11-quantum-under-largest-contribution catches the quantum of 20. I11-U95-asserted-on-booked-quantity catches the invented 80 kWh of measurement uncertainty on a ledger quantity the instance knows exactly, which is the figure the v0.14 vector carried and nobody holds. The display quantum of 120 passes with equality, which is the whole point of evaluating limit one against the maximum U95 over the window the quantum is held constant: q_R is constructed as that maximum (§4), so any other reading alarms on a conforming instance for most of the calibration cycle. I11-quantum-exceeds-U95 catches 150, I11-quantum-window-not-the-held-window catches the single-interval reading, I11-rule-on-coarsened-series catches the rule on a quantised B, and S14-uncertainty-widened-without-metrology catches the privacy ground. The calibration widening passes: the metrological enumeration of I1 is exhaustive and privacy is not in it, or slack measurement becomes a compliance credit (I11, I1, §4, §14).

TV49: The condition holds over the series and the horizon (declarative)

A cumulative total of a protected quantity; a composed error of 30 against a largest single contribution of 40; the same with sticky quantisation offered as the defence; the same with the derived series left unenumerated; a conforming budget; and the budget spent. Then B_ss as a value, B_ss as a pass/fail published to the world, a fail routed to the auditor with no action, and the action published with its enumerated set and a conforming composed error. Finally a delivery-default count. → Nine findings. I11-cumulative-total-of-protected-quantity (the increments are exact), I11-composed-error-insufficient, I11-sticky-hysteresis-not-a-defence (a presentation form, never a defence), I11-derived-series-not-enumerated, I11-noise-budget-spent-series-stops (the series stops rather than keeps leaking), S5-b-ss-value-published (the value inverts to the floor draw of I9 exactly), S5-b-ss-pass-fail-published (the test is a known threshold moving with X, so a dated per-interval bit sorted by threshold height is a binary search on the floor draw), S5-b-ss-fail-without-action and S6-delivery-default-count-published (a count of events at persons, zero included). What publishes is the conforming budget and the action, which is a statement about the instance and not about the drawing population (I11, §5, §6).

TV50: Creation is public and exact, the queue is not (computing)

Two issuance quotas as fractions of M, one at a quantum of m / 5 and one four times coarser; the genesis item as an absolute amount and as a fraction; and the queue published twice, once conforming and once at a quantum of 40 kWh on a seven-interval cadence against a delivery term of fourteen. → The conforming quota and the fractional genesis item publish. I11-quota-quantum-coarser-than-m5; I11-genesis-anchor-published, because a published absolute anchor plus a published series of quotas integrates back to the level of M after the fact; I11-queue-quantum-under-sqrt6 (40 against sqrt(6) x 25 = 61.2); and S6-queue-cadence-faster-than-T, since an entitlement stands in the queue until T and a faster cadence hands the observer repeated views of one standing claim to average over (I11, §6, §6.1). The published depth stays at the 65 of the conforming call: the non-conforming one is refused rather than published. Until v0.15 the engine raised both alarms and then wrote its output anyway, so this vector asserted 80, a figure produced by a call the same vector had just declared non-conforming. The conforming quota also carries its enumerated set of series that are functions of M and a composed error above the largest single issuance posting, which is what now licenses the publication instead of the bare m / 5 resolution.

TV51: The ratchet on the display quantum (declarative)

q_R set at commissioning to the maximum U95(R) of 120 kWh; then 150 on a new-calibration-data ground; then 100; then 110 on added hardware; then 50; then 110 again, keyed to the meter-fleet tolerance instead of the content determination. → Commissioning stands, tightening to 100 stands, and 110 after added hardware stands, so the ratchet ends at 110. S4-display-quantum-widened catches the re-derivation upward out of a widened budget: without it, a wider uncertainty budget would for the first time buy something other than a lower R, and better measurement would cost privacy. S4-display-quantum-below-half-U95 catches 50, which leaves the band U95 / 2 <= q_R <= U95 of §4 on the low side. S4-display-quantum-on-the-wrong-budget catches the meter-fleet keying: U95(R) is the expanded uncertainty of the content determination, which scales with stored capacity and never with throughput, and not the fleet tolerance §14 may widen (§4, §14, I1, I11).

TV52: M stands in the protected enumeration (declarative)

A quota series offered with no enumerated set; the same with a composed error of 0.001 against a largest single issuance posting of 0.002; the same with a composed error of 0.004; the annual growth rate of M offered bare and then with the same set; and the composed budget run on M itself. → I11-M-not-enumerated twice and I11-composed-error-insufficient once. What publishes is the attested quota, the growth rate behind the same condition, and M as an enumerated protected quantity. The point of the vector is that M is now inside the one rule that protects a quantity against an observer who averages across publications, and that neither the quota resolution nor the growth rate takes its quantum by decree any longer (I11, §6.1).

TV53: The hatch runs on the booked meter (declarative)

The hatch condition evaluated on the published anonymised series; then with the share itself offered for publication; then on the booked meter at a share of 0.003 against m / 5 = 0.004 with 8 settlements in the publication interval; then the same with 25. → I11-hatch-tested-on-published-series, because the published concentration meter is quantised to a quantum larger than the largest single contribution, which on a share series is the largest share itself, so the test is undecidable at published resolution and limit two forbids running a rule there at all. I11-hatch-share-published, because what is published is the pass or the fail and never the share. I11-hatch-step-condition-unmet at 8 settlements: opening the hatch voids the cadence and the sqrt(6) quantum of §6 as arithmetic, so the second condition is the one that speaks about the step. At 25 settlements the hatch opens and the result stands as a pass (I11, §8, §9, I13).

TV71: Six mandates of f = 0.05 in one window (computing)

Six fractional decisions of 5 per cent each, announced and effectuated in turn on R = 1000, M = 1000. → Two are admitted and take the cumulative fraction sum to exactly 10 per cent; the third and every one after it are refused with I2-forbidden-act, and M ends at 1100 rather than 1340.10. Before this version the same six calls ran with alarms = [] and flagged_frac = 0.0: the caps existed only on the coin route that I2 declares non-conforming, and the fractional route the same invariant prescribes was untested (I2, §6.1).

TV72: A single fractional decision of f = 0.50 (computing)

One decision of 50 per cent, announced and effectuated. → I2-cap-exceeded and nothing minted. The identical act through the coin route was already refused; this vector exists because for one version the two routes gave opposite answers to the same question (I2).

TV73: The record date is not chosen by the issuer (computing)

Announce f = 0.05 on M = 1000; settle 105 coins inside the window; announce a second f = 0.05 quoting the record-date M of 1000; then the same decision without quoting it. → I2-record-date-base-chosen-by-issuer on the third act. The base is M at the interval close preceding the decision, net of flagged issuance already decided in the window, so the second decision takes 5 per cent of 845 and not of 1000. That rule is what replaces the withdrawn "smaller of M at decision and M at effectuation" clause, which could not stand beside a size pinned to the record date (I2, I6).

TV74: The published identity is not the settlement rate (computing)

Announce f = 0.05; settle 105 coins; then compare the live B / (1 + f) against the rate the engine actually pays. → I6-live-pro-forma-above-settlement-rate, with a gap of 0.5586 per cent. The record-date pro-forma stands at 1 / 1.05 and the rate paid at 900 / 945; an instance paying on the live identity would give every later settler in the window more than the first, so waiting would pay and I4 would break on the published formula. The vector fixes which of the two figures is published and which is paid (I2, I4, I6, §6.1).

TV75: A loss entirely above the audited ceiling (computing)

E_content = 1500 under an audited ceiling of 1200, M = 800; settle 200 coins at B = 1.5; then a measured loss of 120 kWh. → Nothing is written down, nothing is levied, B stays at 1.5 and the headroom stays at 282.35, with I4-writedown-without-R-fall raised. Under the withdrawn form, which stood on the measured loss, the same call wrote the queue down to 270, burned 60 coins, left R at 1200 and lifted B to 1.7222 and the headroom to 371.76: a physical loss bought the issuer 89 coins of issuance room, with no alarm (I4, I7, I8, §5).

TV76: A loss that cuts through the ceiling (computing)

The same instance, with a measured loss of 400 kWh. → Only the realised fall of R_book of 100 kWh is borne: the queue goes to 275, the coin to 550, and B is exactly 1.5 still. The 300 kWh that never reached R_book write nothing down (I4, I7).

TV77: Channel one, the quarterly levy (computing)

R = 1200, M = 800; settle 200 coins; the I8 levy at 10 per cent. → The queue falls to 270 with the coin to 540 and B is exactly 1.5. With the rule scoped on physical loss alone the queue stood still and B fell to 1.4444, which is the transfer from the stayers to the queue that the pari passu rule exists to end (I4, I8).

TV78: Channel two, the reconciliation of I8(b) (computing)

The same standing queue, a measured loss of 120 kWh against 100 coins levied at the pre-fixed quarterly rate. → Both the balances and the queue carry the same one-sixth factor, so the queue falls to 250 and the timing difference of 20 lands on the public reconciliation account exactly as it does on the balance side. B moves as I8 already says a timing difference may (I4, I8).

TV79: Channel three, a negative re-anchor deviation (computing)

The same standing queue, re-anchored from 1200 to 1080 kWh. → The queue falls to 270 and B lands on 1.35, which is exactly what the holders who stayed would have had if the settlement had never happened. Before, B landed on 1.30 and the settled entitlement carried none of the correction: a 3.70 per cent transfer, larger than the 2.78 per cent with which TV42 justifies the whole pari passu rule, on the channel a run actually forms around (I1, I4, I7).

TV80: Channel four, the ceiling write-down and the unexplained sum (computing)

The same standing queue; a capacity test that lowers the audited ceiling to 810; then a deduction of 27 kWh for the running unexplained sum. → Both land on the same routine. The queue goes to 202.5 and then to 195.75, and B lands on 1.0125 and then on 0.97875, both exactly the counterfactual without the settlement. R_book is min(content, ceiling) less the unexplained sum, so both are falls of R_book and neither is physical delivery (I1, I4, I7, §4).

TV81: The levy wedge (computing)

M = 800 of which 300 exempt; one settlement of 100 coins out of a non-exempt balance and one out of the exempt balance; then the I8 levy at 10 per cent. → The non-exempt side carries 16 per cent, which is the scaled rate a non-exempt balance carries, and the exempt entitlement of 150 kWh carries zero. B is exactly 1.5 still, so the exemption survives settlement without costing the invariance. Under the withdrawn wording the whole queue carried the average 10 per cent: a non-exempt holder still swapped a dearer-taxed position for a cheaper-taxed one, so early redemption stayed weakly dominant, and a household inside its exempt working capital started paying a levy in the queue that it did not pay as a balance (I4, I8).

TV82: Autonomy is not a fifth live series (declarative)

The autonomy figure offered live; then computed on the booked net reserve; then over a live floor-delivery divisor; then on a cadence faster than T; then correctly. → S6-autonomy-published-live, I11-autonomy-on-booked-net-reserve, I9-divisor-moves-with-admissions and S6-autonomy-cadence-faster-than-T, and only the fifth call publishes. R_net is defined in §1 as the booked net reserve and is never a live level, because live beside an unblurred B it fixes M exactly; and a live floor-delivery divisor is a head count, which I9 forbids publishing even indirectly (§1, §6, I9, I11).

TV83: The closing control covers f (computing)

A decision at an exact f = 0.037, one settlement inside the window, then an attestation claiming a quantised f and one claiming the exact one. → I2-settled-on-quantised-f on the first. The window settles at 1000 / 1037 and the record-date pro-forma is 1 / 1.037; on the m / 5 grid at m = 2 per cent, f would be readable only to 0.4 per cent, which is up to 8 per cent relative on f and about 0.4 per cent on the payout. f is a rule input and limit two of I11 governs it (I1, I2, I6, I11, §11).

TV84: The write-down term inverts to D / R_book (computing)

A standing queue, a reserve loss of 120 kWh, then the write-down term published beside the measured leakage. → I1-writedown-term-published, and the engine computes the inversion: 30 divided by 120 is 0.25, which is D / R_book exactly. That is why the third I1 meter category carries a publication prohibition rather than a quantum: the divisor is public under I8(b) and (c), and beside R_display the quotient pins the booked queue depth an order finer than the sqrt(6) quantum §6 requires on D itself (I1, I8, I11, §6).

TV85: A loss at or above R_book (computing)

R = 1000, M = 500, D = 200; a measured loss of 2000 kWh against a published leakage budget of 100 plus a margin of 20. → I8-loss-at-or-above-reserve, the loss clamped at R_book, the label set to under-backed, and 880 kWh parked on the reconciliation account under I8(a). The engine used to return R = -1000, M = -500, D = -200 with no alarm at all, and a loss of exactly R gave B = inf still labelled fully backed (I8, §6).

TV86: A queue written down without a levy is junior (computing)

A standing queue, a reserve loss of 120 kWh booked with the write-down but without the levy; then an issuance decision denominated in coins. → I4-writedown-without-levy: a loss I8 has not attributed falls on the instance's own balance and touches neither the queue nor the balances, and writing only the queue down makes the entitlement junior, the mirror of the defect the rule repairs. I2-issuance-denominated-in-coins on the second act, and the pro-forma now returns the same 1.2 as the rate. The engine used to hold two functions that disagreed about the one number I6 says settlement runs against (I2, I4, I6, I8).

TV87: The closing control, computed (computing)

R_book = 1040, D = 200, M = 800, display quantum 100. Three published values of B offered in turn: 1.0, 1.02 and 1.05. → The engine derives both candidates itself, 1.05 on R_book and 1.00 on R_display, and answers I1-B-computed-on-published-value, I1-B-matches-neither-basis and an attestation. The earlier vector for this control passed the engine the string "display" and caught a vector that contained the word display; this one can falsify the arithmetic (I1, §4, §11).

TV88: The horizon condition, computed over twenty-four intervals (computing)

A booked queue depth over 24 intervals, published upward-rounded at q = sqrt(6) x 25 kWh, with the engine averaging across publications over every four-interval sub-window. → I11-composed-error-insufficient-over-horizon. The upward rounding has a known mean offset of q / 2 that an observer simply subtracts, and what survives that subtraction, composed over the horizon, is 9.4526 kWh against a largest single entitlement of 25 kWh. The sqrt(6) factor therefore does not clear I11's own condition; clearing it at this window would need a quantum of about 162 kWh, roughly 6.5 times the largest single entitlement instead of 2.449 times. This is a finding and not an open question, and H8 carries it as one (I11, §6).

---

Part II: Horizon (non-normative)

This part describes the design direction beyond the closed phase-0 cooperative. Nothing in it is an admission requirement. Parts become normative once an instance federates, and then move into the Core of a next major version.

H1. Federation and settlement (the FEP-able layer)

• Admission = grammar compliance plus a bounded mutual audit. Two instances couple only if each satisfies Part I. Mutual audit runs over signed aggregates, tree heads and attestations, plus the right to have a sampled, redacted verification performed by an accredited auditor bound to professional secrecy. Data at the level of an individual connection, account or identity MUST NOT cross an instance boundary, in any form: not live, not archived, not as a sample. Every exchange of personal data between instances requires a published art. 26 GDPR arrangement whose essence is made available to data subjects, outside the EEA an art. 46 transfer instrument, and access lapses on decoupling. Each instance publishes the identity of its auditor; the auditor is liable toward coupled instances for attestation errors.
• Data subject rights are part of the admission test, not an annex matter. A coupling contract is not concluded, and is suspended where it already runs, unless the partner can show that the rights procedure of §10 works in practice: arts. 15 to 21 with published deadlines, a member's own internal access log delivered on request, and the art. 15(4) weighing on an exclusion listing instead of a blanket refusal (I14). The mutual audit tests it as a documented procedure plus a sample of handled requests, which stays inside the aggregate-and-attestation bound above because no personal data has to cross to check it.
• Settling at the lower of two meters. Inter-federation settlement occurs at the minimum of (a) the last audited B and (b) the current live published B including decided issuances (the same record-date logic as I6), both net of the delivery queue D (the one B of §1). Every issuance decision is reported to the federation at the moment of decision. If the audit later deviates negatively from the self-report, the difference is settled retroactively and the deviation counts as covert over-issuance (§11).
• Settlement exclusively in kWh or coins, never in currency (mirror of §12).
• Netting before delivering. Settlement nets multilateral obligations; only the residual is covered. Physical delivery runs over the public grid under the applicable grid codes, via a designated balance-responsible party; costs and losses fall on the initiating instance.
• Message authentication. All federation activities are signed, timestamped and nonced; settlement is idempotent under replay. Recommended envelope: a W3C Data Integrity proof on the object per [FEP-8b32], with the key advertised per [FEP-521a].
• Decoupling. If mutual audit shows a partner sustaining B < 1 against the coupling contract, the link may be broken per that contract; trade continues at the exchange rate.

Open question (F1). Exact ActivityStreams object shapes plus signature envelope, with test vectors: the artefact to file as a FEP.

H2. Secession

When a group leaves an instance, or an instance splits, the departing party takes, at the meter rate, both its claims and the matching share of R. Both sides keep an unchanged B: leaving is a civil right, not a collapse. Physically, secession is a large settlement event (H1): delivery over the grid within an agreed term, or buy-out at audited B; until delivery, the claim counts fully under the dependency ceiling of both instances. The rights of §10 travel with the people: before the split every member is told which entity will hold their record afterwards and how to exercise arts. 15 to 21 against it, a member may object to the transfer of their own record, and the receiving entity is bound by an identical published data regime including I14 (§12). Only aggregate settlement data crosses; neither side receives member-identifying data about the members of the other.

H3. Sybil resistance across federation (candidate FEP)

Within one instance the membership register enforces "one person, one floor" (§7). Across federation borders with differing identity methods, the same person could otherwise draw a floor at each instance. The mechanism:

• Uniqueness by nullifier, not by identity. Whoever grants a Basispuls requires, at enrolment, a proof of unique personhood that yields a nullifier: a deterministic, unlinkable token derived in zero knowledge from the person-bound credential and a shared federation context tag. Same person, same nullifier; different persons, different nullifiers. An already-present nullifier is rejected.
• The shared set is the rule; the anchor is a house rule. Federating instances publish and share an append-only nullifier set per context. The set contains pseudonymised personal data without direct identifiers (§10); mutations are published batched per interval. Anchors: eIDAS 2.0/EUDI wallet (strong), zk document proof (cross-border), web-of-trust (weaker, for the free swarm). Each instance declares its assurance level; coupling contracts set the minimum; below it, money federates but no floor context is shared (double floors then stay possible, bounded and visible).
• The Anchor protocol (reference design, specified in FEP-5fcf). A regenerable seed from a stable person-bound attribute (never from the BSN or any other national personal number without a statutory basis; see FEP-5fcf for the EUDI pseudonym route), blind threshold-OPRF evaluation, liveness attestations from the community where that is safe and from an accredited institutional attester where it is not, and a closed recovery procedure. Enrolment and recovery require a live chip session or equivalent eID attestation; passive chip data never suffices (cloning risk). Resistance against unmasking nullifiers is conditional and computational, not unconditional; the t-collusion risk is honestly stated in FEP-5fcf. Lawful disclosure does not run through an escrow in phase 0. There is none: the instance already knows its members through the membership register, and a facility built in advance to link pseudonyms to persons is forbidden (I12). A lawful order of the competent authority compels disclosure of what the instance holds, and the trace it leaves is split: publicly a per-interval count with the category of the authority and the legal basis, also when the count is zero; privately an inclusion proof to the data subject, deferred under a salted commitment only where an authority has ordered deferred notification. The threshold escrow returns only in the federation phase, where an instance genuinely does not know its members, and then only with trustees inside the EEA or under an adequacy decision. On this reading CBER-1 and FEP-5fcf agree; the earlier formulation here (threshold escrow plus court order plus public transcript) described the model that A11 and A12 replaced.
• Forbidden anchor. Stake, deposit or proof-of-work as a floor gate remains forbidden (§7).

Open question (S1, narrowed). Ciphersuites and parameters: the ZK system for the chip session and seed derivation, the threshold-OPRF suite, attestation cadence and grace periods, the cross-anchor recognition table. To be fixed in FEP-5fcf.

H4. Accounts, keys and recovery

• A wallet is a keypair; Luxury Capacity follows key custody (bearer-like but pseudonymous). Instances offer standard protections (multi-factor, social recovery, hardware keys); the bearer loss model is stated explicitly in the user terms.
• The Basispuls is identity-bound and recoverable (§7).

Open question (K1). Recovery baseline that preserves pseudonymity (live chip session or eID re-authentication, k fresh attestations, public waiting period; same procedure for changing the payout destination). MUST be closed before any field test.

H5. Rent guarantee (Horizon goal)

The rent guarantee has been removed from the Core: landlords have euro obligations and do not accept kWh claims without euro clearing, and forwarding payments touches PSD2. In the pilot phase it is replaced by an energy-cost guarantee on the participant's own energy bill, or a euro subsidy with kWh indexation via the municipality. It returns as an activatable Horizon component only under the condition: B > 0.8 for 12 months plus demonstrable euro liquidity of the coin.

H6. Pilot route and growth path

No municipal pilot now. First a closed cooperative field test of 6 to 12 months with 50 to 200 households around an existing park with full backing. Before the first enrolment: the DPIA is completed and adopted; where it finds a high residual risk after mitigation the art. 36 GDPR prior consultation is completed, with its date and outcome published (I12); and no person living at a confidential address is recruited into the field test until the safety route exists as a working facility rather than as text, meaning at least one accredited institutional attester under contract and reachable per region (two where the route for a person whose documents are not in their own possession requires two attestations) and the connectionless delivery form of §7 actually available and exercised end to end at least once. Recruiting someone whose safety depends on an unbuilt provision is the failure this grammar exists to prevent. Since v0.13 this is no longer only a go criterion: §7 carries it as a binding bullet with the same two conditions, because Part II binds nobody and this is the one rule that makes it defensible to write MUSTs about facilities that do not yet exist. Go criteria for scaling: at least 40% monthly-active participants after 6 months, at least 20 acceptance points, comprehension test at least 80%, and two consecutive quarters of a published p-calculation on the park's actual LCOS and flexibility-market figures (H8): the economic gate opens separately from the adoption gate. The field test is framed in all communication as an adoption test, not a viability proof. Launch under the flag of an existing trusted institution; the primary interface is a physical card plus a staffed counter, an app optional; a mandatory public glossary (exchange, take in, maintenance rate, building up) alongside the unchanged protocol language; a section "value for net contributors" with concrete counter-benefits. Municipal acceptance of coins for a levy or service belongs exclusively to the later municipal-pilot phase, after the regulator guidance of §12, and never takes place during phase 0.

Assurance budget and staffing model. Before the field test starts, the instance publishes a costed assurance budget in euro per year (auditor, witnesses, capacity tests, metrology) with the names of the actual auditor and witnesses. Escrow administration is no longer a line item: there is no escrow in phase 0 (I12). The budget MUST also carry a staffing model for every role this grammar has created, with an estimated time load and a named holder or a stated vacancy: the assessor for manual admissions (§7), the human reviewer for art. 22 decisions (§10), the safeguarding reviewer for the gift valve and the assessor outside the operation for the access regime (§7, §9), the holder of the internal access log and the second person for bulk export (I14), and the accredited institutional attester for the safety route. A rule that presumes a person who does not exist is not in force, and a volunteer cooperative of 50 to 200 households cannot staff them all by assumption. Assurance costs above a pre-declared percentage of the reserve value are their own published coverage blockade, never a line to economise on silently.

H7. Gatekeeper

The Gatekeeper office (Poortwachter: independent oversight with judge-like protection) requires formal legislation and sits on the legislative agenda. For the pilot phase: an independent foundation with statutorily secured independence plus an auditor under civil contract (§11). The external release signer of §14 can come from this corner.

H9. Publicly recomputable conservation without readable accounts (candidate)

Phase 0 demonstrates conservation with auditor attestation plus the published commitments, and says so (I12). The candidate replacement, so that the promise of public recomputability can honestly return: per-account balances held as homomorphically hiding commitments (Pedersen or equivalent), with a per-interval zero-knowledge proof that the sum of all balance mutations equals mint minus burn plus tax flows minus floor draw. Leaves carry salted commitments only, and the tree is padded each interval to a pre-published fixed size so that tree growth reveals no transaction volume. Until such a scheme actually runs, the claim that system verification requires zero insight into persons MUST NOT be made, in the specification or in public communication. Production readiness on cooperative hardware is an open question for the cryptographer named in H8.

H8. Open items (before v1.0)

• (A4 power coverage, partially validated: bank-run routing through the power gate, winter derating of power and of usable capacity on both charge and discharge side, a floor-draw stream with first priority, and an isolated-grid 72-hour winter acceptance test pinned to the promise at test start run in the public simulator, with emergency dispatch bounded at 1.5x installed dispatchable power and disabled during the test; current scripted outcomes with per-person floors: the neighbourhood preset fails with 53 short hours on a pinned floor of 0.38 kWh per person per day and a queue up to 60 kWh, Amsterdam 2035 fails narrowly with 3 short hours on a floor of 1.19 kWh per person per day; the P25 mint coefficient, the three-term P_g formula and the queue-versus-T criterion are not yet simulated; promotion to a normative invariant per the binding metrologist note remains pending the closed field test.) kWh is not kW: at a winter-evening peak the reserve can be energetically full yet power-constrained. The minimal variant is already normative in the Core (§6: live P_g net of derate, live delivery queue D deducted from B, delivery term T with a §14-bound maximum, delivery default). The full candidate invariant keeps maturing here: a claim = 1 kWh AC deliverable within T hours; calls above P_g enter a queue whose aggregate depth is published on the cadence and at the quantum of §6, with no second series for the waiting time, with Basispuls calls ahead of luxury calls and no individual entry, position or timing visible to anyone but the caller; the label shows, next to B, P_g divided by the historical peak demand (absent 12 months of peak history, the contractually guaranteed simultaneous call is the denominator). P_g = the sum over sites of min(C-rate x usable capacity x derate(T_site), inverter power at site temperature, grid-connection value), with usable capacity the audited ceiling of §4 before temperature derate, mirroring §6. Simulator validation runs the winter case: eta_rt at the P10 of measured winter values, capacity derated to P10 winter cell temperature, and coincident Basispuls calls at the historical evening peak, with all redemption calls, bank-run scenarios included, routed through the same P_g queue with Basispuls priority; A4 is adoptable as an invariant only if the queue stays bounded in that case. Binding note (metrologist condition): at any scale-up beyond the field test, P_g becomes normative as the second live status number.
• (Q1) New in v0.15, and a finding rather than an open seat: the sqrt(6) quantum on D does not clear the horizon condition of I11. I11 requires the publication error, composed over the enumerated set of derived series and over the whole published horizon, to exceed the largest single contribution. §6 sets the quantum on D at sqrt(6) times the largest single entitlement and rounds upward deterministically. Upward rounding to a fixed quantum has a known mean offset of q / 2 that any observer subtracts, and what survives that subtraction does not grow with the horizon: it averages down. TV88 runs it: 24 intervals of a booked queue depth at q = sqrt(6) x 25 kWh, averaged over every four-interval sub-window, leaves a composed error of 9.4526 kWh against a largest single entitlement of 25 kWh. Clearing the condition at that window would take a quantum of about 162 kWh, roughly 6.5 times the largest single entitlement rather than 2.449 times. Three consequences are recorded rather than smoothed. One: sqrt(6) is derived from the single-release signal-to-noise argument in §6, which is a different and weaker requirement than the horizon condition I11 states, and the two have never been reconciled. Two: the deterministic rounding of §6 carries no noise budget at all, so the "budget that can run out" which I11 names as the defence does not exist on this series, and what happens when it runs out is therefore also undefined. Three: raising the quantum to clear the condition is not free, since a queue published 162 kWh coarse on a field-test reserve is close to publishing nothing. Which of the three exits to take (a larger quantum, a real noise budget on D, or an exemption of D from the horizon condition with the residual named) is the statistical-disclosure-control question of M1 below, but the failing arithmetic is settled and belongs here as a result.
• (F1) Federation messages as a FEP (H1).
• (K1) Recovery baseline (H4); closed before any field test.
• (S1) Anchor ciphersuites and parameters (H3, FEP-5fcf).
• Legal annex. Qualification analysis EMD2/PSD2/MiCAR/AML/national financial law per phase (§12); the custodian foundation and the MiCAR position are already MUSTs in §12, the substantive analysis lands here.
• Business case of the reserve. Whether LCOS + foregone flexibility revenue ever lands below 1 coin per kWh is an open core question for an energy economist with real figures (§5, coverage blockade).
• (D1) Resolved in v0.4: commitment medium and witness protocol fixed as signed tree heads with at least three independent external witnesses (§10); the remaining detail is witness selection per instance.
• (M1) Resolved in v0.14: the exact derivability of D from R, B and M went to the monetary council and came back as a publication-set rule rather than a precision rule (I1, I11, §4, §6). Two questions the council could not close stay open here and are not written away. Statistical disclosure control under continual observation: how much a level series leaks over T publications, how a privacy budget is composed and spent across publications, and how many publications change-point detection needs on the quantised D that remains. Until that seat is filled, the sqrt(6) factor and the T cadence of §6 are a defensible lower bound and not a proven parameter, and the same holds for the composed condition now placed on M: I11 says which series must clear it and over what horizon, and no one at this table can say how many aligned publications of the quota series, the growth rate and R_display it takes to bring M inside that bound at a given coin velocity. A fourth seat belongs beside them and is named here for the first time: someone who can put a defensible U95 on a battery content determination, including how it runs up inside an anchor cycle. The whole display split and the ratchet on q_R are parametrised on that figure (§4), and nobody has produced it. The value of an attestation without a public series: this version moves the per-interval verification of M, R_book, the steady-state B and the accrued headroom onto the auditor and the three witnesses, and no one at the table could say what work that attestation requires or whether a supervisor under §12 accepts an attested figure as a published backing ratio. A third gap is named beside them: a queueing theorist with arrival dynamics, for the run feedback and the waiting-time distribution that decide how often a T at the dark-period horizon is actually exceeded.

---

Version history

• v0.15, 21 August 2026: engine and monetary repairs after council review 12 (unanimous rejection). The On the publication side in the same version: limit one of I11 restricted to metrologically determined quantities and evaluated against the maximum U95 over the window the quantum is held constant, with quanta on booked quantities under the reverse requirement; M added to the protected enumeration with its largest single contribution defined, and the quota series, the annual growth rate and R_display subjected to the composed condition over the horizon; the queue publication decision moved onto the slow cadence of I11 and the threshold on the standing count withdrawn; the escape hatch moved onto the booked concentration meter with a pass or fail published instead of the share; the B_ss test routed to auditor and witnesses with only the action published; the dark-period horizon defined and measured in par. 7; and a ratchet on q_R with the content-determination budget named. Honest note: TV88 does not clear the horizon condition of I11 on its own quantum, and that arithmetic is recorded as an open item (H8/Q1) rather than smoothed away. twelfth sitting read the v0.14 diff and the public wiki beside it and rejected the proposal unanimously, four chairs out of four, on twelve fatal findings. The heaviest of them is not in the text at all. The reference engine enforced the issuance caps only on the route this grammar declares non-conforming, and on the route it prescribes it enforced nothing. announce_issuance_fraction and effectuate_issuance did no more than pending += f x M and M += pending: no 5 per cent test, no 10 per cent fraction sum, flagged_cum and flagged_frac left at zero. Six mandates of f = 0.05 in one window took M from 1000 to 1340.10 and B from 1.000 to 0.746 with alarms = []; a single decision of f = 0.50 gave M = 1500, also silently; the identical act through mint_flagged was refused with I2-cap-exceeded. That is the worst class of error this file can contain: the council had just taken the level of M off the public set and handed the reader an auditor attestation that the caps were held in exchange, and the engine that is supposed to say what conforming means could not see a breach on the conforming route. It is repaired first and it is recorded first. Three amendments adopted in sitting 11 opened new holes where they were implemented, and that is written down rather than smoothed. The fractional denomination opened three: the cap bypass above, a published pro-forma formula that is not the formula settlement runs on, and a cap base that contradicted its own invariant. Pari passu opened two: a write-down factor standing on the measured loss instead of on the realised fall of R_book, and a rule wired to one channel while R_book falls along five. The metrologist's own limit (q <= U95) opened one, repaired in the publication and measurement pass of the same version. The pattern of the previous rounds has moved: the arguments were sound, the implementation reached the invariant where it was argued and the engine method named in the argument, and almost no neighbouring place that shares the same quantity. What this pass changes. One: the caps run on the route the grammar prescribes (I2, §6.1). One base, written in I2, I6 and §6.1 in the same words: M at the record date net of flagged issuance decided in the rolling window, with the record date fixed at the preceding interval close and never chosen by the issuer. The "smaller of M at decision and M at effectuation" clause is withdrawn: it could not stand beside a size pinned to the record date, and TV45 of v0.14 was itself a 5.59 per cent issuance against a 5 per cent cap that the engine reported as clean. Two: one settlement rate (I6). r = (R_book - D) / (M + f x base) is the only rate under which the first and the last in line receive the same rate, and the published B / (1 + f) is not that rate once anything has settled in the window: it stands 0.559 per cent above it after one settlement, so waiting would pay and I4 would break on the published formula. The record-date pro-forma B_record / (1 + f) stays the published figure, the rate paid is attested, and the claim that the fractional denomination makes the caps publicly checkable is withdrawn as untrue: what is publicly checkable is f. Three: the write-down factor stands on the realised fall of R_book (§1, I1, I4, I8, I9). Under a binding I7 ceiling a measured loss need not lower R_book at all, and the old form then wrote the queue down, burned coins and left R standing, so B rose from 1.500000 to 1.722222 and the mintable headroom from 282.35 to 371.76: a physical loss bought the issuer 89 coins of issuance room, with no alarm. The factor is now zero wherever R_book does not fall, and a write-down proposed against a reserve that did not fall raises I4-writedown-without-R-fall. Four: pari passu runs on every channel (I4, I8, I9). R_book falls along five routes and only one of them is a physical loss between settlement and delivery; on the other four the queue stood senior. A run forms on an announced booking correction and not on a fire, so the rule as adopted repaired the case in which no one runs and left the case in which everyone does. A negative re-anchor deviation transferred 3.70 per cent to the queue, larger than the 2.78 per cent with which TV42 justifies the whole rule. Five: the levy wedge is closed (I4, I8). An entitlement now carries the leakage factor of the balance it was settled out of: zero for the exempt part and the scaled non-exempt rate for the rest, which is I8's own scaling applied to the queue. B stays exactly invariant, the exemption survives settlement instead of lapsing when it is exercised, and the sign of the early-redemption incentive is finally neutral. Six: R_net is defined and taken off the live set (§1, §6, I9, I11). It appeared twice in 1177 lines and was defined nowhere, and the autonomy MUST published it live over a divisor containing the daily floor delivery, which is a head count I9 forbids publishing even indirectly. Autonomy now computes on the already published R_display and D, on the cadence of §6, over an annually banded divisor. Seven: f is published exactly and the closing control covers it (I1, I2, I11, §11). Eight: the I1 cadence clause is written for three terms instead of two, and the third, the write-down term, gets an explicit publication prohibition: divided by the publicly known leakage it yields D / R_book exactly. Nine: engine repairs (amendment 16). publish_queue returns on each of its three alarms instead of publishing anyway; reserve_loss clamps the loss at R_book, alarms at or above it, sets the label to under-backed and runs the I8 budget regime, where it used to return R = -1000, M = -500, D = -200 with no alarm; announce_issuance raises I2-issuance-denominated-in-coins and the pro-forma can no longer diverge from the rate. Ten: the vector set says what it proves (amendment 19). Every vector is marked computing or declarative in the annex and in the engine output, because a vector that receives its own conclusion as an argument is not proof and the previous annex presented both kinds identically. The closing control now has a test in which the engine derives B on R_book and on R_display itself and says which one the published figure matches, and the twenty-interval series vector that the chair had noted as adopted, and which did not exist, is built. It does not come out green, and that is a result. Over 24 intervals at q = sqrt(6) x 25 kWh the composed publication error after the known offset is 9.4526 kWh against a largest single entitlement of 25 kWh, so the sqrt(6) quantum does not clear I11's own horizon condition; clearing it would take roughly 6.5 times the largest entitlement. H8 carries that as finding Q1 rather than as an open seat. Vectors: TV10, TV43, TV44, TV45 and TV50 rewritten, TV71 through TV88 added. Honest notes. The three sentences the council reproduced against the engine and could not both be true (I2's two cap bases, I6's published formula against the settled rate, I4's invariance claim against a binding ceiling) are resolved by choosing, and in each case the choice loses something that was being advertised: the caps are not publicly recomputable, the rate paid inside a record-date window is not publicly recomputable, and the sqrt(6) quantum is now known to fail a condition the same version states. All three are written into the text rather than into the changelog alone. Two seats stay empty and both bear on exactly these repairs: a market-microstructure or mechanism-design economist who checks formulas under successive settlement rather than a single one, which is where the pro-forma broke, and a statistical disclosure control specialist, without whom Q1 has an arithmetic but no chosen exit.

• v0.14, 21 August 2026: monetary council on the derivability of D. The eleventh council sitting took the question three privacy sittings had deliberately forwarded, and it rejected the proposal rather than amending it. The precision route lapses in full. The reason is arithmetic and not a judgement call: B = (R - D) / M is an identity with three degrees of freedom, so publishing three of the four quantities fixes the fourth exactly, whatever quantum is placed on it. Measurement uncertainty protects with exactly zero here, because the derivation uses published values on both sides and the measurement error is common mode and cancels; R is moreover booked at the lower bound of a published budget and reduced by the published unexplained sum, so the deviation is deterministic and publicly invertible rather than stochastic. The publication set was overdetermined, and the old rule bounded the error per publication against an attacker who averages across publications. What replaces it: at most one of M and D is a public per-interval series (default D public and quantised, M off); the condition is composed over every published series that is a function of a protected quantity and over the whole horizon; no cumulative total of a protected quantity is published, because its increments are exact; sticky quantisation with hysteresis is a presentation form and never a defence, and the budget that replaces it has a published horizon and can run out, after which the series stops (I11, §2). The economist's chair dropped out mid-sitting on a connection fault and was heard separately afterwards. He found a fatal defect in the decision itself and a second finding no other member had, and the owner adopted his amendments in full, so where he differs from the chair he governs. Six things follow. One: the level of M disappears entirely, not annually and not in a band. The chair's annual M at one per cent was the mirror image of the route the sitting had just rejected: too coarse for the label by four to seventy-five, too fine for the queue by four to seventy-four, the same error reflected. What appears instead is every mint and issuance category as a fraction of M quantised no coarser than m / 5, plus an annual growth rate and the auditor's attestation on the I2 caps. The genesis clause is pulled in with it: a published absolute legacy amount plus a published series of quotas integrates back to the level after the fact, so that item is a fraction until the hatch opens (§6.1). Two: R_book and R_display split (I11, §4, §1). R_book is exact and feeds B, the headroom of §5, I1, I2 and the deduction of the unexplained sum; R_display is R_book rounded downward to q_R with U95(R)/2 <= q_R <= U95(R) and is the only R in public. No rule is evaluated on it and B never carries blur. The metrologist had been voted down on this in the sitting; the economist noted that all five grounds used against him (label, hysteresis margin, target path, price anchor, backing ceiling) are functions of B and not of R, and supported him after the fact. Three: pari passu, the heaviest of the amendments (I4, I8, I9). A physical loss between settlement and delivery is now borne pro rata by the queue and the coin holders together: the queue is written down by L x D / (D + B M) and the remainder runs through the I8 levy, at a factor identical for the first and the last in line. B is exactly invariant under it, verified in the engine and pinned in TV41 at B = 1.5 rather than at 1. The entitlement is thereby pari passu with the coin instead of senior to it and is no longer exempt from the levy. Without that rule, redeeming early is weakly dominant for anyone who intends to consume, since it swaps a leakage-bearing coin for a leakage-free entitlement fixed in kWh and standing ahead of every holder; that maximises the queue structurally, and together with a queue the meter no longer shows it is a run in slow motion. TV42 keeps the removed regime beside it and reproduces the 2.78% transfer. The council had declared this seniority; the economist ended it, and refused to make the queue less visible before it was pari passu. Four: the escape hatch runs over holdings, the largest anonymised holding share on the concentration meter over twelve months at or below m / 5 of M, never over realised settlements, which the instance can steer through its own dispatch. A ceiling on the single settlement per identity per interval is forbidden outright while I5 prices forward, because it fragments the rate of a large holder across intervals and breaks the equality between tranches of one entitlement (I5, I11). m is never changed on a publication ground, the exact mirror of the rule that the uncertainty budget is never widened on a privacy ground (§4, §14). Five: the closing control moves and is named (I1, §11). Auditor and witnesses attest per interval, the auditor confirms publicly per quarter, that the published B was computed on the booked R, D and M and on no published value, and that the published D is not lower than the booked D. The item is named in its own right and never carried inside a general statement, because an instance that recomputes B on a display value publishes the same number as an honest one. Six: an issuance decision is denominated as a fraction f of M at the record date, so the pro-forma B of I6 is B / (1 + f) and is publicly checkable without M (I2, I6, §6.1). The economist also supplied the option all four other members missed and it is written into §2 and I11: the cut runs between creation and destruction, not between M and D. Creation is the act of the issuer and is public, per interval, exact, as a fraction of M; destruction and the queue are the behaviour of participants and are protected, aggregated, on cadence. That gives full dilution control at interval frequency and leaks nothing about the queue, since an issuance quota contains no term that depends on it. From the sitting itself: D moves to a cadence no faster than one publication per delivery term T, rounded upward because an understated queue overstates backing, at a quantum of at least sqrt(6) times the largest single entitlement, suppressed under k_identity, with B and the I2 ceiling on the booked depth always (§6). The delivery-default count leaves the publication entirely for the auditor, the witnesses and the data protection officer, and only the label consequence stays public, applied at the next scheduled evaluation point and standing a full window. The steady-state B_ss becomes a signed pass/fail, because the published value inverts to the floor draw of I9 exactly. Accrued headroom stops being a running cumulative total. T may not be shorter than the dark-period horizon of §7, and the autonomy figure joins P_g (§5, §6). Three machine-testable limits are now engine rules: no published quantum above the U95 of the same quantity, no rule evaluated on a coarsened series, and no §14 widening of the uncertainty budget on a privacy ground. Engine and vectors: reserve_loss with the pari passu write-down, publish_queue with the section 6 signature and upward rounding, attest_closing_control, announce_issuance_fraction with B / (1 + f), the degrees-of-freedom test replacing the unconditional suppression on derived_from, the escape hatch, the quota and genesis publication, the composed error budget and the three limits. TV27 and TV32 rewritten (TV32 was the contradiction between engine and specification the sitting found: the queue now publishes because M is off the set), TV41 through TV50 added: fifty vectors. Honest notes. The chair ruled the whole outcome a strict tightening and it was kept that way; nothing of the privacy layer rebuilt after the unanimous rejection is rolled back. The economist's seat was empty while the sitting weighed the two questions only that seat could answer, and one of them, the seniority of the queue, turned out to be a live monetary defect rather than a formality: the queue was senior and leakage-free, and no version before this one said so. One privacy rule loses to a monetary one and it is named rather than smoothed: the published D rounds upward rather than to nearest, which is faster to invert across publications, and it is accepted because a queue rounded downward overstates backing. Two seats stay empty and both bear directly on this version: a statistical disclosure control specialist on continual observation, without whom the sqrt(6) factor and the T cadence are a defensible lower bound and not a proven parameter, and an auditor who can say what an attestation without a public series is worth, now that this version has moved M, R_book, B_ss and the accrued headroom onto that route (H8, M1).

• v0.13, 20 August 2026: sweep after council review 10 (rejection withdrawn). The privacy panel that rejected this layer five to zero in review 8, and upheld that rejection in review 9, has withdrawn the rejection. All five members voted to accept with amendments, the two who had voted to reject twice included. No member found an architectural finding this round: the cryptographer called the properties better written down than in any earlier version, the lawyer graded nothing as fatal for the first time, the threat modeller found a placement error and a contradiction instead of a break, and the sceptic called the architecture finished. The owners of both fatal dissents withdrew them themselves. The chair declared the panel redundant for this layer, on the ground that an eleventh sitting produces nothing a second reader with a checklist would not also find, and that what remains is a text sweep, a carrier checklist and a build assignment rather than a meeting. The chair's own caveat is recorded rather than smoothed away: the withdrawal rests on the architecture being finished and not on the carry-through being complete, so the publication blockade on the public site and the recruitment blockade stand independently of this panel, and the field test stays shut until an accredited body is under contract and the conversations under art. 35(9) have been held. Carried out in this version, core-specification side. The recruitment bar becomes binding (A60). No person at a confidential address is enrolled or recruited until an accredited institutional attester is under contract and reachable for their region, two where the documentless route requires two, and the connectionless delivery form of §7 is actually available and exercised end to end at least once, both conditions published. The rule lived only in H6, which sits in Part II, while §15 says that only §1 through §15 bind, so a phase-0 cooperative was touched by no binding rule at all; it is now a bullet in §7, a named act in the data branch of §11 with the ladder starting at suspension of admissions, and a named act in §15. This is the hinge of the whole dossier: writing MUSTs about facilities that do not yet exist is defensible only where leaning on them is itself grammar. One sweep for the pattern three members found four times (A79): every protection that engages is recognisable by its engaging. No safety flag ever changes the publication policy of a series, so at field-test scale either no station series is published at all or every such series is aggregated over a wider whole regardless of flags; publish-or-suppress is decided on a pre-announced cadence no faster than annual and suppression is sticky for a published minimum term; the refusal of §9 gets a fixed, ground-independent form, so the disclosure desk stops being an oracle that answers on request whether someone carries a flag; the counter for the third delivery form gets the I11 clause the manual route already had; and in the engine a refusal now lands as a private finding instead of a public alarm. Setting a flag suspends notification (A80). "Confirmed in advance" means confirmed while the adversary was reading along, and the threat model itself says the device and the PIN are usually his, so all notification is suspended at the moment a flag is set until the person, or the accredited body acting for her, confirms a fresh channel; the body may itself be that channel; held notices are delivered in full afterwards; and the safeguarding review of the gift valve, which fires before any flag exists, makes no contact at all until a safe channel stands. The manual route gets the mechanism its own risk sentence presumed (A68). The I14 exclusion circle now applies to the assessor, who creates the record rather than consults one; refusal is appealable under the art. 22 bullet with suspensive effect; what the assessor may ask is bounded and the substantiation carries a retention maximum; the route MUST NOT be legible as a marker in the member record; and the sybil risk gets a published ceiling per rolling 12 months, a rate ratchet into the ordinary queue, and a named source for the kWh: an unconfirmed manual admission stays out of the per-capita divisor and its floor draw is charged to margin and buffer, with a coverage blockade rather than a lower floor for everyone else. Further, in the order the council numbered them. I14 no longer sends the safeguarding notification to the wrong person and §7 governs where the two meet (A61). I11 takes over the dividing line FEP-5fcf had already written: counts about the instance's own conduct follow the canary and are published including zero, counts about events at persons stay suppressed including zero, and where the two rules meet the rule protecting persons wins (A62). The accountability counters that were the price of three new powers are published in fixed bands per role category rather than suppressed forever at village scale, with the honest price for a single-holder role stated (A63). I1 gives the running unexplained sum and the re-anchor series the same cadence clause as floor draw and D, and the deduction of that sum on R falls under the derived-quantity rule of I11, since suppressing a series while publishing its deduction moves the channel instead of closing it (A64). The six datasets this rebuild itself created get retention maxima in §10 and in the engine limits, with the access log held only as long as the audit object of §11 requires and then aggregated (A65). The household and family graph gets minimisation as grammar (derived flags only, no free text, never for another purpose, never exported) and its necessity goes to the data protection officer with the member-named exclusion list as the alternative to measure against, while I12 withdraws the word "single" from its linking-point claim (A66). The consequence of the manual route for the legal basis is drawn rather than avoided: the anchor stack loses art. 6(1)(b) because a controller who shows a less intrusive means works cannot call the intrusive one necessary, so what carries it is consent, with art. 7(3) switching at any moment without penalty and a ban on tying (A67). A42 and A43 are pulled into the binding carrier: accreditation happens at federation level and never by the instance being checked, de-accreditation never operates on a standing flag, at least one attester per region must be reachable, and the identity and category of the attesting institution are not recorded (A76). Household-bound metering series meet both thresholds and not k_station alone, topology (b) expressly included, because the clause that calls them occupancy behaviour is the reason (A77). The third delivery form gets sole control instead of mere address-freeness, a payment description that reveals nothing, and one handover route that is not the instance in the village (A81). The gift bullet stops promising what the same paragraph retracts three lines later (A82). The delivery default is published as an aggregate count plus its label consequence and never as an event, and the "public view" per person disappears from the decoy, since I12 forbids one to exist (A84). Art. 5(1)(d) is written down at the decoy with art. 6(1)(d) as its carrier, because the argument is good and should be on paper before a supervisory authority finds the gap (A85). I12 requires the art. 36 consultation before the first enrolment rather than "before any processing starts", a MUST that was broken on the day it was written (A86). The secrecy of an exclusion listing becomes a weighing with a duty to give reasons under art. 15(4) and recital 63 instead of an absolute ban, the rights bullet names the member's own access log and their own listing as art. 15 material, and H1 and H2 are pulled along so the rights are actually tested at federation and at secession (A88). The minors clause stops promising carry-over "without any change of token", since the token is per context and the entitlement is what carries (A89). Engine: three alarms the sceptic named plus the allow-list refusal move to the private channel that was built for them and never used, the five-day disclosure term is read by something for the first time, the new retention maxima enter the limits dictionary, and conduct counters and sticky suppression become executable. Five test vectors added (TV36 through TV40) and TV28, TV29, TV30, TV33 and TV34 pulled along; the authoritative count is the last line of python3 audit_cli.py. Not in this version, and open: the four cryptographic construction amendments (A71 PSI freshness, A72 rotation, A73 dictionary root, A74 workable quantisation) and A75 attester hiding, which are FEP-carrier work and in part a build assignment; A78, which needs a criminal-procedure lawyer before it is fixed; the site and privacy-statement repairs A69 and A70, which remain blocking for publication; and A87 and A90, the go criterion for the re-identification assessment and the one carry- through checklist signed off by someone other than the author, which remain blocking before any document goes to a data protection officer or the supervisory authority. The DPIA, the legal annex, FEP-5fcf and both site languages are not touched by this version.

• v0.12, 20 August 2026: the day-zero clamp (finding by the sceptic, reproduced against the engine). Two amendments from the same batch cancelled each other on the worst day of the person they were both written for. §7 promises the connectionless delivery within 24 hours of a safety flag; I14 inverts the circle into an allow-list the instance may not compose alone the moment a flag stands; and on the hour of flight that list does not exist, so every access was refused, I14-not-on-allow-list, with an empty log and no notification, while TV33 recorded that behaviour as correct with a green tick. Fixed: the allow-list is never empty. At the moment a flag is set it is seeded with the person themselves, the accredited body that set the flag and one named assessor outside the operation who can execute the connectionless delivery, and an absent or empty list falls back to that seed and never to refusal. TV36 pins both sides: the assessor passes, a bystander does not. This version was released without its own history entry; it is recorded here.

• v0.11, 20 August 2026: second privacy round after council review 9 (rejection upheld). Council review 9 reviewed the v0.9 and v0.10 rebuild and did not withdraw the unanimous rejection of review 8: three members moved to "accept with amendments", two upheld their rejection. The reasons are recorded here rather than softened. The safety route existed as text and not as a facility: no accredited institutional attester is under contract, so three MUSTs rested on an unbuilt provision. There was no floor on day zero, because the previous repair bound the payout to a household energy contract that the person fleeing usually does not hold, while the energy component expires daily. And the refusal route was missing entirely: saying no to the identity layer still cost a person their subsistence minimum, a fatal finding from review 8 that had never been given an amendment number. Carried out in this version, core-specification side. Manual admission becomes grammar: a human establishes uniqueness with no token published and no community attestations, the residual sybil risk sits with the instance, and only the count is published. A third delivery form becomes grammar: delivery to the person without any connection, within 24 hours of a safety flag and without attestations, and the prohibited destination now names the housemate and the contract holder rather than only the landlord. The I12 deferral clause is taken verbatim into I14, so the invariant no longer forces a choice between a secrecy order and a grammar break, and under a safety flag notification runs only through the confirmed channel. The cadence collision between I1 and I9 is decided in favour of I9: both terms are signed to the auditor and the witnesses every interval, publication is periodic, thresholded and quantised, and the earlier live-per-interval requirement is withdrawn, with the exact derivability of D from R, B and M referred to the monetary council because it touches a monetary invariant. Section 10 no longer promises that anyone can recompute B, and no longer claims the ledger holds no personal data at all: anonymity becomes a conclusion per series with a written re-identification assessment, a named basis and a retention term. I11 is rewritten conjunctively per series type, the incorrect claim that k-anonymity defeats differencing is removed, quantisation or a published noise budget is required on every person-derived series, the unexplained sum and the re-anchor series come under the thresholds, and counters about the watching party are added, which is the answer to "the ladder measures holdings and never gaze". The admission queue loses the word public in section 7 and in H8, and I12 gains a principle rule above its enumeration. The trough uses k_station rather than k_identity, gains a fallback for the case where no conforming aggregate can exist at park scale, and reconciles the three-winter series with the 90-day limit by exempting source meters not attached to a household. Further: a maximum on the membership register, data subject rights as a bullet, a security baseline as grammar with the registers I14 itself creates named as processing, six repairs to I14 including exclusion on history and an allow-list under a standing flag, an arbiter and a refusal ground for the section 9 access regime, the gift safeguarding review written out with a tipping-off ban and a release route for the block, bounds on the decoy including that it never operates against a demanding authority, a staffing model and budget for every role this grammar has created, a fixed content-independent suppression notice, a data branch with a proportional sanction ladder in section 11 and named data acts in section 15, and a recruitment ban for people at a confidential address as a go criterion. Four test vectors added (TV32 to TV35). The rejection stands until the blocking set is carried into all carriers and checked by someone other than the author.

• v0.10, 20 August 2026: remaining privacy amendments after council review 8. v0.9 carried six amendments; this version carries the rest of the core-specification side. New core invariant I14 on internal access: every consultation of a member-identifying record authenticated to a named person, in a tamper-evident access log, disclosed to the member within an interval, with household, address and first-degree relatives technically excluded, member-set exclusions invisible to those excluded, bulk export requiring two people and published as an event, and data role separation on a par with the monetary one. The council noted this invariant was missing entirely, so it is written out in full rather than sketched. Retention limits and data minimisation move from the house-rule column into the grammar with maxima per category, exceeding one is a grammar break, and the settlement interval becomes a §14 parameter with a published minimum; per-identity tax aggregates are abolished outright rather than purpose-bound. The unmasking transcript is split into an immediate public counter (numbers per interval, category of authority, legal basis, also when zero) and a private inclusion proof to the data subject, with the identifying part under a salted commitment during any ordered deferral; trustees release no share without an inclusion proof and never reveal an ongoing investigation. The concentration register becomes non-public for natural persons (anonymised shares, identity only on substantiated legitimate interest with logged access and notice to the holder, legal persons named, a dual relative and absolute threshold, no public departure date): amendment A14 from council review 2 finally lands after sitting unimplemented for three versions. H1 mutual audit is bounded to signed aggregates, tree heads and attestations plus sampled redacted verification, with no connection, account or identity level data crossing an instance boundary in any form. Art. 22 becomes its own bullet covering dormant, ration placement, disputed freezes and straw-man aggregation, and automated graph analysis for the straw-man rule is forbidden. The gift valve is bounded with a per-recipient cap, a revocable 24-hour delay, a one-action standing block never disclosed to the blocked party, and a safeguarding review after three consecutive months. Member-identifying data is placed outside the estate in §12. Minors are decided in the affirmative: one person, one floor, with uniqueness established without publishing any token, no community attestations, guardianship representation without control over the floor, and carry-over at majority; they count in full in the per-capita divisor. Disputed and unreviewed dormant statuses expire automatically and status history is never published, transferred or returned on an opening. The safety route enters §7 as an acknowledged exception to I11: immediate redirection without announcement or waiting period, with the public view and every authorised opening continuing to show the previous destination and status, because the most dangerous adversary is often inside the same house and a public waiting period is itself the flight alarm; that break with the document's own aesthetic is stated rather than reasoned away. Phase 0 gets an explicit ban on any pre-built facility linking pseudonyms to persons, so the escrow is gone from the phase that will actually run and returns only in federation, inside the EEA or under adequacy, never under extraterritorial production law. DPIA and, at high residual risk, the art. 36 prior consultation must be completed and published before the first enrolment (I12, H6). Four test vectors added (TV28 to TV31). Process note carried over from A25: adopted amendments are from now on carried into all carriers, core, FEP, annex and both site languages, before the next council sits; A14 sat unimplemented for three versions while the legal annex already relied on it, and a panel that weighs a text which will not run is wasted.

• v0.9, 19 August 2026: privacy layer rebuilt after council review 8 (unanimous rejection). A full privacy panel (data protection officer, cryptographer, privacy lawyer, domestic-violence threat modeller, sceptic) rejected the design five to zero and the chair sent the privacy layer back to the drawing board. The monetary core, the measurement chain and I1 to I8 were out of scope and are untouched. Carried out here: the publication unit is fixed (I12), so individual accounts, balances, transactions, calls, queue positions and delivery records are never published in any form, pseudonymous included, and a holder verifies through a private inclusion proof instead; "pseudonymous entries" is gone from §10 and I11 is aligned. k-anonymity is grammar on every person-derived series (5 metering points, 20 identities, never finer than the published window) with an explicit suppression notice, and the entitlement divisor of §7 is rounded or banded and published yearly. The metering-point register is no longer public and the trough is verified from signed aggregates per technology and region plus accreditation and witness attestation, with topology (b) excluded from individual publication. The floor is decoupled from destination binding and paid as an energy-cost guarantee on the member's own bill. I9 reconciles against the metered sum or a blinded per-identity sum, with daily resolution at most, deletion within 90 days and a purpose limitation, and §10 gains an art. 9 clause. The delivery queue is published as aggregate depth and expected waiting time only, and the rationing ladder is public as a rule and never as an execution. Three honest notes. (a) Publication was the proof instrument, and at field-test scale that is not tenable: every published series built from person-bound deliveries is personal data before any cryptographic attack is attempted. (b) A3 deliberately trades verifiability for privacy: the bit-for-bit public recomputability that council review 4 had just tightened (A4.11) is given up, because its inputs are hourly series per metering point and a metering point is an address. (c) The promise that anyone can recompute the books does not hold below roughly 1000 participants; verification there falls back on delegated verifiers, and that sentence now stands in §2 and I11 rather than being written away. Nineteen of the twenty-five amendments from this review (A5 to A8, A10 to A16, A18 to A25) are not in this version and remain open.

• v0.7, 19 August 2026: second seam-closing round after council review 5. One B: B = (R - D) / M defined once in §1 and pulled through everywhere (meter rate I4/I5, pro-forma B, I2 test M <= R - D, headroom H = R' - D - M', target path, price anchor, hysteresis, H1 settlement); settlement burns the coin into D, delivery lowers R and D together. One E_content update rule: the temperature-resolved reference pair eta_charge_ref x eta_discharge_ref as the audited decomposition of eta_rt, never an alternative update path (§4). Re-anchor class pinned on the rolling 12-month signed sum with the automatic under-backed consequence explicit for both cumulative caps; three strikes evaluated after temperature correction (I1). Mint follows the recognised R increase: intake above the ceiling never mints, curtailed intake is its own meter line (§5); the unminted P25 difference is anchor-gated before it becomes headroom (§4). Cap rules unified: smaller of decision-M and effectuation-M, both net of window issuance, cumulative as a fraction sum, mandates lapse after one interval (I2). Cold verification discharge at pro-rata P_g level with validity C-rate; first-test bootstrap anchored to the pre-published design discharge power (§4). Commissioning anchor scaled to installed §14-approved capacity (I8). Two R-without-M categories in I1 (floor draw and queue delivery). I11 and §14 lists updated; P_g double derate removed (usable capacity before temperature derate, §6 and H8); ceiling prose formula gains the nameplate capacity factor. H8 reworded to the verified simulator state. Engine: E_content as its own field, D with settle/deliver/default ops, curtailment, windowed re-anchor sum with three-strikes counter, fraction-sum caps, anchor-gated unminted backing, reconciliation account and leakage-budget alarm. TV13 through TV15 revised; TV16 (queue invariance and delivery default), TV17 (P25 coefficient plus anchor-gated headroom) and TV18 (reconciliation account and budget alarm) added: eighteen test vectors. Honest note: TV15 (unflagged overhang as a green tick) and the seasonal bias of the re-anchor class were findings in v0.6's own repairs, and the A4.12 vector block mandated in review 4 is only now delivered.

• v0.8, 19 August 2026: category-scoped suspension and reachable return after council review 7. The v0.7.3 recovery rule was scoped on a name rather than a category: it suspended headroom minting while leaving the automatic minting of over-backing above the target path untouched, three bullets away in the same section, and that bullet still said under-backing freezes mint "beyond the p-margin", which is the very mint being suspended. The suspension now covers every mint against over-backing (headroom, target-path over-backing, buffer replenishment) while the purchase mint against recognised intake continues, since it is the recovery route itself (§5). The claim that the return was "reachable by construction" is withdrawn: it was disproved with algebra, since under pure purchase minting B converges to (e X - F) / (c p X), so at p = 1 or p = 0.99 the threshold is never reached however long the suspension lasts. Suspension is now stated as necessary but not sufficient, headroom is capped at the return threshold rather than at 1, target and recovery paths must end at or above 1 + m, and the steady-state attainable B must be published every interval during a suspension with a duty to lower p or revise the path (§5, §6, Annex A). Gates aligned: resumption follows whichever route set the label, and §6.1 now gates unbacked issuance on the same label, closing the window in which the unbacked route was open while the fully backed one was shut. Accrued headroom does not lapse but is released spread over at least one window with size and dates announced; the coverage blockade does not trigger on the suspension alone and never touches the purchase mint; §6.1(a) says so explicitly. Hysteresis window and margin are §14-bound with a maximum on the window and a minimum on m, frozen for the duration of an episode (§6). The cell-temperature reading that indexes derate(T_site) is mint-determining since v0.7.1 and now falls under sealing, the audit right, the GUM budget and a published cadence, with a fixed conservative aggregation rule (§4). Curtailed intake is defined as a declared, not measured, quantity from the signed inverter log, outside the I1 balance; "consecutive" is defined on scheduled anchors (§5, I1). Engine: the optional third min-term is gone, the content factor is the only source of it and is mandatory, so the winter corner of review 6 can no longer be reproduced by a default call; a real two-way label transition replaces the test hook; a below-book calibration anchor now writes down through the re-anchor class instead of returning silently; unminted backing is checkable. Vectors: TV1, TV17, TV21 and TV22 revised, TV19, TV20, TV22, TV23 and TV24 prose added along with TV19 to TV21, and the Annex B count is now tied to the runner output instead of a written-out number that has expired three releases in a row. Honest notes: the review-6 vector block for the P25 route was only half delivered in v0.7.3 and is completed here; the headroom cap is written in the exact-threshold form rather than the literally mandated subtractive form, because the subtractive form overshoots and leaves the covered equilibrium just below 1 + m, which is the same defect the simulator has just corrected.

• v0.7.3, 19 August 2026: reachable recovery (finding by the author, reproduced in the simulator). The return condition of the hysteresis (B >= 1 + m for a full window) was unreachable for an instance that mints its full headroom, because headroom minting pins B at 1 by construction: once under-backed, permanently under-backed, while the reserve was in fact recovering. Reproduced in the public simulator, where the over-backing cushion pinned B at 1.0195 just below the 1.02 return threshold and the label never returned across 120 simulated days. Fixed: headroom minting is suspended while the label is under-backed and resumes only after the label has returned (§5, mirrored in §6 and Annex A). Simulator fixed identically, with a live countdown to the return on the status card. Test vector TV22 (under-backed, recovery, return) added: twenty-two test vectors.

• v0.7.2, 19 August 2026: homework batch after council review 6 (A6.5 to A6.10). Window-expiry vector added (a re-anchor deviation genuinely leaves the rolling 12-month window; an unwindowed implementation fails it). Queue vector made discriminating (headroom mint of 150: gross allows, net refuses). Curtailed meter line unit fixed to recognised content kWh with the AC-boundary equivalent stated. Nameplate wording aligned across §1, I7 and Annex A; headroom formula written out including the anchor-gated term. In-magnitude clarifier on the re-anchor class cap. Non-confirming anchor defined: the gate releases only at the first confirming anchor, a below-book anchor writes down and never releases; engine coupled to that condition. Twenty-one test vectors.

• v0.7.1, 19 August 2026: surgical fix batch after council review 6. The P25 mint route minted over raw intake under a binding ceiling and could exceed the temperature-resolved content factor in a cold snap; both reproduced by the council chair against the reference engine. Fixed: minting prorated to the recognised intake only (engine), and a third min-term in the mint coefficient (the temperature-resolved reference product of the same interval), mirrored in the loss partition of the metering section. Reference-pair re-anchoring now explicitly after the published temperature correction; hanging referent removed. Simulator: the floor stream follows the daily demand profile and the bank-run log text now states settlement hour by hour at the then-current meter rate. Two vectors added (P25 under a binding ceiling; cold-month coefficient follows the reference): twenty test vectors. Remaining council-6 homework (window-expiry vector, discriminating queue vector, curtailed-intake unit, nameplate wording, in-magnitude clarifier, non-confirming anchor) runs parallel to external review.

• v0.6, 19 August 2026: seam-closing round after council review 4. Double-bounded delta cap: the running 12-month signed unexplained sum is published per interval close and, when positive, deducted in full from the lower-bound valuation of R (unexplained room is never mintable); re-anchor deviations of E_content form their own stock-scaled delta class with a three-strikes same-sign alarm (I1). E_content update rule fixed (reading C): content follows the rolling audited eta_rt, independent of the mint coefficient; the difference is unminted backing (headroom), never leakage and never an unexplained delta; reference split rule with eta_charge_ref/eta_discharge_ref under §14; P25 fallback below 12 monthly values (§4, §5). Reconciliation account is its own explained meter category outside the unexplained cap, bounded by the leakage budget plus margin (I8); above-budget leakage parked until audit attribution, operator consumption and theft charged to the instance, never to holders (I8); leakage budget as a §14 house rule (tighten always, widen only via the slow protocol with accredited measurement) and the anomaly bound also tested against the commissioning budget (I8). Uncertainty budget: tighten-only at unchanged hardware, widening only via §14 with metrological justification, effective in R the same interval (I1, §4). Delivery queue D deducted from every published balance and from B (B = (R - D) / M), flow balance reconciles against R + D, T-maximum §14-bound, delivery default sets under-backed regardless of B (§6, §1). P_g formula derated at the site's P10 winter conditions with usable capacity = the audited ceiling and, under topology (b), the grid-connection term net of contracted household load (§6, mirrored in H8); test discharge level pinned to the string's pro-rata share of the live-published P_g and the accreditation anchor (national accreditation body) restored, derate curves valid only after a verified cold discharge per technology generation (§4). H8 reworded to "partially validated" with the current simulator state. P10 winter trough pinned bit for bit: divisor = active Basispuls entitlements per 1 November, hourly window step, nearest-rank percentile, storage fully excluded from the production sums (§7). I2 caps computed on decision-moment M excluding flagged issuance in the rolling window (I2). Floor draw named in the I1 event enumeration and reconciled per interval against pseudonymous Basispuls delivery records (I1, I9). Engine: persistent audited ceiling with clamp alarm, re_anchor operation with running signed delta sum, decision-base caps; TV14 (re-anchor cap) and TV15 (ceiling clamp) added: fifteen test vectors. Note: the throughput-scaled delta cap of v0.5 was itself the fatal finding of review 4; the pendulum from a too-strict to a too-loose cap is now double-bounded.

• v0.5, 19 August 2026: measurement-chain repair round after council review 3 (battery metrologist). R redefined as min(tracked content, audited ceiling): E_content from the sealed flow balance with monthly calibration anchors; SoH x DoD x derate is a ceiling, never a value (I7). The 0.25%-of-M delta cap replaced by the expanded GUM uncertainty (k=2) over 12-month throughput on signed deltas (I1). Loss partition between eta_rt and leakage; mint coefficient = min(rolling eta_rt, P25 of 12 monthly values) (§4, §5). Leakage budget, reconciliation account, modelled-write-down naming and 1.5x anomaly bound (I8). Condition-bound capacity tests (rated power, P10 winter temperature, ISO/IEC 17025/17020, IEC 62620/61427-2), quarterly string rotation, 72-hour write-out, BMS log under audit (§4). Metering-boundary topology; phase 0 park-only (§4). Floor draw replaces flagged Basispuls accounting: own live meter category outside the I2 caps, capped by the floor size (I9; economist dissent noted). The p-rule rewritten (cost stack, valuation basis, SoC shadow cost, regulatory wedge named). Recovery fraction stays 0.2; escalation via buffer burn (§6.1). Minimal power-coverage variant normative: live P_g and delivery queue, I4 escape clause removed (§6). P10 winter trough recomputable bit for bit on registered production meters (§7). Custodian foundation, MiCAR position and euro firewall as MUSTs (§12); no automated floor extinguishing (art. 22, §7). Costed assurance budget and economic go-gate (H6). §16/§17 became Annexes A and B; only §1 through §15 bind. TV9 revised, TV12/TV13 added: thirteen test vectors. Note: two v0.4 repairs (the 0.25% delta cap and the SoH-based R definition) were themselves the fatal findings of review 3.

• v0.4, 19 August 2026: hardening round after council reviews 1 and 2. Document cut into Core (normative) and Horizon (non-normative). Labels renamed to fully backed/under-backed (the public term fiat status remains). Claim definition as a floating claim; price anchor 1/B. Mint times eta_rt at the sealed AC metering boundary; R via the SoH regime; GUM tolerance with a cumulative delta cap; MID metrology. New invariants: atomic flagging (I3), forward pricing (I5), record date (I6), Basispuls seniority (I9). Recovery path with teeth, quantity caps, emergency-mandate cooldown, genesis clause, distributional honesty, indexation realism, hysteresis exception, crisis playbook. Leakage split with a quarterly rate; tax redesigned (flat plus large holdings); enforcement and legal-form articles; unmasking via threshold escrow with a public transcript; DPIA admission requirement; honesty section (no credit); rent guarantee to Horizon; pilot route; eleven test vectors. Renumbering: old I3→I4, I4→I9, I5→I7, I6→I8, I7→I10, I8→H2, I9→I11, I10→I12, I11→I13, I12→H3.

• v0.3, July 2026. Reference kWh as an algorithmic index (T2); Anchor reference design; eight test vectors with a reference engine.

• v0.2. Mint function (M1) and self-policing tolerance (T1) resolved.

• v0.1. First rule set.

References

• CBER handbook, https://cber.robingenis.com
• Council reviews 1 (flagged issuance), 2 (overall design), 3 (measurement chain, with battery metrologist) and 4 (measurement-chain verification), 19 August 2026, this same dossier. Privacy reviews 8 (unanimous rejection), 9 (rejection upheld) and 10 (rejection withdrawn, panel declared redundant for this layer), 20 August 2026, same dossier.
• [RFC2119] Key words for use in RFCs to Indicate Requirement Levels, 1997
• Related work: GNU Taler, https://taler.net (candidate payment layer; see §10)
• [FEP-521a] Representing actor's public keys (FINAL); [FEP-8b32] Object Integrity Proofs (DRAFT); [FEP-ef61] Portable Objects (DRAFT). Statuses verified against the FEP index, 2026-07-17.
• FEP-5fcf: the Anchor protocol (companion draft; revised in parallel with this specification).

Copyright

To the extent possible under law, the authors have waived all copyright and related or neighboring rights to this work ([CC0]).