§23. Extended Telemetry

Jason St George. "§23. Extended Telemetry" in Next Generation Stores of Value: Privacy, Proofs, Compute. Version v3.1. /v/3.1/read/part-v/23-extended-telemetry/

Extended Telemetry

A constitution nobody can check is a press release. Layer 6 claims that measurement is the constitution — that SLOs, not assurances, decide whether the asset is still money — and that claim is only as strong as the measurement regime beneath it. Dashboards can be gamed, and the gaming is usually boring: a favorable region here, a fast machine there, a bad month quietly absent. So the observatory must be built the way it audits others. Anyone can re-run the audit, on hardware they own, and catch the observatory lying. That is the standard this chapter engineers for, and everything in it — reference machines, cost vectors, sampling seeds, anchored archives — exists to make that re-run possible.

Reference Verifier Classes

“Anyone can verify” is a promise about hardware, so it has to be priced on hardware a person can actually own. All Verify* metrics are therefore measured on standardized reference hardware:

Reference verifier classes.

Rule: All constitutional SLOs (e.g., “VerifyPrice $t_{95} \leq 5$s” — the p95 time field of the canonical tuple, Appendix A: Formal Model of Verification Asymmetry & VerifyPrice) are defined against Laptop-Class unless a workload’s registry entry binds it to another class, in which case the entry names the class. This ensures the “anyone can verify” promise is falsifiable. Where a registry entry binds an SKU to Server-Class (e.g. INFER_LM_7B_512TOK, whose M3 re-execution does not fit a Laptop-Class SLO; §19: Layer 4: Truth & Work), the entry governs that SKU and the Laptop-Class figure is still published beside it; the blanket rule governs everything the registry does not rebind.

Reference Verifier Implementations

Reference verifier implementation requirements.

Why two implementations rather than one trusted one? Because a single verifier codebase is a single point of failure for the truth itself. One bug can inflate or deflate every measurement the constitution depends on, and nobody outside would ever know. Two independent implementations, built by different people from the same specification, turn that silent failure into a visible disagreement — and a disagreement, unlike a bug, shows up on a dashboard.

Cost Vector Definition

A single number is easy to quote and easier to flatter. VerifyPrice is deliberately not one, and it is also deliberately not several: it has one definition, the canonical five-field tuple $(p_{50,t},$ $p_{95,t},$ $p_{50,c},$ $p_{95,c},$ $\text{fail})$ of Appendix A: Formal Model of Verification Asymmetry & VerifyPrice. What this section defines is the cost-vector view — the per-run physical quantities the harness records for workload $W$ on verifier class $V$, from which the canonical tuple is priced by the rule of §19: Layer 4: Truth & Work:

Where:

• $t_{\text{run}}$: verification time (seconds); percentiled into $p_{50,t}$, $p_{95,t}$

• $e_{\text{run}}$: energy (Joules); enters the per-run USD cost $c_{\text{run}}$, which is percentiled into $p_{50,c}$, $p_{95,c}$

• $m_{\text{run}}$: peak memory (MB) — published, not priced; exceeding the registry ceiling is a failure outcome

• $b_{\text{run}}$: bandwidth (bytes) — published, not priced, same rule

• $\text{outcome}_{\text{run}}$: pass or failure code; aggregated into $\text{fail}$

The v3.0 draft introduced this vector with “$\text{VerifyPrice}(W,V) =$” and six fields, while §19: Layer 4: Truth & Work introduced a different five and §19: Layer 4: Truth & Work the canonical five. Only the canonical tuple carries the name; the other two are views of its inputs, and they are now labelled as such wherever they appear.

Sampling and Anti-Cherry-Pick

The most common attack on telemetry is not fabrication; it is curation. Nobody has to invent numbers when selective reporting will do: show receipts from good regions, fast hardware, favorable conditions, and the dashboard flatters itself without a single lie in it. The sampling regime exists to make curation detectable:

Sampling mechanisms for Verify* telemetry.

Rule: Any dashboard point published without a verifiable sampling seed and stratification breakdown is not part of the official Verify* record.

Data Availability and Anti-Memory-Hole

Dashboards are views. The source of truth is the receipt corpus. Receipts must be:

Data availability requirements.

A dashboard can be edited; a Merkle root committed to a neutral ledger cannot be un-committed. That asymmetry is the whole defense. If a government or a CDN can quietly delete the bad months, the telemetry regime has been captured without a single headline. Content-addressing plus neutral anchoring does not prevent deletion — it makes deletion visible, and visible deletion is itself a datum.

Reproducibility Contract

A valid dashboard datapoint is defined as:

Validity check: Anyone can:

1. Fetch receipts by $d_{\text{root}}$ (dataset root)

2. Run $v_{\text{harness}}$ (harness version) with $v_{\text{verifier}}$ (verifier version)

3. Verify $r$ (result) matches

If the results don’t match, the datapoint is invalid and the discrepancy is a Sev-1 incident.

Published artifacts:

• Harness code (open source, tagged)

• Verifier binaries (reproducible builds, hashed)

• Dataset roots (timestamped, anchored)

• Aggregation scripts (deterministic)

This transforms “no dashboards, no trust” from philosophy into a reproducible measurement contract.

How to Measure: Receipts, Not Vibes

VerifyPrice was introduced at Layer 4; VerifyReach at Layer 1; VerifySettle at Layer 5. Layer 6 treats them as a coherent observability regime rather than three unrelated graphs.

The observability story only works if it is itself verifiable. That is why every claim, proof, settlement, and SLA outcome is turned into a receipt with enough structure that anyone can replay the metrics on a reference verifier.

In practice, this means:

• Every proof receipt carries not only the proof artifact but also start/end timestamps, resource usage, and a hardware profile tag.

• Settlement receipts encode corridor, timing, refund status, and failure codes.

• Routers emit anonymized samples of order books, matched and unmatched bids, and house vs. third-party flags.

• Hardware vendors publish lot-attestation artifacts that receipts can reference as part of their profile.

A public “VerifyPrice Observatory” then ingests these receipts and emits the aggregate vectors we refer to in the text. Anyone can pull the raw receipts corresponding to a dashboard point, feed them into the same open-source verifier suite, and see whether they obtain the same numbers. If they do not, the mismatch is itself an incident.

This architecture enforces a simple discipline: if it matters, there is a receipt for it. If a claim about performance, neutrality, or safety cannot be tied back to receipts that anyone can re-check, it is out of scope for the monetary thesis.

They are the three primary dials for answering:

• Is verification still cheap? (VerifyPrice)

• Can users still reach the network under pressure? (VerifyReach)

• Can users still move value privately and safely? (VerifySettle)

We can think of this observability regime as watching the stack across five planes:

Proof & compute plane
Are receipts reliable, and does verification asymmetry actually hold under load?

Settlement & privacy plane
Do non-custodial payouts actually clear, with privacy and refund-safety matching the promise?

Neutrality & admission plane
Can new provers, miners, routers, and mirrors join on equal footing, or has the system ossified into a club?

Economic coverage plane
Are real fee flows, not issuance, paying a growing share of the security and operations budget?

Layer-0 hardware plane
Do “verifiable machines” remain falsifiable in practice, or did we slide quietly back into “trust the vendor”?

Each plane maps directly to the nine SoV requirements of Part I (§3: First Principles: What a SoV Must Survive): credible scarcity, cheap public verification, censorship-resistance and portability, neutrality and permissionlessness, native demand, lawful privacy by design, duration-neutrality, asset-level value capture (non-bypassability), and agency preservation. The economic coverage plane reads on the fifth and eighth; the settlement and privacy plane on the sixth and ninth; the proof and compute plane on the second; the neutrality plane on the third and fourth; the Layer-0 plane on the second and, through sovereign optionality, the third. If any plane drifts too far from its targets, the monetary thesis weakens, no matter how elegant VerifyPrice looks in isolation.

VerifyFlow: Instrumenting the Market Realization Plane

VerifyPrice, VerifyReach, and VerifySettle answer whether the stack is real. None of them answers a question that will dominate every public conversation about the asset: why is the price doing that? §10: Work Credits: Energy-Anchored Claims says we cannot infer monetary adoption from price, and §10: Work Credits: Energy-Anchored Claims says the answer lives in external market structure. VerifyFlow is the fourth named verification family, and it measures the external financial representation and price-transmission state of the native monetary object.

The governing principle extends the existing one:

No protocol dashboards, no monetary trust. No flow ledger, no price inference.

Wrapper-Level Vector

For each external financial wrapper $i$, publish

where $L_i$ is the leverage multiple and reset rule; $A_i$ is assets or delta-adjusted exposure; $\Delta A_i$ is creations and redemptions, published raw and flagged: $\Delta A_i$ is the input to the decomposition of Appendix H: Formal Model of Market Realization, Wrapper Flows, and Price Capture, not an aggregate in its own right, and no downstream sum may consume it unless the wrapper’s series has been decomposed into its $\varepsilon$-, $\alpha$-, and residual components — otherwise aggregating across wrappers silently rebuilds the double-count the asset-level vector exists to prevent. $r_i$ is the wrapper’s underlying return over the daily-reset horizon, and $w_{Xi}$ its delta-equivalent exposure weight to the native asset $X$ (unity for a single-asset physical wrapper, less for baskets and partially hedged structures); both are consumed by the $Q^{RC}$ and $Q^{RD}$ terms below and were missing from the v3.0 tuple while being used by it. $\varepsilon_i$ is holder flow elasticity; $\kappa_i$ is net mechanical gain; $C_i$ is constituent concentration; $H_i$ is hedge implementation (physical, swaps, futures, options); and $D_i$ is dealer or counterparty concentration. Appendix H: Formal Model of Market Realization, Wrapper Flows, and Price Capture derives $\varepsilon$ and $\kappa$ and states their measurement contract.

Asset-Level Vector

For the native asset $X$, publish

The MPR slot is a published pair (gross and net), so the vector names the pair rather than one form; every other slot is a single series.

Return-coupled demand $Q^{RC}$.
Exposure that moves as a function of the return itself, $Q^{RC} = \sum_i w_{Xi}\,\kappa_i A_i r_i$, where $w_{Xi}$ is the wrapper’s delta-equivalent exposure weight to $X$ — the same weight $Q^{RD}$ carries, and without it a basket wrapper’s rebalancing demand for its other constituents would be booked against $X$. This term shapes volatility, momentum, persistence, and reversal severity.

Return-decoupled demand $Q^{RD}$.
Allocation flow largely independent of the day’s return, $Q^{RD} = \sum_k w_{Xk} \alpha_k A_{k}$, where $\alpha_k$ is the return-independent intercept of net creation into wrapper $k$ and $w_{Xk}$ its delta-equivalent exposure weight to $X$. $Q^{RD}$ consumes $\alpha$ only. Per the decomposition rule of Appendix H: Formal Model of Market Realization, Wrapper Flows, and Price Capture, creations split into an $\varepsilon$-driven component (return-coupled, already inside $\kappa$), the intercept $\alpha_k$ (structural bid — distribution growth, mandate adoption, scheduled contributions), and a residual $u_k$ (unexplained, published as its own series and consumed by no aggregate). Feeding raw $F_k$ into this sum would double-count the $\varepsilon$-component, which $\kappa$ already carries through $Q^{RC}$, and would inflate MPR and every downstream reading built on it. This term shapes destination, concentration, and level — which prices get accepted without valuation-sensitive selling.

Mechanical Pressure Ratio (MPR).
Gross measures pressure; net measures direction. That distinction is the whole metric, and it is worth the two definitions it costs. $Q^{RC}$ and $Q^{RD}$ partition product-level demand by return-dependence: the $\varepsilon$-component of creations belongs to $Q^{RC}$ (inside $\kappa$) and only $\alpha_k$ belongs to $Q^{RD}$. Total product-level exposure demand is then $Q^{\text{exp}} = Q^{RC} + Q^{RD}$ with no term counted twice. Dealers translate that exposure into market orders, so realized market demand is its intermediated image,

The v3.0 draft left $\mathcal{H}$ as a symbol, which made MPR a ratio with an undefined numerator. It is defined here as the published pass-through decomposition: for each reporting segment $j$ (venue $\times$ wrapper class),

where $\iota_j$ is the dealer internalization share (exposure netted against other client flow and never sent to market), $\pi_j$ the spot pass-through of the segment’s hedge mix (unity for physical holdings; the delta of the futures, swap, or option book otherwise), and $\Delta I_j$ the change in dealer inventory over the window. Each of $\iota_j$, $\pi_j$, and $\Delta I_j$ is a disclosed series under §23: Extended Telemetry; where a segment’s dealers do not disclose them, $Q^{\text{mkt}}_j$ is not computable, MPR is published with that segment marked missing and its exposure share stated, and no headline MPR is quoted for a window in which the missing share exceeds 20% of $Q^{\text{exp}}$. MPR is thus computable exactly to the extent dealers disclose, and the metric says so rather than filling the gap with an assumption.

The gross form, $\mathrm{MPR}^{\text{gross}} = \sum |Q^{\text{mkt}}_j| / V_X$, counts every dollar of liquidity consumed on both sides: it asks how hard the machinery is leaning on the market, whichever way it leans. The net form, $\mathrm{MPR}^{\text{net}} = |Q^{\text{mkt}}| / V_X$, nets the offsetting flows first and asks only where the weight ends up. Here $V_X$ is the asset’s executable liquidity — average daily traded USD volume on the reference venue set over the same window the numerator aggregates, published with the ratio — and the segments $j$ are the pre-declared reporting partition (venue $\times$ wrapper class), also published with the ratio.

The two forms must never be averaged, ranked, or otherwise combined, because each guards against a different deception. Netting offsetting flows before the modulus erases the liquidity both sides consumed, which is why the gross form leads and the net form contextualizes. And customer exposure and dealer hedging are the same demand observed at two stages, not two independent demands; summing them would double-count. Report $Q^{\text{exp}}$ and $Q^{\text{mkt}}$ separately and never add them — a pressure gauge and a compass are two instruments, and gluing them into one dial breaks both.

Custodial Control Ratio (CCR).
Base asset controlled by custodians and wrappers, divided by circulating supply.

Synthetic Exposure Ratio (SER).
Delta-adjusted derivative exposure divided by liquid free float.

Wrapper–Native Growth Gap (WNG).
$\mathrm{WNG} = \Delta \ln E^{\text{wrapper}} - \Delta \ln U^{\text{native}}$, where $U^{\text{native}}$ counts native service flows only — fee payments, private settlement volume, proof purchases, and verified-compute consumption, each a turnover measured over the window. Collateral lockup is a stock and is published as its own companion series, never summed into $U^{\text{native}}$; burns are supply arithmetic, not buyer evidence (Appendix H: Formal Model of Market Realization, Wrapper Flows, and Price Capture), and are likewise excluded. A persistently positive WNG means financial exposure is growing faster than monetary use — the single most compact measure of financialization outrunning adoption. Because it feeds the triple-divergence composite and Red Line 9, its aggregation is specified rather than left to the operator: a trailing four-quarter window; quantities in unit terms on both sides (wrapper exposure in units of $X$ equivalent, native use in units of service transacted), so that asset-price revaluation is stripped from the comparison by construction; and the USD-denominated series published alongside for readers who want the market view. The reason for unit-denominating is a revaluation artifact, and it runs the other way from what intuition suggests: $E^{\text{wrapper}}$ is a stock observed instantaneously and revalued with every tick, while $U^{\text{native}}$ accumulates at transaction prices over the window, so a price rise — not a fall — can lift measured $\Delta \ln E^{\text{wrapper}}$ on revaluation that no usage produced. Unit terms cancel that term; the USD series exposes it. The deflation convention here is therefore unit denomination, which is distinct from the workload unit-price deflation of Red Line 14 Condition B (a compute-price index, not the asset price): same word, different deflators, both published.

Recursive Claim Ratio (RCR).
Exposure held in wrappers whose underlying is itself another wrapper or derivative, divided by total wrapper exposure — delta-adjusted on both sides, over the same window as SER. One minus RCR is the share of wrapper exposure that bottoms out in the native asset directly.

Native Use Share (NUS).
The share of observable economic activity touching the asset that actually settles through the protocol-native monetary loop, where the universe is defined as all activity on public venues and wrappers reporting the asset (USD value of transfers and wrapper flows over the window), and the numerator is the USD value of native-loop settlement (fee-paying, proof-carrying, or corridor) over the same window. The universe is pre-declared with the metric; activity invisible to public data is excluded from both numerator and denominator and acknowledged as a coverage limit, not silently assumed zero.

Holder Cohorts, Vintage, and Policy Concentration

Flow elasticity is not a permanent product characteristic, and treating it as one is a modeling error. Product launch date predicts holder behavior [Green 2026a]: older funds contain embedded winners who are more likely to skim gains after a rally, whereas newly launched products may contain momentum-oriented holders with no gains to realize and therefore nothing to trim. So

Telemetry should therefore track product age, average holder cost basis where inferable, the realized/unrealized gain distribution, rolling elasticity, statistical break dates, holder-cohort turnover, and fund-flow response after drawdowns.

This matters more, not less, in an agent economy. Automated treasury systems, robo-advisers, and AI allocation agents may share common rebalancing policies, producing a machine-readable version of holder elasticity at scale. The protocol should therefore monitor concentration not only of holders but of holder operating rules.

Policy Concentration Ratio

The share of net asset demand governed by the largest common rebalancing templates, treasury algorithms, robo-advisers, or agent policies. Picture a thousand independent drivers, each in their own car, all running the same navigation app: ownership is distributed, but on the day the app says “take the exit,” they all take the exit. An asset can have decentralized ownership and highly centralized behavior; only the second predicts what happens on a bad day.

Capital Survival: AUM Is Not Investor Return

One further metric prevents a specific and common confusion. A leveraged wrapper can survive commercially while repeatedly destroying investor capital: reverse splits preserve a presentable share price, fresh inflows replenish assets, and the sponsor continues collecting fees on a product whose successive holder cohorts were harmed. Persistent AUM is therefore not evidence of successful capital preservation.

Capital Survival Ratio (CSR)

At the product level, every term must be an aggregate dollar amount — net assets, not per-share NAV, which would mix a per-unit price into a sum of dollar flows:

Because the stated purpose is to ask whether successive cohorts survived, the product-level figure is only a summary. The cohort form is the one that answers the question, for cohort $c$ with cohort-attributable value $V_{c,t}$:

This is a multiple on invested capital by vintage; a dollar-weighted return over the same cohort carries the same information (a cohort’s $\mathrm{CSR}$ exceeding 1 after $T$ quarters corresponds to a positive dollar-weighted IRR over those flows, so the two are orderings of one object, not independent evidence). A product can show $\mathrm{CSR}_i$ near or above 1 while late cohorts sit well below 1, which is precisely the failure the metric exists to expose. Accounting implementations vary, but the purpose does not: AUM is not investor return, product survival is not holder survival, and a wrapper can be an excellent business for its sponsor and a disaster for everyone who owned it.

Dealer Balance Sheets and Hedge Paths

Wrapper exposure does not necessarily arrive as direct spot purchases. Dealers may implement it with swaps, futures, baskets, or options, and counterparty capacity affects how — and whether — the exposure reaches the underlying market. Product-level exposure demand must therefore never be read as an identical quantity of spot orders.

Publish: the wrapper counterparty list; top-$N$ dealer share; physical holdings versus swaps; swaps versus options; average derivative maturity; delta- and gamma-adjusted exposure; collateral and margin requirements; evidence of counterparty caps; and changes in hedge-instrument mix.

Dealer capacity warning. A migration from swaps toward options can indicate that dealer balance-sheet capacity is binding. When dealers are short calls, rising spot and rising volatility can require additional underlying purchases, adding a gamma feedback loop on top of the mechanical one. This is an empirical warning to watch for, not a universal law to assume.

Convenience-Yield Telemetry: Pricing the Holder-Side Service Flow

VerifyPrice, VerifyReach, and VerifySettle measure the stack; the wrapper vector measures the realization plane; the Native Monetary Buyer Map measures who is holding and how. None of them prices the thing the monetary claim actually rests on. §10: Work Credits: Energy-Anchored Claims relocates the premium to a regime-contingent convenience yield — a holder-side service flow with no cash flows to discount — and then concedes it is unsized. The concession is honest but incomplete: unsized does not mean unmeasurable, and an unsized quantity with no instrument is indistinguishable from an article of faith. Storage theory [Kaldor 1939] [Working 1949] extracts convenience yield from observable prices rather than asserting it (the forward-curve slope net of carry); the crypto-native analog is the lending and derivatives complex around the asset. The thesis therefore publishes a fifth measurement family whose job is to make the premium a number rather than a hope.

Instruments.

For each venue publishing a rate, report:

Base-asset lending rates.
The market-clearing rate for borrowing the base asset itself, segmented by venue, term, and counterparty class. A borrower pays this rate to be short the asset; what they are paying for is the units. When holders of the bearer service lend out their units, they are selling the service flow for the term of the loan — so the lending rate is the direct market price of temporary access to bearability, the closest available analog to a lease rate.

Forward and perpetual basis.
Forward price minus spot, and perpetual funding rate, net of the reference interest rate. Persistent positive basis that exceeds carry costs indicates demand for deferred or levered exposure outrunning demand to hold the units — demand for the price story rather than the bearer service. Persistent negative basis indicates the reverse: entities that need the units (operators meeting collateral calls, shorts delivering into settlement) bidding against the float.

Wrapper basis.
The premium or discount of a custody-restricted wrapper over the value of its native holdings. A persistent premium is the price of not holding natively: legal wrapper, custody, and access convenience purchased in place of self-custody, agency, and exit. It is the complement of the lending rate — both price the friction between native holding and representative holding — and under §10: Work Credits: Energy-Anchored Claims a large and rising wrapper premium with stagnant native use is financialization, not monetary adoption.

What the instruments read.

Convenience yield is a residual claim on holding, extracted from prices that also contain discount-rate and risk information, so each reading requires the same care as $\varepsilon$ in Appendix H: Formal Model of Market Realization, Wrapper Flows, and Price Capture:

• Lending rate decomposition. Borrow demand has three sources: directional short interest, market-making inventory financing, and operational short squeeze against locked float. Segment by borrower class where observable; an operational squeeze (collateral calls meeting immobile supply) is a liquidity event, not a premium reading.

• Regime conditioning. The thesis’s claim is specifically regime-contingent: the yield should rise in exactly the states where substitutes weaken. The instrument earns its place only if the rate series is published against the macro-state model of §26: Adoption Curve & Ecosystem Dynamics and the pressure index $R$ of §10: Work Credits: Energy-Anchored Claims, so that $\text{convenience yield} = g(R)$ becomes an estimable function rather than a slogan. A yield flat across regime states is the null result and must be reported as such.

• Both tails checked. A convenience yield that appears only in benign states — holders renting out units for yield-farming while nobody needs the bearer service — is a fee-like cash flow, not the regime-contingent service flow, and belongs in the DCF bucket with the rest of §10: Work Credits: Energy-Anchored Claims.

The null result is publishable.

The instrument is falsification machinery, not advocacy. If, after the stack delivers measurable service, the lending and basis series show no regime-contingent premium — holders charge nothing extra to part with units exactly when substitutes fail — then the holder-side flow is priced at zero and the store-of-value claim has lost its mechanism in public. That outcome belongs on the Value Capture Board beside fee coverage, and it is a more direct test than any red line currently operating on it: the red lines test whether the chain broke; this tests whether the premium exists.

Buyer Quality and Price Provenance

Wrapper vectors answer which product is transmitting exposure. They do not answer who is absorbing the risk, with whose capital, under what mandate, at what leverage, against which liability, through which benchmark, and with what capacity to sit through a mark. That is the sovereign-market question of §2: The World Forces New Monetary Primitives, applied to the native asset’s own realization plane. Publish, as a checklist rather than as a multiplicative index:

• Persistence ($P$). Does the bid recur because contributions, a mandate, or a liability continue, or because a trade has not yet finished?

• Horizon ($H$). Is the holder matching a multi-decade promise, a quarterly risk limit, or a daily reset?

• Liability match ($M$). Is the purchase offsetting an enduring obligation, or following a weight?

• Loss-bearing capacity ($B$). Can the holder absorb marks without forced sale, margin call, or redemption?

• Countercyclicality ($C$). Does incremental buying increase when prices fall, or does the governing rule absorb less risk precisely then?

A high-persistence, low-match, low-countercyclicality buyer is the automatic index flow of §2: The World Forces New Monetary Primitives: it keeps arriving and still fails as an anchor. A leveraged relative-value fund can score the opposite way on persistence and the same way on loss-bearing capacity. Neither score is a number to multiply into a headline $Q_A$. The fields exist so that “there is demand” cannot be reported without saying what kind.

Price then requires a provenance model, not only a feed: who bought, with whose capital, under what mandate, at what leverage, with what redemption terms, against which liability, through which benchmark, and with what capacity to survive losses. A policy that treats the resulting price as an external referendum on credibility is reading an instrument the state and the financial industry themselves constructed. That is the epistemic loop §2: The World Forces New Monetary Primitives already warns about, now stated as a VerifyFlow requirement: no buyer-quality ledger, no inference from the long yield—and no inference from the native asset’s price either.

Native Monetary Buyer Map

Buyer quality belongs inside the monetary chain, not only in the external price model. Publish a Native Monetary Buyer Map that reconciles protocol flows and holder cohorts without pretending that pseudonymous addresses are known persons:

Just-in-time fee acquisition.
Share of fee-paying units acquired within pre-declared windows before expenditure, versus fees paid from retained balances.

Operator sell-through and inventory.
Rewards and fee receipts sold, retained, hedged, or pledged by operators, by cohort and interval.

Burns and net issuance.
Gross burns, gross issuance, and net issuance separately; a burn is supply arithmetic, not evidence of a buyer.

Self-custodied reserve demand.
Net accumulation in addresses or proofs-of-control classified under published, conservative reserve criteria, excluding custodial and wrapper inventories.

Wrapper demand.
Custodial, fund, treasury-company, and synthetic exposure reported apart from native reserve holdings.

Leverage.
Borrowed funding, derivatives, rehypothecation, liquidation sensitivity, and margin terms where observable.

Holding period.
Cohort survival and realized holding-duration distributions, not a single average that mixes fees with reserves.

Loss-bearing capacity.
Evidence that the funding source can absorb marks without margin call, redemption, or forced sale.

Countercyclical accumulation.
Whether native self-custodied reserve cohorts add units during drawdowns and regime-pressure episodes rather than merely after recoveries.

The map must reconcile identities only to the degree evidence permits. Unknown holdings remain unknown; they are not assigned to the most favorable category. Gross native volume passes Premise 7 only when the retained, self-custodied, unlevered or transparently financed, loss-bearing, countercyclical cohort is material and persistent.

The map also carries a representation discipline that every published aggregate in this chapter inherits: any aggregate over households or holders must disclose its weighting rule. The weighting rule is a moral choice made visible. Dollar-weighted and person-weighted summaries of the same underlying observations can move in opposite directions — and neither is the false one. The arithmetic is exact. The gap between the two means is the covariance of spending weight and experience over mean spending weight, $\bar{x}_{\text{dollar}} - \bar{x}_{\text{person}} = \operatorname{Cov}(C_i, x_i)/\bar{C}$, so a positive covariance between spending weight and experience lifts the dollar-weighted mean above the person-weighted mean; the identity is about means, and a statement about the person median needs a separate argument about the shape of the distribution. That is the mechanism behind the “two economies” reading of the same dataset [Green 2026e] (“The Vibecession Was Real”). Board aggregates therefore publish their weights (units transacted, addresses, identities, delta-equivalent exposure) alongside the number, and where a dollar-weighted and a person-weighted reading of the same series diverge persistently, both are shown rather than the more favorable one. A verified aggregate that describes almost no actual participant is not a measurement failure; it is a choice of weights, and the choice is now visible.

The Public Boards

Metrics surface as twelve public boards or maps. The original five have grown to twelve as the thesis has extended from pure verification economics into physical capacity, political economy, dependency, holder quality, and market structure:

Proof & Compute Board.
Summarizes VerifyPrice per workload, SLA attainment, queue depths, and failure modes.

Settlement & Privacy Board.
Reports swap success, refund safety by corridor, time-to-finality, and anonymity-set health.

Neutrality & Admission Board.
Tracks time-to-first-proof for new entrants, top-N share, geo/ASN distribution, and house share.

Layer 0 Capacity Board.
Extends hardware-profile telemetry with Facility Energy Receipts and Facility Capacity Receipts (§14: Layer 0: Verifiable Machines & Energy): grid node, interconnection class, outage history, backup duration, fuel mix, cooling dependency, and Physical VerifyPrice (§19: Layer 4: Truth & Work). Reports both Sovereign Optionality and scenario-specific Delivered Verified Capacity — how much of the grid still lights up when the weather turns — plus active minimum cuts, substitution latency, and dependency groups (§14: Layer 0: Verifiable Machines & Energy). Tracks whether the compute/proof layer is physically resilient or just another hyperscaler/cloud bottleneck, including the Homestead Ratio (§4: Threat Model).

Economic Coverage Board.
Charts fee-coverage ratio, physical VerifyPrice against SLOs, and demand curves indexed to policy events.

Value Capture Board.
Tracks fee coverage, native-asset burn rates, collateral lockup volumes, issuance vs. capacity growth, workload mix (budgeted vs. speculative), and bypass-channel indicators (operator off-ramp rates, stablecoin-denominated fee share). This board makes the §10: Work Credits: Energy-Anchored Claims from §6: The Triad and the Monetary Candidate auditable: if value capture is failing, it shows here before it shows in price. It also carries the triple divergence composite — persistently positive WNG, flat or falling regime-conditioned convenience yield, and falling Homestead Ratio against improving closed-stack service metrics — which is the observable signature of the joint failure mode named in §29: The Closed Sovereign Stack.

Wrapper Dominance Board.
Tracks whether the asset is becoming a financial wrapper rather than money: the Wrapper Dominance Ratio (§10: Work Credits: Energy-Anchored Claims) alongside its component series (ETF/wrapper AUM, custodied balances, exchange balances, wrapped supply, native fee share, non-custodial settlement volume, shielded settlement volume, collateral lockups). A rising WDR while native usage stagnates is surfaced here before it appears anywhere else.

Agency Preservation Board.
Tracks non-custodial usage share, selective-disclosure scope, dossier-reconstitution risk, and forced-disclosure incidence (§24: Legal, Policy, and Jurisdictional Posture), operationalizing the ninth SoV requirement (§3: First Principles: What a SoV Must Survive). This board is optional in early phases but becomes load-bearing once the protocol has material institutional and administrative-state interaction.

Market Realization & Wrapper Board.
Reports the VerifyFlow vectors (§23: Extended Telemetry): wrapper inventory by class, assets and delta-equivalent exposure, creations and redemptions, holder flow elasticity, net mechanical gain, Wrapper Recycling Ratio, constituent concentration, market-depth ratios, hedge-instrument mix, counterparty concentration, the Wrapper–Native Growth Gap, custodial versus self-custody shares, recursive wrapper exposure, cross-jurisdiction exposure, holder-cohort statistics, and the convenience-yield telemetry of §23: Extended Telemetry (lending rates, forward and perpetual basis, wrapper basis, published against the regime-pressure index).

Native Monetary Buyer Map.
Separates just-in-time fee acquisition, operator sell-through and inventory, burns and net issuance, self-custodied reserve demand, wrapper demand, leverage, holding period, loss-bearing capacity, and countercyclical accumulation (§23: Extended Telemetry). It asks who warehouses native monetary risk, not merely whether demand exists.

Common-Cause Dependency Board.
Maps dependencies crossing nominally independent facilities or jurisdictions: hardware and accelerator vendors, firmware and signing systems, energy and fuel markets, cables and network routes, identity, custody, market making, banking, legal recognition, cooling-water basins, and software distribution. For each dependency publish affected capacity, substitutable alternatives, substitution latency, correlated stress scenarios, and the DVC loss if the group fails. The correlated physical-failure framing is adapted selectively from Doomberg’s A Minor Detail [Doomberg 2026c], treated as scenario commentary rather than forecast.

Sponsor Dependency Board.
Reports subsidy concentration, politically contingent demand, cloud-credit dependence, dominant-customer exposure, state or foundation veto power, operator exit capacity, sponsor-withdrawal sensitivity, conflicting terminal objectives, capacity removable on short notice, and spillover to neutral third parties. Subsidized operators and sponsors are separate strategic actors even when their current incentives align. The principal–agent framing is adapted selectively from Doomberg’s Over Target [Doomberg 2026d]; inferred intent and tactical escalation claims are excluded.

Do not merge the Value Capture Board and the Market Realization & Wrapper Board. They answer different questions, and collapsing them destroys the distinction the thesis depends on:

• Value Capture Board: Is service value accruing to the native asset?

• Market Realization & Wrapper Board: What is currently setting its price?

The Value Capture Board stays focused on protocol economics. The Native Monetary Buyer Map asks whether a monetary-risk warehouse exists. VerifyFlow stays focused on market realization. A reader needs all three to distinguish service accrual, monetary adoption, and financialization.

These boards are not marketing pages; they are part of the protocol’s public interface.

Detecting Drift

Drift is the failure mode that never announces itself. Nothing breaks; everything erodes — a few milliseconds added to p95 here, a few points of share consolidated there — and each reading is individually explicable, which is precisely why an adversary (or mere entropy) prefers it to an attack. Telemetry exists to catch the trend while it is still a trend:

Verification cost creep.
VerifyPrice shows p95 verify time creeping up. Response: R&D lab proposes fixes; governance ratifies changes.

Verifier concentration.
80–90% of verifications performed by one hardware profile. Response: adjust rewards to subsidize diverse profiles.

Reachability degradation.
VerifyReach shows a major country blocking protocol ports. Response: shift transports, promote alt routes. You can dam a river; you cannot dam the rain — the response is always to add paths faster than the adversary can close them.

Corridor fragility.
VerifySettle shows corridor success dropping. Response: re-weight corridors, onboard new LPs.

Making Neutrality and Repression-Resilience Falsifiable

Neutrality and repression-resilience are usually sold as moral properties. In this thesis, they are falsifiable hypotheses:

Neutrality hypothesis:
“No actor or group can reliably censor, privilege, or front-run specific flows across Layers 1–5 without being detected and without other actors being able to route around them.”

Repression-resilience hypothesis:
“Under YCC, capital controls, DPI, and blacklists, the triad’s core capacities retain sufficient DVC and the base asset’s self-custodied holder constituency retains sufficient agency to remain a monetary candidate.”

Telemetry makes these hypotheses testable:

• If VerifyReach shows certain flows consistently blocked and no alternatives emerge, neutrality is falsified.

• If VerifySettle shows privacy corridors collapsing under regulation, repression-resilience is falsified.

• If VerifyPrice shows verification cost pushed beyond reach, “anyone can verify” is falsified.

A system that cannot tolerate bad news cannot be money; it can only be marketing.

Policy-Attack Stress Harness

A monetary stack designed for repression should publish the exact conditions under which it considers itself passing or failing. For each attack scenario, we define tests and pass criteria:

Yield-curve control & negative real yields:

• Test: Over 24–36 months of $-300$ to $-500$ bps real yields, FeeCoverage (retained fees, burns excluded) as a share of security budget is stable or rising.

• Pass: Tokens behave like claims on useful capacity, not synthetic bonds.

On-/off-ramp throttling:

• Test: Non-custodial corridors maintain $\geq 95\%$ success with no protocol-attributable loss (§20: Layer 5: Value & Settlement); per-asset anonymity metrics remain above their thresholds (§20: Layer 5: Value & Settlement).

• Pass: Users can move capital via non-custodial rails even when custodial ramps are hostile.

Provenance mandates:

• Test: Canonical provenance workloads have healthy VerifyPrice; regulators can run verify(receipt) with commodity tooling.

• Pass: The triad is the cheapest way to comply with provenance mandates.

Hardware backdoor mandates:

• Test: A non-trivial share of receipts are tied to open or sampled hardware profiles, not a single opaque TEE.

• Pass: Hardware mandates become one option among many, not a kill switch.

When the stack claims “we can survive policy attacks,” the proof is not a blog post; it is a corpus of stress-harness runs with metrics and receipts.

Market-Realization Stress Tests

The harness above stresses repression and availability. The Market Realization Plane needs its own scenarios, because the compositional adversary (§4: Threat Model) does not respond to any of the tests above. Each scenario is run against the VerifyFlow vectors of §23: Extended Telemetry.

A. Wrapper inflow cannon.

A large spot or thematic fund launches; creations arrive independent of daily returns; holdings are concentrated; native liquidity is shallow. Measure: $Q^{RD}/V$, constituent concentration, price impact, native-use response, WNG. Question: does the bid convert into native usage, or only into price?

B. Elasticity regime break.

A $2\times$ or $3\times$ wrapper grows rapidly and holder elasticity drifts toward zero, so recycling declines. Measure: $\kappa$, Wrapper Recycling Ratio, volatility feedback, reversal symmetry. Question: has a product quietly become a momentum amplifier?

C. Creation halt.

Wrapper inflows stop while protocol-native usage stays constant, removing passive support. Measure: price drawdown, native fee coverage, governance response. Pass: native fee coverage remains sound and governance does not respond by inflating issuance or subsidizing price.

D. Overnight gap or market halt.

The underlying gaps beyond a daily-reset wrapper’s viable range before it can rebalance. Measure: wrapper solvency, dealer collateral calls, liquidation paths, cross-venue settlement. Pass: native protocol operations continue unaffected; wrapper failure stays contained in the Market Realization Plane.

E. Swap-capacity exhaustion.

Dealers reduce swap exposure and funds migrate to options. Measure: implied-volatility demand, gamma hedging, dealer concentration, collateral requirements, spot–volatility correlation.

F. Price up, protocol flat.

Price triples and wrapper AUM grows while native fees, settlement, proofs, and compute usage do not. Expected result: market success, monetary-adoption failure, and an automatic dashboard warning. A thesis that cannot raise an alarm during a rally is not falsifiable.

New here? Start with the one-minute version.

Tip: hover a heading to reveal its permalink symbol for copying.