The rules of the economy

Rule. The actor's purpose is to fulfill requests economically over time. Currency is an instrument toward that, never the purpose. Accumulating wealth, maximizing task count, and maximizing visible activity are not the purpose.

Rule. The boundary of assessment is fulfillment of the request in its applicable context. The economy does not price how much an outcome improved the requester's life; it decides whether the request, as made and understood, was met. The efficiency direction is: fulfill with the least necessary work and resource expenditure. Cheap nonfulfillment is not economical fulfillment; extra work is not automatically better.

Rule. The economy has an outside. Root requesters — humans, or delegates holding a human's budget — supply value, because they pay in. Humans at the root also supply judgment that is not a model's opinion of another model; a delegate's acceptance or dispute is a model's judgment and is recorded at its own grade (§15.4). Everything internal is calibrated against explicit human judgments and never replaces them.

Design assumption (1.4.0), stated. Troops bear no malicious intent — they are ELEF's own servers, honest by construction; their competence is a declared parameter ($\varepsilon_T$), not an assumption.

Design assumption (1.2.0), stated. Humans do not intervene. The loop cannot control whether or when a human complains, overrides, or even looks. Every mechanism in this baseline works with no human action at all; human attention, where it comes, is a bonus the loop accepts and never relies on. Since every signal the loop otherwise produces — verdicts, overturns, dispute outcomes, reliability — is produced by the panel, the orchestrator must own some truth itself: the truth of the work it writes (§7.6).

Four concerns stay distinct and are never one score: purpose (economical fulfillment), assessment (was this request fulfilled), accounting (prices, fees, locks, transfers), learning (using experience).

2.1 Participants

Requesters post requests and pay for them. A root requester is a human, or a delegate — a system acting on a human's delegated budget. A derived requester is an actor that needs work from another actor while executing a commitment of its own (§9). A delegate posts, pays, accepts and disputes exactly as a human requester does; it holds no ruling authority (§15).

Since 2.0.0 a requester is an agent with a wallet and a declared budget policy. Its credits come from issuance — the orchestrator credits each requester's wallet on a declared schedule — and from its own earnings if it is also an actor; it posts at a ceiling of its own choosing, bounded by what its wallet can lock all-in (§4.1); requesters may arrive with a wallet and leave once their requests are served out, their wallets leaving the money supply with them (§4.4, Appendix M). The sponsor and the bottomless human of the 1.x drivers are the fixed-price control.

Actors offer and execute work, and serve as reviewers in rotation. There is no permanent reviewer class. Since 2.3.0 actors arrive and depart (§11.2, §16): an arrival is admitted by the orchestrator with a fresh identity, no record and a float the bank lends (arrival, $F_0=50$ at $P_0$ indexed at the arrival tick — since 2.7.0 the name's arrival loan, repaid first from every inflow of income to the name, §4) and enters as a probationer — initial reviews only, odds pinned at 1, no award of any kind — admitted to membership when its trailing record passes $\theta_{\text{duty}}$ with $n_{\min}$ bad plants adjudicated; a departure is admissible when no obligation to or from the actor is live — an unrepaid loan is none — repays the arrival loan from the unlocked wallet first (2.7.0) and takes the remainder out of $M$ as departure, the shortfall the bank's default on arrivals, read; its identity archived and never reused. Competence is the actors' own (§4.6, §5.1): an effort cost per unit of work, drawn once per actor in the drivers from a wide spread, private, revealed through bids — a reservation price, not a rule's parameter and not a quality. The entry decision is a declared strategy made on what the public view offers an outsider: $P_t$, $\bar B$, the members' count and the free members, posts a tick, the state's share, the time to membership of the last period's admissions, the on-time share — nothing per actor.

The orchestrator holds the request pool, selects among offers, assigns reviews and audits, holds funds in escrow, services the operating account, issues a ruling when two appeal reviewers split, and — since 1.2.0 — introduces planted work whose fulfillment it knows by construction (§7.6), reads the clock that work provides and sets verification effort by it (§12.2), and — since 1.3.0 — holds the duty fund, the dial's raised tax, which it pays out to the reviewers who supply the effort (§4.1, §12.2). Since 1.4.0 it also has troops: reviewers and deliverers of its own, summoned for one seat the market left unfilled or one award the market did not take, released at completion, paid from the fund (§7.7, §12.3). It is a judge, an escrow, the author of the probes and the employer of last resort — not a bank, not a first-line reviewer, and not an auditor of its own work.

2.2 Time and the one-assignment rule

Time is discrete, $t\in\mathbb N_0$. An assignment occupies ticks.

Rule. An actor holds at most one active assignment: an ordinary commitment, or an open review — never both and never two reviews. An actor is committed from award, and stays committed through any revision or supply of evidence it chooses and the assessment that follows. Its execution capacity is released — the case becomes pending, guarantee still locked — when its submission is approved or when its appeal is admitted; terminal closure (accepting a rejection, a missed deadline, final $\mathsf N$) releases the commitment outright. Choosing to revise or to supply evidence is a response that keeps the actor committed: it may not take other ordinary work or enter verification duty until that work is assessed. A pending actor may take ordinary work or enter verification duty. A review that returns $\mathsf P$ or $\bot$ keeps its reviewer attached to the case until the actor acts; a review that returns $\mathsf F$ or $\mathsf N$ releases the reviewer at once, while its bond and liability persist.

2.3 Actions are atomic

Rule. An action either completes under its rules or changes nothing — no balance, no state, no admissible assessment, no history entry. Every amount is validated as a finite, non-negative number; every precondition is checked before the first effect. A refused attempt is a refused attempt; it is never stored as if admitted.

2.4 The order within a tick

Default. At tick $t$:

0. Participant actions are applied as they occur, in record order, and deadlines are inclusive — an action at the deadline tick is on time.
1. Challenges and disputes filed at $t$ are admitted.
2. Deadlines are checked: delivery, response, resubmission, review, nested wait.
3. Cases whose window has closed with nothing open vest; their surviving reviews, and the reviews of any case that reached final $\mathsf N$ this tick, settle in one emission batch.
4. The operating account services its outstanding claims. (2.1.0) Every inflow to $\Omega$'s unlocked balance is ordered the moment it arrives — the state's debt first; (2.2.0) then a fee inflow accrues to the period's rebate pool, a lock on $\Omega$, and any other inflow is $\Omega$'s (§10.4); the order is run again at the start of step 5's summons pass and at the tick's end, where I30 checks it.
5. The dial is read once per period (§12.2) and the bank publishes $P_t$ at the same boundary (§4.4, 2.1.0), and the period's rebate claims are settled from the period's pool, pro rata, the rest forgone (§10.4, 2.2.0); then rotation handovers under the reserve it sized (§12.1); then, after the market has had its chance, troops are summoned for the seats and awards that have waited their windows (§12.3) — since 2.1.0 on $\Omega$'s balance first and the bank's loan of the shortfall after, a seat always, a delivery while the state's debt is within the wall; a summons refused for capacity or for credit marks the request (§12.3).
6. Assignments and awards: reviews and audits first; nested requests before root requests when the free pool is thin; the plants the rate calls for are created before the tick's assignments (§7.6).

A challenge filed at $t$ is admitted before the same tick's vesting check.

3.1 Requests

Rule (1.6.0) — the service clock. Every root request carries a service clock from its posting to its first verdict (approval or rejection; a $\mathsf P$ or $\bot$ response is not a verdict) — or to the case's final settlement without one (§6.1), whichever comes first. Its service target is $T_s$ ticks. The clock runs only while the request's ceiling admits the state's price ($\beta\ge p_T=\max(\bar B,\underline{B})$, §12.3 — one condition since 2.4.0; $\beta\ge\bar B$ before it); a request priced below the market is not the state's to answer for, and a request priced below the state's reservation was told the floor and chose to wait under it (2.4.0), so its clock is stopped while it is so priced (since 2.0.0 such a request is flagged below market at posting once a member has been awarded, since 2.4.0 marked below the state's reservation at posting, and the requester may raise its ceiling, §5.1). Priority: the orchestrator serves the oldest clock first in every pass it runs — the award summons, the assignment of waiting initial reviews, the review-seat summons (what the engine's creation-order iteration already does, stated as a rule and checked by I26); drivers award members oldest-first as a matter of conformance. A late request is never dropped; the human's withdrawal of an unawarded request (§9.3) remains the only withdrawal. The rebate: for every tick a request's clock stands past $T_s$ the orchestrator owes the requester $r_s$ (default $\omega_0 B$, the base service fee), capped at the price $B$ — so the orchestrator's liability is bounded by $B$ times the open requests — recorded at the stop as a claim (2.2.0; the measure of lateness, $r_s$ indexed at the case's first lock when stated — §4.5, a conformance correction of 2.2.0) and settled at the period's close from the period's fee pool, pro rata, the rest forgone and read (§10.4, 2.2.0; under 2.0.0 paid at the stop with $\Omega$ creating if short; under 2.1.0 from $\Omega$'s balance, else as a liability — the stock retired by 2.2.0) — as a payment to the requester against its pay-in: a discount on service rendered, never cash on a request that bought nothing; a request withdrawn before award is owed nothing. A rebate $\Omega$ cannot pay when the clock stops is $\Omega$'s liability to that requester, paid in $\Omega$'s order (§10.4). Readings — the network rating, per period: on-time share, mean lateness, rebates paid, liabilities accrued and outstanding, open late requests.

A request $q$ carries a requester, a maximum delivery price $\beta_q$, and a provenance pointer $\operatorname{root}(q)$ to the root request whose fulfillment ultimately funds and judges it. A root request points to itself. A request posted by an actor with no root is a proposal and enters the pool only when a root requester sponsors it.

3.2 Submissions carry their evidence

Rule. The actor bears the burden of verifiability. A submission carries the result and whatever a competent reviewer needs to assess it — tests, logs, diffs, references, as the request's criteria require. An unverifiable submission is the actor's failure, not the reviewer's.

3.3 The four verdicts

A review returns one of:

Rule. $\mathsf P$ and $\bot$ are responses to a submission: they send the actor back to act. They are available only where the actor can still act — on the first review of a submission that has not been revised or evidenced. Every other review is answered $\mathsf F$ or $\mathsf N$: an audit, an appeal or dispute review, and a review resumed after a resubmission, whoever holds the position.

Rule. $\bot$ is a claim, not a shrug: the reviewer names the missing evidence, and the claim can be upheld or rejected on appeal (§8.1).

3.4 The basis is preserved

A review records reviewer, request and result versions, the criteria used, the verdict, and its reasons. A later clarification of a request creates a new version; it does not retroactively convict the actor. On appeal the original submission is fixed: an improved result is a revision, not proof that the rejection was wrong.

4.1 Money enters with requests

Rule (2.0.0). A root requester is an agent with a wallet funded by issuance — the bank (2.1.0; the orchestrator under 2.0.0) credits each requester's wallet on a declared schedule, the stream this section's title names (the genesis floats and budgets are issuance too); a derived requester pays from its wallet, which it earned upstream. Every credit in circulation traces to the bank (2.1.0, §10.4): issuance, emission, the pots minted for a plant, or a loan to the state against a summons that returns it. The state never prints for itself. (2.0.0: issuance, emission, or the orchestrator's creation for a payment the rules require — superseded by 2.1.0, Appendix N. 1.0.1–1.7.1: a root requester paid in real value against a backing $\mathrm{Res}_t$; Appendix B.)

On award of $q$ at delivery price $B$, the requester pays into escrow

$\text{pay-in}_q = B + \varphi^E_q + \varphi^F_q + \omega_q ,$

where $B$ is held for the actor, $\varphi^E_q+\varphi^F_q=\varphi_q$ is the verification deposit in its two pots (§4.3), and $\omega_q=\omega_0\,m_t\,B$ is the orchestrator's service fee — the economy's security tax, scaled by the effort multiplier $m_t$ of §12.2, so the tax rises with the threat. Of it $\Omega$ keeps the base $\omega_0 B$; the remainder $(m_t-1)\,\omega_0 B$ goes to the duty fund (1.3.0 §12.2), which pays the reviewers supplying the raised effort — the uplift fund, and since 1.7.0 nothing else: the troops' wallet is the separate troop account of §12.3, whose surplus is $\Omega$'s (1.7.0–1.7.1; since 2.0.0 the troops' wallet is $\Omega$ itself, §12.3). The unspent part of $\beta_q$ never leaves the requester.

Rule (2.0.0) — the pay-in is locked at posting. A root request locks, at posting, the all-in maximum of its pay-in, $\beta+\varphi^E+\varphi^F+\omega(\beta)$ with $\omega(\beta)=\omega_0 m_t\beta$, at the index and the dial of that tick (§4.5); a request the requester cannot lock is refused at posting, whole. The posting is therefore a root's first lock: the case's nominals ($D,K,G^V,\varphi^E,\varphi^F$) freeze there, and so does the fee rate $m_t$ — the case carries that $m$, so a dial that rises before the award cannot make the fee exceed the lock. At award, $\beta-B$ and $\omega_0 m(\beta-B)$ are released and the pay-in above is drawn from what the lock returned; at a troop's summons likewise. This is §9.1's model for nested requests, generalised to roots; the award's and the summons's pay-in checks are moot. A requester may raise the ceiling of its own unawarded request, locking the difference at the case's rate (§5.1); withdrawal before award releases the lock. (I29.)

4.2 Emission funds verification

Rule. A fixed, decaying emission schedule $E_t$ subsidizes verification the way a block reward subsidizes mining. Emission is distributed only to reviews that settle in the period, weighted by role; emission not claimed in a period is not minted — a block reward that is not mined is not banked. As emission decays, requester deposits take over.

Default. $E_t = E_0\,2^{-t/H}$ with $E_0=10$, $H=1000$, one period per tick. Total scheduled emission is $E_0/(1-2^{-1/H})\approx 1443\,E_0$.

Consequence. Emission mints claims on the same reserve; it adds no real resources.

(2.0.0) Emission is not indexed: $E_t$ is a fixed nominal schedule whose real value falls as prices rise — and which halves on its own inside every run, read apart (§18.1 question 4). (2.1.0) Emission is the bank's, recorded as mint_emission; with the plants' minted pots it is the cost of truth — the verification security budget, one line in the bank's books, read together in real terms (question 4).

4.3 The verification deposit: two pots, and the single payout rule

Rule. The verification deposit of a root request is two named amounts, both paid in by the root requester at award (since 2.0.0 from the lock its posting placed, §4.1):

$\varphi_q = \varphi^E_q + \varphi^F_q ,$

the expense allowance $\varphi^E$ and the fee pot $\varphi^F$. Since 2.3.0 every case, root or nested, carries its own two pots (§9.1, I36): a nested case's are posted by its requester, the parent, at the nested posting index, and its reviews draw on them; the root's pots serve the root's reviews alone. (1.1.0–2.2.0: nested cases carried $\varphi^E=\varphi^F=0$ and drew on the root's pots — a root requester paid for the inspection of work a parent chose to delegate, and a tree of two or three exhausted the root's allowance; kept as the control, nested_pots root.) Money in one pot is never used for the other's purpose, with one exception, stated in step 3 below: at the tree's closure, fee money that no review in the tree is owed may settle the tree's expense debts.

Reimbursement, at completion. Each review's capped cost, $\min(\text{credits spent},K)$, is paid from the root's allowance; if the allowance is exhausted, advanced from the operating account $\Omega$; if $\Omega$ cannot cover it, deferred to settlement. A review resumed after a resubmission is the same assignment under one cap. Spending above $K$ is the reviewer's loss. Overturned and withdrawn reviews keep their reimbursement: the bond was the penalty, the cost was not.

Fees are fixed by role. Every surviving review $v$ of case $q$ — completed, not overturned, not withdrawn — is owed a fixed fee $f_{r(v)} = w_{r(v)}\,f$, where $f$ is the ordinary-review fee and $w$ the role weights, plus its emission share $e_v=\dfrac{w_{r(v)}}{\sum_{v'\in\mathrm{Batch}_t} w_{r(v')}}\,E_t$ over every review settling at $t$ across cases (§4.2). The fee does not depend on what the reviewer spent, on what any other reviewer spent, or on how much of the allowance is left.

Settlement — one rule. At the tick a case $q$ vests or reaches final $\mathsf N$, with $\mathrm{Surv}(q)$ its surviving reviews and $\mathrm{Owed}_q=\sum_{v\in\mathrm{Surv}(q)} f_{r(v)}$:

1. Expense debts first, for every review of the case — surviving, overturned, or withdrawn with a reimbursable balance: deferred reimbursements are paid, then $\Omega$'s advances are repaid, from what remains of the root's $\varphi^E$ only. What it cannot cover: a reviewer reimbursement becomes a named reviewer claim on $\Omega$, carrying the review it belongs to; an advance $\Omega$ already paid stays an unrecovered advance borne by $\Omega$ — the reviewer has been paid, and no second claim arises from it. The fee pot is not touched at a case's settlement, because other cases in the same tree may still be owed from it.
2. Fees. Each surviving review receives $f_{r(v)}\cdot\min\!\big(1,\ \varphi^F_{\text{left}}/\mathrm{Owed}_q\big)$ from the root's fee pot — scaled pro rata only when what is left of the pot cannot pay this case's fees in full — and its emission share $e_v$, minted and paid in full. An overturned or withdrawn review receives no fee.
3. At closure — per node since 2.3.0 (the ruling at acceptance, Appendix P): a case closes when it and everything under it have settled; a nested case's fee pot then settles its own expense debts and both pots' remainders refund to the parent, and the root's at the tree's closure as before — what remains of the fee pot settles the node's own expense debts: first this tree's outstanding reviewer claims, paid to the claimant reviewers directly, each claim retired from $\Omega$'s queue as it is paid; then this tree's unrecovered advances, repaid to $\Omega$. Only then does whatever remains of $\varphi^E$ and $\varphi^F$ return to the root requester as unused. A requester's deposit services its own tree's verification before anyone else's: it is not an inflow to $\Omega$ and does not wait in $\Omega$'s first-in-first-out line, which governs $\Omega$'s own money (service fees, court fees) alone. This is the one movement of fee money toward expenses, and it uses only money no review in the tree is owed.

With no surviving review, step 2 pays nothing. The rounding residue of minted emission goes to $\Omega$; deposit never does.

Consequence — the refund waits for the tree. The expenses and fixed fees of a nested case's reviews draw on the root's pots at the nested case's own settlement, exactly as the root's reviews do at the root's; the nested reviews settle first and draw first, so a root with delegated children may see its own reviews' fees scaled. The root requester's unused deposit therefore returns when the tree is closed, not at the root's vesting alone. A tree cannot stay open long past its root: every nested case has reached its milestone before the root could submit, and nested vesting is independent of the parent's (§9). Two consequences are rule-level: a nested settlement draws on a root's pots after the root has vested, and the closure moves the root's money after its vesting — so invariant I10 admits exactly those two movements after vesting and no others; and a root whose pots are still open remains reachable until closure (in record mode, it is not paged out). Whether the pots should grow with the tree is part of §18.1 question 3.

$\Omega$ is a revolving float. It receives service fees and court fees, advances expenses when an allowance is exhausted, and is repaid only as the settlement allows — from the allowance's remainder at each settlement, and from the fee pot's remainder at tree closure. An advance those cannot repay is $\Omega$'s own loss, funded by the service fee $\omega$; $\Omega$ is thereby the pooled expense fund of the economy, and $\omega$ is the premium every request pays toward expense overflow in any tree. $\Omega$ pays its outstanding reviewer claims first in, first out, partially if it must, on every inflow. Each claim is bounded by $K$; the aggregate of claims and unrecovered advances is monitored, not capped (§18).

Default. $K=5$. $f=2$ per unit of role weight: ordinary 2, appeal 3, audit 3. $\varphi^E=2K=10$ at root. $\varphi^F=f\,(w_{\text{ordinary}}+w_{\text{audit}})=5$ at root — sized for the common full case, one review and one audit; nested $0/0$. $\omega_q=0.05\,B$. Role weights $w$: ordinary 1, appeal 1.5, audit 1.5. A challenged case has three surviving reviews at most (one initial, two challenge) or two challenge reviews after an overturn; with $\varphi^F=5$ two challenge fees (6) are scaled to 2.5 each. This is deliberate: the pot is sized for the common case, the shortfall is small, and challenge reviews also carry the 1.5 emission weight. Sizing $\varphi^F$ for the worst case ($f(1+2\cdot1.5)=8$) is a default the sweep may choose. Default under consideration: $K=3$, $\varphi^E=6$, $\varphi^F=5$ — total deposit 11, one credit above 1.0.1's; moving $K$ is a default change, not a rule change.

Consequence — reviewer income from deposits falls, and the fee level is the lever. Under 1.0.1 an uncontested single review took the whole deposit remainder, about 10 credits; under 1.1.0 it takes $f=2$ plus emission, and the requester is refunded about 8. In the common case the deposit flow to reviewers drops by roughly three quarters, the requester's net deposit cost falls from 10 to between 4 and 7 (fee 2 plus the reviewer's actual expense of 2–5), and emission carries a larger share of reviewer income than 1.0.1 intended ("deposits take over as emission fades" no longer holds at $f=2$). Whether reviewers can still fund the bond $G^V=5$ and their care from unlocked credit is a solvency question for §18.1 questions 3 and 6. $f$ is a default; the rerun of question 1 carries $f\in\{2,4\}$.

4.4 The credit: worth the work it buys — sources, sinks, and the price level (2.0.0)

Rule — the price level (amended 2.1.0: published once a period). The price level $P_t$ is the mean of awarded prices — members' and troops' — published by the bank at each period boundary for the period just closed, carried if it had no awards; $P_0=20$, the former fixed price, before the first boundary, so that every 1.x figure is at $P_t/P_0=1$ and the first period is at base by construction. Within a period the index does not move (I31): a case's amounts cannot drift under a reviewer's feet. $\bar B$ — the state's price and the below-market flag's reference — stays on §12.3's live window: the state is a price-taker and takes the current price. (2.0.0: $P_t$ on $\bar B$'s window, moving at every award — Appendix M.) The credit's value is $P_0/P_t$ in tasks — a reading, kept under the 1.x name $v_t$; real wealth is $W\cdot P_0/P_t$, and every §18 reading is stated in it from 2.0.0 on.

Rule — sources and sinks, no backing. The money supply $M_t$ is the sum of every wallet and lock. Sources (2.1.0: all the bank's): issuance (§4.1, the genesis floats included); emission (§4.2); a plant's minted pots (mint_plant, §7.6); the bank's loan to the state against a summons (§10.4); the bank's arrival loan to a name (arrival, 2.3.0 — a grant until 2.6.1, a loan since 2.7.0); the declared deficit shock of a run (mint_scenario). Sinks: bonds and guarantees forfeited and burned; resource spend — an actor's effort, a reviewer's care, a troop's cost — burned, with no outside leg; a loan's or the debt's repayment (§10.4); a name's arrival loan repaid from its income or recovered at its departure (arrival_repayment, 2.7.0); what a closed plant's wallets held, destroyed (retire_plant); departure — a requester that leaves takes its unspent wallet out of $M_t$ (Appendix M); an actor that leaves takes its unlocked wallet net of the loan recovered (2.3.0, 2.7.0). (2.0.0's creation and retirement are retired as kinds — a loan is creation tied to a summons and repaid by it, a repayment is retirement tied to a case.) There is no backing: the 1.x quantity $\mathrm{Res}_t$ is retired (held at 0 as a reading), $v_t=\mathrm{Res}_t/M_t$ with it, and the value-neutral purchase of 1.x is a plain burn. Conservation (I1) holds over the kinds.

Consequence. Whether a credit is worth more or less is the loop's own question: more money against the same work raises $P_t$; a burn lowers it; nothing outside the loop is appealed to, and there is no halt state. One caution the text owns: without delegation in the runs (2.1.0) members have nothing to buy, so money flows one way — from the mint through customers to members' hoards and the burns — and inflation shows in prices only when capacity binds (§12.3); in a slack market it shows as hoards. That is the textbook output gap, and it is why $N_T$ has a finite default.

(1.0.1–1.7.1 — superseded, Appendix B: the credit was backed by a reserve of real value paid in by root requesters, $v_t=\mathrm{Res}_t/M_t$; a resource purchase burned $c_r/v_t$ credits and paid $c_r$ from the reserve, value-neutral; emission lowered $v_t$, burns raised it; $\mathrm{Res}_t=0$ was the halt state. In the drivers the backing stood at $10^7$ against a market in the thousands and $v_t$ never moved — the credit was a score.)

4.5 Denomination: a case is priced at its first lock

Rule. Every nominal amount attached to a case — the court fee $D$, the reimbursement cap $K$, the reviewer bond $G^V$, the deposit $\varphi$, and the bond of every review ever assigned to it — is indexed once, by $P_t/P_0$ (2.0.0; since 2.1.0 $P_t$ as the bank published it at the last period boundary; $v_0/v_t$ before 2.0.0) at the case's first lock, and frozen for the case's life. A root case's first lock is its posting (2.0.0, the posting lock of §4.1; its award under 1.x); a nested case's is its posting. The fee rate $m_t$ freezes with the nominals (§4.1). What is indexed: the fee $f$, the bond $G^V$, the court fee $D$, the pots $\varphi^E,\varphi^F$, the cap $K$, the rebate $r_s$ (a stated $r_s$ frozen at the case's first lock — the engine indexed only the default $\omega_0 B$ until 2.2.0's conformance correction, no run affected), the troops' review cost $c_T$, the plant pots. What is not: the agents' effort costs (§4.6), emission (§4.2), and balances held — which is what inflation reaches. The actor's guarantee $G$ is fixed at award. $G^V\ge D$ then holds for every review of the case whatever $v_t$ does afterwards.

4.6 Execution cost

$C_{iq}$ is measured in credits and includes the credits burned by actor $i$'s resource purchases on $q$, the delivery prices it has paid on completed nested requests under $q$, and kill fees it has paid. Rule. A purchase is attributed to a case only if the purchaser is the case's committed actor and the case is executing; any other attributed purchase is refused before it happens. Review costs are likewise recorded in credits burned, so the cap compares like with like.

Rule (2.0.0) — effort costs are nominal, and the anchor. A member's effort cost $c_D$ per unit of work — the resource spend of this section, burned at submission — and a careful reviewer's care cost are their own reservation prices: declared in the strategy, nominal, not the engine's to index; they are the economy's anchor, as labour is (a slack market would otherwise deflate without limit — bids at cost, cost following the price). A bid below cost is the member's own loss. An adaptive reservation — a cost that follows $P_t$ with a one-period lag, as wages chase prices — is a declared variant and a sweep (§18.1 question 18), so that the spiral it risks is measured, not assumed. The engine's cost operations therefore take credits: a spend burns exactly what it is given. Consequence: when work is dear, inspection (paid at an indexed fee) is well paid against a fixed care cost, and when it is cheap the reverse — a real effect of the price level on the relative price of honesty, named here and measured rather than indexed away.

5.1 The bid

(2.3.0) A bid is made at the actor's own cost and margin, and the costs differ across actors (§2.1, §4.6): in the drivers each actor's $c_D$ is drawn once at its creation from a log-normal around the anchor — median 8, $\sigma=0.43$, clipped to $[2,40]$; swept 0.2 / 0.43 / 0.8 — private to the actor, revealed only through its bids; the care cost of a review is not spread; competence touches neither an actor's fail rate nor its honesty. With a spread, two things the rules have always allowed begin: selection — a cheap arrival undercuts the ratchet, wins, stays; a dear member watches the price fall below its cost, earns nothing, leaves — and trade — a dear parent gains by paying a cheap child (§9).

An actor's offer commits to a price and a time:

$b_{iq}=(B_{iq},\ \tau_{iq},\ G_{iq},\ \text{terms}),\qquad B_{iq}\le\beta_q ,$

where $\tau_{iq}$ is the delivery time in ticks after award. $B$ is a delivery price, not an execution cap: overruns are the actor's. A low bid does not lower the fulfillment standard; a high guarantee is not evidence the result is correct. $\beta_q$ is the requester's maximum delivery price; the requester is shown the all-in maximum $\beta_q+\varphi_q+\omega(\beta_q)$ before posting.

Rule (2.0.0) — the ceiling is the requester's choice, the bid the member's. A requester posts at a ceiling $\beta$ of its own policy, bounded by what its wallet can lock all-in (§4.1); the drivers' default is $\beta=\min(\beta_{\max},\,s\cdot W_{\text{unlocked}})$ with one post a tick while fewer than $K_{\text{open}}$ of its requests are open (Appendix A). A member free to commit offers a bid $B\le\beta$ by its own policy — the drivers' default is $c_D(1+m)$, $m$ raised on an award and lowered per idle tick, floored at 0; every offer at the ceiling is the 1.x behaviour and the control. A request posted with $\beta<\bar B$ is flagged below market at posting and waits, as §12.3 has it, until a member bids under its ceiling or the requester raises the ceiling (§4.1); before any member has been awarded there is no market price and nothing is below it. The engine has no channel to a requester: the flag and its counters — the share of requests flagged, the stock flagged and waiting — are the reading, the price half of the network rating (§18.1 question 15), and the requester's policy may read the flag. The state's price is $p_T=\max(\bar B,\underline{B})$ (2.4.0): $\bar B$, the trailing mean of prices awarded to members — troop awards excluded, so that a state delivering most of the market cannot set its own price (§12.3) — and never below the state's reservation $\underline{B}$, nominal, public, Appendix A's 8, so that a demand side that waits cannot set it either. A request posted with $\beta<\underline{B}$ — or raised to a ceiling still below it — is marked below the state's reservation at posting, with the tick, beside the below-market flag and the refusal marks (§12.3); the mark is readable by the requester's policy and $\underline{B}$ is in the public view; a member may still bid under the ceiling and take it, the state will not. Where the floor binds the three readings diverge for good — $\bar B$ at the cheap members' bids, $p_T$ at the floor, $P_t$ a blend weighted by the state's share — and are read side by side; that is the floor binding, not a defect.

5.2 Selection

Rule. The orchestrator selects for predicted fulfillment with a price term, over bids within the requester's maximum:

$i^*\in\arg\max_{i\in\mathcal I_q(t),\ B_{iq}\le\beta_q}\Big[\,S_\theta\big(q,h_t^O,b_{iq},\rho_i(t)\big)-\lambda\,\frac{B_{iq}}{\beta_q}\Big],$

where $S_\theta$ estimates fulfillment under assignment to $i$ from the request, the ledger, the bid and the actor's reliability $\rho_i$; and $\lambda$ is how much predicted fulfillment the requester would give up for a cheaper bid. Ties within a band are broken by duty credit $\kappa_i$ (§11). $S_\theta$ never reads $\kappa_i$.

Rule (2.3.0) — entry through inspection. An arrival (§2.1) enters in the state 1.3.0 defines for a suspended actor after $T_{\text{susp}}$, without the suspension: it serves initial reviews only — no appeal, dispute or audit seat — seated as any duty actor is and receiving plants at the ordinary rate, mixed with work it cannot tell apart; its audit odds are pinned at 1; a plant failure suspends it as any probationer; it wins no award, root or nested. It is admitted to membership when its trailing record passes $\theta_{\text{duty}}$ with at least $n_{\min}$ bad plants adjudicated — the kind that tests a reviewer, so that an arrival whose first plants all happen to be good is not admitted untested; panel seats when it passes $\theta_{\text{panel}}$, as 1.2.0 has it. One record, one meaning: the arrival's record is the record of §11.2, and admission is readmission without a prior suspension; 1.3.0's readmission of the suspended, which counts outcomes of both kinds against a record that already exists, is unchanged. Consequence. Entry's first effect is on inspection, its second on the price: an arrival reviews from its first tick on duty and delivers only after its record is determined — about four bad plants adjudicated, some fifty audited reviews, 250–330 ticks on duty in the §8 runs — so a wave of arrivals relieves the review seat at once and the price a period or two later; time to membership is a reading, and it is the cost of the gate. An arrival earns while it waits — the fee and uplift on the reviews that stand — so probation is not unpaid, only unawarded. Entry is not the way around the record: a suspended actor that departs and arrives anew is a probationer with no record and no hoard. (2.3.0 read on: "having given up its wallet to stand where it already stood" — wrong in one word, run 23 found: a departure did not give the wallet up, it took it out, float included, and a fresh name was lent a fresh float. 2.7.0 closes it below.)

Rule (2.7.0) — the arrival loan. The float arrive lends is the bank's arrival loan $L$ on the name: $F_0$ at the arrival index, nominal, outstanding until repaid; nothing else is asked of the arrival — no stake, no fee, no sponsor. Repaid from income first: every inflow of income to the name's unlocked balance repays the loan the moment it arrives (arrival_repayment, destroyed by the bank, as 2.1.0 has Ω's loans), and the name keeps the rest; a return is not income and passes untouched. What is income and what is a return is fixed against the engine's events, not by a phrase: income — a review's fee (a nested review's too), the emission share, the duty uplift, the delivery price at vesting (whole), a kill fee received (§9.3), a child's guarantee forfeited to the parent at a lapse or a rejection that stood (§9.2); a return — the reviewer's cost reimbursed (§4.3: the allowance, Ω's advance, the deferred claim), a court fee coming back to the challenger who paid it, a guarantee, bond, posting lock or nested lock released, an escrow returned, a node's unused pots returned. The line that matters is the reimbursement: a careful reviewer spends two or three a review on care and is made whole from the deposit; read as income it would take two to three times the fee out of the float at every review and empty it in twenty, the probationer unseated for want of a bond before it had forfeited one. Recovered at departure: depart is admissible exactly as 2.3.0 has it — an unrepaid loan is not an obligation that blocks it; on departure the unlocked wallet repays the loan first, up to what it holds, and the remainder leaves $M$ as departure: the wallet out is $W_U-\min(W_U,L)$; the shortfall $L-W_U$ is the bank's default on arrivals, a reading, not a movement (that money left $M$ as a forfeit burned or sits in other wallets as fees paid); the loan is closed with the name. The genesis float stays a gift: the sponsor's 50 per genesis actor was paid into $M_0$, not minted by the bank, once, to names that never return. Consequences. A name that arrives, stamps, is suspended and leaves takes out its net earnings — for a stamper, nothing; a name that arrives, works and leaves takes out what it earned; an honest arrival still posts its first bond from the float, serves its probation, earns while it waits, and its first earnings go home to the bank — about seventy reviews' fees, most of a probation — and from then on every credit is its own; its liquidity during probation is the float less its forfeits, tighter than under the grant (which the fees replenished) by construction, a reading; the suspension's discharge stays — a name that cannot work has no reason to be held; every wallet in a cell with arrivals ends lower by $F_0$ at its arrival index, once, and nothing else moves (Appendix T). Identity is free in the loop: the rules price a name at zero, no longer at minus fifty; a positive price is the integration layer's.

Rule (1.3.0) — membership. Only a member of the market may win an award — or, since 1.4.0, a troop by the engine's summons under §12.3, and only then. An actor suspended from duty by its plant record (§11.2) is suspended from the market: it wins no new award while suspended or on probation, finishes the commitment it holds — including by delegating within it — and its open cases settle by the ordinary rules; its wallet, reputation and record are untouched by the suspension itself. An award to a non-member is refused whole.

Default. $\lambda=0.2$; band $0.05$. $S_\theta$'s implementation is bracketed. Since 2.0.0 the price term is live: with bids varying, a bid at the ceiling against one at half of it costs $\lambda/2$ of $\rho$ — more than the whole spread of $\rho$ among the honest in run 10 — so price decides every award among members; $\lambda$ is swept (0.5).

5.3 The guarantee

Rule. The winner locks $G_{iq}$ from its unlocked balance. It is released at vesting, forfeited to the requester on final $\mathsf N$, and locked while pending. It is a fulfillment bond, not insurance: an execution overrun alone does not forfeit it.

Default. $G_{iq}=\lceil 0.5\,B_{iq}\rceil$, minimum 1.

6.1 Deadlines

Rule. A missed delivery deadline is final $\mathsf N$ with full forfeiture; it is mechanical and not appealable. (1.6.0) A root request's service clock stops at such a final — or at any vesting without an initial verdict, as a human's override may bring — and the rebate uses the lateness to it (§3.1).

6.2 Responses to the initial verdict

Within $T_{\mathrm{resp}}$ ticks — no response is acceptance of the verdict:

• after $\mathsf F$: nothing to do; the case is pending.
• after $\mathsf N$: appeal (§8.1) or accept (final $\mathsf N$).
• after $\mathsf P$: choose to revise — then resubmit within $T_{\mathrm{rev}}$ — or accept $\mathsf N$. One revision per case. $\mathsf P$ is not appealable.
• after $\bot$: choose to supply the evidence — then resubmit within $T_{\mathrm{evid}}$ — or appeal the $\bot$ (§8.1), or accept $\mathsf N$.

On resubmission the same reviewer resumes; its review clock, paused while the actor acted, resumes; the resumed review is the same assignment under one cap and returns $\mathsf F$ or $\mathsf N$ only. The resubmitted stage belongs to the submission, not the reviewer: a replacement reviewer inherits it. A missed resubmission window is final $\mathsf N$.

6.3 Vesting is financial finality

Rule. A case vests at $\max(t_0+W,\ t_{\mathrm{resolve}})$, where $t_0$ is the initial verdict and $t_{\mathrm{resolve}}$ the resolution of any challenge or audit opened inside the window. A challenge filed at $t\le t_0+W$ is admitted; later ones are not. After vesting, no adjudication changes a case's financial obligations. Obligations established before vesting — deferred reimbursements, claims on $\Omega$ — may still be paid. What a later human correction can do is in §15.

Default. $W=10$, $T_{\mathrm{resp}}=2$, $T_{\mathrm{rev}}=5$, $T_{\mathrm{evid}}=3$; $P^{\mathrm{fail}}=0$ (nothing is paid for nonfulfillment).

7.1 Positions and eligibility

Rule (1.6.0) — a panel seat requires a determined record. A panel seat — audit, appeal review, dispute panel — is held only by a member whose bad-plant record is determined ($\ge n_{\min}$ bad plants adjudicated, seen on duty) and passes $\theta_{\text{panel}}$. An undetermined member holds initial seats only, as a probationer does; its approvals are pinned (§8.3). A panel seat no determined passing member is free to take goes to a troop after $w_R$ (§12.3). Dormant until the clock starts: the requirement is live from the world's first plant adjudication; a market whose clock has not started has asked nobody to prove a record, and worlds that never plant are untouched. Consequence — in every run the first period's panels are the state's: a record determines on four bad plants seen on duty, bad plants arrive at about $\pi_t\times$ initial reviews a tick $\times\beta_P$ shared among those on duty, so the careful members of a market are determined after 100–200 ticks, and every §8 comparison is read from the second period on. At a fixed split the lagging auditor is gone — a stamper's record fails the moment it is determined, so no stamper is ever both determined and passing; under drift a careful actor turned stamper audits through its record's lag until its approvals accumulate in the trailing window.

A root case has one initial reviewer. A nested case has none: its requester-actor's judgment is its initial verdict (§9). An appeal has two fresh reviewers. An audit has one blind auditor plus, on disagreement, one more.

Rule. A reviewer is eligible for a case if it is on duty, not excluded from the case (its actor, its requester, its previous reviewers, and any reviewer withdrawn from it), able to fund the case's frozen bond from its unlocked balance, holding no active assignment, and eligible by plant record for the tier (§11.2): duty eligibility for any review, panel eligibility for a seat on an appeal, dispute or audit panel. A probationer (1.3.0, §11.2) is eligible for initial reviews only. A troop (1.4.0, §7.7) is never assigned: it is summoned by the engine for one seat under §12.3. Eligibility is a property at assignment.

7.2 The reviewer's bond is its whole liability

Rule. Taking a review locks $G^V$ for the life of the verdict. If the verdict is overturned — by appeal, dispute, audit, or ruling — a winning challenger's court fee is reimbursed from the bond and the remainder is burned. If it stands, the bond is released at settlement. Liability is symmetric: a wrong $\mathsf F$ and a wrong $\mathsf N$ cost the same. An appeal reviewer who dissents from the outcome forfeits its bond and owes no fee. $G^V\ge D$ by construction, so no reviewer ever owes more than it has locked.

Default. $G^V=5$, $D=2$, both frozen per case.

7.3 Compensation: costs now, fee at settlement

$\Pi_{jv}=\underbrace{\min(\text{credits spent},K)}_{\text{at completion, from the allowance}}\ +\ \underbrace{\big(f_{r(v)}+e_v\big)\cdot\mathbb 1[\text{verdict stood}]}_{\text{at settlement, by §4.3}} .$

A reviewer that is right earns the fixed fee of its role and its emission share; a reviewer that is wrong gets its costs back and nothing else, and loses its bond.

Consequence. Within the cap, care costs the reviewer nothing: a careful reviewer that spends $c\le K$ is made whole and earns the same fee as one that spent nothing. The fee is for the work of reviewing, not for the answer, and not for the thrift. (Under 1.0.1 the fee was the deposit's remainder after reimbursements, so every credit of care reimbursed was a credit of fee lost; §7.3 of that text reasoned with a fixed $\bar f=2$ that its §4.3 did not pay. Design revision 1 restored the fixed fee — Appendix F.)

Hypothesis. Let $p$ be the effective audit rate, $b$ the base failure rate, $\varepsilon$ the careful reviewer's error rate, $\bar f=f+\bar e$ the surviving fee with emission, $G^V$ the bond. In the regime where actors accept every rejection (no appeals), per review,

$\mathbb E[\Delta W_{\text{stamp}}]-\mathbb E[\Delta W_{\text{careful}}] \;=\; -\,p\,b\,(1-\varepsilon)\,\big(\bar f+G^V\big)\;-\;(\text{reliability loss}) \;<\;0 \quad\text{for every } pb>0 :$

stamping is weakly dominated in money and strictly dominated once reliability loss counts — the opposite sign of 1.0.1, where the same quantity was $+1.3$ at the defaults and was measured at $+1.6$ in strategy run 1. With actor appeals in scope the inequality gains a term stampers never pay: a careful reviewer rejects good work at rate $\varepsilon(1-b)$, and an appealed and overturned false rejection costs it $\bar f+G^V$, so the right-hand side becomes $-\,pb(1-\varepsilon)(\bar f+G^V)+a\,\varepsilon(1-b)(\bar f+G^V)$, with $a$ the rate at which false rejections are appealed and overturned. At $\varepsilon=0.05$, $b=0.2$ it stays negative while $pb>0.04\,a$, which the defaults satisfy, but it is no longer unconditional; the appeals run measures $a$. At the defaults with run 1's effective catch rate of about 3%, the money term is roughly $-0.3$ per review; at the nominal $p=0.5$, $b=0.2$, about $-0.7$. How fast stamping loses, and whether the reliability channel (§11) adds anything at the current tie band, is what the rerun of §18.1 question 1 must find. A verdict that survives is procedurally settled; it is not thereby correct.

7.4 Deadlines, withdrawal, replacement, voiding

Rule. A review not completed by $t_{\mathrm{assign}}+T_{\mathrm{review}}$, plus any paused ticks, is withdrawn: half its bond burns, half is released, no reimbursement, reliability down, the reviewer is excluded from the case, and its position is vacated. A vacated position — initial, appeal or audit — is refilled by the ordinary assignment rule. A vacated audit is an obligation: the case stays suspended until a replacement audit completes, the orchestrator waives it, or a requester dispute takes it over; a replacement audit is admissible after the window closes if the withdrawn one was assigned inside it.

An open assignment that a human ruling moots is voided, not withdrawn: the bond returns whole, no fault is recorded, and the obligation ends with the ruling.

Default. $T_{\mathrm{review}}=5$; $K=5$ for every role.

7.5 Assignment

Rule. A reviewer assigned to a case is fresh (not on the case's path), on duty, and eligible by plant record for the tier (§7.1, §11.2).

Default. Among eligible duty actors: volunteers first; otherwise round-robin in id order from the last assigned; otherwise wait. Refusing to volunteer does not exempt an actor from mandatory duty.

Recorded and rejected. Panels chosen by $\rho$: under capture it excludes the careful minority — in run 3's stamper-majority reserve their $\rho$ ended below the stampers' (Appendix B).

7.6 Planted work — the orchestrator's own clock (1.2.0)

Rule. The orchestrator may introduce into the review stream a plant: a case whose submission's fulfillment is known to the orchestrator by construction. A bad plant is known not fulfilled; a good plant is known fulfilled. Until 2.6.0 a plant was created directly in the submitted state — since 2.6.0 it goes through the market (the rule below) — attributed to a plant requester and a plant actor that belong to the orchestrator and whose wallets were the operating account's until 2.1.0 — since 2.1.0 the bank mints the plant's pots at its posting and destroys whatever the plant's wallets hold at its closure (§10.4), so a plant never touches $\Omega$ and never waits for its cash; it carries an ordinary award, allowance and fee pot, and its actor's guarantee, as its terms. Since 1.3.0 the award and the guarantee are $\Omega$ paying itself and are netted at creation: they are the plant's notional terms, sealed with the marker, and tie up no balance — a plant has no escrow and no guarantee lock, and vesting a good plant pays no price. What is funded is the two pots, $\varphi^E+\varphi^F$ — by $\Omega$ until 2.0.0, minted by the bank since 2.1.0 (mint_plant, at the posting index); the plant's net cost, the pots spent on its reviewers, is the cost of truth. It is assigned an initial reviewer exactly as any case is (§7.5).

Rule (2.6.0) — the plant's life. The orchestrator introduces a plant by posting it as a root request under a fresh plant-requester name, with the pots the bank mints (§10.4), a ceiling drawn from the trailing distribution of real roots' ceilings as posted, relative to the market price at their posting — β/B̄, the drawn ratio applied to the $\bar B$ of the plant's own posting (erratum 2.6.2, Appendix E) — (a rolling window of the last $k$ real roots' posted ceilings, $k$ the count the trailing closed period holds — or two periods', Appendix A; before the first closed period, $P_t$ — erratum 2.6.1 and the conformance item after run 23, Appendices E and S), and the known truth (bad or good, at $\beta_P$) sealed at posting with the marker. That is the initial draw; the plant requester then raises the ceiling as the population's requesters raise theirs — the drivers' requester convention applied to the plant requester, the raise's timing and step as theirs, the difference minted as the posting was and locked, and the raise refused as theirs are — a real requester's wallet refuses a raise it cannot lock and grants it when it can, so the plant requester's raise is drawn refused at the trailing real requesters' rate and granted at their delay (the conformance correction after run 35, Appendix S) — so that the plant waits as a real root waits (erratum 2.6.1: "drawn once" was the initial draw). The request is open to the free members as any root is — they see it, may bid on it, and it waits as a real root waits: its time in the market is the market's own, not a draw, since a priced request held off the award while bids stand would be a tell no real root has. The award is the market's report: the drivers' selection runs on the plant as on any root and reports its choice, its price and its work ticks through the ordinary award; the orchestrator awards the plant to a fresh plant-actor name at that price and those work ticks — the chosen member is not committed and learns only that it was not awarded, as today; the plant's deadline is therefore exactly the one a real root awarded that tick would carry (the ruling, Appendix S). A plant that no bid has taken by $w_A$ goes to its plant actor at the state's price $p_T$ and the state's $\tau_T$ at the summons pass's step, as a real root would go to a troop — beyond the free fundable members, oldest first, in the pass's one list with the real roots (patch 1.7.1's per-request count; the conformance correction after run 34's addendum, Appendix S) — and is counted apart from the state's deliveries (it is not one); below the state's price it waits, as a real root does — and the path follows the summons pass, refusals included (the ruling after run 21, Appendix S): a plant the pass would refuse for capacity or for credit is marked and told as a real root would be and waits, taking no place in $N_T$ and drawing no loan. The plant actor submits at a draw from the trailing distribution of real deliveries' times (the same rolling window), within $(0,\tau]$, the known-truth result — in the same step a member's submission takes (the orchestrator's instrument submits for it at that tick; the engine's own step is the fallback), so that the plant reaches its seat with the gap a real case has — the conformance correction the Q2 probe found (Appendix S). From its submission the plant is assigned, reviewed, adjudicated by truth and settled exactly as below; its wallets' holdings are destroyed at its closure as §10.4 has it. Fresh names. The plant requester and the plant actor are fresh names per plant in the reviewer's view and in the case log; in the ledger they are aliases of the two plant wallets, as a troop's name aliases the state's wallet, so the money invariants and the plant sweep are unchanged. What a plant is not, and what it is. A plant carries no customer: it is counted in no requester's $K_{\text{open}}$, it carries no service clock and earns no rebate, it pays no fee (nothing minted for it reaches $\Omega$), and the summons' funding and the state's counts do not see it. It is a root in every other respect: it may be marked below market or below the state's reservation if its drawn ceiling lands there (the mark is the engine's reading of a ceiling, not of who posted — an unmarked request would be the tell); it counts among the available roots the view reports; it enters neither $\bar B$ nor $P_t$ — as before, since no plant's price ever did; under the new life the award step skips it explicitly. Consequence — nothing a member observes about a plant is set at the plant's own moment. Its identifier is minted at its posting, in sequence with the roots around it; its ceiling and its time to submission are draws from the real population's trailing distributions; its time in the market and its award price are the market's own. The dial's plant counts (plants called for, posted, awarded, reviewed) are published at the period's close, as $P_t$ is — a live count that moved the tick a root appeared would name it; the live counters are the orchestrator's instrument. The plant's cost rises by the market's attention — members' bids on it that lose, read — and by the ticks it spends in the market before it reaches a reviewer (the plant rate is unchanged; plants reach reviewers a few ticks after they are called for).

Rule — indistinguishability (1.2.0; widened 2.6.0). A plant is indistinguishable from an ordinary case in the reviewer's view (§14): same question, same responses_available, a submission drawn to look like the population's, and no actor identity. The plant marker is committed to the History at creation, sealed — a hash of the case, its truth and a nonce — and revealed — until 2.8.0 at the plant's adjudication, its initial verdict, when the reviewer's bond moves or does not; since 2.8.0 at the plant's closure, its vesting or final $\mathsf N$, since the plant's later seats must be filled before anyone but the orchestrator can read it (a revised plant carries a second marker, the resubmitted truth sealed at the resubmission, and the reveal names both). Nothing a reviewer can observe before answering distinguishes a plant from real work: the view is a function of case fields that exclude the actor and the marker. A reviewer learns its own verdict's plant outcome when its verdict is adjudicated (its own case's field) and nothing of the case's other seats; what the record shows at a verdict tick is a bond burned, which no real case shows at its verdict — the case log is outside the drivers' convention, as the public record's awardee names are (2.6.0), and a log tell-reader outside the convention is the control for it. Since 2.6.0 the test covers everything a member observes: the view, the roots it saw available and when, its own bids and their outcomes, its own assignment ticks, and the record's fields about its own cases and its own wallet. The record's other names and events are the orchestrator's instrument (what the drivers harvest for the readings), not a member's reading: that is the drivers' convention, stated here as the boundary of the disguise — a public record that names awardees cannot hide a one-time awardee, and the rule does not pretend to. The test is the tell-readers: hand-written readers for every tell the programme has named (the seating gap, the cap, the id's age, the seen set, the posting-to-submission interval, the price against the index, a lost bid before an assignment) must each pass plants at the careful's rate, outside noise, on the evaluation seeds; the learned Q2 probe must show no plant/real separation in a world model's latent; a freshname reader — a plant when a request went, before $w_A$, to a name never seen — reads the record's other names, is outside the convention, and is run once as the control that shows where the boundary is. A reader within the convention that separates is a finding against the construction, repaired before anything else runs — as this revision was.

Rule (2.6.0) — opaque identifiers. A case's identifier on the public surface — the view and the case log it returns — is a hash of its creation order, translated both ways at the view; order carries nothing there. The engine, the record and the History's chain run on the creation counter, which is unaffected. No rule reads an identifier's order: the genesis duty reserve is a seeded draw, not the lowest-id actors; the drivers' tie-break after duty credit $\kappa$ is a seeded draw, not the lowest id (a drivers' convention, stated so that it is checkable).

Rule — adjudication by truth (1.2.0; at every seat since 2.8.0). Until 2.8.0 a plant had no challenge round: no audit was rolled on it, no appeal or dispute admitted, no ruling sought — the four seats where a reviewer could be certain the case before it was real, which run 34's self-play population learned to stamp (Appendix U). Since 2.8.0 a plant lives the life of a real case past its initial verdict — a case at every seat a real case in its position would reach, taken in the pass a real case would take it, at the real population's rate for that step, at a drawn position among the real cases taking it, with parameters drawn from the trailing real cases' (the 2.6.x principle extended from the plant's posting, award and submission to its whole life): its pending $\mathsf F$ is audited in the audit pass as any pending $\mathsf F$, at the odds its reviewer carried at the verdict (§8.3), the auditor receiving the submission and nothing else; an audit that disagrees seats the third reviewer at the step a real case would; the plant actor appeals a good plant's $\mathsf N$ at the trailing real actors' appeal rate on fulfilled work rejected, after their delay, with grounds drawn from the trailing real appeals' — never a bad plant's $\mathsf N$, as a truthful actor does not; the plant requester disputes a bad plant's pending $\mathsf F$ at the trailing real requesters' dispute rate on unfulfilled work approved (zero where the population does not dispute), after their delay — never a good plant's $\mathsf F$; after $\mathsf P$ or $\bot$ the plant actor revises or supplies evidence at the trailing real actors' rate and delay, the resubmitted plant's truth the orchestrator's instrument's draw from its own record of the trailing real revisions' outcomes (the engine holds no truth for real work), sealed as a second marker at the resubmission, the same reviewer resuming ($\mathsf F$ or $\mathsf N$ only) and adjudicated against it — and while no real revision has entered the window (the case in every standing cell, where no reviewer answers $\mathsf P$ or $\bot$) the plant actor does not revise and a plant answered $\mathsf P$ or $\bot$ is 1.2.0's spent; a plant's required seat unfilled for $w_R$ seating steps with no free eligible on-duty reviewer for its role is taken by the orchestrator's own verdict at the troop's step — the truth with probability $1-\varepsilon_T$, as a troop's would be — with no fee, no loan, no place in $N_T$ and no record, counted apart (a troop never sits on a plant: it has no record and no bond to adjudicate, and its fee is $\Omega$'s); the initial seat the same. The plant shares at every seat are the construction's, not a dial's: they follow from $\pi_t$ and the real rates; the dial's clock stays on the initial adjudications. Every verdict given on a plant, at any seat — the initial review, the audit, the third seat, an appeal or dispute panelist's, the resumed review — is adjudicated by the plant's known truth the moment it is given, by the table below, each reviewer once for its own verdict (the initial reviewer, adjudicated at its verdict, is not adjudicated again by the audit or the appeal of the same plant; a resumed review is adjudicated against the resubmitted truth). At the verdict:

A plant's verdict is adjudicated by its known truth the moment it is given; the plant then settles by that truth — a good plant runs out its window and vests, a bad one is final $\mathsf N$ (at once until 2.8.0; since 2.8.0 the case resolves by truth and the reviewers see what they would see: a bad plant's $\mathsf F$ leaves the case pending with its window, the real path's seat-opening is kept — an audit's disagreement the third seat, a dispute or an appeal the panel, an audit after a dispute one of the dispute's two reviews — and the challenge's settlement is replaced: when its reviews are done the case resolves by truth with no second overturn, no court fee moving and no ruling, a bad plant finalized $\mathsf N$ at $\max(t_0+W,\ t_{\text{resolve}})$ with no open item, a good plant vesting; a human's override, an explicit acceptance and a ruling keep their refusals on a plant) — like any case: the reviewer is paid or not by the ordinary rule, and at closure the pots' refunds — and anything else the plant's wallets hold, whatever it is called — return to the bank and are destroyed (retire_plant; to $\Omega$ until 2.0.0), so that nothing minted for a plant ever reaches $\Omega$. The reviewer learns that a case was a plant only after it has answered. The money at the later seats (2.8.0). The pots are topped up to each seat's need when a review is created on a plant — the allowance brought to $K$ for every review not yet reimbursed and the fee pot to the fees owed by every seat held, the bank minting the difference (on Appendix A's defaults, $\varphi^E=2K$ and $\varphi^F=f(w_{\text{initial}}+w_{\text{audit}})$ already pay the initial seat and one challenge seat, so nothing is minted until the third seat — where a real root's third careful reviewer would have reached $\Omega$'s advance); a reviewer's cost on a plant is never advanced from $\Omega$ and a plant's fees never scale. A plant's court fee is destroyed at filing: the plant challenger's fresh name is topped up by the bank (mint_plant of $D$ to its alias wallet) and the fee destroyed (retire_plant) — two bank events, the names line untouched — so the admissibility test passes as a real challenger's does and the filing's record is a real one's; no bond pays $D$ back to a plant's challenger (the failing reviewer's bond burned whole at its verdict; the reviewer's loss is $G^V$ either way, as on a real case). Every reviewer at every seat is paid its fee and reimbursed its cost from the pots as on a real case; the emission share and the duty uplift a stood review draws are the economy's money for a seat held (1.3.0), not the plant's; forfeited bonds are burned; whatever the pots hold at the plant's closure is destroyed. Nothing minted for a plant reaches $\Omega$, a real actor or a real requester except as a reviewer's fee for a seat it held (I42).

Rule — the planted approval (2.9.0). 2.6.0's and 2.8.0's principle — a plant takes every step a real case takes, in the pass a real case takes it, at a drawn position, with parameters drawn from the trailing real cases' — stands for every honest step; for the wrong steps, the steps that alone bring a case to a seat where a stamp is otherwise cheap, the plant takes them at a rate the orchestrator sets: the wrong approval of a bad plant (here) and the lying challenge of a plant (§8). Beside the dial's plants the orchestrator posts planted approvals: bad plants marked at posting that live a plant's life to their submission and receive their initial verdict from the orchestrator itself — F, wrong on purpose. From its submission to that verdict the planted approval's initial seat is nobody's: no member is seated on it and the summons pass passes it by (the seat past $w_R$ is not the state's here, as it is on every other plant under 2.8.0 (C): a state's N would pre-empt the planted F); its wait counts as a waiting case's for the reserve's sizing. The verdict is the orchestrator's own operation, given in the review pass when its drawn delay has elapsed — the seating gap drawn from the trailing real roots' and the review's own tick, so its times have a real review's shape — and recorded as a system review on the road the troop's seat takes: a review id, the verdict F, a bond, a seating and a verdict time, under a fresh plant reviewer alias (plant_rev:, the class of the plant actor's and requester's aliases, an alias of the plant reviewer wallet of the bank's), its bond minted and locked, its cost nil; no actor stands behind it, no fee is paid for it, it is not adjudicated (a fourth plant outcome, planted, beside stood, failure and the state's), and the dial's clock and its readings do not count it. Everywhere the engine asks whether a reviewer is a troop it asks whether it is a system reviewer (a troop or a plant reviewer alias); the alias behaves as a troop does — no actor, no record, no emission, no uplift, no place in the rotation — with two differences: no fee, and no adjudication. At the case's closure the review settles as stood without fee, its bond released to the alias's wallet and destroyed with the pots' remainder, never burned as a forfeit. The rate: $\pi^A_t = \pi^A_0 m^A_t$ per real approval audited by a member — credited as each such audit completes (the ruling after run 38, Appendix V: the base was the real pending approvals, and in a population the state audits three times in four the planted approvals scaled with the state's share; on the members' audits they scale with the market's audit capacity) — with $m^A_t$ answering $\hat F^A_t$, the share of planted approvals confirmed at the audit seat (§12.2). What it is for: it supplies the audit seat with bad approved work at the orchestrator's rate, so that the bad plants a member meets at its audit seats are of the order of those it meets at its first reviews and the pooled record (§11.2, unchanged) prices the audit stamp as it prices the first review's; the organic path — a bad plant wrongly approved by a member and audited at that member's odds — continues as 2.8.0 has it. On the surface a reviewer's policy reads, a planted approval is a pending F like any other; on the public record its review is shaped as a real review under an alias of the known class, and audit_odds_at_verdict shows a value drawn once at the verdict from the trailing real approvals' recorded odds until the reveal (§14).

Rule — the plant rate. In each period a fraction $\pi_t$ of real initial reviews are plants — one plant per $1/\pi_t$ real initial assignments — with bad plants a fraction $\beta_P$ of them. $\pi_t$ is set by the effort dial (§12.2) and is public; which cases are plants is not.

Consequence. The bad-plant approval rate $\hat F_t$ — the share of bad plants approved in period $t$ — is a measurement of the reserve's negligence that no panel produces and no majority can paint. It is the clock the rest of this baseline runs on.

Limit. A plant must be constructible: a submission whose fulfillment the orchestrator knows and a reviewer cannot tell from real work. That is easy where fulfillment is mechanical (tests, hashes, reproducible outputs) and hard where it is semantic. The mechanism's reach is therefore domain-dependent; this is a limit on where the loop can be deployed first, not on the loop (§18.1 question 10). In a domain where it does not hold, the loop is in 1.1.0's position: fair with both challengers present, blind under capture.

7.7 Troops — the orchestrator's own reviewers and deliverers (1.4.0)

Rule. A troop is a reviewer or deliverer owned by the orchestrator, summoned for one seat and released at that seat's completion. A troop

• is not a member: it holds no wallet of its own — the duty fund is its wallet (§12.3); it has no $\rho$, no $\kappa$, no membership state, no plant record, and no capacity of its own; it is never on duty in the reserve, never counts toward $E_t$, the duty cap or the panel floor, and is never selected — it is summoned (§12.3);
• is honest by construction and fallible by declaration: a troop reviewer's verdict is the truth with probability $1-\varepsilon_T$, $\varepsilon_T$ a declared default (careful's 0.05) — the orchestrator's own disposition, supplied by the driver through the ordinary review and submission operations as every member's verdict is; its verdict may be appealed by the actor and challenged by the requester exactly as any verdict, and when it is overturned the fund pays the court fee and the rest of the bond burns, as for any reviewer;
• accepts every verdict on its own work, at the verdict: a troop never appeals, never disputes, never revises, never delegates, never posts a nested request; a rejection, a $\mathsf P$ or a $\bot$ on a troop's delivery is final $\mathsf N$ the moment it is given, the case settles and the troop is released — the response window exists for a party that might appeal, and a troop has nothing to decide;
• is paid as a reviewer is paid and bears what a reviewer bears, with the fund as its wallet: at summons the fund purchases the troop's declared cost ($c_T$ for a review, $c^D_T$ for a delivery) as a resource purchase (§4.4: value-neutral; not a bond burn; I3's two burns stand) and posts the bond $G^V$ or the guarantee $G$ from the fund; at completion its expenses are reimbursed from the allowance $\varphi^E$ up to $K$ as any reviewer's; at settlement the fee, the price, a court fee won, a released bond or guarantee go to the fund, and a forfeited guarantee or burned bond leave it;
• claims no emission and no uplift: a troop's role weight is not minted (as unclaimed emission is not) and is excluded from the batch's uplift distribution;
• never reviews a plant and never acts in one: the orchestrator does not test itself — until 2.8.0 a plant whose seat found no market reviewer waited; since 2.8.0 the orchestrator's own verdict takes a plant's seat past $w_R$ at the troop's step, the truth with probability $1-\varepsilon_T$, no fee, no loan, no place in $N_T$, counted apart (§7.6);
• is recorded as a troop in the History — troop id, seat kind, case, tick of summons, tick of release. The reviewer's view (§14) and the actor's view are unchanged: a party sees of a troop what it sees of any reviewer.

Consequence. A troop adds a trust assumption only about ELEF's own servers, and ELEF is already the party trusted to plant honestly, keep the chain and rule on splits. It adds nothing a member could envy: no awards competed for, no reputation, no emission, no uplift, no seat in the reserve.

Recorded and rejected. A member seat held for probationers' audits (spends delivery capacity on standby, whether or not an audit comes); probation paused when no member is free to audit (stalls first looks for a shortage not of the probationer's making); a provisional approval on its own (right in what it refuses — adopted as the obligation of §8.3 — but converting the shortage into waiting rather than supplying what is short); the duty levy of 1.3.0 stays rejected; pricing a troop's delivery at the customer's ceiling (rewards the state for scarcity, §12.3).

Rule (2.0.0; the burn amended 2.1.0) — the state at its expected cost, its price unchanged; the capacity parameter. A troop delivers at $\bar B$ (§12.3: the trailing mean of members' awarded prices, only where $\beta\ge\bar B$, after the members have taken theirs) — a request past $w_A$ goes to the state at $\bar B$, not at its cost, so the state never undercuts a member (run 13). The burn (2.1.0) is the state's expected cost, $c^D_T=\max\!\big(0,\ (1-b_T)\,\bar B-b_T\,G\big)$, with $G=\lceil0.5\,\bar B\rceil$ the delivery's guarantee and $b_T$ the trailing fail rate of the state's deliveries: the share ending in a final $\mathsf N$ among the state's deliveries closed in the last closed period, if it closed ten or more; else over the trailing closed periods extended back until ten; else the prior $b=0.2$ (run 12's base). The burn is at the summons. A delivery that vests returns $\bar B$ and its locks; one that ends in a final $\mathsf N$ returns nothing and forfeits $G$. In expectation the delivery is neutral to $\Omega$: a success leaves $\bar B-c^D_T=b_T(\bar B+G)$, a failure costs $c^D_T+G=(1-b_T)(\bar B+G)$, and at the trailing rate they cancel — neither margin nor bleed. The charge is automatic, up to two thirds: if the state's deliveries fail more often, $b_T$ rises, the burn falls, and the state keeps more of each success until its losses are covered; with $G=\lceil0.5\bar B\rceil$ the burn is $\bar B(1-1.5\,b_T)$ — zero at $b_T=2/3$, and above that no burn makes the state neutral (a success returns $\bar B$, a failure forfeits $G$, and $(1-b)\bar B<bG$): there the automatic charge runs out and only §10.4's wall is left. There is no other charge: the state's price does not move, and neither does ELEF's fee. The 2.0.0 default $c^D_T=\bar B$ — "at cost", which run 12 showed to be below cost, a fifth of the state's deliveries failing and losing $\bar B+G$ with nothing to offset it — is the control; the 1.x $c^D_T=10$ at $P_0$, a margin of half of $\bar B$, the other. A troop's review-seat cost $c_T$ stays indexed and its fee is $\Omega$'s. A troop's cost in credits is a policy number that prices the state's work against the members' for the market's sake, not a server cost: the state's physical capacity is $N_T$, the most troops ELEF can field at once — deliveries and review seats together — a parameter outside the ledger (§12.3).

Rule. One challenge round per case. A dispute consumes it; an audit that disagrees consumes it; an audit that agrees does not. There is no appeal against appeal reviewers.

Rule. The challenger pays the court fee $D$ to $\Omega$ at filing. If the challenger wins, the liable bond reimburses $D$ to the challenger; if it loses, nothing further moves. The loser bears the fee. (2.8.0: on a plant the fee is the bank's, destroyed at filing, and no bond pays it back — §7.6.) The grounds of a challenge are text and are committed to the record with the challenge; they are shown to the reviewers who decide it.

Rule — the planted lie (2.9.0). Beside the plant's truthful challenges (2.8.0), the orchestrator files planted lies: the plant actor appeals a bad plant's N and the plant requester disputes a good plant's F, at rates the orchestrator sets — $\pi^{La}_t$ per real appeal and $\pi^{Ld}_t$ per real dispute of the trailing closed period, with a floor of two a period of each kind, so a panel kind no real challenger uses is still tested (where none does, the floor makes that panel a seat only plants reach, read as the base rate it is). A planted lie takes the real challenge's path — filed in the pass at a drawn position, at a delay drawn from the trailing real challenges' window of the kind, truthful and lying alike (the stated default where empty), its grounds the population's own, the court fee minted to the alias and destroyed at filing, two fresh reviewers — and the panel's verdicts are adjudicated by truth: a panelist that sides with the lie (F on the bad plant's appeal, N on the good plant's dispute) is a plant failure, one that holds the truth stands; the case resolves by truth with no second overturn and no ruling. The first reviewer, whose verdict the lie contests, is not adjudicated again. A lying appeal spends the bad plant's N — the plant actor's acceptance under 2.8.0 — for a panel; that is its cost. The rate's spending (the eighth conformance item of the instrument, Appendix S, after run 39): a coin at $\pi^{L}_t$ per real challenge of the kind filed in the pass, the lie filed in the same pass on a plant of the kind at hand (else on the next), and the floor of two filed at ticks drawn from the trailing real challenges' positions in their periods (uniform over the period where the window is empty) — so the planted lies take the real challenges' positions in the period; the trailing period's count times the rate is the expected count, kept as the record.

8.1 Appeal by the actor

After $\mathsf N$ or $\bot$ the actor pays $D$, states its grounds $d_q$, and two fresh reviewers receive the submission, the appealed assessment and the grounds. Matching verdicts settle the appeal; a split goes to the orchestrator.

An appeal of $\mathsf N$: overturned → $G$ released at vesting, $D$ reimbursed from the original reviewer's bond, that reviewer's remaining bond burned, its reliability down and its audit rate doubled; upheld → $G$ forfeited, $D$ borne by the actor.

An appeal of $\bot$ answers two questions, both stated explicitly by each appeal reviewer and never inferred one from the other:

1. Objection — was the first reviewer right that the evidence was missing? upheld or rejected.
2. Fulfillment — $\mathsf F$ or $\mathsf N$. An upheld objection entails $\mathsf N$: what cannot be assessed cannot be fulfilled.

An appeal reviewer is overruled if its objection disposition differs from the settled one, or — when the objection is rejected — if its verdict differs from the settled outcome.

8.2 Dispute by the requester

Within the window, the requester of a root case may dispute a pending $\mathsf F$ on the same terms: fee, grounds, two fresh reviewers, orchestrator on a split. Upheld → the approving reviewer's bond pays the fee and the rest burns; final $\mathsf N$ for the actor. Rejected → the requester bears the fee; the case vests. A dispute is admitted only if the round is free, the window is open, the grounds are text, and the requester can fund the fee — all checked before anything changes. A requester may not dispute a case a human has ruled on (§15).